Recent Hackings and Steps to Ensure Account Safety.

[Tricen]

Gee, thanks for the criticism Anonymous.

And you're not anonymous? Uhhh....

[Apelila]

So, i got curious and went to one of the sites listed on somepage.

http://i5.photobucket.com/albums/y16...shots/lolz.jpg

From whois lookup:

inetnum: 58.22.224.0 - 58.22.239.255
netname: CNCGROUP-FJ-LONGYAN-MAN
country: CN
descr: Longyan city, fujian provincial network of CNCGROUP

Also: lol downloaded times.

[Shuvo]

OP, you're just causing more problems for people. Most modern keyloggers record changes to the clipboard, in fact, I want to say it's probably the default for all of them. That being said, let me explain how people get your information with keyloggers: They set up the keylogger to take a screenshot of your desktop either at a certain interval, or X seconds after you open pol.exe. This is the only way they can get your POL ID. Then, they just have to hope that one of the passwords you type elsewhere is the same as your POL password. So congratulations OP, by advocating that people copy and paste their password instead of storing it, you just made a lot more people vulnerable.

So if keyloggers can only harvest POL ID's by screenshots, would it be possible for their to be a windower plugin that blacks out the ID on the login? :X

[saskiot]

OK...i found some good info and alot of bullshit can we stop attacking one another
and keep on the topic at hand. we have a big problem here bigger then petty arguing over
whos right and who is wrong.
atm i have 4 maybe 5 anit spyware programs and avg anitvirus im using firefox as
my browser and i avoid most sights. mostly i come here check the BG wiki yahoo and watch-movies.net.
i think im safe im hoping i am i also changed my pw after i did my scans and got my spyware out.

ppls accounts are being swiped left and right can we focus on where the key loggers come from
where are they found and kill the SOB who made them and put them on the net? Lets also talk about
what places to avoid. really if u know where the enemy is u must be one stupid sob to go there. so
left find out where the enemy is and just stop checking that page(yes i know after a while they will just
find some other page to infect)
im sure we have alot of ppl that dont know much about computers so lets give them pages of info not
pages of he said she said and call them morons over and over again waisting time and space used for other things.
like ummm maybe enjoying the game we are here trying to protect here?
(i have a feeling im going to get alot of crap for this post but i had to get it off my chest. iv been reading though the post and wasted alot of time trying to sort out the bull and the useful info. i have alot of camp battles i want to do before bed and not alot of time to do them)

[Paegan]

Enough. I'm speaking on deaf ears it seems.

And have been since your first post in this thread expousing the virtues of a rendering engine built into the OS showed you to be the idiot you subsequently proved yourself to be.

Throughput > all. Lolz.

[Khamsin]

OP, you're just causing more problems for people. Most modern keyloggers record changes to the clipboard, in fact, I want to say it's probably the default for all of them. That being said, let me explain how people get your information with keyloggers: They set up the keylogger to take a screenshot of your desktop either at a certain interval, or X seconds after you open pol.exe. This is the only way they can get your POL ID. Then, they just have to hope that one of the passwords you type elsewhere is the same as your POL password. So congratulations OP, by advocating that people copy and paste their password instead of storing it, you just made a lot more people vulnerable.

So if keyloggers can only harvest POL ID's by screenshots, would it be possible for their to be a windower plugin that blacks out the ID on the login? :X

Or the entire screen, similar to how certain programs can do it to prevent taking copyrighted screenshots (i.e. when you hit print screen, but the clipboard is black). Unless that sort of thing is easily circumvented.

[Christophe]

So, i got curious and went to one of the sites listed on ]]DO NOT USE SOMEPAGE[[.

http://i5.photobucket.com/albums/y16...shots/lolz.jpg

From whois lookup:

inetnum: 58.22.224.0 - 58.22.239.255
netname: CNCGROUP-FJ-LONGYAN-MAN
country: CN
descr: Longyan city, fujian provincial network of CNCGROUP

Also: lol downloaded times.

somehow i had people visiting the linkshell board I host from that range and tried to access server dir such as /includes and /admin.... I banned the whole 58.22 range server side. screw them.

]]DO NOT USE SOMEPAGE[[.

I sure wont. fake microsoft url loading itself in the background as if it was a ad.

http://neobubu.free.fr/btl/Untitled.jpg

miorsocft.com (218.66.104.248)

	218.66.0.0 - 218.67.127.255
CHINANET Fujian province network
China Telecom
A12,Xin-Jie-Kou-Wai Street
Beijing 100088

	CHINANETFJ IP ADMIN
7,East Street,Fuzhou,Fujian,PRC
+86-591-3333169-293
+86-591-3371954
[email protected]

	Chinanet Hostmaster
[email protected]
No.31 ,jingrong street,beijing
100032
+86-10-58501724
+86-10-58501724

and aurik is right, the way the pol password is stored and crypted is tied to some hardware in your computer. changing my network card to another PCI slot reset my ffxi password before.

[Airenn]

Is that the address of the people who put the Iframe on somepage?

Also, what program is notifying you of the trojan?

[Christophe]

Kaspersky Antivirus. the antivirus kicked in as soon as somepage.com started loading on my browser..

[Airenn]

Kaspersky Antivirus

Thanks, adding that to the list.

[dagget]

just a quick question. does anyone know where i find the file my password is stored in?
I used to save my password in POL Viewer, so now i wanna make sure its gone, since i am not saving it anymore in
POL. Or will it be automaticly removed, when you change your settings?

[defiant]

Kaspersky is a pretty good antivirus program. Always found shit for me that Norton never saw.

[Viena]

Opera doesn't even attempt to download that when browsing somepage. :ashira:

[arshesney]

A nice free alternative to AVG is Avast, the Home edition is free, but it requires registration.

I prefer Avast over AVG because it has a nice option to perform a virus scan BEFORE system startup (like when you force shutdown and windows prompts you with disk checking), so it's able to detect/remove more stuff than when you perform a standard virus scan.
Avast's drawbacks are only the registration and the noticeable system resources usage when it updates, but still better than Trend/Norton/McAfee bloatware.

[nithyan]

Opera doesn't even attempt to download that when browsing ]]DO NOT USE SOMEPAGE[[. :ashira:

Unless opera has some sort of iframe/frame-blocking option, it's still downloading it.

[Christophe]

A nice free alternative to AVG is Avast, the Home edition is free, but it requires registration.

I prefer Avast over AVG because it has a nice option to perform a virus scan BEFORE system startup (like when you force shutdown and windows prompts you with disk checking), so it's able to detect/remove more stuff than when you perform a standard virus scan.
Avast's drawbacks are only the registration and the noticeable system resources usage when it updates, but still better than Trend/Norton/McAfee bloatware.

Sorry but no. Avast is crap.. no more no less.
Where I used to work people installed Avast as it's the only free anti-virus translated in French.. we had like 3 or 4 return a week because Avast failed to do its job and computers were plagued with virus. some people at work didn't believe it was because of Avast and thought it was the client who disabled the anti-virus to install their porn "software"(don't laugh it happens..) but we found it that it was indeed Avast that as falling to detect viruses.

AVG is better and it's also free, if you don't have money to buy a decent Anti-virus.

[kisada]

so just visiting the site itself without proper protection is cause enough for harm?

it's a bit ambiguous whether it's by clicking on the malicious frame or just by loading the page, as the kapersky screenshot shows

[Shuvo]

just a quick question. does anyone know where i find the file my password is stored in?
I used to save my password in POL Viewer, so now i wanna make sure its gone, since i am not saving it anymore in
POL. Or will it be automaticly removed, when you change your settings?

You need to update your sig...

I'm not sure which file the password is stored in, but I know for a fact they made it encrypted in an update about 1-1.5 years ago so you should be safe if it's stored in POL. Typing it in each time is probably more insecure.

Edit: Actually I think the update I was talking about was for the password stored in memory not the actual file. But if one is encrypted then I'm sure the other one is too...

[Spira]

ok.. so we know that Somepage contains a trojan..

for those that have been to somepage recently, and are not sure if they were affected by the trojan or not, is there any form of recourse to take? like, what would be the steps to take to check if you indeed have that trojan? or how to remove it?

I used somepage advanced item search just yesterday...
now doing a full system scan using spyware doctor.

[Shuvo]

ok.. so we know that ]]DO NOT USE SOMEPAGE[[ contains a trojan..

for those that have been to ]]DO NOT USE SOMEPAGE[[ recently, and are not sure if they were affected by the trojan or not, is there any form of recourse to take? like, what would be the steps to take to check if you indeed have that trojan? or how to remove it?

I used ]]DO NOT USE SOMEPAGE[[ advanced item search just yesterday...
now doing a full system scan using spyware doctor.

Read the first post... >_>