FFXI: JavaScript exploit on the loose(Repairs inside)

[Amele]

ruin;

(Default) (Value not set) is a placeholder value in all directories of a registry tree; it doesn't mean anything or have any impact on your PC. you can't delete it because it doesn't (really) exist.

I know alot of people are giving you all kinds of shit about this - you are doing the right thing asking about keys that you think might be suspicious instead of just deleting them first, the registry is an important part of a windows OS machine and screwing something up in there can hose your system in a way that would require a total rebuild of windows (causing you to lose most of your programs/settings/etc.)

to everyone else;

calm the fuck down. all any of you had to do was explain what (default) keys are about - and if you didn't know yourself, don't be a parrot: registry edits are more important than for you to treat it like writing a new windower macro script.

[Toksyuryel]

Just a note about the linkshell community website, whether it's related to this hacking incident or not is irrelevant to why it should be avoided at all cost: your login information is sent as unencrypted plaintext over the internet whenever you log in to it, so anyone who happens to be watching your line at the time can easily snipe this info from you no matter how secure your setup is. I almost did this myself but firefox warned me about what I was about to do and I haven't gone near the site since.

[Scragg]

it should be avoided at all cost: your login information is sent as unencrypted plaintext over the internet

not true...

[Toksyuryel]

it should be avoided at all cost: your login information is sent as unencrypted plaintext over the internet

not true...

The login page itself is encrypted, but the connection it uses to send your information to the server is not. That is the warning I got when I clicked the "submit" button. Unless they've fixed that since the last time I tried, I recommend staying far away from it.

[Jingex]

I followed directions on to see if you have those 4 files, only thing that came up was npqtplugin3.dll two differant files...is that bad? D:

[Aerin]

No, the only file you don't want that is like that is exactly in3.dll it will have nothing more and nothing less than that. The rest are fine.

[Jingex]

thank you thank you ^^
also

000 REG_SZ rsbo.exe


is nothing to worry about right? sorry just being paranoid and asking

[Amele]

thank you thank you ^^
also

000 REG_SZ rsbo.exe


is nothing to worry about right? sorry just being paranoid and asking

sounds like just a search history key, but you need to tell us what folder it's in and not just the key:value pair.

if it's something like ~\microsoft\search assistant\ACMru\ then you don't need to delete it. (you don't need to keep it either)

[rath]

Semi-related to the somepage incident.

Well, apparently they "Cleaned" every virus and trojans off their site, but there are tons of virus hiding in some .gif and other .tmp files that appears when visiting ]DO NOT USE FFXIAH[
I tested with a crappy laptop with windows freshly installed, Visited a few items on FFXAH and Bam! found 4 different virus from .gif files from the site as I was surfing on their site.

I know alot of people use that site, it's awesome indeed, but apparently they are being attacked (or they are trying to hack people...) and there's virii roaming freely on their site/add pictures.

Just thought that I should warn the people from the LS about this so nobody gets the victims from hackers.

Best thing to do if you still want to use this site, use a crappy computer with a good anti-virus and without any POL programs on it.

(this happened to a few people I know, they all checked and had virus on their comp)

From a ls site I use.

[Khamsin]

What exploit do gif virii use?

[Jingex]

Its under a file called 5604 and 5603 D: thats bad right?

[Aerin]

Its under a file called 5604 and 5603 D: thats bad right?

It is okay if what you found is in HKEY_CURRENT_USER/Software/Microsoft/Search Assistant/ACMru/5603, probably looks something like:

[HKEY_CURRENT_USER\Software\Microsoft\Search Assistant\ACMru\5603]
(Default) REG_SZ   Value not set
000       REG_SZ   in3.dll
001       REG_SZ   rsbo.exe
002       REG_SZ   kb1ss1p.dll
003       REG_SZ   kb1ss1p.sys

That's just the stuff you searched for in start button -> search. You can test it. Type in something completely random, refresh that regedit 5603 folder and it will be there.

You're fine.

[nithyan]

What exploit do gif virii use?

Often they're just renamed ANI files that are used to try and exploit http://www.microsoft.com/technet/securi ... 35423.mspx

[Jingex]

thank you ^^ /bow

[Elesirdur]

Found out I did have the .dll files in registry (motherfucker), but I do not have the .exes. Deleted everything nefarious that I could find out of registry.

edit: found them in
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Explorer Bars\{C4EE31F3-4768-11D2-BE5C-00A0C9A83DA1}\FilesNamedMRU

...
am I missing something somewhere or is this one of those just lucky/weird occurrences?

That's where recent searches go in Win2k.

Weird. I was having the same issue with Windows XP. I find the registry keys for the items I searched for under that heading but I have no evidence (either in searching for the files or running AV/spyware scans) that the virus was ever downloaded. Maybe because I'm using TweakUI's to make windows use the old-school search dialog box instead of the crappy XP one that I'm finding the search keys in that location.

[Marsala]

Ok, so I went to check on apradar which is on ffxilinkshell.com and this is what I got. DO NOT GO THERE. Just an fyi

http://i64.photobucket.com/albums/h1...195/hacked.jpg

Here is the souce. I don't know if it's legit or not. It did pop up an alert to try to update my quicktime though. I just hard shut down my computer.
http://i64.photobucket.com/albums/h1...95/hacked2.jpg

No this isn't my computer. It is one which doesn't have ffxi on it.

[Furtwangler]

It's just ridiculous how many sites are under attack/hacked etc. wonder what caused this whole chain of crap besides rmt trying to get accounts, unless that's all that's caused it, which is pretty sad.

[Gere]

I'm guessing the rmt hired a bunch of hackers and told them to google ffxi and try to put a keylogger on whatever sites come up.

[nithyan]

From a google search, it looks like that "byguard" character is nothing more than a loltard scriptkiddy with a wordpress exploit. He's probably nothing to do with the RMT.

[Marsala]

From a google search, it looks like that "byguard" character is nothing more than a loltard scriptkiddy with a wordpress exploit. He's probably nothing to do with the RMT.

Well, I didn't take any chances. I immediately shut down my comp and am now reinstalling windows even after my virus scanners said i was clean. I won't log into FFXI until I get this done and am promptly going to change my PW when I do.