FFXI: JavaScript exploit on the loose(Repairs inside)

[Gredival]

http://ffxi.allakhazam.com/forum.html?f ... =16;page=1

Any information on this?

[Scragg]

http://ffxi.allakhazam.com/forum.html?forum=10;mid=119751186813322503;num=16; page=1

Any information on this?

Warning, this is a ffxiah link - only click this from a "safed" computer

The second quote is from that Alla thread and variations of the same message on other Alla threads. /facepalm. The ironic part is the new ads that were put into rotation on FFXIAH (and subsequently taken down due to this hysteria) are from the same exact advertising company that Allakhazam uses. So to summarize, the RMT Google ads are actually the ones that are safe from any type of adware/spyware/whateveryouwanttocallit. Thought I might say that... just to keep people informed.

[Gredival]

The OP in that thread goes into a bit of detail about a trojan that installs files besides the notorious four that everyone has been looking for. He also mentions that most anti-virus are not picking this infection up.

While I have seen a lot of safety/prevention measures mentioned for the somepage infection, it seems that info on this is relatively scant by comparison.

[Ichthyos]

FYI: I just noticed that the front page of s0mepage has been cleaned. I haven't heard back from Cuer yet about how it might have happened, though.

[Ichthyos]

Found out I did have the .dll files in registry (motherfucker), but I do not have the .exes. Deleted everything nefarious that I could find out of registry.

edit: found them in
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Explorer Bars\{C4EE31F3-4768-11D2-BE5C-00A0C9A83DA1}\FilesNamedMRU

...
am I missing something somewhere or is this one of those just lucky/weird occurrences?

That's where recent searches go in Win2k.

[rath]

To clarify those who think taj did all the work to find this, he didnt. I was on IRC when it was discovered, I told somebody to make the post including all of what was posted, Taj said he would do it, I said I would sticky it to make the community aware. It could have well been Aikar making the post as well, or somebody else, but Taj stepped up to the plate to make the post and I am grateful he did for the good of all.

Stop throwing out baseless accusations blaming Taj for all of this, he didnt do any wrong, he is just trying to help.
FFXIAH's popup issues were related to advertising, not this backdoor hack. It is conceivable that the hack was spread around other sources and other web pages as well, but until you find proof of it being on another page, dont go firing up the torches. The fact that the FFXIAH guy has been here working with us and the some-page links on their site are gone shows he is fighting the good fight.

From a ls mate that posted on my forums. This is what happened when an ad popped up on ffxiah.com on dec9th.

Application Hijacking has been detected
The application: \Documents and Settings\All Users\Start Menu\Programs\Startup\msupd21589.exe try to launch another application: \Program Files\Internet Explorer\IEXPLORE.EXE
I got that on December 9th

I realize these ads are no longer there, but people should make sure they are not infected by this as well.

[Gan]

Hi,

I've never had any of the softwares recomended to prevent spy/bots/keyloger and dunno much really abotu comps... so my question is as simple as this:

is it safe to just search this software on google and donwload them from the main page showing it? or should i get it from any (if exists) secured site?

Thx

Edit: Also, would ppl here recomend any Anti-virus over the rest?? I know from personal exp than Norton doesnt works really well with ffxi so any recomendation is welcome

[Jefe]

^ If you just don't wanna google your stuff, visit download.com and search for spybot, high jack this, or w/e program you are looking for. They also have links to their sites, etc. so it's safer than a random site.

[Builttolast]

Hi,

I've never had any of the softwares recomended to prevent spy/bots/keyloger and dunno much really abotu comps... so my question is as simple as this:

is it safe to just search this software on google and donwload them from the main page showing it? or should i get it from any (if exists) secured site?

Thx

Edit: Also, would ppl here recomend any Anti-virus over the rest?? I know from personal exp than Norton doesnt works really well with ffxi so any recomendation is welcome

1) Always download only from official sites. ie for Adaware that would be lavasoftusa.com or lavasoft.de . For Microsoft products only download directly from microsoft.com/downloads . There are trusted "mirrors"/sites such as sourceforge and Cnet where you can feel safe downloading from. Many free versions of software are distributed freely through Cnet downloads.

2) As for Antivirus only 2 are worth their salt. Norton and Kaspersky. The amount of PCs I have to clean daily that have up to date AVG, NOD32 or other unknowns installed and operating indicates to me they are not sufficient. YMMV

[Missnasty]

Just checked the site with Firefox and the <iframe> code appears to have been removed.

[Sonomaa]

Courtesy Pikko.
http://ffxi.allakhazam.com/sdetail.html?story=11667

Official statement from Square Enix:

We have received reports that a popular third-party FINAL FANTASY XI website had been infecting customers with malicious software. Our Legal team immediately contacted the hosting site of the offending third-party website and had the site taken down until the issue could be addressed. While the website main page has had the offending code removed, we strongly recommend that our community be careful when they visit any website concerning FINAL FANTASY XI that is not endorsed by Square Enix. While we have no control over these third-party websites, we urge that the community contact us immediately if any similar incidents arise in the future.

We also suggest that our customers read up on precautionary measures they can take to ensure they safety of their information online.

http://www.playonline.com/ff11us/polnew ... 0343.shtml

[Everlasting]

Thanks for nothing SE.

[Leashedragon]

Not sure if it's been said yet, but I wouldn't go to FFXIDats either for the time being. Supposively they're having the same issue as Somepage. There is a thread on their forum warning those using IE about it.

I went to check it just now like I normally do and my AVG popped up catching an auto-downloader. I tried a heal and failed, so I moved it to the Virus Vault. I'm not sure if this is enough to take care of it or not. Going to read that other thread on how to take care of these files once I find it.

EDIT: Registry was clean. But I still worry. ><

[Tsutsumiko]

Well this thread has definitely been helpful in learning things about the virus and such.

I usually visit these sites in question frequently and have now stopped.

Considering I am a creature of habit, I took the liberty of changing the Firefox FFXI Helper plugins. Just in case anyone else also uses this plugin, I suggest changing all the settings to the websites to "about:blank" for all the URL fields.

I've been telling a few LS members and such who also do this, and it is helpful. I still find myself becoming half brain dead from time to time and trying to visit Somepage/FFXIAH for information using the FFXI plugin. This way, I've kinda saved my ass preemptively.

Go me for being brain dead!

[BRP]

we strongly recommend that our community be careful when they visit any website concerning FINAL FANTASY XI that is not endorsed by Square Enix.

Sorry BG forums...

[Ruin]

After following the guide to make sure your system safe, I just have a concern or 2.

1) After doing the advanced computer scan, and regedit search for the 4 files in the guide, If none of those exact names found you are safe?

2) Reason I say exact names, is because it warns you that when you regedit in3.dll other names can come up. On mine it brought up 3 files in Quicktime folder, these are nothing to worry about?

3) Is it confirmed it was just some~page?? Scared to even look up synth recipies on ffxiclopedia, and/or info on campaigns OPs that id like to check out.

[Kaeko]

1) After doing the advanced computer scan, and regedit search for the 4 files in the guide, If none of those exact names found you are safe?

2) Reason I say exact names, is because it warns you that when you regedit in3.dll other names can come up. On mine it brought up 3 files in Quicktime folder, these are nothing to worry about?

In regards to question 2, if you searched and got like Plugin3.dll or something like that you're good. The malicious file is just exactly "in3.dll".

I'm actually curious about question 1 as well. I ran like all the various virus checkers and searched all hidden folders and registries and found nothing; but I know I had the vulnerable version of RealPlayer, used IE6, and went to Somepage a lot... I think the only thing saving me is I don't type the password usually on POL. I can't seem to find anything but I'm still paranoid I have a bug.

[Leashedragon]

1) After doing the advanced computer scan, and regedit search for the 4 files in the guide, If none of those exact names found you are safe?

2) Reason I say exact names, is because it warns you that when you regedit in3.dll other names can come up. On mine it brought up 3 files in Quicktime folder, these are nothing to worry about?

In regards to question 2, if you searched and got like Plugin3.dll or something like that you're good. The malicious file is just exactly "in3.dll".

I'm actually curious about question 1 as well. I ran like all the various virus checkers and searched all hidden folders and registries and found nothing; but I know I had the vulnerable version of RealPlayer, used IE6, and went to ]]DO NOT USE SOMEPAGE[[ a lot... I think the only thing saving me is I don't type the password usually on POL. I can't seem to find anything but I'm still paranoid I have a bug.

You aren't the only one a little paranoid. Even though my registry was clean after AVG caught it on FFXIDats, I still am worried. I refused to log into FFXI tonight. I don't know much about this kind of thing, so I'm worried it being in the Virus Vault might not be enough. I talked to a few people about it and they said it should be fine if the registry and clear and it's in the vault. Some more reasurance from others more knowing of the situation would be nice. x_x

As for it just being Somepage, I mentioned a few posts up FFXIDats is having an issue as well. That's where I ran into mine.

I've informed a few friends who play about it and also told them if they see me in game to send me a tell and make sure it's me. If there is no response and I'm moving around to contact a GM, although it might not do much. I did hear someone caught it in the act and actually got the account frozen by doing such. Here's to hoping it doesn't come to that.

[Infini]

Theres rumors goin around that ffxi-atlas has been hit as well dunno wether its confirmed yet or not? anyone able to update on this?

[Mathayus]

Theres rumors goin around that ffxi-atlas has been hit as well dunno wether its confirmed yet or not? anyone able to update on this?

I dont know much about this, but if these are the locations,
C:\Windows\System32\rsbo.exe
C:\Windows\System32\kb1ss1p.dll
C:\Windows\System32\kb1ss1p.sys

Ive been to atlas a few times and havnt found these in those locations yet. Still not an excure to let guards down tho. I think ive done 10 checks and scans for those files sense yesterday.