Aight guys, listen up. I am going to do my best to walk everyone through how to protect your computer and get this spyware/keyloggers off before anymore people get hacked.
If I can think to add anymore, I'll mention the update here.
12/11/07 Posted, and I hope it helps.
-Added some programs, and recommendations on password security/saving. Thanks guys!
-Changed title, cause I want to make sure people know this is specifically for the hackings.
First things first:
Actions that need to be taken immediately:
1) Take this post to your LS Forums. Post it.
2) No forums? LS Message, broadcast on FFXI, send them(LS), friends, people you know, to BG to read it. (Publicizing BG and preventing hacks<3)
3) Stop typing your password into POL. Also, do not save your password into the POL.
3b) Make a .txt file for now, somewhere on your comp with your FFXI Password in it. Every time you need to log on, copy/paste your password into POL.
3c) Don't save as a plain file to your Desktop if you are worried about people poking their nose in it.
Fhqwghads wrote:
Place a shortcut to notepad.exe on your desktop, and drag & drop the file containing your password on that instead. Or, you can double-click on the plain text file, and create an association with notepad. Associations are local to your machine, so if someone compromised it and browsed your files, I'm fairly certain they wouldn't see it associated with notepad. Name the file something obscure like "gfsfilsys" for instance, or just random characters. No extension. There's so many files like that on your machine that the chance it will look appealing to someone browsing your system is fairly low.
Keyloggers record every keystroke on your computer so you are still not 100% safe with this method, although I do feel it's the second safest bet.
Safest might actually be this:
3d)
CharlotteW wrote:
However, if you are already infected, simply typing in the .txt file will not guarantee your safety. I suggest you log it on a different PC, if available, save it to your disc of choice (floppy, CDR, Flash drive), and use that instead. (I recommend you DON'T save it to your harddrive, incase your harddrive gets infiltrated in the future.)
4) Use Mozilla/Firefox/Opera, get off of IE for now, if you can.
Programs you should be getting: (A BG rep can check these links, there is no maliciousness hidden within.)
1) Ad-Adare Free Version
2) Spy-Bot Search&Destroy
3) AVG Free Spyware Edition AND AVG Free Virus Edition Get both, they are 2 seperate downloads. I have caught so many problems with this that Norton never picked up.
4) Firefox
5) ProcessGuard
6) CCleaner
Step-by-Step Walkthrough:
1) Get those programs and open them. Update them first, once they are installed.
2) Run them, fix any problems, delete any bad files, etc, etc.
3) Once all that is done, do this:
Start Menu > Search > All Files and Folders > Click Advanced Options > Search System Folders, Hidden Folders, Search Subfolders > Type in the Search Field: rsbo.exe
Repeat said steps for ALL these files:
rsbo.exe
kb1ss1p.dll
kb1ss1p.sys
in3.dll
4) If you find the files, delete them asap. If you cannot delete them, post here, we'll try to figure out how to do it.
5) Search the Registry by doing this:
Start Menu > Run > type in "regedit" and click OK > Highlight My Computer in the newly opened Regedit box > Click on Edit > Click on Find > type in rsbo.exe
Repeat said steps for ALL these files:
rsbo.exe
kb1ss1p.dll
kb1ss1p.sys
in3.dll
6) If you find anything with those listed delete them immediately. Note: you may find something with a really long name when you look for "in3.dll" it's not it, it's actually a plugin3.dll
7) Restart your computer, research to make sure it's all gone. You should be clean.
If you are all clean, now is the time to change your password in case RMT have gotten it. Do so. If you want 100% extra security, call SE, have them change it and keep doing the copy/paste trick with your new password.
____________________________________________
Back story that I posted to my LS website a day or so ago:
As of 12/11/07 (updated this part)
No one really knows how or why the recent hackings (listed on Blue Gartr) have been happening, but everyone is helping out and trying to narrow it down.
We think we've got it narrowed down to a keylogger coming from IE. Doing a search on specific files has lead me to google it and this is what I came up with:
Here's the details from a WoW player who was hacked:
Quote:
A couple of days ago my account was hacked by a keylogger. Normally I'm a very secure person but I found out the issue and where it occurred. I have a few computer systems and one of my systems was using Trend Micro and it failed to notice the keylogger trojan injection. Here is the following information folks should be concerned about regarding this:
Trojan Type:
Agent.GDA type
Files:
C:\Windows\System32\rsbo.exe
C:\Windows\System32\kb1ss1p.dll
C:\Windows\System32\kb1ss1p.sys
Registry Key:
{ED0ACB58-556F-21DA-DDFE-6D20F3F611BB}
The file rsbo.exe automatically creates the .sys and .dll files each time you login. They are stored in the windows\system32 directory. They inject themselves into the windows processes and remain hidden from "most" antivirus protection. Norton, McAfee, and Trend Micro did not find this trojan. The only software that found it was AVG Pro.
The method of injection occurred through Internet Explorer, even though I had all windows updates on that particular machine.
Again, this was not my main system but a secondary system that was affected. My main character Drabin (level 70 mage) was stripped of all gold, many items, and the incident reported. I'm waiting for (hopefully) reimbursement to come.
I am posting this as a helpful post so that others do not have this occur to them. Originally I had thought I retrieved the keylogger from WAU (Wow Ace Updater) but was sorely mistaken. Even though it is a third party software, the method of injection was not from this app.
Now, I'd like you all to PLEASE PLEASE follow this:
Quote:
Recommendations for other players so they don't get a keylogger:
# Don't use Internet Explorer (use Mozilla Firefox as it is a much safer and secure browser)
Use a solid Anti-virus package (do not use multiple)
Implement a Firewall
Use Hijackthis to check issues on your system
Use Spywareblaster to block and protect your browsers from known spyware/malware
Use Rootkit Unhooker (to find rootkit injections in your processes)
Use RegistryBooster or similar (to clean your registry of unwanted or susceptible rootkit hacks)
Lastly, I'd like ALL PC users, especially those who use IE to do the following:
Do a search on your computer for those three files. Run Virus Checks, Any AntiSpyware you have/can find, and POST the results here IF you have any of the above.
To check your registry do this:
Start > Run > Regedit > go to top of list and click mycomputer > Edit > find > in3.dll/kb1ss1p.dll/rsbo.exe > find
Any and all information can help, also, post which FF/Gaming sites you go to such as Atlas, FFAH, FF LS Community, even Generic ones, AND which browser you are using.
Thanks guys, and I bring this to your attention because I would really hate to see any of your accounts getting hacked.
Also, if you don't take this seriously, that's fine, your choice, but be warned, if your account gets hacked SE is doing NOTHING about it, and are telling the people they have to take it to their local law enforcements and to get a subpoena before they(SE) can do anything at all to help you.
:fill(white):strip_exif()/i/1224538181.jpg?f=thumbmini)
:fill(white):strip_exif()/i/1223580657.jpg?f=thumbmini)
:fill(white):strip_exif()/i/1258989430.jpeg?f=thumbmini)
/u/64853/crop59bfb34d82ba1_cropped.png?f=community)
:strip_icc():strip_exif()/u/13316/icon.jpg?f=community){kind=icon}
vanavond maar weer verder, limbus is uitgesteld.
:strip_exif()/u/113284/ratflail.gif?f=community)
:strip_icc():strip_exif()/u/46158/crop577a793aa05da_cropped.jpeg?f=community)
/u/78932/Jewel3GoT.png?f=community)
Wel, vandaag effe 2x Kirin gedaan en Proto-Ultima omgelegd. En mijn nashira manteel gekregen ^^ Ik kan nu eindelijk meedoen aan de gay contest!!
:strip_exif()/u/94336/crop5eae33f1b86f4_cropped.gif?f=community)
Weet iemand een goede store waar ik met paypal kan betalen?
:strip_icc():strip_exif()/u/130008/Sputnik.jpg?f=community)
:strip_icc():strip_exif()/u/33344/fs1.jpg?f=community)
Hele leuke community.
:strip_icc():strip_exif()/u/2932/Catcrown.jpg?f=community)
/u/72577/avatar.JPG?f=community){kind=avatar}
