Attention players with Compromised Accounts

[Psalm]

Ok my account got hacked. My question is this. I reformatted my hard drive and reinstalled everything. Have firefox with no script, addblock plus, avg and fire wall. Avg hasnt found any virus's thus far. Im not to smart when it comes to pc's but is it safe to play ffxi again on pc for me or should i just stick to ps? I have yet to get my email to notify me when my account has been rolledback. 8-6-08 will be 3 weeks. I just hate to think its safe even tho I'm pretty sure it is and then get hacked again. Thing is with my hack I never did find the 2 known virus's on my pc. thanks in advance

[Sparx]

The easiest way to tell if you have the virus is if you have a long wait for Shutdown. If you reformatted your computer you are definitely rid of the virus. If you are nervous about the virus, just watch for long waits for the shutdown menu to come up and,

Start Menu > Run > type in "regedit" and click OK > Highlight My Computer in the newly opened Regedit box > Click on Edit > Click on Find > type in rsbo.exe

Repeat said steps for ALL these files:

rsbo.exe
kb1ss1p.dll
kb1ss1p.sys
in3.dll

if you have any of those. DELETE THEM IMMEDIATLY, these are the viruses, I was lucky to save a friend from getting hacked because she had this in her registry.

[Psalm]

The easiest way to tell if you have the virus is if you have a long wait for Shutdown. If you reformatted your computer you are definitely rid of the virus. If you are nervous about the virus, just watch for long waits for the shutdown menu to come up and,

Start Menu > Run > type in "regedit" and click OK > Highlight My Computer in the newly opened Regedit box > Click on Edit > Click on Find > type in rsbo.exe

Repeat said steps for ALL these files:

rsbo.exe
kb1ss1p.dll
kb1ss1p.sys
in3.dll


if you have any of those. DELETE THEM IMMEDIATLY, these are the viruses, I was lucky to save a friend from getting hacked because she had this in her registry.

thanks a bunch. Just did what you suggested and I don't have any of those on my pc. Before I got hacked I had to manully shut my pc down just because it wouldn't shut down on it's own. Figured I deleted a file I shouldn't had. Really wish I had just broke down and reformatted. Thanks again

[Sparx]

No problem man. I had been hacked and was too late to delete the virus. They got me when I was on vacation. I just got my account returned today after 3 week, 1 day rollback. I'm so happy!

[rath]

K, I have a cousin that got two accounts hacked. He was a moron and didn't change his PW after the first got hacked and he removed the virus. But the thing is, he got the first one restored, but the GMs and CSR line have told him his registry keys are wrong for the second account. He didn't RMT the second account, he bought the disks and started it up for his little brother, and even reading them right off the manul, they say he is giving them the wrong keys and they will not freeze the account.

Has anyone ever had this problem before? IS there some way RMT/Hackers have discovered to alter an accounts initial registry? Or is this just SE screwing up again? He has been trying for 3 weeks now, daily, and they still won't freeze the account.

[Gremlin37]

Got my char back today 8/7/2008. Was hacked December 15th 2007... Will be tossing it into rollback this evening after the update... took long enough >.>

Info on account was...
Phone Number: 919-390-2315
Email: [email protected]
City: Raleigh
Postal Code: 276 - 01

Anyway.. GL to anyone still trying to recover their accounts.

[MaachaQ]

Ok my account got hacked. My question is this. I reformatted my hard drive and reinstalled everything. Have firefox with no script, addblock plus, avg and fire wall. Avg hasnt found any virus's thus far. Im not to smart when it comes to pc's but is it safe to play ffxi again on pc for me or should i just stick to ps? I have yet to get my email to notify me when my account has been rolledback. 8-6-08 will be 3 weeks. I just hate to think its safe even tho I'm pretty sure it is and then get hacked again. Thing is with my hack I never did find the 2 known virus's on my pc. thanks in advance

3 weeks seems to be about average for restores for recently hacked people.

If you formatted your computer and did a full reinstall you should be fine, as long as you don't reinstall an infected file you may have saved on an external harddrive.

A friend of mine got hacked a while back (Mieka - Ramuh), and she never found a virus either, but we urged her to have her PC wiped and restored from scratch while she was waiting on her account to be returned. Even the best AV software takes some time to find new viruses, update your virus definitions every few days and runs scans whenever possible (I'm paranoid, I have my AV do a full scan every night ^^; ). Virus writers are always thinking of new ways to get into your stuff, and it takes the AV companies a while to catch up with the latest hacks.

Think of it like the Flu Vaccine every year, they need to make a new one every season because the virus keeps evolving, and even with the latest vaccine some people will still get sick because their particular bug was not put into the vaccine mix.

[EmptyBullring]

I have a question about the keylogging issue.

If a keylogger was somehow placed into my computer, and it was the reason why someone was able to obtain my POL password...then how did they get my POL ID? They would need both pieces of information to access my account and the POL ID is not something that I type in anywhere.

[ronin sparthos]

The keyloggers take screenshots which include your POLID then this information along with the captured password (taken via your memory or keystroke capture) are emailed to the RMT who then steal your account.

[EmptyBullring]

Thanks

[Psalm]

ok so after 3 weeks and 2 days I have my account back. rollbacked to day before I got hacked. Now Im trying to update pol and ffxi on my pc since I reformatted and when I click playonline viewer its going straight to an update pol page. Im not even logged in yet so this seems odd to me.

[Oziris]

Got my account back three weeks and a couple days after it got hacked. It was restored to three hours before I had went afk from the game before it was hacked. I was really pleased to find everything intact and all items/gil present.

[Oziris]

By the way, the wzcsvbxm.dll malware (trojan I believe) had changed the registry value data of the ServiceDll (located in My Computer\HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\S ervices\wuauserv\Parameters ). It had changed the data from " %SystemRoot%\System32\wuauserv.dll " to " %SystemRoot%\System32\wzcsvbxm.dll " in both ControlSet001 and ControlSet002 roots. I had to change it back to wuauserv.dll and that was the final fix to the problem (among a myriad of other scans and safe mode operations).
Ironically enough, the Add Remove Programs in the Control Panel was having problems a few weeks before my account was stolen. It just gave a blank white screen and didn't populate a list of current programs found on the system. After changing this dll file data back to its original state (wuauserv.dll) this issue was fixed completely, which makes me think I had this malware on my computer a good week or more before my account was finally stolen.

[Psalm]

Ironically enough, the Add Remove Programs in the Control Panel was having problems a few weeks before my account was stolen. It just gave a blank white screen and didn't populate a list of current programs found on the system.

I had that same problem for atleast 2 weeks on my pc aswell along with shut down not working either. I Had to manually shut down my pc to get it off.

[Sparx]

Those are the symptoms of the virus, long wait time for Shutdown and blank screen in the control panel. You gotta go delete it in Registry and Hidden folders (Read my post before)

[Ivelios]

Hello~ My account was hacked 8-14-08 and it's in lock down like I posted in the List of hacked players. I'm not too bright when it comes to PC usage, especially when it comes to the registry stuff. However, from Sparx's post earlier with what files to look for, I did find the first and last two files in my system. However, in the same sort of file, and I'm not sure if it has any part of working with a key logger, I found two .DLL files that.... I'm questioning bases specifically on what they are called. One is key.dll the other is steel.dll. I don't know if those are tied in or not... but... as a major Novice in this area... they have me nervous.

Also, since I am in the process of moving atm, most of my stuff is in boxes atm and I can't seem to find it in the ones that are easily accessible. When I talked to the SE Service and Support people, they said that, even though I had the rest of the information correct, that they'd send me a conformation e-mail. That was at 11:50ish am PST and they said I should have it today... and I have yet to get it. I was wondering if the one Jeny has posted in the first post is the same thing, and if I can just print it, fill it out, have it notarized, and send it off, or if I should wait for their e-mail @_@;?

Any and all help I could get is much appreciated.

[BRP]

er, wrong thread.

[Sparx]

Hello~ My account was hacked 8-14-08 and it's in lock down like I posted in the List of hacked players. I'm not too bright when it comes to PC usage, especially when it comes to the registry stuff. However, from Sparx's post earlier with what files to look for, I did find the first and last two files in my system. However, in the same sort of file, and I'm not sure if it has any part of working with a key logger, I found two .DLL files that.... I'm questioning bases specifically on what they are called. One is key.dll the other is steel.dll. I don't know if those are tied in or not... but... as a major Novice in this area... they have me nervous.

If they were in the same folder as the viruses you had, you should delete them no questions asked. Delete anything in that folder containing the viruses. I had additional virus names (smart.dll, etc.) as well. If you don't recognize the name...With steel.dll and key.dll do you still have the symptoms of the other viruses? long time for shutdown to load up, control panel not working, etc. I dont recognize the names, but if you still have symptoms of the virus (or it was in the same folder as the other two), you need to delete them ASAP and change your POL password. I reccommend you try scanning registry for wzcsvbxm.dll and smart.dll once as well, I have a feeling you're clean but scanning registry takes all but 5-10 minutes and it could save you from another hacking. Good luck!

Also, since I am in the process of moving atm, most of my stuff is in boxes atm and I can't seem to find it in the ones that are easily accessible. When I talked to the SE Service and Support people, they said that, even though I had the rest of the information correct, that they'd send me a conformation e-mail. That was at 11:50ish am PST and they said I should have it today... and I have yet to get it. I was wondering if the one Jeny has posted in the first post is the same thing, and if I can just print it, fill it out, have it notarized, and send it off, or if I should wait for their e-mail @_@;?

The process of rollbacking accounts generally take 3 weeks. Yeah, I was in your boat. Wait for the e-mail. Also, check Spam folder if you have Yahoo email. The email came in that for me lol.

[Pyrexia]

Hacked 8-16-08 at approximately 9:30am. Pyrexia was moved from Hades to Caitsith, luckily friends got it locked for me. Stupid SE not open on weekends so the actual person who was hacked can do nothing about it.

Doesn't look like he's sold anything, friends said he spent a lot of time in Port Bastok for some reason.

Now, if/when I do find something, deleting it should be fine?

[Valkerion]

Name: Valkerion
Server: Bahamut (not sure were now)

Moved out to L.A. for the summer early May/ late April, and logged on, on a friends PC since I was living with him. Dint play for about a week (new city/people ect), sit down to see I cant log in saying my password is wrong. Friend tried his account same thing (name is Tobueh on Fairy). He tried his other character he mains on 360 and it was working but his other, and mine dint work. Turns out the pc was infected with something and boom, both accounts were eaten up. Friend could get his character back but I coulnt cause I wasnt at home and noone to get the regi codes for me.

Just got back into the game and found out the old FFXI stuff was tossed so now i am attempting to get the regi codes back if possible. but it has been 3 months so im not too hopeful

if anyone sees Valkerion tell me.