Malicious attack on BG Forums and how to protect yourself

[ronin sparthos]

The ffxiah didnt say anything about what version flash i have it just said "your flash versions is "

Anyway hope nobody gets hacked from this shit, its happened enough all ready.

DId you tweak noscript so that FFAH.com was allowed? If you didnt, you wont be able to see the version you have.

[Jeny]

[quote=ronin sparthos][quote="? ? ?":2vi553dz]The ffxiah didnt say anything about what version flash i have it just said "your flash versions is "

Anyway hope nobody gets hacked from this shit, its happened enough all ready.[/quote]

DId you tweak noscript so that FFAH.com was allowed? If you didnt, you wont be able to see the version you have.[/quote:2vi553dz]

Just check your version at the official site: [url="http://kb.adobe.com/selfservice/viewContent.do?externalId=tn_15507"]http://kb.adobe.com/selfservice/viewCon ... d=tn_15507[/url]

[Patroklis]

Man, seems dealing with FFXI is getting as bad as dealing with TSA these days. Won't be long before I'm required to take off my shoes to enter the forums methinks. Been keeping myself updated fortunately, for safe and secure lurking.

[? ? ?]

rofl.

will we have random screenings before we are allowed to post as well?

[Corrderio]

start running little man

we found you...

Shall we get the pitchforks, torches, and noose ready?

[Guyverarmor]

There won't be after Sonokitty and co. are done with him...

[Corrderio]

Aww....

...I'm still brining a bat with me though >.>

[Harutaru]

Friend just got hacked about 20 mins ago. He first got booted on Monday, managed to change his Pword before they could. He then changed his password on a new machine and changed it everyday since using the new onscreen keyboard thingy. He did not have smart.dll and still does not, and his Flash Player was updated. No one else has his account info. He used IE7Pro. They also got his friend's old account which he had sole access too. BG and our linkshell forums were the only FFXI related sites he used...anyone able to spread some light on this situation?

[netz]

Friend just got hacked about 20 mins ago. He first got booted on Monday, managed to change his Pword before they could. He then changed his password on a new machine and changed it everyday since using the new onscreen keyboard thingy. He did not have smart.dll and still does not, and his Flash Player was updated. No one else has his account info. He used IE7Pro. They also got his friend's old account which he had sole access too. BG and our linkshell forums were the only FFXI related sites he used...anyone able to spread some light on this situation?

Maybe it's no longer named smart.dll.

Direct him to the usual suspects for seeing what modules attach themselves to running programs: Process Explorer and HiJackThis.

To use process explorer, he should probably open it up and then open up PlayOnline, and then right click on the pol.exe listing and select Properties. It'll look something like this once he clicks on the Threads tab: http://www.zten.org/img/procexp.png.

Note anything unusual in both the threads attached to POL (I believe smart.dll traditionally appears here), and any processes running on the system that seem out of place. It might be necessary to check other processes for out-of-place attachments, since a keylogger could lodge itself anywhere.

Do the same for HiJackThis, but it's a bit more straightforward.

[Katlan]

Maybe it's no longer named smart.dll.

Direct him to the usual suspects for seeing what modules attach themselves to running programs: Process Explorer and HiJackThis.

To use process explorer, he should probably open it up and then open up PlayOnline, and then right click on the pol.exe listing and select Properties. It'll look something like this once he clicks on the Threads tab: http://www.zten.org/img/procexp.png.

Note anything unusual in both the threads attached to POL (I believe smart.dll traditionally appears here), and any processes running on the system that seem out of place. It might be necessary to check other processes for out-of-place attachments, since a keylogger could lodge itself anywhere.

Do the same for HiJackThis, but it's a bit more straightforward.

I have a security-question kinda related to this... I got a new comp about 3 weeks ago and was told to not have multiple anti-virus/spyware programs on it since that drastically slows down your computer. So... right now I'm only use Trend Internet Security Pro, but I wanted to get the free AVG anti-spyware program w/scans your comp for only spyware (and I don't think it runs as an anti-virus program). But my question is.... If I DL and install AVG anti-spyware scanner (w/doesn't auto update itself & only scans when I ask it to) will that slow down my comp since i already have Trend?

I am just curious because I ran McAfee and AVG on my old cpm and don't want to on my new one if it's gonna slow everything down due to two programs performing the same functions.

[Deband]

Note anything unusual in both the threads attached to POL (I believe smart.dll traditionally appears here), and any processes running on the system that seem out of place. It might be necessary to check other processes for out-of-place attachments, since a keylogger could lodge itself anywhere.

Do the same for HiJackThis, but it's a bit more straightforward.

Any idea what should be there under pol? Or should it just be 1 line in top part of your Hijackthis scan?

[Arkanna]

I have a security-question kinda related to this... I got a new comp about 3 weeks ago and was told to not have multiple anti-virus/spyware programs on it since that drastically slows down your computer. So... right now I'm only use Trend Internet Security Pro, but I wanted to get the free AVG anti-spyware program w/scans your comp for only spyware (and I don't think it runs as an anti-virus program). But my question is.... If I DL and install AVG anti-spyware scanner (w/doesn't auto update itself & only scans when I ask it to) will that slow down my comp since i already have Trend?

I am just curious because I ran McAfee and AVG on my old cpm and don't want to on my new one if it's gonna slow everything down due to two programs performing the same functions.

You should not run multiple anti-virus apps on the same machine, no. But you -can- run multiple anti-spyware apps without issue.

AVG no longer offers the stand-alone Anti-Spyware app it previous did; instead, the version 8 of their AVG Free Anti-Virus includes the functionality both the older version of AVG Free and the Anti-Spyware app. AVG Free v8 is a great utility; I'd run it if I was you and get rid of the virus scanner you use now. Couple that with the immunization feature of Spybot S&D (which makes modifications to your HOSTS files and your browser's setting to block bad sites) and you're pretty well covered.

[brisk]

Note anything unusual in both the threads attached to POL (I believe smart.dll traditionally appears here), and any processes running on the system that seem out of place. It might be necessary to check other processes for out-of-place attachments, since a keylogger could lodge itself anywhere.

Do the same for HiJackThis, but it's a bit more straightforward.

Any idea what should be there under pol? Or should it just be 1 line in top part of your Hijackthis scan?

What like some idea also on what should be under POL. Kernal.(whatever) look suspicous to me.

[Kiyuan98]

I was at work earlier today (4:30PM ish EST), and noticed this thread (along with all the shit thats been happening today). And came across this on my work laptop, so I thought I'd print screen it since I noticed noone has mentioned this noscript yet (only the one that was at the top of the site earlier). Does anyone know what this is/was? I'm at home now on my sister's PC and its not showing up anymore? I'm guessing sono fixed it or something. Either way this shit is getting annoying.

• http://img68.imageshack.us/img68/7500/atworkpr8.jpg

[Katlan]

You should not run multiple anti-virus apps on the same machine, no. But you -can- run multiple anti-spyware apps without issue.

AVG no longer offers the stand-alone Anti-Spyware app it previous did; instead, the version 8 of their AVG Free Anti-Virus includes the functionality both the older version of AVG Free and the Anti-Spyware app. AVG Free v8 is a great utility; I'd run it if I was you and get rid of the virus scanner you use now. Couple that with the immunization feature of Spybot S&D (which makes modifications to your HOSTS files and your browser's setting to block bad sites) and you're pretty well covered.

Thank you! Much appreciated

edit: When I reloaded the page moments ago I got a "error message 500: what are you doing here" maint msg w/ "LOL Happy Cat Pirates" dance & theme song. At the bottom of the page it said "lolmaintenancestfu" in small old-school spoilers style. Is this a normal BG forum maint msg...? lol

[Fodder]

I just got this when I tried browse the forum.

Edit: It was a flash file, started with "Do what you want" or someshit then the bloody cats started flying around. I was half paying attention at first then hit print screen and closed my browser and tried to hit the url again and it went to the forum. I think you may have missed something in the cleanup Sonomaa, that or more shenaniggans are afoot.

[Ashira]

I just got this when I tried browse the forum

yeah, so did we all, just an error page, some pages weren't linking proper.


Also, for everyone asking 'am i up to date blah blah' - http://filehippo.com

The site is great, checks all your free installed software for latest versions, etc, including betas if you choose the option.

[Thevaultdweller]

I just got this when I tried browse the forum.

Edit: It was a flash file, started with "Do what you want" or someshit then the bloody cats started flying around. I was half paying attention at first then hit print screen and closed my browser and tried to hit the url again and it went to the forum. I think you may have missed something in the cleanup Sonomaa, that or more shenaniggans are afoot.

Just like it says...zomgmaintenancestfu

[Kiyuan98]

I just got this when I tried browse the forum.

Edit: It was a flash file, started with "Do what you want" or someshit then the bloody cats started flying around. I was half paying attention at first then hit print screen and closed my browser and tried to hit the url again and it went to the forum. I think you may have missed something in the cleanup Sonomaa, that or more shenaniggans are afoot.

Just like it says...zomgmaintenancestfu

...woosh?

[Guyverarmor]

Ashira...your sig scares me ._. my nephew watches that show all the time!