FFXI: JavaScript exploit on the loose(Repairs inside)

[SephYuyX]

No, you do not delete those.
Bottom of the OP: viewtopic.php?f=2&t=27226

Secondary note: You will find strings related to your previous Start Menu > Search functions. It is just indicating that you recently did a search on this. Just to clear that up, I know it scared a lot of people.

Ashokan wrote:
Zosi's right.

It is okay if what you found is in HKEY_CURRENT_USER/Software/Microsoft/Search Assistant/ACMru/5603, probably looks something like:


Code:
[HKEY_CURRENT_USER\Software\Microsoft\Search Assistant\ACMru\5603]
(Default) REG_SZ Value not set
000 REG_SZ in3.dll
001 REG_SZ rsbo.exe
002 REG_SZ kb1ss1p.dll
003 REG_SZ kb1ss1p.sys


That's just the stuff you searched for in start button -> search. You can test it. Type in something completely random, refresh that regedit 5603 folder and it will be there.

[Sonomaa]

To clarify those who think taj did all the work to find this, he didnt. I was on IRC when it was discovered, I told somebody to make the post including all of what was posted, Taj said he would do it, I said I would sticky it to make the community aware. It could have well been Aikar making the post as well, or somebody else, but Taj stepped up to the plate to make the post and I am grateful he did for the good of all.

Stop throwing out baseless accusations blaming Taj for all of this, he didnt do any wrong, he is just trying to help.
FFXIAH's popup issues were related to advertising, not this backdoor hack. It is conceivable that the hack was spread around other sources and other web pages as well, but until you find proof of it being on another page, dont go firing up the torches. The fact that the FFXIAH guy has been here working with us and the some-page links on their site are gone shows he is fighting the good fight.

[Viena]

Has there been any word from the MIA somepage admins?

[pinkie]

Can some one please post location of all these files... like were exactly are they located.. path and all...

I have manually searched my system32 folder for all of them I have not found them.. but is this the same as the registry directry?
I have win vista home premium, norton, and have both spybot, win defender, AVG virus and spy thingy.. Do I need to do this in safemode??

I just want to make sure my system is clean. Thanks. PM if you need.

[SephYuyX]

Can some one please post location of all these files... like were exactly are they located.. path and all...

I have manually searched my system32 folder for all of them I have not found them.. but is this the same as the registry directry?
I have win vista home premium, norton, and have both spybot, win defender, AVG virus and spy thingy.. Do I need to do this in safemode??

I just want to make sure my system is clean. Thanks. PM if you need.

You dont need to worry then as Vista is not affected

[Avilaa]

I have Firefox with Windows Vista and AVG Free Edition, and Realplayer is not installed on my system. I still got the exploit and lost my account about an hour after I typed my foll POL ID and password into FFXI Linkshell Community.

It seems as though people with Vista are still affected =/

[Octavious]

I have Firefox with Windows Vista and AVG Free Edition, and Realplayer is not installed on my system. I still got the exploit and lost my account about an hour after I typed my full POL ID and password into FFXI Linkshell Community.

It seems as though people with Vista are still affected =/

Something tells me it's not the complete story either. The sharing of acct. information could have well caused that. Typing your password in the LS Community could have simply been coincidence. Just because it happened after doesn't mean the keylogger wasn't on your PC for 2~3days or something.

As much a Suckenix's security blows, there's very low chance you got hacked because you logged into the LS community (aside from that time Taj pwnd people who were too stupid to change their own passwords)

[Fhqwghads]

Windows Key + F will bring up the find files dialog. Click "All files and folders". From there make sure the options to search hidden files and folders is checked, as well as search subfolders, and search system folders. Then where it says "Look In:" choose your local drives. Fill in the field "All or part of the file name" with the files listed in one of the threads, separated by commas. Click the Search button. Keep fingers crossed that nothing is found. 8)

[Avilaa]

I agree with you, Octavious. I'm a bit skeptical. But he does bring up a good point when he says that he has no reason to stir things up; however, that doesn't necessarily mean that he didn't leave some information out. For what its worth, people (experienced with computers) claim the keylogger CANNOT be downloaded onto your PC if you have Vista, so that piece of information has to be worth something.

[Octavious]

I agree with you, Octavious. I'm a bit skeptical. But he does bring up a good point when he says that he has no reason to stir things up; however, that doesn't necessarily mean that he didn't leave some information out. For what its worth, people (experienced with computers) claim the keylogger CANNOT be downloaded onto your PC if you have Vista, so that piece of information has to be worth something.

Yes I understand this, but you also could account for if it was a Vista Upgrade, or a Vista OEM. If it was a fresh box with Vista it might act differently then an XP box with Vista Upgraded on it.

So much screwy bullshit (for lack of any better term) has come up with Windows Vista, I wouldn't be surprised if say, you had an old copy of RealPlayer on Xp, upgraded to Vista without Upgrading/Patching RealPlayer, then got the virus.

Also, ya never know if he's used multiple boxes to log onto his character. XP Machine/Vista Machine/ Friends Computer, shoot there's so many variables it's ridiculous, lol. I will admit some validity to his comments, but typing your password into the FFXI LS Community wouldn't directly cause you to be hacked 1hour later.

[pinkie]

Well I bought my box (hehe) with pista (vista) installed already.. and it aint coming off .. I tried to install xp over the summer on it and it told me to piss off :S

But Anywhoo thanks for all yer help all. I just want to make sure my kitties are all safe. I am going to change pwd on them all on 360 just to be sure.

[Ashira]

Ok you're either being deliberately obtuse or you're an idiot. Why are you pasting the PLAYONLINE FFXI page source?

I'm doing it to prove a point that this is nothing to be worried about.

anything that links to a site that's a poor attempt at an anagram hoax for microsoft is an obvious attempt for an exploit

You're not doing any good posting here, the exploit is VERY CLEAR.

it's called a typo. Again give me proof there is a damn exploit is there and I'll go on my way since I'm testing faith going to the website constantly on internet explorer I may say and real media installed and nothing is happening. nothing is being downloaded, nothing is going on.

I didn't actually see this fully refuted within this thread; obviously you didn't read the 11 page thread through very clearly or you'd know not to be calling it simply a typo.

The 'typo' is a registered domain to somewhere in China, and is the same name/IP whatever as the file uploads that are put in comments on varying item pages.

Actual typos like that on highly maintained pages like somepage used to be do not exist for long, because they get seen and corrected.

I know this was about 12 hrs ago now in this thread, but it provided me with quite the chuckle now, and I also didn't see this very simple "statement" he made even really referred to or corrected properly, and figured it was due so as to prevent more confusion as people browse through the threads.

[Airenn]

Question to those who might know something about legal/international affairs.


Is there anything we could do by sending this information somehow to the American Embassy in Beijing China? We have an adress and numbers, yea?

[Correction]

Question to those who might know something about legal/international affairs.


Is there anything we could do by sending this information somehow to the American Embassy in Beijing China? We have an adress and numbers, yea?

Embassies don't enforce laws. The most you could do is send mail to the ISP that hosts the Javascript and report the user as a TOS abuser, but lolChineseISPs usually don't give a shit about that.

[SP]

What if the files are located in

HKEY_CURRENT_USER/Software/Microsoft/Search Assistant/ACMru/5604

Is that still previous searches like in the 5603 folder? Or is this something else?

[SephYuyX]

5604 is also search assistant related, so it's ok.

[Delekii]

Has the exploit been removed from the main page? Browsing it in firefox from work now I don't see the arrow, nor does the source code contain any iframe - either the filtering software here is removing it somehow or somepage has removed the frame from their page?

Note: because I'm sure there are some people that will, please don't take my word for it and open the page in IE before someone has confirmed that it is indeed gone

[nithyan]

Looks like it's gone, at least from the main page and news entry.

[Aihree]

It does seem to have been removed. Anyone's guess whether or not it was the hackers or the site owner. I was looking the source up to add it to a null route, and can't find it anymore.

Still not trusting the site though. There's no telling whether or not the exploit's just been renamed and moved somewhere else on the site, now that the front page is known to be mallicious.

[Ort]

i couldn't sit here and read the entire thread but i skimmed through some of it and didn't notice the links that a user on ]]DO NOT USE SOMEPAGE[[ had posted, on quite a few items listed on the site he posted a url to a trojan, if you try downloading it you're risking your account.

for example you search for "Bastore Sardine" a url will be posted "ffxifisher.net.2.0.3 its working " and below a link to a download of the trojan, there's other ones for some Ore he had posted which say like "ffximiner.net.2.0.3 its working " with the same link below it.

i know botting in this game will always be and people who try to download this crap deserve a good kick in the face for being so gullable but just wanted to give a heads up anyways.