Attention players with Compromised Accounts

[ronin sparthos]

thanks Radio :D

well, my account is currently entered in rollback system, GM said it can takes days to weeks... /joy hehe

anyway, my account when i logged it off had about 300k and was geared on my rdm/nin...
i didn't have aLOT of expensive stuff, haubergeon, enfeebling torque, unji, etc...

getting him back, i had 1.5 mil, all my stuff was sold that was worth money, i was on nin/thf ... i had 13 stacks of beast blood on me and some bat wings... 4 of my 5 mules were deleted, all but the jeuno mule which was completely emptied out...

RMT didn't seem to toss any of my Rare/ex, was awesome to wear my moogle cap again :D

initiated the rollback through GM after running into an old ifrit friend that moved to quetzalcoatl.

Awesome news~

[MaachaQ]

I really worry about how the RMT keep coming up with new viruses to steal our info... Ever with the best anti-virus software, it can take time for your definitions to get updated for a new virus. What will happen if you are legitimately hacked more than once? It's really bad that this is supposed to be a one time restore at this point, but there is a chance that no matter what precautions you take you really can be hacked more than once on the same account...

Hopefully the new system they've announced for the Sept. version update will help with this... it's had me worried for a while now...

[Sparx]

I really worry about how the RMT keep coming up with new viruses to steal our info... Ever with the best anti-virus software, it can take time for your definitions to get updated for a new virus. What will happen if you are legitimately hacked more than once? It's really bad that this is supposed to be a one time restore at this point, but there is a chance that no matter what precautions you take you really can be hacked more than once on the same account...

Hopefully the new system they've announced for the Sept. version update will help with this... it's had me worried for a while now...

If SE fixes the issue of hacked accounts, RMT are nearly terminated since that's their biggest money maker. Also, if you're issued a rollback, make sure you terminate all of the viruses you have and change all POL passwords.

[Ligro]

Ligro
Midgardsormr

Character returned on Monday Aug 25th, by the person that obtained the account from outside seller!

[setzor]

Ligro
Midgardsormr

Character returned on Monday Aug 25th, by the person that obtained the account from outside seller!

huh? do you mean that the account was returned to you by the person who bought it from the RMT that stole it? that's pretty crazy luck...

[Ligro]

Toon was sold by someone I know, I was able to track down the person and viola!

[Pyrexia]

Well... They returned the account to me after the notary form and all that stuff... and I log on to find... no gear, no gil, I'm on CaitSith, and half my rare/ex stuff is tossed because it was in the way of the RMT.

Now why did SE get my hopes up and return my account only to take it away to do a rollback? Why isn't a rollback pretty much standard procedure for a hacked account? Do people like being on random servers with no gear or gil to speak of? Seems stupid.

Py's in rollback mode... supposed to be a week from Monday or maybe a bit more. They said the waiting list is looong.

[Edged]

Yeah I finally got into the rollback process after my account has been under investigations for 2 1/2 weeks. Contacted a GM today and they said they have started the recovery process and if its not done in 1 week than I should be sure to recontact them.

[Omnipotent]

Kind of a far fetched question don't know if this pertains to this thread but...... say you get a character banned that previously wasn't yours, but a friend quit and gave him to you and you only had him for a month. If your friend calls for you and submits a compromised account form etc.... can they reverse the ban?

[Ivelios]

Kind of a far fetched question don't know if this pertains to this thread but...... say you get a character banned that previously wasn't yours, but a friend quit and gave him to you and you only had him for a month. If your friend calls for you and submits a compromised account form etc.... can they reverse the ban?

I'd assume so since when you want to change any of the info, you can't change the original name and DoB that is on the account. Just so long as you make sure that person has the rest of the information required, you should be okay... at least I think so don't think what I am saying is a guaranteed fact.

As for Ivelios, I got him back on Aug 25th and he was stripped ;; Anything I had over 10k was sold off or traded or whatever the hell the hacker did to him. I got a roll back issued though (Called up SE directly to have it done) and am waiting for the e-mail that says I can have him back again @_@.

Oh, a quick tip for ANYONE that has their account hacked, when you call SE, make sure you write the name of whoever you are talking to. This is especially useful for when you are calling them about that e-mail (that they seem to never send -.-) for the Notary Form. Plus, if you keep track of all the information they tell you, as well as the information needed to get your account back, you can double, triple, and quadruple check to make sure that your accounts locked, it's being investigated, it's in a rollback, or what ever else they might be doing to your account.

[Omnipotent]

I could give him my CC, but then he wouldn't go into the Comrpimses stages so I still need to go through that Notary Form stage, which I am all to familiar with so hopefully this works.

[Ivelios]

Well hopefully you get everything sorted out and the account back, up, and running as soon as you can.

Also, as I stated earlier I'm not the most computer savy person there is, but somehow, after all the protection stuff I put on my computer, I found in3.dll on my computer again And this is after I have put up AVG, a Norton Secondary AV, NoScript and AdBlockerPlus for Firefox(Including having the options set on both to pretty much block absolutely everything unless I say it's okay to run it). I've visited just the site's that I've visited before that I know were safe.

But this little bugger popped up again somehow...

So I did a google search for it.... and this is what I found....

Google Search Result: in3.dll

> Spyware Encyclopedia Page 162 > Unknown Pest
Unknown Pest removal
Spyware Unknown Pest Information
Name: Unknown Pest
Category: Browser Helper Object
Date: 2004-09-01
Dangerous: Yes
Unknown Pest is one of Browser Helper Object spywares.
Finding it on your computer means that your computer is infected with Browser Helper Object and crucial data could be endangered or even lost.
This Browser Helper Object is also known as:
•Adware/eZula - named by Panda.
• Application/HideWindow.A - named by Panda.
• Backdoor Program - named by Panda.
• Worm Generic.LC - named by Panda.

>> Delete Unknown Pest automatically - Download Spyware Doctor

Unknown Pest Removal Instructions
Kill the following processes
bw.exe, empavms.exe, ezbndlwr.exe, ircd.exe, mannager98a.exe, refslow.exe, top_moxie.exe, pstor.exe, remd1.exe, removed.exe, smsis.exe, stde9.exe, svchost.exe, anxf.exe, cjpwgnta.exe, dhnubh.exe, elszg.exe, pswzcg.exe, pzh.exe, susp.exe, bkj6sa7.exe, lmsxxd.exe, sysregfix.exe, tgaf5mnu.exe, tgixwq.exe, version.exe, tyj6apez7a.exe, utnkxqqurovvp.exe, vividgal.exe, xmpzbfi.exe, teaw.exe, tvchost32.exe
Unregister the following DLLs and reboot
gt_info.dll, icmpfilter.dll, in3.dll, mdx.dll, r.dll, rvspsp.dll, sckclient.dll, sysboot.dll, syste32.dll, telnet.dll, vbejat32.dll.
ssgrllishhj.dll in Documents and Settings\UserName\application data\
moo.dll in Windows\fonts\font2\
iehook.dll, ipsysdrv32.dll, msg121.dll, msrev21.dll, msudp.dll, ukbdlv.dll, wincore.dll, winupd.dll in Windows\system32\
iehook.dll, ipsysdrv32.dll, msudp.dll in Windows\system\
Delete these registry entries
HKEY_CLASSES_ROOT\clsid\{00673769-777f-4814-be0f-74cba1d823b8}
HKEY_CLASSES_ROOT\clsid\{13f90341-ad79-4a9f-9b57-0234675670d6}
HKEY_CLASSES_ROOT\clsid\{1e1b2879-88ff-11d2-8d96-d7acac97972f}
HKEY_CLASSES_ROOT\clsid\{75b3573b-a881-4d03-9d55-eecba889ac24}
HKEY_CLASSES_ROOT\clsid\{920cb957-3665-45e5-92e9-a37b58af2758}
HKEY_CLASSES_ROOT\clsid\{97847d03-bd75-43d2-bf56-74d59b54b81e}
HKEY_CLASSES_ROOT\software\microsoft\windows\curre ntversion\explorer\browser helper objects\{00673769-777f-4814-be0f-74cba1d823b8}
HKEY_CLASSES_ROOT\software\microsoft\windows\curre ntversion\explorer\browser helper objects\{13f90341-ad79-4a9f-9b57-0234675670d6}
HKEY_CLASSES_ROOT\software\microsoft\windows\curre ntversion\explorer\browser helper objects\{1e1b2879-88ff-11d2-8d96-d7acac97972f}
HKEY_CLASSES_ROOT\typelib\{0d4ef487-bbb7-4d83-b064-88126e45d4f0}
HKEY_CURRENT_USER\software\aveo
HKEY_CURRENT_USER\software\microsoft\windows\curre ntversion\run\sglpost6r0
HKEY_CURRENT_USER\software\microsoft\windows\curre ntversion\run\wrhuxdovrqmjjw
HKEY_LOCAL_MACHINE\software\aveo
HKEY_LOCAL_MACHINE\software\classes\clsid\{0067376 9-777f-4814-be0f-74cba1d823b8}
HKEY_LOCAL_MACHINE\software\classes\clsid\{13f9034 1-ad79-4a9f-9b57-0234675670d6}
HKEY_LOCAL_MACHINE\software\classes\clsid\{1e1b287 9-88ff-11d2-8d96-d7acac97972f}
HKEY_LOCAL_MACHINE\software\classes\clsid\{75b3573 b-a881-4d03-9d55-eecba889ac24}
HKEY_LOCAL_MACHINE\software\classes\clsid\{97847d0 3-bd75-43d2-bf56-74d59b54b81e}
HKEY_LOCAL_MACHINE\software\microsoft\internet explorer\toolbar\{75b3573b-a881-4d03-9d55-eecba889ac24}
HKEY_LOCAL_MACHINE\software\microsoft\windows\curr entversion\explorer\browser helper objects\{00673769-777f-4814-be0f-74cba1d823b8}
HKEY_LOCAL_MACHINE\software\microsoft\windows\curr entversion\explorer\browser helper objects\{13f90341-ad79-4a9f-9b57-0234675670d6}
HKEY_LOCAL_MACHINE\software\microsoft\windows\curr entversion\explorer\browser helper objects\{1e1b2879-88ff-11d2-8d96-d7acac97972f}
HKEY_LOCAL_MACHINE\software\microsoft\windows\curr entversion\explorer\browser helper objects\{97847d03-bd75-43d2-bf56-74d59b54b81e}
HKEY_LOCAL_MACHINE\software\microsoft\windows\curr entversion\run\4jatk3@4#ajhrm
HKEY_LOCAL_MACHINE\software\microsoft\windows\curr entversion\run\55x6w2r4y#7#wj
HKEY_LOCAL_MACHINE\software\microsoft\windows\curr entversion\run\anxf
HKEY_LOCAL_MACHINE\software\microsoft\windows\curr entversion\run\cjpwgnta
HKEY_LOCAL_MACHINE\software\microsoft\windows\curr entversion\run\dhnubh
HKEY_LOCAL_MACHINE\software\microsoft\windows\curr entversion\run\elszg
HKEY_LOCAL_MACHINE\software\microsoft\windows\curr entversion\run\plus barb
HKEY_LOCAL_MACHINE\software\microsoft\windows\curr entversion\run\pswzcg
HKEY_LOCAL_MACHINE\software\microsoft\windows\curr entversion\run\pzh
HKEY_LOCAL_MACHINE\software\microsoft\windows\curr entversion\run\susp
HKEY_LOCAL_MACHINE\software\microsoft\windows\curr entversion\run\sysregfix.task
HKEY_LOCAL_MACHINE\software\microsoft\windows\curr entversion\run\xmpzbfi
HKEY_LOCAL_MACHINE\software\microsoft\windows\curr entversion\uninstall\etraffic
Remove the following files
bw.exe, crk.vxd, empavms.exe, ezbndlwr.exe, gtsev1.final-6.rls.pvt.rtf, gt_info.dll, hit.lst, i.p, icmpfilter.dll, in3.dll, ircd.exe, lmc.log, mannager98a.exe, mdm.scr, mdx.dll, n.txt, nasty-ass-code2.html, nt32.ini, pstor.exe, r.dll, readme.htm, readme.rtf, remd1.exe, remote.ini, removed.exe, rvspsp.dll, sckclient.dll, servucert.crt, servucert.key, servudaemon.ini, servustartuplog.txt, smsis.exe, srv.cnf, stde9.exe, su.txt, suw.txt, svchost.exe, sysboot.dll, syste32.dll, teaw.exe, telnet.dll, tftp8675, tk00.tmp, tvchost32.exe, vbejat32.dll, views.mdx, webserv.mrc, winddowslogs, wsminsck.oxc.
ssgrllishhj.dll in Documents and Settings\UserName\application data\
refslow.exe in Program Files\antecurbfile\
top_moxie.exe in Program Files\limewire\2.4.1\
0f8243e7.htm, 60da1e12.class, 60e41c07.class in Program Files\norton antivirus\quarantine\
anxf.exe, cjpwgnta.exe, dhnubh.exe, elszg.exe, pswzcg.exe, pzh.exe, susp.exe, tyj6apez7a.exe, utnkxqqurovvp.exe, vividgal.exe, xmpzbfi.exe in Windows\
moo.dll in Windows\fonts\font2\
bkj6sa7.exe, iehook.dll, ipsysdrv32.dll, lmsxxd.exe, msg121.dll, msrev21.dll, msudp.dll, sysregfix.exe, tgaf5mnu.exe, tgixwq.exe, ukbdlv.dll, version.exe, wincore.dll, winupd.dll in Windows\system32\
iehook.dll, ipsysdrv32.dll, msudp.dll in Windows\system\
Remove the following directories
Program Files\antecurbfile

As you can see.... there is a lot of stuff in there.... and.. I'm at a complete loss for as to what is truthful and isn't..... a little help with this would be very, very helpful >.>

[Sparx]

Well hopefully you get everything sorted out and the account back, up, and running as soon as you can.

Also, as I stated earlier I'm not the most computer savy person there is, but somehow, after all the protection stuff I put on my computer, I found in3.dll on my computer again And this is after I have put up AVG, a Norton Secondary AV, NoScript and AdBlockerPlus for Firefox(Including having the options set on both to pretty much block absolutely everything unless I say it's okay to run it). I've visited just the site's that I've visited before that I know were safe.

But this little bugger popped up again somehow...

So I did a google search for it.... and this is what I found....

Google Search Result: in3.dll



As you can see.... there is a lot of stuff in there.... and.. I'm at a complete loss for as to what is truthful and isn't..... a little help with this would be very, very helpful >.>

After reading all of that, I'd defintely get Spyware Doctor. Apparently it just came out like 3 weeks ago. Here is link:

http://www.pctools.com/spyware-doctor/

I just looked through websites validating if it's malware or not and it doesn't appear that it is. Most of those that AVG detected do look malicious however, before you start deleting them on registry, try deleting them via Spyware Doctor. Good luck!

[Catrina]

Grats guys :D

[setzor]

I got rolled back last night, 7 days after putting in the rollback request. So roughly 8 and a half months from being hacked to being rolled back. My character was restored to about 3-4 days before I got hacked as I was missing some items I had obtained shortly before getting hacked, but fortunately it was all easy to re obtain stuff.

[Pyrexia]

When'd you sumbit your rollback request? And when you get rolled back do they send you to GM chat or can you just log right in?

It's been a freaking week and a half and they're still not stinking done... and charged me twice for my account... and still charged me for the server migration. Grrrr. Worthless..

[Sparx]

When'd you sumbit your rollback request? And when you get rolled back do they send you to GM chat or can you just log right in?

It's been a freaking week and a half and they're still not stinking done... and charged me twice for my account... and still charged me for the server migration. Grrrr. Worthless..

Nah they dont send u to GM chat. They just notify you via email that your account was compromised and then you're free to log in. On average it takes three weeks. You can call POL about revoking server charges as with a hacking, it wasn't your fault. I know they revoked mine when Sparx got sent to Bahaumet. Also if you log in with a different name, call a GM and you can get your name back (as long as it wasnt taken again at your home server).

[Pyrexia]

Well including the week and a half it took them to verify my identity/account and then give me the run around about a rollback, it's been three weeks. How can they justify charging me for this past month of I can't play 3/4 of the time at least? And they're very intent of charging me for the regular service, they did tell me I would have the server charge refunded and said they took care of it, but they didn't even do that and still charged me.

It's just so frustrating that this is such a ridiculous process... I knew the exact time I logged off last and the exact time it was compromised. It shouldn't take so damn long. Plus in the morning a day ago, they told me the rollback was in the ending stages. And still no luck this afternoon. I'm just tired of support personnel telling me what I want to hear just because I'm angry... do something about it and I won't have to be.

And why in the world doesn't SE have a TOLL FREE NUMBER? I'm a college student for goodness sakes.

[Omnipotent]

I was on the Web chat and was on hold for 4 and a half hours. I went away to poop for 5 mins and came back and session was ended and I missed them. This was right before they closed. Yesteday called on phone, after 2 hours on hold I got the operator and literally ripped him a new asshole complaining of the pathetic excuse for a web chat program and he assured me they are "Working to adjust this process".

[Mystics]

I been was supposed to update my information. I received my email that they was giving Mystics back on August 19 that same day I got it unlocked and checked it out. I was still on Midgardsomr so had GM put it into rollback that night after work. A week later on Tuesday I received the email to log into Mystics and I checked it out and it was fully rollbacked maybe about 5days before I claimed it hacked which was December 9th i believe i remember it was a Saturday though. The only thing I was missing was a Seveneyes I had received December 7th which isn't a total loss since I got Novio and gaiters etc back. Well GL to the rest of yall waiting. Feel free to look me up on Remora.

~Mystics