The sky is falling: player with token hacked? (lolIE)

**Spekkio** · 2009-08-25 10:47

the odds against 2 different attacks with very different MOs spawning in the wild within such a narrow band of time is unlikely. without sustained claims of recovering from redballs under RMT control, i'm going to write it off as questionable at least until more material comes out. still, mafai's analysis of it being perfect timing can't hold for the posted scenario as iirc, the poster claimed the member was still in party at the time of being under RMT control.

**Mafai** · 2009-08-25 10:49

Originally Posted by Spekkio

the poster claimed the member was still in party at the time of being under RMT control.

oh i missed that....wtf

**Spekkio** · 2009-08-25 10:49

Originally Posted by Kailani

I have sat there for two hours this morning trying to get my Laptop infected using Firefox and IE8 taking different Hijackthis logs after trying something different with the Laptop to see if I could get something to load onto the PC. The only thing I have not tried to do it with so far is Java installed. I will install Java and give it a go on the Wiki site. Everytime I refreshed the page on the Wiki site I would get the old error message regarding Java not being installed. Going to run an online Virus scan right now and see if it pulls anything up as Norton has not complained yet.

you're getting a java error on the wiki site? since when did the wiki site rely on java for anything? maybe some jscript stuff for the clock on the frontpage, but java? hmmm...

**Kailani** · 2009-08-25 10:56

Originally Posted by Spekkio

you're getting a java error on the wiki site? since when did the wiki site rely on java for anything? maybe some jscript stuff for the clock on the frontpage, but java? hmmm...

Before I start a riot it should be noted that this laptop is quite screwed in many ways but it was clean up until today. It could simply be the clock that is on there that is causing the error as I do not have Java installed.

By clean I mean scanned for Rootkits before I started trying to ruin it and checked regulalry for Virii and always browsed with Firefox, Ad Block and No Script configured correctly.

Edit for clatification. The Vana'diel Clock that I believe is on the Wiki web page.

**Mafai** · 2009-08-25 10:59

Originally Posted by Kailani

Before I start a riot it should be noted that this laptop is quite screwed in many ways but it was clean up until today. It could simply be the clock that is on there that is causing the error as I do not have Java installed.

By clean I mean scanned for Rootkits before I started trying to ruin it and checked regulalry for Virii and always browsed with Firefox, Ad Block and No Script configured correctly.

Are you trying to get infected and using a scan to detect it? Maybe someone can experiment with trial POL ID / PWs on a clean laptop/desktop.

I'm stuck at work so this isnt possible for me to do, maybe I can tonight if no one else does (and PS3 slims arent released today).

I'm pretty sure this is undetected atm, so spamming refresh and scans might not show anything.

**Riki** · 2009-08-25 11:08

I really have no clue now if POL just crashed on me (which never happened before in years) or if there is something fishy going on.
When i log back into POL and enter wrong password and onetime password i just get the normal error message that either of those was entered wrong, but POL doesen't crash on me again.
What happened before was that i logged on normally and was already in game for about 10 minutes. Suddenly the game crashes on me without warning and i get an error message regarding POL.

my hijacktis log looks like this:

Spoiler: show

**Kailani** · 2009-08-25 11:15

Originally Posted by Mafai

Are you trying to get infected and using a scan to detect it? Maybe someone can experiment with trial POL ID / PWs on a clean laptop/desktop.

I'm stuck at work so this isnt possible for me to do, maybe I can tonight if no one else does (and PS3 slims arent released today).

I'm pretty sure this is undetected atm, so spamming refresh and scans might not show anything.

Everything I have attempted so far.

Firefox securely configured randomly browse 30 pages on the Wiki Reboot run Hijackthis and look at the log for anything that looks out of place.

IE8 Out of the box randomly browse 30 pages on the Wiki Reboot run Hijack this and check the log again for anything that seems wrong

IE8 and Firefox both sent off to browse Brogame and other RMT sites. Reboot and run Hijack this and nothing untoward in the Logs

IE8 and Firefox sent to do battle with ffxiah this time Firefox has scripts allowed globally and adblock disabled again rebooted ran Hijack this and nothing untoward.

After I did all this I realised one thing that could trigger something to occur could possibly be to run PoL so I opened PoL and attempted to log one of my dormant accounts accounts in with a completely random password and made up token number. Ran Hijack this before and after rebooting. I cant find nothing. Going to try playing with Java soon

I am not an expert in this kind of thing far from it but I do have a reasonable grasp of PC's and internet safety.

**Riki** · 2009-08-25 11:25

Originally Posted by Mafai

Look for a red X with POL as the program that crashed.

Post the details of the crash.

It's in german but i try to translate to my best:
application failure: pol.exe version 1.18.12.0

error modul (?): d3d8.dll, version 5.3.2600.5512, error adress 0x0002fab2.

**The Stig** · 2009-08-25 11:27

Originally Posted by Riki

It's in german but i try to translate to my best:
application failure: pol.exe version 1.18.12.0

error modul (?): d3d8.dll, version 5.3.2600.5512, error adress 0x0002fab2.

Graphical error

**Riki** · 2009-08-25 11:29

Originally Posted by TheStig

Graphical error

So my graphics card crashed? well that's a relief...kind of.

**The Stig** · 2009-08-25 11:32

Something along the lines of that, D3D = Direct 3D and 8 = DirectX 8 since FFXI only supports up to DirectX 8. As for the cause, no idea. Yet. Lets hear input from the others.

**Mafai** · 2009-08-25 11:56

Originally Posted by Riki

It's in german but i try to translate to my best:
application failure: pol.exe version 1.18.12.0

error modul (?): d3d8.dll, version 5.3.2600.5512, error adress 0x0002fab2.

yea this was video error.

**Riki** · 2009-08-25 12:31

Originally Posted by Mafai

yea this was video error.

Thanks for the help. I just logged back in and my account is fine.
But one question still stands. If i disconnect/crash and suspect being account hacked, is the account safe as long as i don't log back in right away and use the token-password again?

**Hanyoko** · 2009-08-25 12:35

As others have suggested. if you crash, log back in but with invalid info. that way it kicks off whoever is there but wont give them correct data.

If you get the legit POL "incorrect loging/PW" message its fine. if it crashes again during connect, its not fine and seek help.

**Infini** · 2009-08-25 12:43

Whoops nvm x_x

Taintedone · 2009-08-25 12:56

Contributing to the cause, posting my Hijackthis log, looks like I also have the suspect line showing up. Also worth mentioning I suppose only sites I frequent are BG, Wiki, FFXIAH, Alla (sometimes), and every once in a blue moon KI, though very rarely. I use Firefox 99.9% of the time, have had NS and Ad-block active for quite a while on it (configured correctly, double checked it with the Windower post concerning correct settings) and have so far not been hacked (knock on wood). One thing that has personally gave me cause for concern is I have in the last few weeks or so had 2 instances of my FFXI "freezing up" I guess would be the best way to describe it. It happened when I afk'ed to do something each time, came back and FFXI was totally unresponsive. This was before I heard anything about this hacking, so I was able to close the window, log back into POL successfully immediately (thank God).

**Tsuki** · 2009-08-25 13:33

Originally Posted by Hanyoko

As others have suggested. if you crash, log back in but with invalid info. that way it kicks off whoever is there but wont give them correct data.

If you get the legit POL "incorrect loging/PW" message its fine. if it crashes again during connect, its not fine and seek help.

SE fixed this when people complained that logging in with the incorrect information would boot them off. You no longer get disconnected when another instance of pol logs in the same account with the incorrect information.

**Mafai** · 2009-08-25 13:37

Originally Posted by Tsuki

SE fixed this when people complained that logging in with the incorrect information would boot them off. You no longer get disconnected when another instance of pol logs in the same account with the incorrect information.

this is true based on POL info.

BUT (last i checked)

If you have the correct POL info (the thiefs have this already and all stored info already), but the incorrect SE account info you will still be booted.

**Tsuki** · 2009-08-25 13:39

that's never happend to me, afaik.

**Kailani** · 2009-08-25 14:10

With regards to my earlier post regarding a Javascript error IE8 was throwing at me I can recreate this error by visiting the Wiki front page I can refresh the page and get the error a few times it will stop on the next refresh for several refreshes and then come back again for a few refreshes and the cycle will continue. I am certain that this is nothing to do with Virii, RMT or anything other than my ancient laptop being a pain. I am just tieing up my post with the conclusion so no one thinks did/didnt I find anything.

The Error I get is as follows.

Spoiler: show

I have had to remove the URL as I cannot post it with less than 10 posts

Opening the URL in Firefox will give me a page of Javascript and I assume the error is referring to line 4857 of that page of script which would be

Code:

    return $P(parentElement || document.body).getElementsByClassName(className);

Like I said I just wanted to tie up my posts to conclude what I said earlier I have found nothing to my knowledge.

I cannot get any known Virii on this Laptop at present although of course if the major AV companies do not know about it it wil not show up in scans.

Thread: The sky is falling: player with token hacked? (lolIE)

Thread Tools

Similar Threads

What in the fuck is going on with Ancient Currency prices?

Ok what the hell is up with Roc?

Oldschool players with JP Accounts & The new Expansion

Latest Threads

Up & Coming Threads

Hottest Threads