Attention players with Compromised Accounts

[Ivelios]

If they were in the same folder as the viruses you had, you should delete them no questions asked. Delete anything in that folder containing the viruses. I had additional virus names (smart.dll, etc.) as well. If you don't recognize the name...With steel.dll and key.dll do you still have the symptoms of the other viruses? long time for shutdown to load up, control panel not working, etc. I dont recognize the names, but if you still have symptoms of the virus (or it was in the same folder as the other two), you need to delete them ASAP and change your POL password. [, I have a feeling you're clean but scanning registry takes all but 5-10 minutes and it could save you from another hacking. Good luck!



The process of rollbacking accounts generally take 3 weeks. Yeah, I was in your boat. Wait for the e-mail. Also, check Spam folder if you have Yahoo email. The email came in that for me lol.

You sir, are a life saver! I wasn't having the control panel issues, but the long ass shutdowns and start ups were there. And I had smart.dll in there as well, along with a DoStartUp and DoShutDown that were in the registry with it. Plus, when I did the ones that showed up the steel and key.dll... well I just deleted all the attached shit that was with it. The thing that I just saw that damn near gave me a heart attack, is that when I did that search I saw my PoL ID listed with everything else that came up with them.... so... Deleted all that fun stuff as well... Thank you again so much for your help!! d_(^.^)_b

[Zhane]

I found a smart.dll on my computer when searching in the registry. I clicked on it and deleted it, restarted my computer but I'm still having incredibly long shutdowns and startups still.

I searched for rsbo.exe
kb1ss1p.dll
kb1ss1p.sys
in3.dll
wzcsvbxm.dll
smart.dll

So if there is anything else I don't know what it's called or really how to find it.

Also, I don't know if this is related, but I'm getting a lot of pop ups on windows with messages such as (0xc00012d) and FFXI will freeze my whole computer when I'm warped or if something happens quickly on screen. Also when this occurs my start button will no longer say "start" and also the names of folders that are open will no longer be displayed in the window. I just put that hoping maybe it is related and could help narrow down what my problem is.

[Sparx]

I found a smart.dll on my computer when searching in the registry. I clicked on it and deleted it, restarted my computer but I'm still having incredibly long shutdowns and startups still.

I searched for rsbo.exe
kb1ss1p.dll
kb1ss1p.sys
in3.dll
wzcsvbxm.dll
smart.dll

So if there is anything else I don't know what it's called or really how to find it.

Also, I don't know if this is related, but I'm getting a lot of pop ups on windows with messages such as (0xc00012d) and FFXI will freeze my whole computer when I'm warped or if something happens quickly on screen. Also when this occurs my start button will no longer say "start" and also the names of folders that are open will no longer be displayed in the window. I just put that hoping maybe it is related and could help narrow down what my problem is.

Was Smart.dll in a folder? If so, you need to delete ANYTHING in that folder (delete the folder as well!!!!). Make sure it's gone. Restart computer a few times, look at registry. If anything weird or unknown is in there, i.e. key.dll, steel.dll, DoStartUp, DoStartDown like Ivel had in his, delete it immediately. Keep looking at registry until all that shit is gone. It took me like 3 tries of deleting all of that shit to get it erased from my system in the registry. If none of this works out for you, you might be forced into getting your computer reformatted. Your computer if infected still should have more shit in it if it's having a slow time with shutdown. Most infected computers have more stuff than JUST smart.dll. So basically the best advice I can give you is to get all that shit outta your system with registry, look at the viruses Ivel had, look for those. Restart computer several times, keep checking, making sure they're gone. Watch shutdown speed, etc. Good luck!

You sir, are a life saver! I wasn't having the control panel issues, but the long ass shutdowns and start ups were there. And I had smart.dll in there as well, along with a DoStartUp and DoShutDown that were in the registry with it. Plus, when I did the ones that showed up the steel and key.dll... well I just deleted all the attached shit that was with it. The thing that I just saw that damn near gave me a heart attack, is that when I did that search I saw my PoL ID listed with everything else that came up with them.... so... Deleted all that fun stuff as well... Thank you again so much for your help!! d_(^.^)_b

You're welcome... Just make sure you don't have any symptoms of the virus. When you don't have long shutdown times and things, consider yourself clean. Change your password or have SE change it if you feel safer with them doing it (I had them change it and they're really friendly about it) once you are clean with no viruses in your registry and no symptoms of the virus. Change passwords of every account you logged on the computer with when it was infected, including ones from Guest login, etc.. You don't want your friends to get hacked don'tcha? lol

[Ivelios]

You're welcome... Just make sure you don't have any symptoms of the virus. When you don't have long shutdown times and things, consider yourself clean. Change your password or have SE change it if you feel safer with them doing it (I had them change it and they're really friendly about it) once you are clean with no viruses in your registry and no symptoms of the virus. Change passwords of every account you logged on the computer with when it was infected, including ones from Guest login, etc.. You don't want your friends to get hacked don'tcha? lol

Hehe... I went one step farther than that... I reformated my freaking Laptop. I then installed AVG and Norton, had them both rescan my computer, downloaded firefox, had AVG and Norton rescan again while doing the regedit too, got NoScript, scanned again, then add blocker, add blocker plus, and Spybot, and between each I did a scan. Probably went a bit overboard... but... better safe than sorry at this point.

As for my account, I'm still in verification Limbo atm so I can't even get back into Ivelios to check what has been lost. The e-mail they were supposed to send friday never came, called them again today and had them resend to two different accounts (And I checked spam on my first, and other two accounts) and still nothing...

I'm seriously tempted to just print off that Verification form Jeny posted in the first post and fill it out and send it to them if this keeps up -.-

[Darte]

Hehe... I went one step farther than that... I reformated my freaking Laptop. I then installed AVG and Norton, had them both rescan my computer, downloaded firefox, had AVG and Norton rescan again while doing the regedit too, got NoScript, scanned again, then add blocker, add blocker plus, and Spybot, and between each I did a scan. Probably went a bit overboard... but... better safe than sorry at this point.

As for my account, I'm still in verification Limbo atm so I can't even get back into Ivelios to check what has been lost. The e-mail they were supposed to send friday never came, called them again today and had them resend to two different accounts (And I checked spam on my first, and other two accounts) and still nothing...

I'm seriously tempted to just print off that Verification form Jeny posted in the first post and fill it out and send it to them if this keeps up -.-

Do it, i never ended up getting it, and really once you've started the process, they just want that piece of paper to confirm it

[Sparx]

Yeah Rollback takes about 3 weeks. You're better off doing it with email way unless you wanna waste time with the Notary form shit lol.

[Ivelios]

Yeah Rollback takes about 3 weeks. You're better off doing it with email way unless you wanna waste time with the Notary form shit lol.

Lol that's what that form is XD Gonna print it off a little bit later today and send it off once I can get to a notary :3

[Mystics]

Finally Got account back! ! ! was hacked December 9th.. locked Jan 5th and sent notary March 5th... put the account back in the system for rollback -.- so wasn't much an enjoyable reunion

[MaachaQ]

Finally Got account back! ! ! was hacked December 9th.. locked Jan 5th and sent notary March 5th... put the account back in the system for rollback -.- so wasn't much an enjoyable reunion

I'm so glad the first round of hacked players are getting their restores too. It's a shame they needed to wait so long, but I suppose since their hackings happened longer ago it took longer to investigate than the more recent ones.

I just hope that some new super-virus doesn't start infecting people despite all our precautions and people who already got restores are not eligible for another one... there is only so much security we can use on our side to protect our accounts...

[Edged]

I have searched all the reg files that you guys have mentioned and have not found any of them on my PC nor have I found any virus on my computer. I too had my account hacked and I have been in the rollback process for just over a week now. Since I did not find any of these regs on my computer and I don't have freakishly long shutdowns. Is it possible that my account was hacked through my friends PC? His account was hacked just 2 days before mine was and since he has my account POL ID and password could he be the reason my account was hacked? His computer always took a long time to load up and shutdown. I'm not sure if he has the regs you guys mentioned earlier, but when he gets back from his trip I'll scan his PC and see what I find and to make sure I delete my POL account information of his PC.

[Airenn]

For anyone who cares, here's my little story.

First, I wrote one of the inital posts about how to clean up and take care of your computer to try and prevent the hackings...

Oh, the irony, eh?

Well, shortly after I wrote that post, I quit Final Fantasy XI.

I would log on to start selling off junk and clean up the account because I had no use for low level items and what not. I would log on to try and solo Cactrot Rapido, and that's about it.

So, a couple months go by and a friend that previously played who had a RDM wanted to see how the solo went for CR.

I log on in March on a Sunday and proceed to start the solo at a friends house. The internet dies and I don't even bother logging back on to see myself dead in Altepa. I just didn't care and I was NOT about to restart the process.

A week later, I was logging on to an Alt account to go to Limbus with them. I knew there was going to be an update and for some reason I decided to do the update on Airenn, my main account.

Log in failed. BAM Hit me in the face. I thought I forgot the password.

Called SE, and sure enough, it had been hacked becuase all the information was wrong. Told them what I could, and had them lock the account. (For the record when I got the account back it was some address in Alaska, a chinese email, etc.)

For about a month or so, I never cared to get the email with the form. For about another month after RECEIVING and getting the form signed did I care to send it back into SE.

I just didn't care... But then slowly, I started caring. I'd at least like to have her back to play her here and there. Or to at least shut her down for good once and for all.

So, I sent the form in and about two weeks later they give me the account back.

Note: This was at the end of June. I had to input MY CC info in to even log in to see if she had anything taken off her. She did.

So, I put in a restoration for my account.

Two weeks after that they get back to me saying they didn't find anything, and that they can't do anything else.

This was in July. So I had just been billed for two months.

So, I call them up, pissed beyond belief. Nothing they can do, yadda, yadda.

I give the account to a friend, because I'm literally DONE.

He server transfers the character to where my second character is - From Alexander to Ifrit, but we still cancel the ID's so as to not pay for August.

He reads my LJ and finds out that the dates I gave SE were about a week before the actual compromising took place.

He calls an SGM and relays this information. This is now around mid July.

SGM closes the account again for another investigation.

4 WEEKS exactly go by and I got the email today that she had been restored.

Had that said friend log in on his break from work since I won't be able to check it out til tomorrow.

She was rolled back FAR. I quit with about 3M on her. She has 1.4 now and was in a completely different zone than when I last saw her.

The server transfer that was paid for is now useless, however they said that I can call in and see if it would be possible to bypass the $25 because I had technically paid for one. But since the rollback, it counts as a server transfer and she can't go anywhere for a while. (59 days the guy said, so it was either from when we switched her to Ifrit or the rollback.)


The money is gone, but the Bando Kotes and Koga Tekko are still there. The most recent things I got, anyway. And so are the Ochiudo's which I had SOLD at some time.

Interesting...


What did I learn? Don't waste time in doing things, just creates problems down the road.

[Sparx]

I have searched all the reg files that you guys have mentioned and have not found any of them on my PC nor have I found any virus on my computer. I too had my account hacked and I have been in the rollback process for just over a week now. Since I did not find any of these regs on my computer and I don't have freakishly long shutdowns. Is it possible that my account was hacked through my friends PC? His account was hacked just 2 days before mine was and since he has my account POL ID and password could he be the reason my account was hacked? His computer always took a long time to load up and shutdown. I'm not sure if he has the regs you guys mentioned earlier, but when he gets back from his trip I'll scan his PC and see what I find and to make sure I delete my POL account information of his PC.

You are absolutely correct man. Your friend had the virus on his computer, not yours. Long shutdown times on the computer is an automatic bingo. Any person with the virus has a keylogger watching their every move. If your friend logged onto your account in the infected PC, then your account was in jeapordy and was hacked. When my computer was infected, I had to contact a friend who's account I had logged into with on my infected PC and save them (if they change their password on a 'clean' PC, RMT won't get it) You need to delete all of that stuff on your friends PC immediately. Because if you don't, your accounts will be hacked again. Scanning your friends computer will do NOTHING. You need to delete all of the things in registry, ALL OF THEM, even the folder itself. Make sure it's gone and he doesn't suffer the long shutdown time. Good luck!

[akanesama]

Well, another victim of smart.dll here. Must've happened two days ago, I discovered it yesterday. RMT did a World Change over to Bahamut and cleared out all my crap.

So, yeah. I guess this stuff is still going on.

[Mercenary480]

First of all I'm sorry but I didn't read all 24 pages if this was already posted....

I was hacked about 1 week ago... I've called SE about 3x and the first time i got my account locked, and they said they would send me an Email..... That was on Monday, They said i would receive the Email within 24hours, i didn't so I called back, this happened about 3 times.... I had them send an Email to both my AOL and my Hotmail accounts

I'd like to know to others that had this problem, if i just print out the form off this site would I get the Email with my new password? Because I'm just afraid that if i don't receive this email I wont receive the Email when they open my account and give me a new password.

Also i only had wzcsvbxm.dll in my regestry, should i be searching for anything else besides the other ones listed? I never had any shutdown startup problems and I'm running every kind of Virus Scan and Disc Cleanups i can, mainly because i don't want to uninstall windows

[Commskywalker]

Contacted SE Friday August 15th to initiate compromised account investigation. Sent notary on Monday(never received e-mail). Received an e-mail on Friday August 22nd saying the process was complete and to contact SE, was too late when I got home. Contacted them this afternoon and received new password.

Question for people that had their account recovered. I didn't lose much but I want to get back to my server. On Avatarati's blog post about the recovery, he says he called SE after getting his account recovered, and they were able to change his server back over the phone, and after that he initiated the item investigation. I just called SE, and the rep I got said I can't be moved back to my server unless I initiate the 2-3 week rollback. I really don't want to be unable to login in again for that long.

So has anyone gotten SE to change them back to original server without having to do through rollback process?

[Sparx]

Contacted SE Friday August 15th to initiate compromised account investigation. Sent notary on Monday(never received e-mail). Received an e-mail on Friday August 22nd saying the process was complete and to contact SE, was too late when I got home. Contacted them this afternoon and received new password.

Question for people that had their account recovered. I didn't lose much but I want to get back to my server. On Avatarati's blog post about the recovery, he says he called SE after getting his account recovered, and they were able to change his server back over the phone, and after that he initiated the item investigation. I just called SE, and the rep I got said I can't be moved back to my server unless I initiate the 2-3 week rollback. I really don't want to be unable to login in again for that long.

So has anyone gotten SE to change them back to original server without having to do through rollback process?

Um when my character was hacked, i got sent to Bahaumet (from Sylph). After the rollback my character was changed back to Sylph with the hacked accounts name (Sparx had changed to Debraube in the hacking since there was a Sparx already in Bahaumet). So i got back to Sylph with the name Debraube. Called a GM and was all set. If I were you, I'd call a GM tell them you were issued a rollback but didn't get server transfered. They should server transfer you for free and relinquish server transfer charges that were placed upon the hacking. Good luck!

[Commskywalker]

Well, I wasn't issued a rollback. Surprisingly I didn't really lose any items, save for seals and junk. The person that had my account seems to have gotten into an hnm ls and been using the character. When I initially contacted SE about my account being compromised, a rollback/restore investigation was never opened, the guy just started the process to confirm that I am the original owner(freezing account, sending notary email, etc.)

So since I really didn't lose much, what I really want is for them to just transfer me with no hassle without waiting weeks for them to investigate, and not being able to play in the meanwhile.

Edit: Spoke to a GM, he couldn't even change my name unless I opened the investigation.. geez

[setzor]

got setzor back today.

what can I say, 8 months and 9 days.

they want me to look at the character before putting in my rollback request, guess i'll get to check out quetzalcoatl for a short while before moving back to Ifrit.

whew...

[Radioactivepoop]

Setz <3 Welcome back.

[setzor]

thanks Radio :D

well, my account is currently entered in rollback system, GM said it can takes days to weeks... /joy hehe

anyway, my account when i logged it off had about 300k and was geared on my rdm/nin...
i didn't have aLOT of expensive stuff, haubergeon, enfeebling torque, unji, etc...

getting him back, i had 1.5 mil, all my stuff was sold that was worth money, i was on nin/thf ... i had 13 stacks of beast blood on me and some bat wings... 4 of my 5 mules were deleted, all but the jeuno mule which was completely emptied out...

RMT didn't seem to toss any of my Rare/ex, was awesome to wear my moogle cap again :D

initiated the rollback through GM after running into an old ifrit friend that moved to quetzalcoatl.