The sky is falling: player with token hacked? (lolIE)

**Corrderio** · 2009-08-25 02:51

Hmm, starting to look like Ase was right about that Proxy Override line being suspicious.

**S N K** · 2009-08-25 03:18

I would rather SE take the Sonomaa suggestion and ban all of China from the servers. This is really fucking stupid.

**Yugl** · 2009-08-25 03:20

So how would I check for this on my PC? I play on PS3, but frequent Wiki for info, so it's possible for me to have w/e it is and not see the effects.

**Akisu** · 2009-08-25 03:21

It's a paste formatting issue, it displays correctly in my log. My laptop that I "infected" purposefully to test with does not use google toolbar. I did normal format, default install of XP, fully updated it via windows update, installed Java and Flashplayer, then began testing. I'm currently in the process of reformatting the machine again to try to duplicate it.

**Akisu** · 2009-08-25 03:23

Originally Posted by Yugl

So how would I check for this on my PC? I play on PS3, but frequent Wiki for info, so it's possible for me to have w/e it is and not see the effects.

Get a copy of Hijack this, (it's free, google is your friend), and look for the following line in the log:

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Int ernet Settings,ProxyOverride = *.local

This is not a 100% confirmed thing, as we're still trying to figure out what it is, or where it's coming from, but it seems to be a common line in everyone who's been hacked so far.

**Tempyst** · 2009-08-25 03:26

Originally Posted by S N K

I would rather SE take the Sonomaa suggestion and ban all of China from the servers. This is really fucking stupid.

Allowing us to put personal limits on what regions our accounts can be accessed from would be nice too

**Silenka** · 2009-08-25 03:30

Originally Posted by Tempyst

Allowing us to put personal limits on what regions our accounts can be accessed from would be nice too

Yeah but would that really help? For all we know these hackers could be china or canada-based. I know a good bunch of RMT live in California, too. And isn't there a way to make it look like they're interneting from somewhere in the US even if they're situated in China? If they're going so far as to hack around the tokens, I can't see how they wouldn't find a way around that too - it would be just another security measure that may or may not help, and I bet a lot of stupid people would fail at using it, too.

**Eleven19** · 2009-08-25 03:31

I pretty much sit here and troll all over BG while keeping Wiki open for info on my laptop all day long, but I play on PS2.

I just ran Hijack this and I don't have the entry (Though I did have that host something or other line that was highlighted a few posts back and got rid of, thanks for that).

I'm gunna go through wiki a bit and run HT again. Maybe Alla too.

**Yugl** · 2009-08-25 03:36

I only have the line with internet as one word (If I'm doing this right). Not posting the entire log in case there's personal stuff I shouldn't be posting (Someone mentioned this earlier).

**Mistress Stowastiq** · 2009-08-25 04:21

Originally Posted by Yugl

I only have the line with internet as one word (If I'm doing this right). Not posting the entire log in case there's personal stuff I shouldn't be posting (Someone mentioned this earlier).

Sorry about my question regarding that if it confused you. There was a confirmation that the space in the name was just formatting from pasting it here in the forum.

**Sabertiger** · 2009-08-25 04:21

Hmm. I ran a HJT scan on my machine, couldn't find the suspicious line.
I'd say I've been all over wiki the past couple of days, too.
For reference, I'll post my HJT log:

Spoiler: show

Obviously, I use firefox only. IE is installed on this machine, but it's never at any site except microsoft updates. I don't have NoScript in firefox, but I am using AdBlock Plus. I've had it blocking pics (even the top banner on ffxiah.com) so that basically ah.com is ONLY text for me. I can't even view screenshots people posted because it blocks them all. Same on wiki, except I left the top banner on. I did, however, block the side banner ads and bottom banner ads.

Perhaps checking sources on these banner ads on a machine that doesn't have FF installed (or any valuable data stored on it for that matter) would be a good course of action at this point. It's 5am, and I'll be in class the better part of today plus salvage when I get home, but, I'll gladly lend a hand to this issue when time permits.

Best wishes to anyone who got robbed. If you were trying to buy gil, sorry about your shitty luck. If you weren't, I sincerely hope you get everything back. In the meantime, my suggestion is firefox only, adblock plus + noscript, with adblock plus killing most of the non-critical viewing content on wiki and ah.com (that is, banner ads, pictures, etc.).
And, as added protection, I'd suggest Ad-Aware scans (free tool last I checked from lavasoft, google is your friend finding these things), CCleaner, Spybot S&D, and.. that's all I can think of at the moment. Hope that helps people at least avoid this mess.

**Aihree** · 2009-08-25 04:24

I've been doing some digging into this mysterious line ever since finding it on my secondary pc.

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Int ernet Settings,ProxyOverride = local

The interesting thing is that on mine, it showed as Internet Settings (no space between t and e), yet many posts here show it WITH space, and so do google searches, it's not just a formatting thing.

Still, my searches have turned up empty of any threat implied by that line alone. For it to really be a sign of vulnerability it should be accompanied by a second line as well, similar to:

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Int ernet Settings,ProxyServer = 127.0.0.1:8080

The absence of such a line usually means that there is no local proxy process running.

**Mistress Stowastiq** · 2009-08-25 04:33

Originally Posted by Aihree

I've been doing some digging into this mysterious line ever since finding it on my secondary pc.

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Int ernet Settings,ProxyOverride = local

The interesting thing is that on mine, it showed as Internet Settings (no space between t and e), yet many posts here show it WITH space, and so do google searches, it's not just a formatting thing.

Still, my searches have turned up empty of any threat implied by that line alone. For it to really be a sign of vulnerability it should be accompanied by a second line as well, similar to:

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Int ernet Settings,ProxyServer = 127.0.0.1:8080

The absence of such a line usually means that there is no local proxy process running.

Is it possible people are not including the address in their posts of HT logs because it is private info? I am referring to the 127.0.0.1:8080 you posted for example.
As for the space being an actual part of the line vs only occurring because it was pasted and formatting broken: I brought it up because in this thread a couple people mentioned it. I am uncertain why it was ruled out, but since the person knew more about this kind of thing than I do, I accepted it.

**Sabertiger** · 2009-08-25 04:46

After googling the line itself, I'm seeing 2 sets of possible results, one with and one without the spacing in Int ernet (Internet and Int ernet results).
Skimming, it seems the Int ernet line is related to spyware/malware.
See: mywebsearch problem - PC Help Forum

It could still be a formatting issue. Since those logs are posted into forums, and google will just parse the text when performing the search, it's entirely possible we're seeing false-positives for "Int ernet" due to general copy+paste formatting issue.

Although, in lots of instances, spyware/malware will insert something that looks completely normal, until further analyzed. In this case, we have the variance of "Internet" and "Int ernet".

Now, I doubt randomly obtained spyware is now specifically targeting FFXI accounts, but it is highly possibly someone (RMT?) have obtained scripts already written by hackers to infect PCs with malware, and modified it to target FFXI players via community website ad banners.

**Mistress Stowastiq** · 2009-08-25 04:51

Originally Posted by Sabertiger

After googling the line itself, I'm seeing 2 sets of possible results, one with and one without the spacing in Int ernet (Internet and Int ernet results).
Skimming, it seems the Int ernet line is related to spyware/malware.
See: mywebsearch problem - PC Help Forum

Now, I doubt randomly obtained spyware is now specifically targeting FFXI accounts, but it is highly possibly someone (RMT?) have obtained scripts already written by hackers to infect PCs with malware, and modified it to target FFXI players via community website ad banners.

Someone posted that the spacing was not present on their HJT log, only after pasting it into the forums, maybe others with the line can confirm this?

Since I am bored, I will go and do a count of all the HJT logs in this thread and see how many have spacing vs none.

**Akisu** · 2009-08-25 05:00

It's a line break problem when pasting it into the forums, heres a clip of the screenshot from my log, compare it with the break in the text in my previous post.

http://img511.imageshack.us/img511/4595/hjtlog.png

And I fully agree, this could be an older script/exploit adapted to deliver this new FFXI "hack" payload. It's actually pretty common in terms of internet security, they're called "variants", and sending in trojans with custom coded payloads for specific purposes is an old concept.

**Sabertiger** · 2009-08-25 05:01

Since Aihree pretty plainly stated there was no spacing on their log, I'd lean more towards the formatting issue. It wouldn't be the first time something got jerked around while pasting into a forum. I'm also pretty sure someone stated on a recent page that their log also had no spacing.

EDIT: Or not, since Akisu was kind enough to post a screen shot of their log without the spacing.

So, now the question is, if it is a malicious script modified to target FFXI players, where exactly is it? /sigh.

**Mistress Stowastiq** · 2009-08-25 05:14

Thank you Akisu for the pic ruling out the spacing issue

**jammalamma** · 2009-08-25 05:18

So I ran hijackthis and I'm getting the same line as other people but my account hasn't been compromised yet.

In my log there is no space, but you're saying that's just a formatting error due to the forums right?

So pretty much, what should I do at this point? Should I just backup files and reformat? If so, is it ok to copy my POL folder onto my external HDD to just put back after reformatting or should I just do a fresh install?

Also, since I ran hijackthis and saw that line in the log I simply logged off of FF for now, I should be fine until I figure out what to do, right?

Also, how come when I run hijackthis and superantispybot AVG detects them both as generic trojan 14ABVT?

Actually, this may be an opportunity for me to possibly help determine what site(s) are bad if I'm just going to reformat anyway. >_>

**Akisu** · 2009-08-25 05:47

Ready the wall of text!.... Here goes....

I'm 90% sure it's the adverts Wiki has been displaying. I've been checking different ad-banners, and occasionally I'll get broken ad-banners. Blank banners that generate this error: (I've removed the URL to prevent people from clicking randomly, incase it is a tainted script address.)

Spoiler: show

After looking up the code, it's a bug in the script itself, which makes me wonder how a google script manages to break itself. The ad-bars that are in error are WoW banners, which would also make sense because WoW has also been having accounts hacked lately. Perhaps the problem is in this "gamepad" ad-banner type from Google?

Wiki's front page also seems to be spewing other broken script errors, and as far as the code goes, without seeing the backend of the scripts they have set up, I can't really make heads or tails of it. But I do know that any website that throws that many error codes out has some serious problems with their scripts, and you usually see something like this with sloppy, quick code jobs, pre-debug. (Or maybe a quick hack into the scripts to add some kind of exploit, which in turn broke the functionality of the scripts themselves?)

Here's some of the other random errors it's tossing out: (Again, broken all the URLs... just in case... if someone wants to bravely check them as well, toss me a PM, and I can provide you with the full URLs)

Spoiler: show

Again, these errors are generated exclusively on pages that use the google ad banners, from the "gamepad" section of google ad services.

It's very possible that this is just bad coding on Wiki's behalf, but it's also possible someone was screwing around with the script files, I wouldn't be able to tell for sure without server logs, and I doubt we'll ever see those.

I did some looking around in the Wiki's forums, apparently under the support section, users have been reporting getting virus notices from adbanners since late July, the only notice they've looked into it was an "I'll pass it along." post from a moderator. The virus they are citing as being found in ad banners is "Trojan:Win32/FakeXPA". Upon checking the report area of Wikia (Owners of ffxi wiki + many others) there's quite a few notices posted about users having similar issues with tainted adverts.

KI also had a very large posting about them finding the exact same trojan in ad-banners found on wiki, as well as KI itself, and they are also claiming a banner on BG itself was infected, as there was an old post here about it as well. All of that was also posted at the end of July.

Perhaps this is the culprit, but the ad-banners are in a time-delay rotation, so you're only getting them displayed every so often? I'm aware that site owners have no real control over the ad-banners displayed, most are page content sensitive and try to target ads for any key words they manage to pick up. Perhaps google is throwing around some tainted ad-banners, it wouldn't be the first time, that's for sure. Just google "google ads trojan," it seems they've been fending off trojans nested inside "fake" google ads that replace real google ads for a long time. Maybe the RMT community is just jumping on the bandwagon for any gamer-related adverts.

Thread: The sky is falling: player with token hacked? (lolIE)

Thread Tools

Similar Threads

What in the fuck is going on with Ancient Currency prices?

Ok what the hell is up with Roc?

Oldschool players with JP Accounts & The new Expansion

Latest Threads

Up & Coming Threads

Hottest Threads