SRL Archive - Bot Information and Spottings

Hey guys,
I've kind of a problem. Last year i stopped playing rs, botted therefore some 99s with rsbuddy. I have never been hacked then.. Now i started playing again last month and i almost directly got hacked.. Think it was a keylogger of something.. But in the following weeks i have been hacked four times in a row.. Two times while i was botting, but i am almost certain it wasnot caused by the scripts!
I did change my password couple times just like my pin and ign, also installed some spyware etc. but it seems like it's not working, because got hacked again.
I don't really like playing/ botting the game when i got hacked over and over again. So do you guys got some good tips for me to prevent from being hacked??
Hacks have been between 15-60m

You are silly sir!
If it's happening that often, you are not fixing/killing it!
You MUST reformat your computer completely, and install a fresh copy of windows (or whatever operating system you use) and then you will be fine!

From: YoHoJo
You are silly sir!
If it's happening that often, you are not fixing/killing it!
You MUST reformat your computer completely, and install a fresh copy of windows (or whatever operating system you use) and then you will be fine!

Woah, YoHoJo don't tell em' to reformat already, there could be ways to remove it.

@OP
Sounds like you have a FUD RAT to me. Tell me, did you run any sketchy executables at any point in time? Or, it could be a java drive-by RAT, then you're in for it if you ask me, however there's still ways to remove.

yeah most likely a rat

From: XxX Toxin XxX
Woah, YoHoJo don't tell em' to reformat already, there could be ways to remove it.

@OP
Sounds like you have a FUD RAT to me. Tell me, did you run any sketchy executables at any point in time? Or, it could be a java drive-by RAT, then you're in for it if you ask me, however there's still ways to remove.

Can't remember, maybe my little bro did. But I ain't that good with pcs, how could you check if you have one and delete it??

From: XxX Toxin XxX
Woah, YoHoJo don't tell em' to reformat already, there could be ways to remove it.

No there's not.

From: http://technet.microsoft.com/en-us/library/cc512587.aspx
You can't clean a compromised system by patching it.

You can't clean a compromised system by removing the back doors.

You can't clean a compromised system by using some "vulnerability remover."

You can't clean a compromised system by using a virus scanner.

You can't clean a compromised system by reinstalling the operating system over the existing installation.

You can't trust any data copied from a compromised system.

You can't trust the event logs on a compromised system.

You may not be able to trust your latest backup.

The only way to clean a compromised system is to flatten and rebuild.

Jesper M. Johansson, Ph.D., CISSP, MCSE, MCP+I

Security Program Manager
Microsoft Corporation

I have a think pad laptop, I use the "One button restore" every 2 week (due to hard disk error, pretty much hard drive works good for 10 days and stops). Thus I never had to use ANY anti virus :P

You never mentioned whether or not you changed your account recoveries. Haha.

From: Hero
You never mentioned whether or not you changed your account recoveries. Haha.

^This!

I've reformat my pc, but now I have another problem.. There aren't hardware drivers for Ethernet-controller and netwerkcontroller?! So I cannot go on the internet, what do I have to do ???

Go to device manager, figure out what Ethernet device you have, download the drivers on another PC, put them on USB, put them on PC without driver, install.

From: Floppie
I've reformat my pc, but now I have another problem.. There aren't hardware drivers for Ethernet-controller and netwerkcontroller?! So I cannot go on the internet, what do I have to do ???

Go on another computer download the required drivers onto a usb then copy and install them onto the computer you want. Easy.

I fixed it! Many thanks guys!! you all really helped me out!

No problem ^.^~

Now refrain yourself from running suspicious programs or going into shady sites.

If you ever get a virus, remember that the only way to get rid of it is to full format. Best wishes

^.^~ DemiseScythe

From: DemiseScythe
No problem ^.^~

Now refrain yourself from running suspicious programs or going into shady sites.

If you ever get a virus, remember that the only way to get rid of it is to full format. Best wishes

^.^~ DemiseScythe

All downloadzz duh gppzz spawna!

reformat your pc its the safest option

From: DemiseScythe
If you ever get a virus, remember that the only way to get rid of it is to full format. Best wishes

No need to lie. We all know that that's not the ONLY way ALL the time.
And Harry, it's laughable that you'd cite something from microsoft… HAHA

From: footballjds
No need to lie. We all know that that's not the ONLY way ALL the time.
And Harry, it's laughable that you'd cite something from microsoft… HAHA

Well thats the only 100% way of removing.

From: footballjds
No need to lie. We all know that that's not the ONLY way ALL the time.
And Harry, it's laughable that you'd cite something from microsoft… HAHA

This.

From: supersain
Well thats the only 100% way of removing.

No it isn't don't be silly. A 'microsoft specialist' is somewhat lol. Sourcing what one would say is like calling customer service and telling them your computer's ethernet drivers are messed up and they'll tell you to go online and download the newest driver. Bunch of no brained, follow my step-by-step guide know-nothings.

From: footballjds
No need to lie. We all know that that's not the ONLY way ALL the time.
And Harry, it's laughable that you'd cite something from microsoft… HAHA

It's laughable to cite the people who actually make the OS, but is okay to listen people who have never had any extensive computer security training? Oooookay.

From: XxX Toxin XxX
A 'microsoft specialist' is somewhat lol. Sourcing what one would say is like calling customer service and telling them your computer's ethernet drivers are messed up and they'll tell you to go online and download the newest driver. Bunch of no brained, follow my step-by-step guide know-nothings.

He's the head security manager of the entire corporation. He knows what he's talking about. He's not some customer support whack, nor does he even do any customer support. You're crazy if you think any decent virus won't spread around into other places where you will never find it and other such issues.

When you came back, you started to find bots?

If yes, then you probably downloaded something injected and now this has caused you to get haxed.

Clean your computer. Format C works best. Google it.

Some really pesty rootkits are very hard to remove. Harder than reinstall/remove and they could just leave some shit in the bootsector or other hidden files. There are lots of cases where it's easier to reinstlal than malwarebytes, TDSSKiller, combofix and hijackthis. Some of those Java RAT's are very hard to remove because AV vendors usually don't detect those.
So now stop the lies.

From: Harry

He's the head security manager of the entire corporation. He knows what he's talking about. He's not some customer support whack, nor does he even do any customer support. You're crazy if you think any decent virus won't spread around into other places where you will never find it and other such issues.

Sorry Harry but even the head of the whole security end of the corporation is still is making it such a generalized thing to say, complete removal of any virus is 100% removed by reformatting… Well tell you what, even my 8 year old sister knows that, and she has little to no knowledge of computers, nor does she need to be the 'head' of security at Microsoft.

Clearly if one does not have any working knowledge of how to go on about removing it, or attempting to do so, then yeah sure go ahead and spend hours wiping your hard disk and re-installing your OS, drivers…etc

There are ways, not many, but there are existing ways to remove RAT's, if that is what he had. Who said his case was a 'decent' virus even? It was just undetectable by whatever antivirus software he was using.

From: Harry
It's laughable to cite the people who actually make the OS, but is okay to listen people who have never had any extensive computer security training? Oooookay.

I'll laugh at you citing Microsoft's opinion on ANYTHING. YES. Even their own OS.
I work with computers EVERY day of my life. It's my job. If i had to reformat every computer after the admin staff get a virus on it I'd be in a living hell…

From: Harry

He's the head security manager of the entire corporation. He knows what he's talking about. He's not some customer support whack, nor does he even do any customer support. You're crazy if you think any decent virus won't spread around into other places where you will never find it and other such issues.

Most viruses aren't "any decent"…

From: footballjds
I'll laugh at you citing Microsoft's opinion on ANYTHING. YES. Even their own OS.
I work with computers EVERY day of my life. It's my job. If i had to reformat every computer after the admin staff get a virus on it I'd be in a living hell..

Are you implying that you're smarter than a guy who has a Ph.D., CISSP cert, MCSE cert, etc? You, who hasn't even gone to school for it, knows better about it than someone who is the security head of a multi-billion dollar company? Plus, you are doing your job completely wrong if they are able to get a virus at all, much less they get it often enough that spending less than an hour reinstalling Windows and needed software would be considered "a living hell"

You guys are just being silly. He obviously tried to remove it and failed, thus repeated hackings. Using a different antivirus probably won't find it. Using all your RAT finding tools and having him waste a couple hours sending those logs to a site would be better spend doing a clean reformat where he will be 100% SURE he is clean.

You can pretend that running a ton of tools and having "experts" read the logs for you will go and be sure the problem is removed, but it doesn't change at the end of the day he would be most likely still rooted unless he flattens and rebuilds.

From: Harry
Are you implying that you're smarter than a guy who has a Ph.D., CISSP cert, MCSE cert, etc? You, who hasn't even gone to school for it, knows better about it than someone who is the security head of a multi-billion dollar company? Plus, you are doing your job completely wrong if they are able to get a virus at all, much less they get it often enough that spending less than an hour reinstalling Windows and needed software would be considered "a living hell"

You guys are just being silly. He obviously tried to remove it and failed, thus repeated hackings. Using a different antivirus probably won't find it. Using all your RAT finding tools and having him waste a couple hours sending those logs to a site would be better spend doing a clean reformat where he will be 100% SURE he is clean.

You can pretend that running a ton of tools and having "experts" read the logs for you will go and be sure the problem is removed, but it doesn't change at the end of the day he would be most likely still rooted unless he flattens and rebuilds.

I'm not going to argue with you at all, sorry to disappoint. All I'm saying is that his statement(and yours…) is over reaching.
relax, okay?
Most viruses can easily be removed. If that's not the case then you reformat. I would never just reformat as a first option… If you personally do not know what virus you have(maybe you're inexperienced or haven't seen that specific virus before) then you should probably just reformat to be sure…

Imo that microsoft dude is trying to prevent stupid.

From: footballjds
I'm not going to argue with you at all, sorry to disappoint. All I'm saying is that his statement(and yours…) is over reaching.
relax, okay?
Most viruses can easily be removed. If that's not the case then you reformat. I would never just reformat as a first option… If you personally do not know what virus you have(maybe you're inexperienced or haven't seen that specific virus before) then you should probably just reformat to be sure…

Imo that microsoft dude is trying to prevent stupid.

People with your attitude is why there are so many botnets in the world. Most viruses you won't know even exists until your IRL bank account gets wiped out. You can never be too paranoid over your security. Just keep believing your little cleans successfully removed the viruses, but don't come crying to anyone when your house gets raided by the police for being in someone's child porn botnet.

For the record I haven't gotten a virus on a box in over 8 years. Even for whatever job you say you have, make proper access policies and you will never have to deal with a virus other than Windows 0-days. It's a bit obvious you're a "general computer fixer guy" or something and not a security consultant, no offense intended.

From: Harry
It's a bit obvious you're a "general computer fixer guy" or something and not a security consultant, no offense intended.

none taken, I stopped caring what people hiding behind a pixel'd avatar say, thank god…

From: footballjds
none taken, I stopped caring what people hiding behind a pixel'd avatar say, thank god…

What's that supposed to mean :D

From: Harry
What's that supposed to mean :D

that i used to be too immature, :redface:

I'm sitting here laughing, but pardon me, do continue on with the show. It's quite funny, though IMO as footballjds has been saying all along I can't help but agree, just the name Microsoft makes me want to cringe because all they do is make everything idiot proof, gee sir, thanks I shall reformat my computer right away, because 100% there's zero chance of having it removed.

Harry, you're being very ignorant by saying that you're in 100% in agreement to what that guy from Microsoft is saying, because even you wouldn't just go and reformat your computer right away, you'd be digging in away at trying to find the source or wherever it is at.

I have to side with FJDS on this one.. Most viruses are easy to remove.. Note the word Most.. No one said all.

Process Explorer
GMer rootkit detector
Regedit open

Lots of brains and the right tools and you can tackle down a rat/virus/trojan/worm.. all the same things to me.. of course if the person is an expert and leaves a backdoor/hole then you better be good at finding exploits and holes in your own firewall.. A simple buffer overflow in your OS can screw you from a pro even if it's Microsoft's fault for stacking an array or objects.

And it doesn't matter how pro that Microsoft employee is.. I've seen guys with enough degrees get screwed in their own fields by a bunch of kids..

P.S. the tech guys with their A+ and PHD's and CCNA's in my Uni are stupid.. we bluescreen the school comps 24/7 with a program we wrote.. and they think it's a virus.. Turns out the only way to stop it is to update with a windows hotfix.. they ended up replacing all the computers saying it's a hardware problem.. LOL

[QUOTE='Toxin;954300]Harry, you're being very ignorant by saying that you're in 100% in agreement to what that guy from Microsoft is saying, because even you wouldn't just go and reformat your computer right away, you'd be digging in away at trying to find the source or wherever it is at.
No I wouldn't. If I was retarded enough to get a virus (haven't gotten one in over 8 years), I would instantly reformat. Anyone who doesn't is a sadist who enjoys wasting their time.

Your house has a huge hole in its roof that insects are flying in from and laying their eggs everywhere! You have a choice from your insurance company: either have us pay for a new house down the street from you- all you have to do is move your personal goods; or you can try to patch up the hole and clean out the eggs (and the soon to be larvae) in your house.

From: Harry
No I wouldn't. If I was retarded enough to get a virus (haven't gotten one in over 8 years), I would instantly reformat. Anyone who doesn't is a sadist who enjoys wasting their time.

Your house has a huge hole in its roof that insects are flying in from and laying their eggs everywhere! You have a choice from your insurance company: either have us pay for a new house down the street from you- all you have to do is move your personal goods; or you can try to patch up the hole and clean out the eggs (and the soon to be larvae) in your house.

This.

I've never had a virus either for a really long time and I don't even have an anti-virus software other than MSE. You just got to be smart..

Reformat. I store my documents, music, etc. on my server so I don't have much to back up. Just use something like Ninite :).

I just use ghost to restore my system in a healthy condition. All i have to do is copy a few folders to a flashdrive , restore image, copy folders again.

Takes no time at all and the moment I even think something might have gotten on my system i just do that. Even without a virus it's a routine every 2 months.

But I guess everyone handles his pc in his own way he feels best about. Take the advice that best suits you and stop argueing :D