New virus: FFXIAtlas infected again

[Meat]

i think this just got me

[Shuemue]

i think this just got me

trying not to laugh

[Meat]

have a laugh, fuck all if i care, i've got my account locked I'll get back in 2 weeks

[Rivieras]

People are lazy and don't want to have to use two resources. Spoon-feed me, please.

As far as it goes for where to get all of the items you need.

FFXIAH is actually perfect when it comes to the jumping off point. As a crafter, I'm always looking at the recipes, gear, stats etc., trying to decide what to craft next.

I've found that as long as you are able to click a little "FFXI Wiki" button under the description it at least sends you to a secondary point. Now, I know many people will QQ over the lack of options of sites that it sends you, but at least it gives you the ability to do more research.

While it's not as convenient as having it read to you while you sleep so you can absorb it, it's something. I personally haven't been back to somepage in a very longtime, once a site is exploited I'd rather find something else. My accounts just aren't worth the "convenience" of having an "All-In-One" because that will be the next target anyway.

Convenience can lead to laziness which will lead to someone wanting to exploit the lazy bastards. And while FFXIAH has become a target, it's at least active enough that those running it take enough care to ensure it remains clean, or clean-ish.

And if by this point you aren't running NoScript; then you are looking to get jacked.

[Shuemue]

I probably wouldn't have been so amused pre-rollback policy, I don't dislike you that much, but knowing you'll get it all back, I snigger at you being inconvenienced.

[Avarice]

So since I'm on a computer that's not related in anyway to where I play FFXI (College Computer lab, lol) I checked out some of these pages and, you know, I'm not a big computer nerd guy thingie yet but what does "OK.NO. -> 1" mean or have to do with anything? I checked the page source but that text was all that was listed. (Again, I'm not one who understands how this shit works.)

[Destinye]

I just heard about FFXIAtlas yesterday..good thing I didn't get a chance to visit it.

I do have a question though, isn't

c:\windows\system32\tcpip.sys

and

c:\windows\system32\tcpip6.sys

Legit? I had these for awhile (Created Aug 4th 2004/modified june 20 2008..)

I'm not computer savy..but they're located in the drivers folder..so does this thing infect them or create them

[Kuuhalee]

I just heard about FFXIAtlas yesterday..good thing I didn't get a chance to visit it.

I do have a question though, isn't

c:\windows\system32\tcpip.sys

and

c:\windows\system32\tcpip6.sys

Legit? I had these for awhile (Created Aug 4th 2004/modified june 20 2008..)

I'm not computer savy..but they're located in the drivers folder..so does this thing infect them or create them

This trojan will alter and/or infect tcpip.sys. The file tcpip.sys was signed by Microsoft and was verified as such by AutoRuns (www.sysinternals.com) before infection. After infection the signature on tcpip.sys could no longer be verified to Microsoft and therefore was altered and/or infected.

If you cannot find any of the other files listed in my post before, chances are good that you have not been infected.

[Raji]

Ok, so I've been to FFXIAtlas a few times recently (the last one being yesterday morning EST), I had NoScript, Flashblock, and AdBlock going at the time (all set up to block IFrames, even on trusted sites, and everything else covered in Aikar's posts); repeated full scans with AVG and AdAware haven't turned up anything, and manual searches for the files in Kuuhalee's posts were similarly unproductive (running tcpip.sys through virustotal.com's scanner turned up nothing as well).

That in mind, is it safe for me to breathe a sigh of relief and log in on my PC (having already changed my password from my PS2), or should I nuke the hard drive from orbit?

Apologies for the noob/clueless end-user post

[Destinye]

Oh..ok. Well thanks for the info!

Yeah these were the only files found.

[ringthree]

I probably wouldn't have been so amused pre-rollback policy, I don't dislike you that much, but knowing you'll get it all back, I snigger at you being inconvenienced.

Man, I better not get hacked then! You would have a field day. LOL

[Mizango]

Man, I better not get hacked then! You would have a field day. LOL

A lot of people would actually.

[ringthree]

A lot of people would actually.

Meh, most of you don't matter.

[Tubbers]

Ok, so I've been to FFXIAtlas a few times recently (the last one being yesterday morning EST), I had NoScript, Flashblock, and AdBlock going at the time (all set up to block IFrames, even on trusted sites, and everything else covered in Aikar's posts); repeated full scans with AVG and AdAware haven't turned up anything, and manual searches for the files in Kuuhalee's posts were similarly unproductive (running tcpip.sys through virustotal.com's scanner turned up nothing as well).

That in mind, is it safe for me to breathe a sigh of relief and log in on my PC (having already changed my password from my PS2), or should I nuke the hard drive from orbit?

Apologies for the noob/clueless end-user post

Search your computer for the files specified in this thread that Kuuhalee posted.

[Mizango]

Meh, most of you don't matter.

It's ok most of us feel the same about you. Glad we can agree on something. <3

[Raji]

Search your computer for the files specified in this thread that Kuuhalee posted.

I meant to say that that's exactly what I already did prior to making my earlier post, and nothing turned up

[Shuemue]

Man, I better not get hacked then! You would have a field day. LOL

While you're undoubtedly a fucking idiot, why would I particularly care about you?

Over-inflated sense of self-worth much?

[Kuuhalee]

I meant to say that that's exactly what I already did prior to making my earlier post, and nothing turned up

You should be fine then. If you still want to be absolutely sure, then I would advise you to download AutoRuns (http://technet.microsoft.com/en-us/s.../bb963902.aspx). When you initially run the program, it will begin a scan. Tap the Escape button once and it will cancel the scan. Make sure that 'Verify Code Signatures' and 'Hide Signed Microsoft Entries' are selected in the 'Options' menu of the program, then execute another scan by clicking on the Refresh icon. If you find any of the items in the image below that are selected in the red, you are infected.

http://www.moofah.com/temp/media/ima...fxi-trojan.jpg

Please be aware that this image was taken from a clean installation of Windows XP. Your results will most likely vary from the image above. Simply verify that the files highlighted in red are not on your system.

[Raji]

Yup, that did it, none of those files showed up at all. Thanks for the link, and for saving me a huge amount of time and worry ^^

[ringthree]

While you're undoubtedly a fucking idiot, why would I particularly care about you?

Over-inflated sense of self-worth much?

Your post belies your comment. *huggles*

On topic: Amele do you have a decent blank map pack, I am missing more maps than I hoped.