**WARNING** Somepage.com compromised **UPDATED 5/27**

[#686578]

If you copy FF from one PC to another as an alternative way to install it, you will notice something in POL. All of you saved PlayOnline IDs and passwords go with it. It's not just key loggers. People are complaining "I haven't typed my password in 2 years how did I get hacked?" Simple. These programs are copying whichever file your information is SAVED on and transfering it to them. All they do is replace the file on their PC with yours and BAM. All the saved sign in information is there. They simply start POL and you're on your way to a new server ^-^

From what I understand saved passwords are encrypted using your hardware settings? I dont remember what was said exactly and I can't search for it but I'm pretty sure I remember the phrase "Even if you change just your NIC card your password will be lost" meaning copying it from one computer to another would be completely useless. I've never done it, I'm just saying what's been said several times. I'd site sources but I cant search and too lazy to use google.

Random quick question. If my PC were infected (which I doubt it is), and I change the password using the Windows Vista On-Screen Keyboard and SAVE the new password, this is undetectable through regular keylogging means, right?

Meaning they'd need some highly advanced shit or to just steal the entire login file, which they apparently don't do.

If I remember right, wrong. Onscreen keyboard inputs key commands just as the keyboard does, which would be captured the same way. It's been a while since I've programmed, but I remember testing a program with a special condition towards accessibility options and the onscreen keyboard worked with commands I meant to work for the keyboard itself.

Ninja Edit: The best thing to do if you think you might be infected is to reformat your computer, reinstall an Anti-Virus and firewall FROM CD or OTHER OFFLINE SOURCE before connecting to the internet, then reinstall FFXI and update and change your password then. Using a friends known uncompromised computer is a second best, I guess.

That's kinda shitty.

I changed my password on my Xbox 360 but I still have to input my password at least once in order to log in on my laptop, so that POL can have it saved. I'm almost positive that I'm not infected, but a friend got hacked earlier today so I wanted to change my password just as an extra precautionary measure. I always surf with NoScript/AdBlock, haven't found any malicious .dlls or other files, and run both Spydot and a Firewall, so I hope that I'm safe. But who knows, nowadays?

From what you've said you sound safe enough to me.

[Eanae]

Saving your password doesn't make you safe. A keylogger can pull the saved password from the registry, and since the encryption is easily broken, there's no protecting yourself with precautionary measures if you're infected other then changing your password on an uninfected machine. =|

[Prosek]

After a certain point, they stop being victims of RMT hacking and become co-consipirators to credit fraud; the use of our account credit cards to purchase services from SE (server transfers, content IDs) -- if you want to get real monetary crimes involved.

[Aryea]

In regards to the POL errors, I have a question. I just reformatted my PC over the weekend and freshly installed Windows Vista, and have since installed/updated FFXI with the use of Windower. last night my POL froze, and then I tried to restart windower, and got an error. it was NOT the "unsupported interface" error, and I had no smart.dll found on my PC. In fact, I think I've only opened my browser like twice on that PC since I reformatted, and have NOT gone to any FFXI sites.

The error said something about a pathway, and I saw it twice. After that, POL froze one more time during the evening. I have Norton Internet Security 2008, and Spyware Doctor w/ antivirus. Did full scans with both, and changed my PW on a clean laptop of mine. Does this pathway error seem indicative of an infection?

Also, Ive noticed in NIS08 that it constantly sites POL.exe making changes to the Windows Startup. Even on the newly reformatted PC, as well as my laptop? Is this normal? I just can't fathom how I could already be infected on this PC that has gone to like.. google twice. lol

[#686578]

In regards to the POL errors, I have a question. I just reformatted my PC over the weekend and freshly installed Windows Vista, and have since installed/updated FFXI with the use of Windower. last night my POL froze, and then I tried to restart windower, and got an error. it was NOT the "unsupported interface" error, and I had no smart.dll found on my PC. In fact, I think I've only opened my browser like twice on that PC since I reformatted, and have NOT gone to any FFXI sites.

The error said something about a pathway, and I saw it twice. After that, POL froze one more time during the evening. I have Norton Internet Security 2008, and Spyware Doctor w/ antivirus. Did full scans with both, and changed my PW on a clean laptop of mine. Does this pathway error seem indicative of an infection?

Also, Ive noticed in NIS08 that it constantly sites POL.exe making changes to the Windows Startup. Even on the newly reformatted PC, as well as my laptop? Is this normal? I just can't fathom how I could already be infected on this PC that has gone to like.. google twice. lol

A computer can be infected as soon as it's on a network, the only way to be 100% sure you didn't get a virus already was by reformatting/reinstalling and then installing an antivirus before connecting it to a network. I can't think of anything you have specifically but it just sounds like vista's screwing with POL installing correctly.

[Aryea]

I spoke with a friend of mine who is very good with PC's (but unfamiliar with FFXI), and he said those reports on the NIS08 shouldn't worry me too much. I really don't think I could already be infected again, and my two AV programs were among the first things I installed right after getting a fresh install of Win-Vista up and running again.

I was just concerned with the POL error I got after windower Froze, but I also haven't restarted my PC in a few days. Maybe that was simply the cause. The error said nothing about a nonsupported interface.

And to clarify, POL/FFXI are already installed/updated. So the game works just fine. I was actually adding another mule to my account when POL froze, and when I tried to restart, I got the POL error. I saw it only two times (and the only times I've ever seen it, period) last night.

[DancingEdge]

If I updated the flash player, you can't get infected from Somepage, right?

I accidentally clicked somepage, but I already upgraded from the main adobe site.

[cdgreg]

If I updated the flash player, you can't get infected from Somepage, right?

I accidentally clicked somepage, but I already upgraded from the main adobe site.

wouldn't hurt to search your pc for smart.dll anyways

[sparik]

Solution: http://store.apple.com/

Do they sell garbage cans for the overpriced garbage?

Clearly you didn't go to the site, they are right there on the front page, can't miss 'um.

[Jolitili]

Its pretty clear that who ever owns Somepage/Atlas etc is a idiot. SEe should shut these sites down.

I also still cant see how the Keylogger can crack POL encryption for your Login account without you typing it in. Maybe its something to do with the Linkshell community site. I myself don't use that site because i wouldn't feal secure using my POL ID and password even as SE owns it.
When you use that site obviously your browser will store the details within a cookie? Could it easily encrypt that?

[Baylin]

I've just been hacked 45 minutes ago. AVG popped up saying it had found a potentially harmful hack tool which was called A0000400.EXE and within 2 minutes my password had been changed.

I have noscript/spybot/avg all configured to stop this shit but still got hacked. SE changed my password within 5 mins of calling so hopefully not too much damage done

[aurik]

Run HijackThis and post the log.

[Rellikard]

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 5:30:18 PM, on 6/6/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Common Files\InterVideo\DeviceService\DevSvc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Trend Micro\AntiVirus 2007\tavsvc.exe
C:\Program Files\Trend Micro\AntiVirus 2007\Components\tmproxy.exe
C:\Program Files\Trend Micro\AntiVirus 2007\tavui.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\WINDOWS\system32\mdm.exe
C:\Program Files\uTorrent\uTorrent.exe
C:\Program Files\Mozilla Firefox\firefox.exe
E:\Geek Squad\HiJackThis\HiJackThis.exe
C:\WINDOWS\system32\NOTEPAD.EXE

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Int ernet Settings,ProxyOverride = *.local
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Me ... b56907.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/s ... wflash.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762# # (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Capture Device Service - InterVideo Inc. - C:\Program Files\Common Files\InterVideo\DeviceService\DevSvc.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Trend Micro AntiVirus Protection Service (tavsvc) - Trend Micro Inc. - C:\Program Files\Trend Micro\AntiVirus 2007\tavsvc.exe
O23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Inc. - C:\Program Files\Trend Micro\AntiVirus 2007\Components\tmproxy.exe

--
End of file - 4738 bytes

Account stolen yesterday. Been on phone w/ SE for 2hr+. Forgot to update Adobe Flash and clicked on an old post's link from months ago and it linked to somepage.com. I found the smart.dll file, deleted it, creation date was same day as I clicked the somepage.com link(6/3/08).

http://www.ffxiah.com/player.php?id=1259337 Seems to be person that stole all my shit and someone else's.

[UnknownGamer]

I was going to write this:

It's too bad SE never suggests what browser and plugins to use. Everyone remembers Firefox, but that alone does nothing to protect you compared to IE7. It's NoScript doing all the work, and that plugin isn't made for IE7. So we should just give one piece of advice: NoScript with I-Frames option enabled. After failing to load NoScript into IE7, the Firefox part of the advice should come naturally. (However, I'm still trying to find out a good security reason to load AdBlock after having configured NoScript properly.)

Then I read Baylin's post, and I would be very interested in his HJT log to see how he got infected. I wonder the source of that random .exe file. I wonder if his NoScript is set to disable IFrames.

And I'm still going to write this:

That recent Flash attack (smart.dll aka cn91x) reminded me of many things, it carried a very potent payload in its ability to bypass security, no doubt the best I'd seen for FFXI. When SE announced that our accounts were in jeopardy, the way they wrote it hinted that this was not just a keylogger. And in fact this payload could read running process memory and extract both POL login and passwords for your current account... it was written for WoW as well, written from the ground up so that antivirus and malware scans also failed to pick up its signature. People first detected it only through process/browser scanners and careful monitoring of NoScript, I imagine some poor souls could have even whitelisted the misspelled version of playonline.com...

A week later it all seems different. My normal antivirus picks it up right away, the current version of Flash (which was available over 2 months ago, hope you upgraded) is no longer susceptible to the buffer overflow error, and everyone by now has seen SE's warnings. Doesn't mean we're safe at all. If you got hacked, hope you changed some fundamental protocols and from now on devote time to keep abreast of security developments and keeping your machines updated.

I personally surf within a sandbox (Sandboxie, don't have to pay for it), which is less secure than a full VM or separate machine, but a lot more convenient. All it takes is one mistaken whitelist for you to be infected through NoScript. I hate to advise people to entirely avoid certain sites, that is just a temporary solution and a crude inconvenience, so this is my way around it.

[Baylin]

After a long day of trying to get to the bottom of this shit and get my account back (which i did in the end), i decided to format my hard drive. I'm annoyed that i didnt get a HJT log first ><;;

I was infected with Gaelicum.A last week which is a horrible worm. I managed to get it off my main and secondary HD's but after a format AVG found it again on my second HD. Gaelicum attaches itself to .EXE files at a rapid speed and then from this point downloads trojans onto your HD. I ran all the cleaners and thought it was gone, until today when AVG suddenly finds a hack tool and my account gets stolen. Not long after this AVG pops up to tell me that the Gaelicum virus is still on my secondary HD. The location of the gaelicum file was E:/System Volume Information which is the exact same place AVG found the hack tool i posted earlier(but on my C:/ drive). In addition to this it had a similar name "Stringofnumbers.EXE".

After doing a full scan of all my hard drives again i decided to just unplug them and format my main HD again, so i could get back on FF this evening. Not really sure how im going to resolve the possibility of Gaelicum still hiding on my secondary E drive, but i dont plan on putting it back in this computer.


My main worry from all this is how, after removing the virus, it managed to suddenly re-appear again, and produce EXE files in almost identical places as where the hack tool was found. I don't know enough about Gaelicum to make a link, but i pressume that its the reason behind me losing my account

[Tricen]

Can it hide from a search all files and folders? I did that for smart.dll and nothing came up. What other ones should I search for?

[Rellikard]

I got my account back this evening around 7PM. Found person that took all my shit. The stuff he didn't sell on AH, he's selling in Batallia Downs. POL support told me to contact a GM in-game to try their item restore before doing the account recovery(roll-back). I placed a GM call at about 7:10PM, about 7:20PM got an automated GM message stating to get all of my info together for the item restoration and they'd be with me shortly. It's been 4 hours and not one response. I initially sent the GM call with 99 calls ahead of mine then an hour later sent another had 180 ahead of mine then a couple hours later sent another and now it's 260 calls before mine. SE has the worst customer service that I've ever experienced.

[Tricen]

I got my account back this evening around 7PM. Found person that took all my shit. The stuff he didn't sell on AH, he's selling in Batallia Downs. POL support told me to contact a GM in-game to try their item restore before doing the account recovery(roll-back). I placed a GM call at about 7:10PM, about 7:20PM got an automated GM message stating to get all of my info together for the item restoration and they'd be with me shortly. It's been 4 hours and not one response. I initially sent the GM call with 99 calls ahead of mine then an hour later sent another had 180 ahead of mine then a couple hours later sent another and now it's 260 calls before mine. SE has the worst customer service that I've ever experienced.

What's even worse is, they don't care either.

[UnknownGamer]

1)
Gaelicum is major ouch. It spreads like a classic virus, once infected all disks that are connected and not read-only have their exe's infected, possibly their boot records too but I'm not sure. This pollutes exe's in system restore, backup drives, and any disks you insert, maybe even CD-RWs.

So you'll just have to deal with a safe zone consisting of CD-ROMs made before the infection, or made with a computer you're sure is clean. You need a low-level format of your drives that erases the boot record, I sure wouldn't trust formatting in Windows.

If you were infected with Gaelicum, a HJT log would be the last of your worries. HJT is for malware, not that useful against pure viruses. Get two or three different antivirus products to scan your unprotected backup media, better yet re-download every exe from sites you can trust.

2)
I haven't noticed any tamper protection with smart.dll, it's among the easier trojans to remove, the only complication is that once you find it, it's hooked onto Winlogon so you need HJT or regedit to remove the startup entry first, then delete the file on a subsequent restart.

3)
During a "crisis" expect their support lines and GM services to be unusually slow. Right now we're still going through one because last week all sorts of people got hacked and we've had two back-to-back notices from POL. They take a week to investigate and then some to roll back characters.

[Izildur]

well tonight im at vrtra of all places and i get dc'd with someone else logging into my account - i log on - they log - i log - they log ... and each time i log in i get 1 step closer to changing my PW .. LUCKY i was at and on the pc at the time of compromise and changed my PW - then typed my old PW to disable login for some time. and then re logged with new code

Odd thing - I have like 5 account all on different IDs on the pc - and ONLY my main account with the decent gill and gear etc was accessed ... so they are most probably not just blanket covering Logins from any one PC, but targeting certain accounts perhaps ;;

I checked for the file mentioned here and its not on my PC the only thing i found was "internet mal-ware" which i deleted via ad-aware