New virus: FFXIAtlas infected again

**Sonomaa** · 2008-08-26 21:34

Kuuhalee for your awesome powers of awesomeability, you are granted a custom title of your choosing. Let me know here or send me a PM and it shall be done.

**Kuuhalee** · 2008-08-27 02:08

A few quick corrections :

• I mistakenly tagged tcpip.sys as altered or infected by this trojan but after further testing this does not seem to be the case. I have changed my original post to reflect this new information.

• The DLL, SYS, KEY and INI file names are all randomly generated when the trojan is installed and therefore those who have visited the affected website(s) recently and followed my previous detection instructions may want to perform a quick re-check.

• I have provided instructions on how to try and detect the trojan on my original post :

http://www.bluegartr.com/forum/showp...6&postcount=30

Sorry for the mistakes.

**Miraun** · 2008-08-27 09:01

Kuuhalee's posts should be compiled and exported into a short mysteryblog.

**Gulkeeva** · 2008-08-27 09:14

Originally Posted by Deimos

How do these sites keep ending up with this stuff on them?

Is it always because they run advertisements that they're not in control of, or are their actual servers getting compromised?

Well most advertisements are just from small companies trying to make money, so they use cheap non secure servers (a lot just do it from their home PC).

So an easy avenue to infect a website is through someones advertisements onto a webpage, usually its easier then trying to go through a webhosting company that (most I hope) spend time fixing possible exploits to their servers.

Then theirs always the "outdated" website, and of course the 0-day sites you can lookup exploits for newer stuff, or someone angry enough to figure a way to do something to a website.

Of course the best defense is usually information, less they can find out about you (website), the less chance they can do something to you

**Qbertian** · 2008-08-27 10:10

Nasa has confirmed that laptops carried to the ISS in July were infected with a virus known as Gammima.AG.

The worm was first detected on earth in August 2007 and lurks on infected machines waiting to steal login names for popular online games.

They'll even steal your info in space.

**Gwynplaine** · 2008-08-27 10:23

Originally Posted by elphaba

... Yeah, I should get on that...... *slurks into the photoshop depths*

~

Seriously, I at one point had all the maps, but a lot of them were doubled, so I needed to rename them. I'll go ahead and start working on it again.. i need something to look busy

Also, is it on every page of ffxi atlas or just the front? i never go to the front page of either of them, i have sacrarium bookmarked and just know the shortcuts, or the item search on somepage.

also, Kua, you are awesome and a cat to boot. Even better.

edit: the map pack / zip file i have is up to the end of 2007.. i believe this is the list that i have for it.. around 600 maps, give or take.

Spoiler: show

You might not want to reference those for some areas. They are slow as hell and only relatively recently updated to show some newer things.

**Kayos** · 2008-08-27 11:31

Apparently gil sellers have set their sights higher now!

http://www.switched.com/2008/08/27/c...space-station/

My favorite part lol:

Originally Posted by

The virus is Gammima.AG and is the type that runs in the background and steals usernames and passwords, with the hopes of hijacking people's accounts to a variety of popular Asian online games.

**Gwynplaine** · 2008-08-27 11:53

Originally Posted by elphaba

Slow as hell? o.O

I'm saying all I'm doing atm is going through the map pack (they're not labelled with what is actually what) and then renaming everything. if Wiki doesn't have a map that I do, i'll upload it and link it.

Sorry, I meant that Atlas is slow keeping their maps up to date. Not your files lol. Implying the ones from 07 could be missing current info.

**jurjur** · 2008-08-27 15:53

Originally Posted by Kayos

Apparently gil sellers have set their sights higher now!

http://www.switched.com/2008/08/27/c...space-station/

My favorite part lol:

i lol'd

**Tarage** · 2008-08-27 21:29

Wow... I did not know they played MMOs in space. Man, what an addicting genre.

'I CAN'T DO A SPACE WALK NOW, I HAVE TO GO ON A RAID!'

**Amele** · 2008-08-27 22:29

Originally Posted by Tarage

Wow... I did not know they played MMOs in space. Man, what an addicting genre.

'I CAN'T DO A SPACE WALK NOW, I HAVE TO GO ON A RAID!'

the ISS is actually probably pretty boring most of the time.

**Qbertian** · 2008-08-29 00:10

Originally Posted by Kayos

Apparently gil sellers have set their sights higher now!

http://www.switched.com/2008/08/27/c...space-station/

My favorite part lol:

I feel like there's been a glitch in the Matrix...

You even bolded the same line, lol.

**gairaiden** · 2008-08-29 07:39

anyone know if atlas is still virused or if it ever got fixed yet.

(or better yet can someone recommend somewhere else to find the maps when i need them that's not got a virus aim'd at hacking accounts)

**Semitry** · 2008-08-29 10:06

Originally Posted by gairaiden

anyone know if atlas is still virused or if it ever got fixed yet.

(or better yet can someone recommend somewhere else to find the maps when i need them that's not got a virus aim'd at hacking accounts)

It's been fixed, 5 hours after. My fault for not keeping all software up to date consistently.

You should be using firefox + noscript while browsing anyways to visit any FF related site since most have been hacked at one point or another.

**Anadosia** · 2009-07-09 15:28

I know this is an old link but it's the only one I see from their site as a way to let the admins know. Atlas needs a "contact us" link on their page so we can tell them immediately of any viruses.
As of 7/8/09 my virus scanner picked up the following: (changed some of it so it cannot be clicked on)
ffxi-atlas.cozzz/javascript/regionlist.js
HTML: Script-inf Virus/Worm

**Semitry** · 2009-07-09 17:15

Originally Posted by Anadosia

I know this is an old link but it's the only one I see from their site as a way to let the admins know. Atlas needs a "contact us" link on their page so we can tell them immediately of any viruses.
As of 7/8/09 my virus scanner picked up the following: (changed some of it so it cannot be clicked on)
ffxi-atlas.cozzz/javascript/regionlist.js
HTML: Script-inf Virus/Worm

Thanks, removed. I'll let the admin know about a contact us area.

Thread: New virus: FFXIAtlas infected again

Thread Tools

Similar Threads

New Password Stealing Virus

Latest Threads

Up & Coming Threads

Hottest Threads