Recent Hackings and Steps to Ensure Account Safety.

[Eruantalon]

Information on Having a "Strong" Password

1. lowercase letters
2. UPPERCASE LETTERS
3. Digits: 1234567890
4. Symbols: !@#$%^&*()

Each one you add to your password increases the strength of your password to make it harder to crack (obviously keyloggers would get around this)

Also not having numbers being obvious (like example above), birthdays are also pretty bad, and to increase the strength of your password even more when you do include numbers don't put them at the beginning or end of the password.

Hopefully this helps and educates.

[rath]

The trojan downloads to your temp internet files. The file is called help[1].htm My antivirus software alerts me when I go to somepage and blocks the inbound TCP attempt. I use an F-secure product supplied by my ISP.

Edit: Allowing it to download did not give me those registry files you others have. So I am not sure if you all picked those up somewhere else. My anti-virus also cleaned it without any issues. There is also a new windows update for IE, make sure to get it.

[rath]

OP, you're just causing more problems for people. Most modern keyloggers record changes to the clipboard, in fact, I want to say it's probably the default for all of them. That being said, let me explain how people get your information with keyloggers: They set up the keylogger to take a screenshot of your desktop either at a certain interval, or X seconds after you open pol.exe. This is the only way they can get your POL ID. Then, they just have to hope that one of the passwords you type elsewhere is the same as your POL password. So congratulations OP, by advocating that people copy and paste their password instead of storing it, you just made a lot more people vulnerable.

So if keyloggers can only harvest POL ID's by screenshots, would it be possible for their to be a windower plugin that blacks out the ID on the login? :X

If you have "automatic login" checked off, your ID will never be shown, you will automatically be logged in and a SS will be useless for getting your ID or PW

[Metah]

I didn't know FFXIAH was affected, so now I got them. They were in my registries but not found using file search or virus/adware scanners.

When I found them in my registries, it found all 4, but it also found a fifth called

(Default) TYPE: REG_SZ Data: (value not set)

Should I delete that too?

[Edrick]

Information on Having a "Strong" Password

1. lowercase letters
2. UPPERCASE LETTERS
3. Digits: 1234567890
4. Symbols: !@#$%^&*()

Each one you add to your password increases the strength of your password to make it harder to crack (obviously keyloggers would get around this)

Also not having numbers being obvious (like example above), birthdays are also pretty bad, and to increase the strength of your password even more when you do include numbers don't put them at the beginning or end of the password.

Hopefully this helps and educates.

Just a reminder, #4) Symbols... don't use that at all in your PoL password. It'll accept it and change it, but you won't be able to use any symbols to log into PoL after the password is changed. I don't know why SE is taking password security for ...

[Feielle]

I didn't know FFXIAH was affected

Can someone point to concrete evidence showing this is the case? All I have read thus far has been speculation and paranoia. I would just like to verify before updating my own LS page outlining current known information about this. Thank you.

[Naramaska]

I didn't know FFXIAH was affected

Can someone point to concrete evidence showing this is the case? All I have read thus far has been speculation and paranoia. I would just like to verify before updating my own LS page outlining current known information about this. Thank you.

There WAS an ad being served up via google ads that was one of those obnoxious "YOU'VE GOTS TEH SPIWAER!!!1!! CLIK HEAR TO INSTAL ANTI-SPY STUFFS!!1!" ads that basically tries to fool people into thinking they have spyware/a virus etc. There were also talks of there being an ad attempting to utilize an exploit with Flash, also served up by google. Since then FFXIAH has changed their ads to another service and has been stamping out ads like both from rotation with extreme prejudice.



in short: ffxiah is fine.

[Apelila]

From page 10 of the stickied thread:

First off, I'd like to briefly comment on the FFXIAH Ad(s). Although annoying and unacceptable by our users & admins, I just wanted to be clear that adware/spyware from an advertisement does not equate to a key stroke logger capable of stealing FFXI accounts. I'm not saying it's not possible either, in this case it is just very slim.

However, there is some news to report. FFXI ]]DO NOT USE SOMEPAGE[[ is confirmed to have a hidden iframe (0x0px) that contains malicious javascript. I only ask people with technical expertise to attempt to load the page at this time. The iframe loads a page from "miorsocft.com", it should be easy to find. This script is being looked into by our dev team already and some volunteers. (I'll post some screenshots later)

Screenshot

Despite the news above, we'll still look into the ADs and have a full report on our website, because "account stealing capable" or not, we don't want them installing annoying junk on your PCs.

Hopefully I won't wake up to another 20 pages to read in 3 different threads.

[Metah]

I didn't know FFXIAH was affected

Can someone point to concrete evidence showing this is the case? All I have read thus far has been speculation and paranoia. I would just like to verify before updating my own LS page outlining current known information about this. Thank you.

When I read that Somepage was infected this morning, I checked all my systems and I was clean, even though I never use Somepage cause its a piece of shit.

Regardless, I logged into FFXI and started playing, this was about 2 hours before maint. was going to start today. I thought "maybe I'll set Metah up to go camp some NMs after" and I checked the price of M-Bugard Tusk on FFXIAH while I was still logged into FFXI.

Then I read that FFXIah had been affected shortly after checking the site. I searched with AVG and Ad-aware, and searched for files manually and found nothing. But indeed my registries were infected by those 4 files.

If that isn't concrete, I don't know what is.

Also, still unsure whether to delete that default or not, but the others are gone. I haven't logged back into FFXI yet to change the password, and won't until I'm sure everything is gone.

I don't think they would've gotten my password if I got infected while already playing FFXI, but this has only been brought to my attention today and if anyone wants to prove me wrong, please do.

Edit: No, I didn't click any ads. Yes, I use Firefox.

[chunz]

i'm having trouble deleting kb1ss1p.dll. It says access is denied. Make sure the disk is not full or write protected and that the file is not in use

edit: dll not sys

One easy way is to boot up ur computer in safe mode and delete the file
Press and hold F8 when windows is booting up to select safemode

However, you may not be able to hold F8 and boot up in Safemode if you are using a USB keyboard...>,<

[kuronosan]

No problems on this comp whatsoever... though FFXIAH being bugged really concerns me.

[chunz]

I didn't know FFXIAH was affected

Can someone point to concrete evidence showing this is the case? All I have read thus far has been speculation and paranoia. I would just like to verify before updating my own LS page outlining current known information about this. Thank you.

When I read that ]]DO NOT USE SOMEPAGE[[ was infected this morning, I checked all my systems and I was clean, even though I never use ]]DO NOT USE SOMEPAGE[[ cause its a piece of shit.

Regardless, I logged into FFXI and started playing, this was about 2 hours before maint. was going to start today. I thought "maybe I'll set Metah up to go camp some NMs after" and I checked the price of M-Bugard Tusk on FFXIAH while I was still logged into FFXI.

Then I read that FFXIah had been affected shortly after checking the site. I searched with AVG and Ad-aware, and searched for files manually and found nothing. But indeed my registries were infected by those 4 files.

If that isn't concrete, I don't know what is.

Also, still unsure whether to delete that default or not, but the others are gone. I haven't logged back into FFXI yet to change the password, and won't until I'm sure everything is gone.

I don't think they would've gotten my password if I got infected while already playing FFXI, but this has only been brought to my attention today and if anyone wants to prove me wrong, please do.

Edit: No, I didn't click any ads. Yes, I use Firefox.

Have u tried using the Noscript Plugin for Firefox? it should be able to prevent infection...

[Zosi]

Then I read that FFXIah had been affected shortly after checking the site. I searched with AVG and Ad-aware, and searched for files manually and found nothing. But indeed my registries were infected by those 4 files.

It's not concrete, because searching for the files using the Windows find utility adds (harmless) registry entries containing the filenames. You aren't "infected" unless you actually have the files, registry entries alone mean nothing.

[Metah]

Then I read that FFXIah had been affected shortly after checking the site. I searched with AVG and Ad-aware, and searched for files manually and found nothing. But indeed my registries were infected by those 4 files.

It's not concrete, because searching for the files using the Windows find utility adds (harmless) registry entries containing the filenames. You aren't "infected" unless you actually have the files, registry entries alone mean nothing.

Phew! I'm not much of a computer guy, all I use my PC for is leisure activities. Thanks, Cleo.

[Izzy]

If I don't have any of these files, or have real player installed, or use IE, do I really need to go through my registry and search for this fucking shit. It's not gonna affect anything just sitting in the registry.

[Ashokan]

I didn't know FFXIAH was affected, so now I got them. They were in my registries but not found using file search or virus/adware scanners.

When I found them in my registries, it found all 4, but it also found a fifth called

(Default) TYPE: REG_SZ Data: (value not set)

Should I delete that too?

It's not concrete, because searching for the files using the Windows find utility adds (harmless) registry entries containing the filenames. You aren't "infected" unless you actually have the files, registry entries alone mean nothing.

Zosi's right.

It is okay if what you found is in HKEY_CURRENT_USER/Software/Microsoft/Search Assistant/ACMru/5603, probably looks something like:

[HKEY_CURRENT_USER\Software\Microsoft\Search Assistant\ACMru\5603]
(Default) REG_SZ   Value not set
000       REG_SZ   in3.dll
001       REG_SZ   rsbo.exe
002       REG_SZ   kb1ss1p.dll
003       REG_SZ   kb1ss1p.sys

That's just the stuff you searched for in start button -> search. You can test it. Type in something completely random, refresh that regedit 5603 folder and it will be there.

[Arkanna]

If I don't have any of these files, or have real player installed, or use IE, do I really need to go through my registry and search for this fucking shit. It's not gonna affect anything just sitting in the registry.

No, you're fine.

[CharlotteW]

SE is not responsible for what hacks/bugs/exploits/viruses are in the coding of a third party website. They can only be held responsible in the most minescule way if they listed it on their list of Community Sites, which Somepage is not listed on there.

SE is not responsible if you surf the internet without proper protection. Just like Durex is not responsible if you didn't use a condom when you banged that stripper and got her pregnant or nailed yourself AIDS.

SE is not responsible for anything you download that doesn't come from their site. They are not responsible if you download mp3s, torrents, or porn on your PC. That's your fault.

SE is not responsible when you choose not to update your OS or key program (virus scanner, firewall ect) because it will lag your game. That's your fault.

SE is not responsible if you use a stupid password. They are also not responsible if you use that same stupid password for every single application you use.

SE IS responsible for their shitty customer service. The simple fact that when we call/e-mail/message customer support, they make us verify all this info to make sure the character in question is indeed ours, then only use the CC info as proof of ownership of the character is absurd. It is also SE's fault when Serivce and Support say "Go to a GM" and the GM says "Go to Service and Support."

SE IS responsible for their less-than-favorable POL application, which only requires your initial log in to change your membership information. Any asshole with your POL ID and password can get in and change your membership information.

[Imperial]

Thank you very much for this.

I posted this in Alla and will sticky it to make sure everyone gets to see it.

[Octavious]

Simple Solution: Require Current Credit Card Info to Change Password?

I mean..it makes it a bitch for those of us who want to change passwords every3months...but then again if someone takes your account it's blatent they stole your credit card info (if this system was done right...)

Anyway...i wonder why the RMT feel the need to steal accounts, in the long run it works them out of a job...piss enough people off, said MMO ends (like what...3yrs left on FF max?), then they have no more job, or go to another MMO, seems lame.