SRL Archive - News and General

So today I logged on my account today and before I logged in I noticed a different IP that last logged in. Shit….. Yup took all my cash. 20m out the window, it was a lot for me. But the main reason for this post is if your hacked by a keylogger do I have to do anything to get rid of it? I have 6m sitting on a pure and im not sure if I should trade it over yet. I was using a new powerbot script–(iPHQs Alcher) I also did not have a bank pin set, would that have saved my bank or do keyloggers cover that too.

BTW I am now a gold farmer :)

Add a bank pin next time :P

And run some anti-virus programs

From: Zyt3x
Add a bank pin next time :P

And run some anti-virus programs

I have definantly learned my lesson on bank pins, but what should I scan all my rsbot/powerbot files or my whole computer?

Scan your entire computer.

Kill any suspicious files that are running already tho (Task Manager)
Check registry / msconfig for files being run on startup.

Don't use java bots lol

From: rogeruk
Scan your entire computer.

Kill any suspicious files that are running already tho (Task Manager)
Check registry / msconfig for files being run on startup.

Don't use java bots lol

Alright im running a full scan but am I safe to log onto my other accounts or should I wait. Since im down 20m I want to start botting again as soon as I can.
Thanks for the quick help too

You logged onto them before?.

Set PINs on all accounts. Should solve the problem

From: rogeruk
You logged onto them before?.

Set PINs on all accounts. Should solve the problem

Ive logged on one of my other accounts in panic wondering if it was also hacked and it wasnt so yes today I have logged on another one but I have never logged on that account using that script or rsbot.

I set pins already but they take 6 long days to set…

Reformat and reinstall without a backup. Only way to be sure it's gone.

From: Big Tom
Ive logged on one of my other accounts in panic wondering if it was also hacked and it wasnt so yes today I have logged on another one but I have never logged on that account using that script or rsbot.

I set pins already but they take 6 long days to set…

Get someone to "hold" your stuff?.

You got MSN?

From: rogeruk
Get someone to "hold" your stuff?.

You got MSN?

I will get one of my friends to hold my stuff untill I feel my account is safe. My computer scan is going to take tell tomorrow night so il post back if I find anything then

Clearing my whole computer is not an option for me because this is my familys labtop. Wanting me to reformat, does this mean my virus protection wont pick this up?

do what harry said, that is what I did after I lost all my money (50Mil :() reformating is the safest way is it removes everything off your hard drive

From: Sgt Soul
do what harry said, that is what I did after I lost all my money (50Mil :() reformating is the safest way is it removes everything off your hard drive

Reformatting is over the top. There's no need.
If its a boot sector virus/trojan w/e then reformatting won't do shit.

Do a proper scan, check task manager. Find the process, terminate it, and remove it.

From: rogeruk
Reformatting is over the top. There's no need.
If its a boot sector virus/trojan w/e then reformatting won't do shit.

Do a proper scan, check task manager. Find the process, terminate it, and remove it.

In task manager will it be under process? If so what am I looking for there are so many processes going on and ive never had a keylogger so I dont know what im looking for.

Do you have MSN? I did PM you. I'll help over MSN if you like

From: rogeruk
Do you have MSN? I did PM you. I'll help over MSN if you like

That sounds easier I sent a request
I have to eat quick so il be back in 10 minutes if i dont respond on msn

The only way to be sure you're safe after being infected is a reformat. You can be pretty sure you are safe after a well clean, but you really shouldn't risk it unless you must.

From: Harry
The only way to be sure you're safe after being infected is a reformat. You can be pretty sure you are safe after a well clean, but you really shouldn't risk it unless you must.

It is my last resort. Is this keylogger a risk to any of my other files or anything with a password?

I didn't get a request on MSN. PM me your email

Reformat does not fix boot sector virus's

From: rogeruk
I didn't get a request on MSN. PM me your email

Reformat does not fix boot sector virus's

Sent it

From: Big Tom
I was using a new powerbot script–(iPHQs Alcher)

What version of powerbot are you using? Was it inbetween version 2.22 - 2.24 (Or was it either of these?) and did you compile it yourself or download it?

From: cycrosism
What version of powerbot are you using? Was it inbetween version 2.22 - 2.24 (Or was it either of these?) and did you compile it yourself or download it?

He says his AV has found 'Trojans'.

But i bet that either the powerbot client was rigged, or the java file was capturing passwords lol.

From: Harry
Reformat and reinstall without a backup. Only way to be sure it's gone.

This, basically.

From: rogeruk
He says his AV has found 'Trojans'.

But i bet that either the powerbot client was rigged, or the java file was capturing passwords lol.

If you downloaded RSbot version 2.22 or 2.24 your password would have been stolen.

If you compiled it, then it wouldn't have, as it was only the bot that was uploaded that was infected, the source code on the compiled versions weren't (The RSbot they uploaded was not open source)

Luckily for me I only ever compile rsbot.

Check your StartUp Programs (Use CCleaner to find them all)
Because with Normal Windows MSCONFIG, you are able to hide them with Keylogger.
Check your Registy, Check your Process List (Most commmon is Server.exe)


~Home

From: Home
Check your StartUp Programs (Use CCleaner to find them all)
Because with Normal Windows MSCONFIG, you are able to hide them with Keylogger.
Check your Registy, Check your Process List (Most commmon is Server.exe)


~Home

Most keyloggers are not that obvious - They are designed to look like system processes, such as ctfmon.exe

Protip: Install KeyScrambler or Zenmata.

sucks man :(

NEVER use RSBot simple, 12000 accounts were take with it. Powerbot was hacked by Gho$t and changed the download link to his own made imitation of RSBot witch had a keylogger in it plus decoded the passwords in the UID file on your computer. I was lucky enough to of changed my passwords before they logged into my account. The keylogger was only inside RSBot and only worked when loaded up as far as i know. So get rid of all RSBot files and the UID file from your computer. Change ALL of your passwords and download RSBuddy witch i would say is safe or even better TRY SIMBA and use the scripts on this site ;). If you haven't got an internet security download AVG I.S 2011 and go here http://serials.ws/index.php to find the password to unlock it until 2018 lol :P I know you have all probably helped him but i thought i would say this just in case other people see this thread to and he can do these things if he hasn't already. Hope you get back to being a happy botter Big Tom.

From: Home
Check your StartUp Programs (Use CCleaner to find them all)
Because with Normal Windows MSCONFIG, you are able to hide them with Keylogger.
Check your Registy, Check your Process List (Most commmon is Server.exe)


~Home

Some viruses can even make itself invisible to taskman and regedit though.

After scanning, download and run http://free.antivirus.com/hijackthis/ and http://www.safer-networking.org/en/index.html. You should also download and install a firewall and watch your network activity (I use ESET Smart Security 4).

Malwarebytes is also a good one.