SRL Archive - News and General

I have been hacked(Naums hacker)

He took my MSN, and then requested money from my paypal ( then some how get control of my paypal ) and then accept the money request. ( I system restored before he got to accept the request somehow)
Add this please




From: Daniel Malate(Dervix@hotmail.com.au)
To: me Roberts (air_mc_roberts@yahoo.com)
Amount: $999.00 USD
Status: Pending
Date Requested: Nov 6, 2010
Subject: PayPal money request from Daniel Malate

That could be the hacker, fuck I'm going linux tomorrow.

If i restored to an earlier point, can he still get my info?

he somehow got the virus onto your computer, and once its on there, it can take anything instantly. so probably before you even restored your computer to the earlier point, he already had the info to your account.

From: traveler
he somehow got the virus onto your computer, and once its on there, it can take anything instantly. so probably before you even restored your computer to the earlier point, he already had the info to your account.

Then how come he didn't send money, he requested it ?

Was your pass the same as the one to the forum? Or other forums online? Or is this just stolen by a virus?

From: Wizzup?
Was your pass the same as the one to the forum? Or other forums online? Or is this just stolen by a virus?

My paypal password was its own seperate one. MSN one was used else where.


Can he still gather my info even though I restored?

[QUOTE=Camaro';748217]My paypal password was its own seperate one. MSN one was used else where.


Can he still gather my info even though I restored?[/QUOTE]

Don't know. Just make sure you change all your passwords from another computer. Also, you should never use the same password twice. :)

From: Wizzup?
Don't know. Just make sure you change all your passwords from another computer. Also, you should never use the same password twice. :)

Ok… I hope everything is ok with my paypal mostly..

Did you go to rs-hacking dot com at all? That site got hacked and uploaded with a trojan or something

No. He took my backup msn email too…………………………………………………………………………..

So now theres no hope to get my msn email back.



Said he was on windows vista / firefox

So we have his name/OS/internet browser / name / email / country / and some ip . Does he visit srl wizzup?

No matches for the IP. Probably a proxy.

This sucks how the guy lives all the way across the world from me.

Whois:
(useless)



[Querying whois.arin.net]
[Redirected to whois.apnic.net]
[Querying whois.apnic.net]
[whois.apnic.net]
% [whois.apnic.net node-2]
% Whois data copyright terms    http://www.apnic.net/db/dbcopyright.html

inetnum:        27.32.0.0 - 27.33.255.255
netname:        TPG-AU
descr:          TPG Internet Pty Ltd.
country:        AU
admin-c:        TH178-AP
tech-c:         TH178-AP
remarks:        Australian Internet Service Provider (ISP)
remarks:        http://www.tpg.com.au
status:         ALLOCATED PORTABLE
mnt-by:         APNIC-HM
mnt-lower:      MAINT-AU-TPGCOM
remarks:        -+-+-+-+-+-+-+-+-+-+-+-++-+-+-+-+-+-+-+-+-+-+-+-+-+-+
remarks:        This object can only be updated by APNIC hostmasters.
remarks:        To update this object, please contact APNIC
remarks:        hostmasters and include your organisation's account
remarks:        name in the subject line.
remarks:        -+-+-+-+-+-+-+-+-+-+-+-++-+-+-+-+-+-+-+-+-+-+-+-+-+-+
changed:        hm-changed@apnic.net 20100318
source:         APNIC

role:         TPG Hostmaster
address:      TPG Internet Pty Ltd.
address:      (Part of the Total Peripherals Group)
address:      65 Waterloo Road
address:      North Ryde NSW 2113
country:      AU
phone:        +61 2 9850 0800
fax-no:       +61 2 9850 0817
e-mail:       hostmaster@tpg.com.au
trouble:      -+-+-+-+-+-+-+-+-+-+-+-++-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-
trouble:      Send all spam and abuse reports to abuse@tpg.com.au or
trouble:      via our web interface at the link provided below:
trouble:      http://www.tpg.com.au/about/enquiry.php?type=Report%20Spamming
trouble:      .
trouble:      Please include detailed information such as full message
trouble:      headers and times in UTC
trouble:      --
trouble:      Send all network related issues such as routing to
trouble:      trouble@tpg.com.au
trouble:      -+-+-+-+-+-+-+-+-+-+-+-++-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-
admin-c:      TPG3-AP
tech-c:       TPG2-AP
tech-c:       TA56-AP
nic-hdl:      TH178-AP
remarks:      Australian Internet Service Provider (ISP)
remarks:      http://www.tpg.com.au
notify:       hostmaster@tpg.com.au
mnt-by:       MAINT-AU-TPGCOM
changed:      hostmaster@tpg.com.au 20041106
changed:      hostmaster@tpg.com.au 20090212
source:       APNIC

	

Like Wizzup? said, it's probably a proxy.

Cant you just contact http://www.tpg.com.au/about/enquiry.php?type=Report%20Spamming
and ask them what IP was using their service [assuming proxy] to access your stuff?

They also went into runescape, should get him back. This is what he did to me, I hope naum didn't get it too bad.

Can you tell me how you it has been hacked?

From: Deathscytex
Can you tell me how you it has been hacked?

How I was hacked? Naum got hacked and his msn asked me to run Naums Scar to Exe tool, I downloaded it, scanned it twice and ran it. :(

Well if you still have the exe, I want to analyze it :P.

You are probaly just Keylogged. Reformat whole computer. You can even use Kill Disk if you are afraid that virus will stay.
Change all passwords on other computer. GL mate!

~Home

From: Home
You are probaly just Keylogged. Reformat whole computer. You can even use Kill Disk if you are afraid that virus will stay.
Change all passwords on other computer. GL mate!

~Home

Does kill disk just format the disk properly or does it do like a DBAN thing?

From: cstrike
Does kill disk just format the disk properly or does it do like a DBAN thing?

It will clean everything, when your normally format with like Windows disk. it will leave some traces.

~Home

kill disk sets all your sectors back to 0

Currently running Ubuntu 10.10 :)

Found his real IP I think on one of my botters, lets try an IP check on this one :)

from the down under?

That person hacked me as well but my friend gave me an AntiVirus called <link gone>. It is the best AntiVirus I've used.

Instead of reformating your computer try that antivirus and I hope you remove the virus.

From: Aaronator
That person hacked me as well but my friend gave me an AntiVirus called <Link gone>. It is the best AntiVirus I've used.

Instead of reformating your computer try that antivirus and I hope you remove the virus.

What is this shit. Why is everyone distributing viruses.

From: Aaronator
That person hacked me as well but my friend gave me an AntiVirus called "Lazarte AntiVirus". It is the best AntiVirus I've used.

Instead of reformating your computer try that antivirus and I hope you remove the virus.

Nobody download this. It seems to me like it's a virus.

From: Aaronator
That person hacked me as well but my friend gave me an AntiVirus called <Link removed>. It is the best AntiVirus I've used.

Instead of reformating your computer try that antivirus and I hope you remove the virus.

http://temp.ionoone.com/Lazarte/reportexe.html
http://temp.ionoone.com/Lazarte/reportdll.html
Just showing not saying they are bad =)

From: Dgby714
http://temp.ionoone.com/Lazarte/reportexe.html
http://temp.ionoone.com/Lazarte/reportdll.html
Just showing not saying they are bad =)

Yes, and neither was the one being distributed by Naum's msn.

Think. Think how he managed to take it from you?

It is not even a virus…

It looks like the file Aaronator posted was a crypted virus, meaning it can bypass antivirus's scanners. The (exe) file was originally named fudhacking_crypted.exe.

It looks like either the stub or the virus was coded in VB.
It's possible the guy has the info on where to send logs in one of these lines: (highly possible in the first 3)

Nt68Pcn0D3Qks5TLe91JjXz24KoCa74WyAd03MwFq9x8SHm75Ebi1RGg6
jYbOjsy5j6fL06OTn/eyoJDVrr/PwbKEruWZ+aqLju2fu5LPxaCtkobU0rqZhYHQw7SZip3J0aq3k6zzg9iukKbAwrOWg/aYu4HQv4Lw2LeUjdCPyqiJlPWBka/C0beyk43Fwr+FhKvL0rGIt6LQ1LqUprrAgdq0iLjq/76ClOmZsJDAup7x8qyFiMGy9bGMhNa0h5zA062qjaf4z6uSm6rAw6GNq6P6z6uRt4f/mN+kq438zLyAjvGHmq3Nronu86eUmMSu9JuXldOlup/f16jC5cfX0a7TtIvEy7WHttjBzrLKh5rYns+s9LvE07beqPKMvIHB8qLo5rODpcm90barpuiet4XE6YGdr4zG3oylv4fRxaGtsprRxK6XjYjAmt+TnbD9zqWfsfqlsJHCpLP8xLaFn8a+1beJ24jpqYDcjb2Aq4XQyrzTspzIibaOoYDH0/GArIbamPOqsY/Q9ZC/o8qyur/9uYPAzLqkpMyi1aCd4g==
=qrYkkpuRGOXiroJYeedfxUXnttcdc210cC5nbWFpbC5jb20=qrYkkpuRGOXiroJYeedfxUXnttcd587qrYkkpuRGOXiroJYeedfxUXnttcdZGFya2luejEyM0BnbWFpbC5jb20=qrYkkpuRGOXiroJYeedfxUXnttcdZGFya3dhcnJpb3I=qrYkkpuRGOXiroJYeedfxUXnttcdFalseqrYkkpuRGOXiroJYeedfxUXnttcdqrYkkpuRGOXiroJYeedfxUXnttcdTrueqrYkkpuRGOXiroJYeedfxUXnttcdTrueqrYkkpuRGOXiroJYeedfxUXnttcdTrueqrYkkpuRGOXiroJYeedfxUXnttcdTrueqrYkkpuRGOXiroJYeedfxUXnttcdTrueqrYkkpuRGOXiroJYeedfxUXnttcdTrueqrYkkpuRGOXiroJYeedfxUXnttcdhttp://www.example.com/System.Data.SQLite.DLLqrYkkpuRGOXiroJYeedfxUXnttcdFalseqrYkkpuRGOXiroJYeedfxUXnttcdhttp://www.example.com/server.exeqrYkkpuRGOXiroJYeedfxUXnttcd

whatsup
Y6Cbw5LMo34DcJp28Hiz7TKm9a0NZq94Ext2F7Xke8Q3Ayf6
sender

His cypher for the first 3 lines of text is: "qrYkkpuRGOXiroJYeedfxUXnttcd", without the quotes.

Anyone have any more viruses for me to analyze? I have a history of hacking hackers' gmails and whatnot. ;)

First off, this sucks. GL man with getting cleaned up.

From: TRiLeZ
Anyone have any more viruses for me to analyze? I have a history of hacking hackers' gmails and whatnot. ;)

^ Nice, the reverse crack. You ever go to things like def con? You might enjoy the such.

From: anonymity
First off, this sucks. GL man with getting cleaned up. ^ Nice, the reverse crack. You ever go to things like def con? You might enjoy the such.

I think I'm cleaned, the only things he has left is my botters , I think.
Ban Aaronator please… Does the ip match up with anyone here at SRL? (My last post)

and Naums MSN did give me the first virus. The guy who sent it said it was coded in VB too.

I'm on Ubuntu , can some one verify that i'm clean from here on out?

[QUOTE=Camaro';748491]I think I'm cleaned, the only things he has left is my botters , I think.
Ban Aaronator please… Does the ip match up with anyone here at SRL? (My last post)

and Naums MSN did give me the first virus. The guy who sent it said it was coded in VB too.

I'm on Ubuntu , can some one verify that i'm clean from here on out?

You should be clean, now if you run something that seems suspicious and asks you to type in your password, dont do it, unless its from a trusted source (Downloading google chrome, firefox, other major programs, ect)

From: Failpailirl
You should be clean, now if you run something that seems suspicious and asks you to type in your password, dont do it, unless its from a trusted source (Downloading google chrome, firefox, other major programs, ect)

You shouldn't have to give the root password to any of those programs.. the only time you should need to give root access is when you are using synaptic/apt-get (when installing programs at least..). Also, you need to be warry about running code you don't know. Especially if it requires root access.

If you have the executable available for reverse engineering or need help with malware removal let me know.

From: Aaronator
It is not even a virus…

Right, first post after over a YEAR of being inactive and it's a small "anti-virus" that NO ONE has ever heard about before.

This kiddie is really annoying. What are you trying to get out of these people you're hacking? There are no lulz.

From: TRiLeZ
It looks like the file Aaronator posted was a crypted virus, meaning it can bypass antivirus's scanners. The (exe) file was originally named fudhacking_crypted.exe.

It looks like either the stub or the virus was coded in VB.

Reached the same conclusion about the name.
The exe is either coded in C# or VB. Haven't investigated it any further since its really too small to be a good antivirus. And an antivirus wouldn't need to be crypted and have a name such as "fudhacking_crypted.exe".

[QUOTE=Camaro';748491]
and Naums MSN did give me the first virus. The guy who sent it said it was coded in VB too.

I'm on Ubuntu , can some one verify that i'm clean from here on out?

Guy sent me one and said it was in c++

As long as you're on Ubuntu, it cant get you ;)

If you open a virus while on the Ubuntu (Dual Boot). Will it still be dangerous if you reboot into windows?

From: Zyt3x
If you open a virus while on the Ubuntu (Dual Boot). Will it still be dangerous if you reboot into windows?

Well, was the virus made for Windows or Linux? You'd have to run the virus in WINE if you're on Linux, even then it wouldn't have full priv. to everything.

From: noidea
Well, was the virus made for Windows or Linux? You'd have to run the virus in WINE if you're on Linux, even then it wouldn't have full priv. to everything.

Hypothetically question, and thanks :) :)

Everyone delete my old account

[email]Air_mc_roberts@hotmail.com[/email]

and add my new one! :)

[Email]aarondawg14@yahoo.com[/email]

IP Check?

[QUOTE=Camaro';748645]IP Check?[/QUOTE]
Wizzup on IRC said no matches. Chances are they don't use this site, or they are using a ton of proxies.

Well even if you remove the maleware he still got your account.

Daniel Malate.
Lives in Mahaplag, province of Leyte, Philippines. NE of Indonesia.
His IP MIGHT be "110.33.220.231" or "27.33.255.255" but we're not too sure.

http://www.facebook.com/profile.php?id=100001274601098
He is playing guitar in the band "Surprised to Bleed".

His MSN is [email]Dervix@hotmail.com.au[/email] and Dervix is also his nickname.

Dervix… close to Dervish :S