Account stolen last night at 2:53 AM EST

[Sonomaa]

no, I got the same popup ads on firefox, I have no spyware on my system whatsoever, I can assure you of that 100% Thats a malicious ad caused by the bar on the right side, it loads the web page which issues the pop ups and popunders, then tries to get you with the fake load thing.

[LinktheDeme]

Wait so theres actually a virus? Or is it just that ad-aware crap that just creates spy ware saying your infected so you'll buy their product?

[Sonomaa]

Wait so theres actually a virus? Or is it just that ad-aware crap that just creates spy ware saying your infected so you'll buy their product?

fake thing saying you are infected, it said I had like 1700ish infections, I took a look at f-secure and it said I was clean, its always on autoscan so I know Im solid

[LinktheDeme]

Yea I remember my dumbass sister accidently installed that and it was a bitch to get rid of. Had to buy norton then wait for a year for them to finally update something that fixes it

[Izzy]

Basically, don't run any activex controls that you weren't intending to run and you should be safe.

*EDIT* oh yea, and use your head before you click "OK" on any boxes Q_Q.

I doubt Microsoft would create a popup that looks like this:

 __________________________
|  U R INFECTED, CLICK HERE 4 |
|  FIX 2 UR PROBLEMZ!!!!!!!!! |
|              ______         |
|             |   K?  |       |
|              -------        |
--------------------------------

[Fartaru]

Went to ffxiah on my spare pc at work to see if it was true, one minute into browsing ffxiah the pc all but locks up and then my Symantec AntiVirus Corperate pops up saying it blocked the installation of malicious software, one minute later it tried to install automatically again and was blocked. Never got one popup either 'asking' to install any software at all.

[Leonock]

Friend of mine on Kujata was just hacked apparently, I'll provide more info when I can (he has only posted on our forums just recently) ...

Edit: From what I can tell he went through the same symptoms as everyone else. PW changed crazy fast and account stripping with mule armies.

[Izzy]

I just went to at least 100 different FFXIAH pages and I didn't get a single warning or popup Q_Q.

[Khajit]

I think I remember a weird popup like that but cant tell if i clicked yes or not...
It looks like im going to be changing to ps2 for a month or two and changing my ps2 on the ps2side.
I have so many damned macros to recreate now.

[Fartaru]

I just went to at least 100 different FFXIAH pages and I didn't get a single warning or popup Q_Q.

I was using IE6 at work, Mozilla at my home pc, never any problems at home.

[Izzy]

I just went to at least 100 different FFXIAH pages and I didn't get a single warning or popup Q_Q.

I was using IE6 at work, Mozilla at my home pc, never any problems at home.

I'm using Mozilla at work, but Sonomaa said he got popups with that too.

Question: Those of you that had your account stolen that did not engage in any shady shit, was your PW saved in POL so you didn't have to type it, or did you type it every time?

[Geostigma]

I would like to add my account to the list who was stolen...Sodaru, Dietsoda(mule), Cherrysoda(mule), Orangesoda(mule) and Silvos(mule). They were all stolen, moved to Asura, and sold geer. It appears that they're using my seals and everything...someone on Asura please lookout for Sodaru and track them out ; ;...

Yahoo: Dragonz12345
AIM: Blazerdragon00
MSN: [email protected]

Just reading through this thread and saw this. Sodaru has given his account info to many people over the years so yeah im really surprised its taken this long for this to happen lol.

[OctavoGilgamesh]

Quit clicking on the gil buying adds :D

On a more serious note, those adds are picked by google based on keywords and such and the designers really have no clue what specific site their add will go on. These adds could be on any other ffxi site as well.

[Izzy]

Quit clicking on the gil buying adds :D

On a more serious note, those adds are picked by google based on keywords and such and the designers really have no clue what specific site their add will go on. These adds could be on any other ffxi site as well.

They haven't randomly shown up on any ffxiah pages I've clicked, and I've done it nonstop for the past hour. (Work is boring)

[AzazaelFenrir]

for what it is worth while I was on FFXIAH over the weekend, my computer more or less locked up, so I rebooted. When I came back AVG found (and keeps finding this)

c:\windows\system32\dbnmpntwj.dll
Infected with virus Obfustat.ABXY

I don't know if this is an actual virus or not. Thankfully it is on a PC that doesn't have FF on it.

[Whatinthe]

for what it is worth while I was on FFXIAH over the weekend, my computer more or less locked up, so I rebooted. When I came back AVG found (and keeps finding this)

c:\windows\system32\dbnmpntwj.dll
Infected with virus Obfustat.ABXY

There is an actual dll called "dbnmpntw.dll" (note it's different from above name). It's the MS NaMed Pipe NeT DLL for SQL Clients. However, your little DLL above is 9 characters long, which is a big no-no flag. IIRC, all "official" MS executables and DLLs are supposed to have 8.3 filenames (hold-over from good ol' DOS days), so I do suspect it's a trojan that can be safetly deleted.

If you can't deleted it, you need to go into Safe Mode and try it that way.

[Khajit]

infected......PW changed on my ps2 now but I got a shitload of macros to redo that i've been procrastinating on.

[Maaglin]

Sounds like it would be a solid plan to not save your password in POL and do a copy & paste from a seperate text file to beat any keyloggers.

[Izzy]

Sounds like it would be a solid plan to not save your password in POL and do a copy & paste from a seperate text file to beat any keyloggers.

That's why I asked how they stored their PW's. Then we could find out if it's due to saving the PW, or typing it.

[Maaglin]

Sounds like it would be a solid plan to not save your password in POL and do a copy & paste from a seperate text file to beat any keyloggers.

That's why I asked how they stored their PW's. Then we could find out if it's due to saving the PW, or typing it.

And I'm just saying why wait until we find out that answer? Accounts are being jacked now, so I'd do everything I could to prevent it from happening to me.