The sky is falling: player with token hacked? (lolIE)

[Hoshiku]

I'm kind of curious because I did run POL.EXE through virus scan.org or at least I tried to. Someone had already uploaded it recently and it came back with one positive out of 37 possible: Packer.Win32.UnkPacker.b [Suspicious]. I don't think it actually scanned my version of POL since I'd scanned a file previously and it actually ran through the scan and for this file it told me that it had already been scanned after I uploaded it. Dunno though.

[Norellicus]

If someone can reliably force a "hack" to occur as one person (name escapes me, too many pages now) claims to have done, try running Process Monitor while doing it and see if you can find out maybe what files are actually in play here.

[Izzy]

I'm kind of curious because I did run POL.EXE through virus scan.org or at least I tried to. Someone had already uploaded it recently and it came back with one positive out of 37 possible: Packer.Win32.UnkPacker.b [Suspicious]. I don't think it actually scanned my version of POL since I'd scanned a file previously and it actually ran through the scan and for this file it told me that it had already been scanned after I uploaded it. Dunno though.

I just checked all 4 of my computers with POL installed, and all 4 get the same result. I'm going to assume it's a false positive since one of the computers is NEVER used for anything except logging in as my mule.

[Rilu]

An LS member just ran HJT, has the proxy line. Not hacked, and doesn't surf the web. Anyone else not hacked have the line?

for kicks, I just scanned my work laptop, which I don't use to browse for anything online (actually, it was just re-imaged yesterday), only company sites to access secure sites and documentation, use programs like Adobe CS3 for work, etc. I got the following entry:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 3:09:37 PM, on 8/26/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16674)
Boot mode: Normal


R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Int ernet Settings,ProxyOverride = *.local


i'm starting to think its just something linked to IE 7.0, and nothing more. I have not accessed any of the ffxi sites using this laptop.

also to note, started playing ffxi in Nov of 2003 - I have shared my PW with over 10 people in my LS over that time, and now have the security token. In that time, I have NEVER had an issue with being "hacked" although, I can't browse the internet and play ffxi at the same time, if I do open a browser window (since they added their own windower option, and no longer gives you full screen errors) it will red-dot me and give me a server time-out error and i'll need to re-login. If I need to access info, or access this site while playing, I just use a 2nd computer (personal laptop/desktop etc).

[Zanmato]

Hi Guys!

Just some interesting stuff …

Last night while turning off my laptop, there was an automatic Windows Update that took place.

My laptop is configured to download “High-Priority” updates automatically and to ask me when to install them. Usually I would have to click the “Yellow Shield” button near the clock in the start menu taskbar to install the updates, but the one that happened last night was when I clicked START > SHUT DOWN > TURN OFF. The “Yellow Shield” appeared there meaning to install updates just before shutting down. This is nothing new, but just letting y’all know that that’s where the update happened.

So anyway, today I see all this crap about accounts getting hacked and all that and I decide to check out what the update was about, thinking at the back of my mind that it could be something that’s got to do with IE.

And guess what … something about IE pops up:
h ttp://support.microsoft.com/kb/894199
It has a “non-security content” tag though, but we all know how Microsoft performs ninja patches.

What is weird is that both my Laptop and my PC are configured the same manner. Both have FFXI installed, but this update didn’t pop up on my PC. Keep in mind that recently I manually ran Windows Live Update and updated everything on the same day for both my machines. This makes me wonder, is this something that’s got to do with Laptops? I know it’s highly unlikely, but I’ve seen lots of people state that they play FFXI on their Laptops.

(No time to check grammatical mistakes; my shift is about to end. Sorry!!)

BTW, awesome job guys for trying to figure out this whole Proxy line thing.

[Sabertiger]

That's interesting, Rilu.

In the log where I found that proxy line, there's...

MSIE: Internet Explorer v7.00 (7.00.6000.16850)

so a slightly different build of IE, which is never used except at Microsoft updates, and a slightly different proxy line...

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Int ernet Settings,ProxyOverride = localhost

Also, I have a machine that doesn't have IE installed period, and thus far, I have been unable to force that line to appear from visiting any site on that machine. I even shut off the firewall, but the line won't show up. After some sleep, and thinking a bit more clearly than last night, it's pretty clear that's pointing to some other exploit somewhere. Maybe the exploit, for whatever reason, has to throw this registry line in there to perform its operations?


Zanmato, I've not looked at windows updates since this started happening. I'm on 2 desktop PCs, not a laptop. I'll check what updates Microsoft says I need, compare anything with IE to the link you posted, and get back to you on that.

Edit: So I checked Microsoft updates, got a bunch of XP security updates (I doubt it's related but possibly?) and one security update for IE7, http://www.microsoft.com/technet/sec.../ms09-034.mspx. It says in that update information that it would allow execution of remote code if you viewed a specially crafted web site with IE. Quoted, "This security update also resolves three privately reported vulnerabilities in Internet Explorer. These vulnerabilities could allow remote code execution if a user views a specially crafted Web page using Internet Explorer." Make of it what you will, but it doesn't appear to be directly related, unless someone found a similar vulnerability in firefox.

[Narse]

Also, I have a machine that doesn't have IE installed period.

This is the point where it became apparent that you have no idea what you're talking about, by the way. In case you need to figure that out later down the road.

[Izzy]

This is the point where it became apparent that you have no idea what you're talking about, by the way. In case you need to figure that out later down the road.

Yea, I didn't wanna say anything...but lol.

[Solefald]

I just checked all 4 of my computers with POL installed, and all 4 get the same result. I'm going to assume it's a false positive since one of the computers is NEVER used for anything except logging in as my mule.

Yeah, probably a false positive since that appears to be a heuristic detection rather than a known virus signature.

I went back and looked at Metta's hijackthis log since he is one of the few actual hacking victims in this thread. A couple suspicious things:
O4 - HKCU\..\Run: [{8A6CBBD4-E3C9-C738-E422-F9FE869A435E}] C:\Program Files\drivers\msmsrs.exe
O4 - Startup: santa.bat

Google search for the first one came up with this: Remove Trojan-Backdoor.Bifrose.afg | Spyware Removal Information

Googling santa.bat also points to a probable infection, I'm not sure exactly which virus though.

These could be unrelated to his FFXI hacking, though.

I keep asking for crash reports and process explorer logs because we know the hackers are able to crash POL. This means that their virus is capable of altering the POL process somehow. This is also why the constant talk about localhost/proxy registry keys isn't helpful to the discussion.

[Sabertiger]

How exactly do I have no idea what I'm talking about by saying I don't have IE installed on a machine? There's the few registry entries where IE would be, but it's ripped out of the OS I'm running. Try knowing what the fuck you're talking about before saying someone else doesn't. The machine doesn't have IE on it, period. Don't like that or don't believe it? Search google for TinyXP sometime.

Edit: Never mind, I'll just post the link and save you time so you can get back to being more retarded.
http://techome.wordpress.com/2008/07...g-live-tinyxp/
Notice those nifty options that say WITHOUT IE? Love that.
In case you're wondering how I went to Windows Update without IE, take note, that I have 2 PCs, one of which does have IE. Not that IE even seems to matter in all of this, since quite a few reports have been posted with people using only Firefox.

Have fun flaming.

[Mistress Stowastiq]

No, I was saying if this script has the potential to allow someone access to my account in order to steal everything they can sell and leave me with a half empty account, then it's worthy of alarm.

Glad to hear you did not get your account hit. I thought when you had the GM lock it down that it certainly meant you had been hit. I hope they do not hassle you for the false alarm and let you re open it.

Another thing, does anyone know when billing maintenance ends? Their message was kind of vague as to when it is over and I usually do not check. Considering that billing maintenance might mean that you cannot change passwords, I was trying to figure this out.

I am referring to this part of the POL notice posed on the 25th of Aug:

Part of the post:

This is a reminder that registration server maintenance will be held in the near future. This coincides with the normal monthly billing cycle. Please be advised that you will not be able perform any of the following actions during this time:
- Register or unsubscribe PlayOnline accounts
- Review or update member information

[Akisu]

How exactly do I have no idea what I'm talking about by saying I don't have IE installed on a machine? There's the few registry entries where IE would be, but it's ripped out of the OS I'm running. Try knowing what the fuck you're talking about before saying someone else doesn't. The machine doesn't have IE on it, period. Don't like that or don't believe it? Search google for TinyXP sometime.

Accept the fact now that there are some BG users who don't care if you actually find the virus, it's filename, and the cure for it. They'll only respond to your post to pick at you using a wrong word tense, or a wrong citation used in a post 3 years ago, or something they don't understand.

Anyway...

Regards to the proxy thing, since it's obvious some people still haven't read up on it. In summary:

If you find the line, it doesn't mean you're infected. Several known pieces of software install the line. Including IE7/IE8 using plugins or "accelerators" and even certain Adobe products use it for authentication purposes. If Adobe's using it, I'm sure other software packages are as well.

If you find a line altering your hosts, I would be way more concerned.
If you find the previously mentioned .dll, I would be formatting since there doesn't seem to be a removal package floating around anywhere for it. (after sending me a copy of it to disect, of course.)
If you have had your account already compromised, I suggest logging, scanning, posting results, then formatting to clean your system, as it's the only way you're going to be sure to get it all, unless of course it's a boot level bug, in which case we're all screwed anyway if it's that advanced.

The proxy line by itself is curious, as some people have reported it not being there, then all of a sudden, "Hey, look, I'm here after visiting FFXIClopedia!" or another community website. Connection, perhaps, flailing around over it won't help prove or disprove it actually being attached.

Also: In responce to Solefald and who he was talking about earlier. Msmsrs.exe is a confirmed keylogging trojan, and I suggest removing it right away. Is there anyone else who's finding this on their machine? Or was this user infected with this from another source? (Very possible.)

I looked through the windows security updates as well; the only thing that's been updated recently was the August blah blah security junk (They put one of these out monthly). I believe for users using Windows Defender, it also recently had a defenitions update as well.

[Effluo]

I had my mule online over night. I just recently came back to check her. After heading to my MH and doing a few things, I got the "logged on from another machine" error. I immediately killed POL and logged in on my Xbox. Everything was there, so I'm not sure how much help that is.

I run FF with the appropriate add-ons and settings. I have yet to receive any type of warning from the various anti-virus and security programs I have installed. Going to pull the plug from my connection and run a full scan of all tools... will post results.

###For Clarity: No, I do not have a security token. I have my POL ID and PW saved. I have never typed them in to get in POL/FFXI. My POL PW is unique to all but one account that I thought would be safe (changing all PWs from a secure connection 2morrow).

What ever this is is pretty amazing. I've yet to see anything quite this involved...

If RMT are resorting to this, can we officially label them as desperate for some gil?

Or is this a giant SE conspiracy to drive us all away from XI and into the arms of XIV?####

[Sabertiger]

Yea Mistress, thanks. I had it locked asap via texting a friend in game to contact a GM, this being right after POL crashed as I tried logging back in. I just called SE about 1.5 hours ago and had it unlocked. Everything is still in place, the character didn't even appear to have moved. Although, I haven't checked the mules out yet. I'd assume if they were after gil or sellable items they would have gone straight to my main. I'll check those after einherjar anyway, to be sure.

After finding the registry proxyoverride entry on PC1 (has IE, XP Home, doesn't have POL / FF installed on it), I've locked down the firewall and IF there's anything on it, it's not going anywhere.

After I got into POL, on PC2 running TinyXP (No IE, firewalled, Firefox as the only browser, AV programs, spyware detectors, w/e), I got a popup warning from Windows Firewall (go figure) that said some features of pol.exe were being blocked, and it asked me to either continue blocking, unblock, or kill process. I let it continue blocking. Maybe it was blocking the mail server connection, but if so, I got nothing inside POL that said it couldn't connect to the mail server. No idea if it's related or not. I didn't catch anything in process explorer or process hacker. If anyone has had issues with windows firewall and pol.exe blocks, I'd be interested in hearing about it.

[Effluo]

super lag spike... double post... -dkp

[Narse]

How exactly do I have no idea what I'm talking about by saying I don't have IE installed on a machine?

It's not so much that you don't have IE installed, as it is that Windows still has dependencies which are not removed through simply removing Internet Explorer, and to my understanding, a security vulnerability that is in whatever underlying version of Explorer is on your machine is going to have an effect on your, whether or not the Internet Explorer executable is removed.

I will admit that this is the first I've heard of TinyXP though, and if they somehow have completely disintegrated Explorer from Windows, then it would be I that is lacking on my understanding of the removal of IE from Windows and not you, at which point I would owe you an apology.

[Sabertiger]

Hope everything is ok, Effluo.
If you can play reasonably well on your 360 (without constant crashes like some people I know) then just go on there for a while. Better safe than sorry.

[Sabertiger]

Not at all, Narse. You are correct about the removal of IE being incomplete, as there are still underlying registry entries there with IE labels, although, they're empty except for default key entries if I remember correctly. There is one folder where IE would be installed in program files.
Lets see here...
It has: 2 folders. One is named Connection Wizard, the other, MUI. MUI has only a single .dll, mscorier.dll. Connection Wizard appears to have connection wizard tools etc.

Browsing regedit....
and every entry I find referring to IE (aside from connection wizard entries) are blanked with (Default).

If you've got a spare machine/partition space, TinyXP has served me well. If nothing else, the security on it could be analyzed by someone with more knowledge than I.

[Narse]

Looking into it, and it seens nLite does indeed have the ability to install Windows without the Internet Explorer core, though there seems to be a decent amount of functionality lost in Windows when you do this.

Are you running XP with an IE core still? If so I would not rule the system out to being vulnerable to IE exploits.

[Sabertiger]

I'm not seeing any registry entries for IE, and no IE options are listed anywhere. Nothing in control panel or add/remove programs under windows components. Is there a way to check for the core otherwise?
An HJT log from TinyXP, if this helps clarify anything:

Spoiler: show

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:00:43 PM, on 8/26/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Unable to get Internet Explorer version!
Boot mode: Normal

Running processes:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\My Programs\Sygate Personal Firewall Pro\smc.exe
D:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
D:\WINDOWS\system32\spoolsv.exe
D:\My Programs\Intel Desktop Utilities\iduServ.exe
D:\My Programs\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
D:\My Programs\Norton SystemWorks\Norton Utilities\NPROTECT.EXE
D:\WINDOWS\system32\nvsvc32.exe
D:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
D:\My Programs\Window Blinds\wbload.exe
D:\WINDOWS\Explorer.EXE
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\RTHDCPL.EXE
D:\WINDOWS\system32\RUNDLL32.EXE
D:\Program Files\Common Files\Symantec Shared\ccApp.exe
D:\My Programs\Intel Desktop Utilities\ipTray.exe
D:\WINDOWS\system32\taskmgr.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\Explorer.EXE
D:\My Programs\HiJack This\HijackThis.exe
D:\WINDOWS\regedit.exe
D:\WINDOWS\system32\rundll32.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - Default URLSearchHook is missing
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - D:\My Programs\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - D:\My Programs\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE D:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE D:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [ccApp] D:\Program Files\Common Files\Symantec Shared\ccApp.exe
O4 - HKLM\..\Run: [ccRegVfy] D:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe
O4 - HKLM\..\Run: [ipTray.exe] "D:\My Programs\Intel Desktop Utilities\ipTray.exe"
O4 - HKLM\..\Run: [LogonStudio] "D:\My Programs\LogonStudio\logonstudio.exe" /RANDOM
O4 - HKLM\..\Run: [BootSkin Startup Jobs] "D:\My Programs\BootSkin\BootSkin.exe" /StartupJobs
O4 - HKLM\..\Run: [SSC_UserPrompt] D:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
O4 - HKLM\..\Run: [SmcService] D:\MYPROG~1\SYGATE~1\smc.exe -startgui
O4 - HKUS\S-1-5-19\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'Default user')
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - D:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - D:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O13 - DefaultPrefix:
O13 - WWW Prefix:
O13 - Home Prefix:
O13 - Mosaic Prefix:
O13 - FTP Prefix:
O13 - Gopher Prefix:
O17 - HKLM\System\CCS\Services\Tcpip\..\{A217301B-9352-4650-ADA9-871A6C871E5B}: NameServer = 64.136.173.8 64.136.164.66
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - D:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation Service (ccPwdSvc) - Symantec Corporation - D:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Intel(R) Desktop Utilities Service (IduService) - Intel(R) Corporation - D:\My Programs\Intel Desktop Utilities\iduServ.exe
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - D:\My Programs\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - D:\My Programs\Norton SystemWorks\Norton Utilities\NPROTECT.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - D:\WINDOWS\system32\nvsvc32.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - D:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Sygate Personal Firewall Pro (SmcService) - Sygate Technologies, Inc. - D:\My Programs\Sygate Personal Firewall Pro\smc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - D:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe

--
End of file - 5243 bytes

I'll catch up tomorrow. Time for some rest. ^^;;