SRL Archive - Discussions & Debates

I recently started botting again via Simba… Never had a problem in the past, and I know for a fact that I never downloaded anything on this computer towards Runescape or anything of that matter on this computer…

I recently log in after going to bed and botting for a bit and noticed my account was stripped of (27K Cash, Rune Axe, and my Defense leveled up to 2)… I checked all the scripts I could find that I used and I found 0 that contained anything with stealing a password via a DATA Stealer (P07_PlayerName, etc)..

So please tell me… What could have been done…

Another confusing part: I have JAG Enabled -_-

Yes Simba is safe, you sure you didn't have jag enabled on any other computers somebody may have accessed? Did you do some virus scans?

You where botting on a 07 server? JAG doesn't work with 07.

From: Justin
You where botting on a 07 server? JAG doesn't work with 07.

Thats annoying lol :/

It's most likely a drive-by of some kind, I always make sure to have atleast one decent paid anti-virus software(best is personal pref) installed, or keep renewing trials,

Can't believe they leveled your def to 2 aswell :(

You clicked on a link which causes you to get phished/get a java drive by

Simba has been safe for a Long time, should've seen that since this is probably the first thread created this year about 'getting hacked'

From: Four
You clicked on a link which causes you to get phished/get a java drive by

Simba has been safe for a Long time, should've seen that since this is probably the first thread created this year about 'getting hacked'

Hey budd.. I don't condone with Drive-Bys… I'm one to know not to trust anything… I understand how safe it is.. But I also remember running a script made on here about loading some sort of other client… I'd like to know what it was…. It was a SIMBA SCRIPT -___-..

Nothing has been accessed on this computer except:
-Runescape.com
-Villavu.com
BRAND NEW COMPUTER

And they changed my name to HackedBy-SRL.. There goes my fucking name -_-

Yea I'm sure this happened, NOT. Mods would catch a infected script in minutes, one time I released a 15 line semi-obfuscated script that calculate max hit and within 3 mins I was told to post original clean source trust me theres no infected scripts on here.

It's not simba bud.
Don't know what it could have been but its not simba. NOT simba.

And now your name has been changed all of a sudden? Hmm fishy fishy.

You haven't told us what scripts you used. Anyhow, Simba is completely safe, obviously; it's open source.

Not accusing, but did anyone look through that SMART thing mx1000 posted?

Do you have the IP of the last person logged in to your account?

From: Echo_
Do you have the IP of the last person logged in to your account?

That's where I would start. Also, were you using anything unofficial? Specifically, related to BMWxi's suggestion?

There has been a hacking spree on 07 scape. alot of accounts are getting hacked. Its all over runescape forums. It has nothing to do with simba

From: Itankbots
There has been a hacking spree on 07 scape. alot of accounts are getting hacked. Its all over runescape forums. It has nothing to do with simba

The thing that gets me is how the OP said villavu.com and rs were the only thing they accessed. That and the name change

If they changed your name to HackedBy-SRL, then it is indeed worrying.

Do you have the IP? Have you tried any unofficial releases (except scripts)? What scripts were you using?

Perhaps I'm wrong, but I just looked through @DannyRS' OldschoolRS07 Include, and I couldn't find a screenshot capture part for the IP in the LoginPlayer. If I'm not mistaken, this means there is probably no IP record of the hacker :(

I think mx1000 (besides being heavily disliked for having stolen code and not giving credit) recently posted up a new link to a NON-SIMBA version of his bot that claims to run 07 reflection - which I seriously doubt he accomplished even remotely. Did you use "his" Fight Caves script?

From: BMWxi
Perhaps I'm wrong, but I just looked through @DannyRS' OldschoolRS07 Include, and I couldn't find a screenshot capture part for the IP in the LoginPlayer. If I'm not mistaken, this means there is probably no IP record of the hacker :(

Unfortunately that's true, if he logged in with Simba using that, there's no log :(

http://www.oracle.com/technetwork/topics/security/alert-cve-2013-1493-1915081.html

Annddd… another ZD exploit came out march 4 to java 7_15 and earlier.
Could have been a jdb. Could have.

Kinda hard to imagine how this happened if it wasn't a script from here and they changed your name to that.

#SimbaIsSafe
#PossibleTroll

From: Gucci
Kinda hard to imagine how this happened if it wasn't a script from here and they changed your name to that.

#SimbaIsSafe
#PossibleTroll

I still think it may have been someone from here, did anyone look through the .rar he posted?

Yeah the mx1000 dude did post a couple non-simba files into his fightcaver thread, did you run any of those by any chance?

Simba is not safe: Simba is a disney lion, like all lions the closer you get, the more likely you get eaten… … :surprised:
And back to the topic, Simba and it's scripts are open source, it's kinda your fault if you dont check the script. p.s. im back :)

From: DannyRS
Unfortunately that's true, if he logged in with Simba using that, there's no log :(

That needs to be added to the include ASAP

From: Echo_
That needs to be added to the include ASAP

Official Include near complete,

So, mine is discontinued

Still wonder why he hasn't responded on this thread.

mx was suspended yesterday for something or another (likely for all the ads he was posting for wbot).

Dont worry, i got scammed too from a faggot from bugabuse.net
And no i havent visited that site, i knew they had my acc and pass, and i was right

I sent a PM to Hobbit to look into the matter. It may very well be a result of mx1000's custom SMART package. Perhaps we can have the link to his client removed as well as a public warning.

He had already removed his rar and posted more ads to his site.
I've completely deleted the thread now. Will try and find a copy of his rar and take a look through

From: Hobbit
He had already removed his rar and posted more ads to his site.
I've completely deleted the thread now. Will try and find a copy of his rar and take a look through

Thanks Hobbit, I assumed you guys would have a copy of all attachments somewhere :)

@Hobbit i have a copy of the rar on the forum site he linked to

I looked through it and I couldnt find anything hidden in any of the included scripts or any thing hidden the in includes. Only thing I can think of is that he could have repacked one of the plugins but I doubt that. Also no hits on the IP who accessed the account.

On an unrelated note, @DannyRS; while going through your include comparing it to the version he had in his package, I came across these two lines, what is their purpose? (I cant find any)

  P07_PName:=P07_PlayerName;
  P07_PPass:=P07_PlayerPass;

From: Hobbit
I came across these two lines, what is their purpose? (I cant find any)

  P07_PName:=P07_PlayerName;
  P07_PPass:=P07_PlayerPass;

I saw that aswell

I'm guessing it makes it so you have to call

SetupP07Include;

before the login procedure or the script will terminate.

From: Hobbit
I looked through it and I couldnt find anything hidden in any of the included scripts or any thing hidden the in includes. Only thing I can think of is that he could have repacked one of the plugins but I doubt that. Also no hits on the IP who accessed the account.

On an unrelated note, @DannyRS; while going through your include comparing it to the version he had in his package, I came across these two lines, what is their purpose? (I cant find any)

  P07_PName:=P07_PlayerName;
  P07_PPass:=P07_PlayerPass;

Was originally so you had to call the setup to get it to load like mentioned above lol, realized how pointless it was later, but just never went back to change it as I stopped updating it a while ago, and theres no real negative effect from it

Happend to me too after using "RS_07 Powerminer"

More than likely you were hacked by Arcane or Irecover using a hacked forum database, while you use the same password and email combo for either a forum you signed up for or for Runescape. I know you'll claim to be all "I never use the same password" just like "It's a new laptop guise!" but I really don't care. Just trying to help you understand a way through which your account may have been compromised.