The sky is falling: player with token hacked? (lolIE)

**Sabertiger** · 2009-08-25 05:54

Ahh, I've seen a lot of gamepad ads blocked on ah.com. I've been sitting here stepping through those, unblocking, scanning, refreshing, source checking, repeat for each. With the time delayed rotation, it's rather annoying to thoroughly analyze one page.

I've yet to set my cross-hairs over on wiki, but I'll check out the links if you would PM them over. I'll be back in a bit, breakfast time and going to reboot anyway!

In response to jamma's post, if you've found this on your PC and logged out, you should be ok.
If you can get a friend to keep an eye out for your character being online, that would be a plus.
Also, HJT can access the registry on your machine, so chances are, AVG throws a flag on it because it can modify the registry. As for superantispybot, no idea, never used it. I've had HJT on my machine for years, I can assure you that it is not a trojan.
As for formatting and reinstalling, that's probably the easier option if you don't have a ton of programs etc. on your PC. Yes, you should be able to copy FF to an external HDD, format, reinstall OS, reinstall FF, then copy the updated files from the external HDD back in. Just don't make the mistake I made once and try to copy them back BEFORE reinstalling the expansions. Opps.

**Akisu** · 2009-08-25 05:56

Originally Posted by jammalamma

So I ran hijackthis and I'm getting the same line as other people but my account hasn't been compromised yet.

In my log there is no space, but you're saying that's just a formatting error due to the forums right?

So pretty much, what should I do at this point? Should I just backup files and reformat? If so, is it ok to copy my POL folder onto my external HDD to just put back after reformatting or should I just do a fresh install?

Also, since I ran hijackthis and saw that line in the log I simply logged off of FF for now, I should be fine until I figure out what to do, right?

Also, how come when I run hijackthis and superantispybot AVG detects them both as generic trojan 14ABVT?

Actually, this may be an opportunity for me to possibly help determine what site(s) are bad if I'm just going to reformat anyway. >_>

If you suspect you've been hacked, the best course of action (in my opinion...) is to backup your user folder for FFXI, and any other important files to you, then reformat, and do a new install of playonline/ffxi. The "hack" that's happening to some people is an injection into playonline's executable, so if you back that up, you'll just bring the hacked executable with you to your fresh install.

As far as using HijackThis, did you get it strait from TrendMicro? It's a free download and not infected, as TrendMicro themselves are an anti-virus company.

I've never heard of superantispybot. It sounds like a knock off of Spybot-S&D developed by Safer Networking. Again, where did you download it from? lol.

Assuming both of them were downloaded from the actual websites, it could be a false-positive. Avast Antivirus > AVG in terms of free antivirus software, by far, going off of actual detection rates.

**Kimiko** · 2009-08-25 05:57

Ok, not sure if this may be related to the recent hacking news, but this started popping up this morning on both PetFoodAlpha's site (unreachable atm), and on the TTTO website.

http://www.bluegartr.com/forum/attac...1&d=1251197847

**The Stig** · 2009-08-25 05:58

For the hammering on:

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Int ernet Settings,ProxyOverride = local

If you're paranoid you can go to Internet Options > Connections Tab and click on "LAN Settings" to see.

If you tick "use a proxy server..." and then click on Advanced you will see a box where it says "Exceptions".

If you leave it blank, then it will have "local" (or <local>) or something to that variant. If you put anything in the box (a list of addresses) it will end with <local> or local regardless in your Registry or HJ Log.

This box is just for people who use a proxy server but will to bypass the proxy for whatever purpose (usually internal websites like intranets or other application based site that's internal).

**Destinye** · 2009-08-25 06:05

Banning all of china is an extreme when if the article posted is correct, wasn't even something the chinese made but russian made that was being sold off to other cyberhackers, which can include Amercian groups. What if it's an American doing it? SE should ban all of America too right?

It's not unlikely that there could be non chinese doing it and just passing themselves off as RMT, hackers and etc aren't completely stupid and will try to hide behind anything possible and since people are willing to buy characters/gear/gil for ridiculous amounts of money..it would attract anyone..if they play FF/WoW or not, if you can make literally thousands on virtual shit, you'll do it..chinese or not. IIRC major RMT operations like IGE is American based, while they may have chinese farmers they're technically an American company.

As for PS2/PS3/360 users being hacked, if it's what's been posted before, it's definitely that suspicious line in everyone's hijack this log, because I don't think there's been any other major vulnerabilities in the PSN/Live networks lately.

**Corrderio** · 2009-08-25 06:21

Kimiko... that's pretty odd. It does look like the RMT are at new tricks.

**Akisu** · 2009-08-25 06:27

Originally Posted by TheStig

For the hammering on:

If you're paranoid you can go to Internet Options > Connections Tab and click on "LAN Settings" to see.

If you tick "use a proxy server..." and then click on Advanced you will see a box where it says "Exceptions".

If you leave it blank, then it will have "local" (or <local>) or something to that variant. If you put anything in the box (a list of addresses) it will end with <local> or local regardless in your Registry or HJ Log.

This box is just for people who use a proxy server but will to bypass the proxy for whatever purpose (usually internal websites like intranets or other application based site that's internal).

The issue is that the line of code is being created in the registry without user intervention of any kind; and by default does not exist in the registry, and it seems to be a common denominator in people who are "infected" versus those who aren't.

**Shaard** · 2009-08-25 06:29

Originally Posted by Kimiko

Ok, not sure if this may be related to the recent hacking news, but this started popping up this morning on both PetFoodAlpha's site (unreachable atm), and on the TTTO website.

http://www.bluegartr.com/forum/attac...1&d=1251197847

Isn't that just some .htaccess authentication?

**Fridell** · 2009-08-25 06:30

Can we have some TL;DR sum up at some point, shit loads of info that can be somewhat hard to follow, that would be great thanks.

**Mistress Stowastiq** · 2009-08-25 06:37

Is that just Ganiman's site or something?

**Kimiko** · 2009-08-25 06:38

Originally Posted by Shaard

Isn't that just some .htaccess authentication?

I would think so, but it also came up on TTTO as well. Told Wyred bout it, he removed the PFA ad on the site which cleared up the issue there. Also, what would Ganiman have to do with the PFA site?

**Corrderio** · 2009-08-25 06:39

Originally Posted by Fridell

Can we have some TL;DR sum up at some point, shit loads of info that can be somewhat hard to follow, that would be great thanks.

As much as I wish we could we still don't know exactly what's happening. Ase noticed there was a Proxy Override line in people's highjack this logs who were hacked opposed to those who weren't. The issue is that line comes up when you have some proxxy option checked in IE. What I want to know is if the virus checks this box if it's currently off and that's where the exploit is.

EDIT: Starting here is where that Proxy Override thought started: http://www.bluegartr.com/forum/80487...ml#post3015536

**Destinye** · 2009-08-25 06:40

Originally Posted by Kimiko

I would think so, but it also came up on TTTO as well. Told Wyred bout it, he removed the PFA ad on the site which cleared up the issue there. Also, what would Ganiman have to do with the PFA site?

Considering this is a supposed RMT attack, has Ganiman ever been linked to RMT related issues before?

**Akisu** · 2009-08-25 06:43

Originally Posted by Fridell

Can we have some TL;DR sum up at some point, shit loads of info that can be somewhat hard to follow, that would be great thanks.

In summary:

People are getting their accounts hacked again, similar to how it was happening before, except it also includes people with tokens using Firefox+noscript/etc.

We've been trying to figure out where/how/why/etc.

Likely suspects seem to include the ever popular Flash ad-bars displayed everywhere.

People are taking note of a common line of code in the registry between users who are infected/been hacked:
"R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Int ernet Settings,ProxyOverride = *.local"

I made a long winded post about some scripts looking odd on the wiki's site, then you asked for a summary.

/End Summary.

**Nymphadora** · 2009-08-25 06:46

There's no space in 'internet' in my log either.

Also, a friend of mine noticed this similarity in the hjt logs in this thread that were from definate hackings or attempts:

O1 - Hosts: ::1 localhost

Not sure if that's anything important. According to her, it seemed to be in the infected logs but wasn't present in clean logs. Might be an extension of what's going on with the proxy override line just above it?

And I can definately rule out ffxiah or whatnot. Only been to bg, wiki, windower, and a couple of smaller ls-specific forums before picking this up on sunday. Pretty sure it's not the windower site as that doesnt seem to be a common link between hacked players. Gotta be either BG or wiki. And if it's coming from gaming related banners, it could be both, although tbh I have my firefox addons blocking the banner ads.

**Mistress Stowastiq** · 2009-08-25 06:46

Originally Posted by Kimiko

I would think so, but it also came up on TTTO as well. Told Wyred bout it, he removed the PFA ad on the site which cleared up the issue there. Also, what would Ganiman have to do with the PFA site?

I do not know what kind of access Gani shares with Pfa but he is fairly easy to contact by posting in the wiki forum section related to wikipedia editing. There is also the irc. If I actually knew what to notify them of I could contact them. Perhaps some one could pm Steak(sp) here on bg to let him know about the issue or ask about it.

**Fridell** · 2009-08-25 06:48

Thanks for summary. Much appreciated.

**Kaces** · 2009-08-25 06:51

Spoiler: show

nothing seems to be out of place but this is my machine and it has that proxy line as well ;o

i run 1 tokened account + 2 untokened mules with quite a few valuables but they don't seem to be missing anything, nor does my machine seem unstable as when mafai's friend had it happening. nothing's happened to any of my accounts, as of yet anyway.

got a few errands to run this morning, so i'll be back to run some tests per rootkit/process injection.

if anyone's on, can they check what their filesizes are for these files.

Size(Not Size on disk):

pol.exe 1.52MB (1,600,000 bytes)
polboot.exe 56.0 KB (57,344 bytes)

**Akisu** · 2009-08-25 06:54

Originally Posted by Destinye

Considering this is a supposed RMT attack, has Ganiman ever been linked to RMT related issues before?

You could if you grasp a bit, atleast from my knowledge, as ffxiclopedia was one of the main sources from the previous hack wave of flash exploited ad-banners. Then again, ffxiclopedia was sold to wikia I believe, so that would be on Wikia's head, I don't know the timeline.

Anyone know? lol.

Originally Posted by Nymphadora

There's no space in 'internet' in my log either.

Also, a friend of mine noticed this similarity in the hjt logs in this thread that were from definate hackings or attempts:

O1 - Hosts: ::1 localhost

Not sure if that's anything important. According to her, it seemed to be in the infected logs but wasn't present in clean logs. Might be an extension of what's going on with the proxy override line just above it?

And I can definately rule out ffxiah or whatnot. Only been to bg, wiki, windower, and a couple of smaller ls-specific forums before picking this up on sunday. Pretty sure it's not the windower site as that doesnt seem to be a common link between hacked players. Gotta be either BG or wiki. And if it's coming from gaming related banners, it could be both, although tbh I have my firefox addons blocking the banner ads.

I'm fairly sure that the spacing between what people were pasting from their logs was just a copy/paste problem, not actually there in everyone's logs.

Also, a post on ffxiclopedia's forums mentioned that windower's site, FFOChat, and eorzeapedia were all down yesterday around 11:00pm-11:30pm, but don't take my word for that, just quoting what I'm reading off of ffxiclopedia's forums at the moment. They were all displaying a "general error" message that was citing issues connecting to the database, which is "a problem with shared hosting." However, I don't believe they are all hosted from the same place.... ?

**Nymphadora** · 2009-08-25 06:56

Originally Posted by Corrderio

As much as I wish we could we still don't know exactly what's happening. Ase noticed there was a Proxy Override line in people's highjack this logs who were hacked opposed to those who weren't. The issue is that line comes up when you have some proxxy option checked in IE. What I want to know is if the virus checks this box if it's currently off and that's where the exploit is.

EDIT: Starting here is where that Proxy Override thought started: http://www.bluegartr.com/forum/80487...ml#post3015536

Problem here is that I don't have any proxy options checked. Box left unchecked, no proxy address specified and all of those options are left grayed out on my infected machine. [edit, just noticed you were talking about IE. Not sure if it would be the same in firefox though?]

Originally Posted by Akisu

You could if you grasp a bit, atleast from my knowledge, as ffxiclopedia was one of the main sources from the previous hack wave of flash exploited ad-banners. Then again, ffxiclopedia was sold to wikia I believe, so that would be on Wikia's head, I don't know the timeline.

Anyone know? lol.

I'm fairly sure that the spacing between what people were pasting from their logs was just a copy/paste problem, not actually there in everyone's logs.

Also, a post on ffxiclopedia's forums mentioned that windower's site, FFOChat, and eorzeapedia were all down yesterday around 11:00pm-11:30pm, but don't take my word for that, just quoting what I'm reading off of ffxiclopedia's forums at the moment. They were all displaying a "general error" message that was citing issues connecting to the database, which is "a problem with shared hosting." However, I don't believe they are all hosted from the same place.... ?

Didn't know anything about that. Could possibly sound suspicious if so. I was only on windower's site Sunday evening and a lot of the others infected didn't seem to have that in common. Although if it's the banner ads, they could be popping up everywhere.

And no, don't think those sites are hosted from the same place to my knowledge. Eorzeapedia is an extension of ffxiclopedia aimed at ff14. Don't think windower or the chat are at all connected. Someone could probably check into it?

Thread: The sky is falling: player with token hacked? (lolIE)

Thread Tools

Similar Threads

What in the fuck is going on with Ancient Currency prices?

Ok what the hell is up with Roc?

Oldschool players with JP Accounts & The new Expansion

Latest Threads

Up & Coming Threads

Hottest Threads