FFXI: JavaScript exploit on the loose(Repairs inside)

[Semitry]

Theres rumors goin around that ffxi-atlas has been hit as well dunno wether its confirmed yet or not? anyone able to update on this?

I dont know much about this, but if these are the locations,
C:\Windows\System32\rsbo.exe
C:\Windows\System32\kb1ss1p.dll
C:\Windows\System32\kb1ss1p.sys

Ive been to atlas a few times and havnt found these in those locations yet. Still not an excure to let guards down tho. I think ive done 10 checks and scans for those files sense yesterday.

I've grepped all of atlas's files searching for malicious code but have not found anything. Is there anything else that needs to be searched aside from iframe, miorsocft, playenline, any code loading real audio/quick time files?

[Lordwafik]

Yesterday, my friend got hacked in front of my eyes.

All of a sudden, his main DCs (he has 2 accounts he has logged in always, parties them together etc), and he sends me tells from his alt saying he logged in from another location, and didn't understand why.

I told him quickly log back in, and for the next 10 minutes, him and the RMT were battling eachother to login to the account, at the end the RMT gave up and I quickly made him change passes and do a scan, all the files bar one showed up, and then I showed him how to remove them. It was kinda scary for something like that to happen but we are so lucky to have caught it so early. The RMT was on his way to the mog house to pick up all the goodies.

If we didn't catch it, RMT would have gotten away with a very pimped out RDM/WAR/DRK/BRD with special things like dalmy/ridill etc.


Just a warning to let -everyone- know , he doesn't read forums, and he has realplayer/IE/Somepage. Now he's removed realplayer, and refuses to use IE anymore Firefox baybee.

[Aerin]

EDIT: nvm friend just told me about searching and registry

[TacoTaru]

I know the guy from FFXIAH was working to find out of they were bugged too, but just for confirmation, FFXIAH is clean or still suspicious as of now?

[Ruin]

This file, Name: (Default) Type: REZ_SZ Data: (value not set) - Its located in my comp somewhere, I cannot delete it, ive changed POL password and havent played on PC since. Is this one to worry about..?

[Izzy]

Yesterday, my friend got hacked in front of my eyes.

All of a sudden, his main DCs (he has 2 accounts he has logged in always, parties them together etc), and he sends me tells from his alt saying he logged in from another location, and didn't understand why.

I told him quickly log back in, and for the next 10 minutes, him and the RMT were battling eachother to login to the account, at the end the RMT gave up and I quickly made him change passes and do a scan, all the files bar one showed up, and then I showed him how to remove them. It was kinda scary for something like that to happen but we are so lucky to have caught it so early. The RMT was on his way to the mog house to pick up all the goodies.

If we didn't catch it, RMT would have gotten away with a very pimped out RDM/WAR/DRK/BRD with special things like dalmy/ridill etc.


Just a warning to let -everyone- know , he doesn't read forums, and he has realplayer/IE/]]DO NOT USE SOMEPAGE[[. Now he's removed realplayer, and refuses to use IE anymore Firefox baybee.

That's pretty nuts. I'd do the same thing if someone logged onto my account. I'd spam the fuck out of login and have someone else spam wrong password on my account until it was locked out.

[Aerin]

This file, Name: (Default) Type: REZ_SZ Data: (value not set) - Its located in my comp somewhere, I cannot delete it, ive changed POL password and havent played on PC since. Is this one to worry about..?

pretty sure it's not

[LinktheDeme]

Courtesy Pikko.
http://ffxi.allakhazam.com/sdetail.html?story=11667

Official statement from Square Enix:

We have received reports that a popular third-party FINAL FANTASY XI website had been infecting customers with malicious software. Our Legal team immediately contacted the hosting site of the offending third-party website and had the site taken down until the issue could be addressed. While the website main page has had the offending code removed, we strongly recommend that our community be careful when they visit any website concerning FINAL FANTASY XI that is not endorsed by Square Enix. While we have no control over these third-party websites, we urge that the community contact us immediately if any similar incidents arise in the future.

We also suggest that our customers read up on precautionary measures they can take to ensure they safety of their information online.

http://www.playonline.com/ff11us/polnew ... 0343.shtml

Anyone else notice its dated May 11th?

[Minions]

I just assumed they referenced an old post regarding such situations.

[Kurokikaze]

Courtesy Pikko.
http://ffxi.allakhazam.com/sdetail.html?story=11667

Official statement from Square Enix:

We have received reports that a popular third-party FINAL FANTASY XI website had been infecting customers with malicious software. Our Legal team immediately contacted the hosting site of the offending third-party website and had the site taken down until the issue could be addressed. While the website main page has had the offending code removed, we strongly recommend that our community be careful when they visit any website concerning FINAL FANTASY XI that is not endorsed by Square Enix. While we have no control over these third-party websites, we urge that the community contact us immediately if any similar incidents arise in the future.

We also suggest that our customers read up on precautionary measures they can take to ensure they safety of their information online.

http://www.playonline.com/ff11us/polnew ... 0343.shtml

Anyone else notice its dated May 11th?

Oh snap. No wonder I couldn't find the update on the top news section of POL site... Either thats referencing an old incident similar to this, a typo, or they are trying to keep this on the low... -_-

[Sagacious Sundi]

Courtesy Pikko.
http://ffxi.allakhazam.com/sdetail.html?story=11667

Official statement from Square Enix:

We have received reports that a popular third-party FINAL FANTASY XI website had been infecting customers with malicious software. Our Legal team immediately contacted the hosting site of the offending third-party website and had the site taken down until the issue could be addressed. While the website main page has had the offending code removed, we strongly recommend that our community be careful when they visit any website concerning FINAL FANTASY XI that is not endorsed by Square Enix. While we have no control over these third-party websites, we urge that the community contact us immediately if any similar incidents arise in the future.

We also suggest that our customers read up on precautionary measures they can take to ensure they safety of their information online.

http://www.playonline.com/ff11us/polnew ... 0343.shtml

Anyone else notice its dated May 11th?

Oh snap. No wonder I couldn't find the update on the top news section of POL site... Either thats referencing an old incident similar to this, a typo, or they are trying to keep this on the low... -_-

Yeah, they're probably just linking that as a guideline of sorts.

[Builttolast]

Courtesy Pikko.
http://ffxi.allakhazam.com/sdetail.html?story=11667

Official statement from Square Enix:

We have received reports that a popular third-party FINAL FANTASY XI website had been infecting customers with malicious software. Our Legal team immediately contacted the hosting site of the offending third-party website and had the site taken down until the issue could be addressed. While the website main page has had the offending code removed, we strongly recommend that our community be careful when they visit any website concerning FINAL FANTASY XI that is not endorsed by Square Enix. While we have no control over these third-party websites, we urge that the community contact us immediately if any similar incidents arise in the future.

We also suggest that our customers read up on precautionary measures they can take to ensure they safety of their information online.

http://www.playonline.com/ff11us/polnew ... 0343.shtml

Anyone else notice its dated May 11th?

Oh snap. No wonder I couldn't find the update on the top news section of POL site... Either thats referencing an old incident similar to this, a typo, or they are trying to keep this on the low... -_-

Yeah, they're probably just linking that as a guideline of sorts.

More recycled content, they can't help themselves

[ringthree]

This file, Name: (Default) Type: REZ_SZ Data: (value not set) - Its located in my comp somewhere, I cannot delete it, ive changed POL password and havent played on PC since. Is this one to worry about..?

If you had read this thread you would know this is fine. Its a track of your search function. Its on page 1 or 2.

[Anadosia]

Courtesy Pikko.
http://ffxi.allakhazam.com/sdetail.html?story=11667

Official statement from Square Enix:

We have received reports that a popular third-party FINAL FANTASY XI website had been infecting customers with malicious software. Our Legal team immediately contacted the hosting site of the offending third-party website and had the site taken down until the issue could be addressed. While the website main page has had the offending code removed, we strongly recommend that our community be careful when they visit any website concerning FINAL FANTASY XI that is not endorsed by Square Enix. While we have no control over these third-party websites, we urge that the community contact us immediately if any similar incidents arise in the future.

We also suggest that our customers read up on precautionary measures they can take to ensure they safety of their information online.

http://www.playonline.com/ff11us/polnew ... 0343.shtml

I looked all over POL for this and it doesn't exist. It only redirects me to an old statement from May 11,2007. As far as I am concerned they still haven't admitted anything has happened. Furthermore, they just made it even easier for them to invade our accounts, way to go SE It's like they are throwing us at rmt.

Quote:
The PlayOnline Membership Information section can now be accessed from the web! (12/18/2007)

Starting today, the PlayOnline "Membership Information" section under Service & Support on the PlayOnline Viewer can be accessed from the web.

The site is currently limited to viewing specific account data, but in the future, more features will be added and users will be able to purchase Content IDs or change payment methods.

PlayOnline "Membership Information" can be accessed here.
http://www.playonline.com/ff11us/index.shtml

Damn it....Built to last beat me to it. >.<

[PrincessMinnet]

FYI...this is how it happened when my husband's and a friends' accounts got hacked.

a.) we hadnt heard anything about this cause we dont generally hit up forums very often.
b.) His system has been having trouble for the last couple of months due to totally unrelated issues (hardware)

He visists somepage, ffxiah, alla, ect regularly. Neither he nor I have noticed any dl's despite having virus/popup protection.

Sunday 12/16 in the evening, his computer crashed (nothing new there...happens often). This time when it came back up, it was giving him some kind of error about POL not being installed properly. He just figured the computer crashing had somehow messed up his install. He popped in his CD, reinstalled POL...well when you do that It returns all the POL fields to default. You HAVE to re-enter your POL ID and password. Of course he didn't think anything of that since that's standard, he entered his and our friends info (we're holding the account for him until he can come back) back into his POL. Damage done....info transmitted to the hackers. We went to bed around 1am CST Monday morning and between then and 7am CST (when he went to log in before heading to work) it was hijacked. Call SE....you know the drill....Not gonna do anything because the Billing addy and CC info were changed.

So...now someone has actually put down what happened leading up to the hijacking....how many other people had that exact thing happen...or is it working in other ways for some people?

[Ruin]

This file, Name: (Default) Type: REZ_SZ Data: (value not set) - Its located in my comp somewhere, I cannot delete it. Is this one to worry about..?

pretty sure it's not

Anyone confirm this file is just Vista's record of you searching for it?

[cdgreg]

This file, Name: (Default) Type: REZ_SZ Data: (value not set) - Its located in my comp somewhere, I cannot delete it. Is this one to worry about..?

pretty sure it's not

Anyone confirm this file is just Vista's record of you searching for it?

Maybe the other 10 posts that referred to this on the previous pages?

[Ruin]

This file, Name: (Default) Type: REZ_SZ Data: (value not set) - Its located in my comp somewhere, I cannot delete it. Is this one to worry about..?

pretty sure it's not

Anyone confirm this file is just Vista's record of you searching for it?

Maybe the other 10 posts that referred to this on the previous pages?

Actually you show me 1 post that even mentions this specific file. Yeah its been said vista keeps the record of it, but what file specifically nope. God, so tired of lippy responses, why not just keep ur mouth shut.

[Aerin]

This file, Name: (Default) Type: REZ_SZ Data: (value not set) - Its located in my comp somewhere, I cannot delete it. Is this one to worry about..?

pretty sure it's not

Anyone confirm this file is just Vista's record of you searching for it?

Maybe the other 10 posts that referred to this on the previous pages?

Actually you show me 1 post that even mentions this specific file. Yeah its been said vista keeps the record of it, but what file specifically nope. God, so tired of lippy responses, why not just keep ur mouth shut.

Because if you actually go back one page you will find it right at the top of the page. Not only that, but there's a link to the original page on how to search for the files AND it tells you on the original post there too.

Oh fuck it, the answer you're looking for is NO.

[ringthree]

This file, Name: (Default) Type: REZ_SZ Data: (value not set) - Its located in my comp somewhere, I cannot delete it. Is this one to worry about..?

pretty sure it's not

Anyone confirm this file is just Vista's record of you searching for it?

Maybe the other 10 posts that referred to this on the previous pages?

Actually you show me 1 post that even mentions this specific file. Yeah its been said vista keeps the record of it, but what file specifically nope. God, so tired of lippy responses, why not just keep ur mouth shut.

http://bluegartr.com/forum/viewtopic.php?f=2&t=27226

First post.