SRL Archive - News and General

Reported Post:
http://www.sythe.org/report-spammer-archive/1544664-reported-post-trent.html

Posts he made:
http://puu.sh/2e1Op
http://puu.sh/2e1Ov

The response:

From: The Xoy
@Trent, go back to RiD and pay for your credits to use a simple script. Don't post here again please. We can compete against RiD, and win.

If you don't know Trent! is a HUGE proponent for the RiD bot.

He plugs it a lot and often aggrandizes it's capabilities to an extreme extent.

I like RiD, he's a very cool guy, but the bot isn't at at level which I would personally wish to pay for.

Someone is sad that RiD has competition….

AFAIK WBot is completely legit and made by competent people.

Also, why would anyone go through the trouble of making a legitimate WORKING bot, just to hack people, when MUCH MORE money could be made selling it?

Trent might be right, he might just trying to be cautious and help people out, WBot might be malicious, but I highly doubt it and just think he's upset that his favorite bot has some hardcore competition.

But coming from a proponent of a different bot, and being the ONLY 'evidence' trying SO HARD to crack down on a competing bot, it's just hard to take seriously.

Judge for yourself.

LOL, love gotta love Trent!:)

My favorite one is where he has the image from chrome… Any sort of executable has that warning. luls.

It is however indeed a virus…

Even I decompiled it… And DEOB'ed the Allatori Algorithm in it…

It connects to a private server (not a RSPS) on port 100..

Many attempts to open a connection alone shows some suspicion

From: Turpinator
My favorite one is where he has the image from chrome… Any sort of executable has that warning. luls.

Oh man I loved that part.
Any almost jar or exe chrome downloads it gives you that message.
Dat chrome warning evidence!
Surprised he didn't put up a UAC message too!

From: VillaVuFTW
It is however indeed a virus…

Even I decompiled it… And DEOB'ed the Allatori Algorithm in it…

It connects to a private server (not a RSPS) on port 100..

Many attempts to open a connection alone shows some suspicion

The Allatori Algorithm is just an obfuscator. I bet RiD uses it too because if you didn't obfuscate the inner code, every botting client would just steal each other's techniques.

Connecting to a private server might be a worry; but it could very well also be an updater for the client or a stats monitor. The real question is what information is passed along to said private server. Run Fiddler and monitor the Requests and Responses sent to this private non-Runescape address and see if there's anything to worry about.

From: VillaVuFTW
It is however indeed a virus…

Even I decompiled it… And DEOB'ed the Allatori Algorithm in it…

It connects to a private server (not a RSPS) on port 100..

Many attempts to open a connection alone shows some suspicion

There's lots of reasons someone would want to connect to a server, maybe they want to track the stats, see how many people are using their software, and for how long etc.

From: Netzone
There's lots of reasons someone would want to connect to a server, maybe they want to track the stats, see how many people are using their software, and for how long etc.

You don't realize… To check stats and shit would be port 80(HTTP) not Port 100

Damn I thought I was the only one who saw it but I didn't want to say anything.

Oh and I forgot to add

From: VillaVuFTW
You don't realize… To check stats and shit would be port 80(HTTP) not Port 100

A) Ports only really matter in a browser basis. If I make my own webservice that only I use, there's no reason I can't send my https traffic through port 80, my HTTP traffic through 72 and my UDP traffic through port 1. As this is a program, they can send anything on any port, with no worries, unless you block your ports (which you can do to prevent this from travelling along port 100).

B) Port 100, as standards define it, is for TCP and UDP traffic. If you aren't familiar with those protocols, they exist for consistent connections such as streaming video or sound (skype/youtube as example), or for statistics - as that is something that would be consistently updated with a loss in packets not being an issue. Stealing usernames/passwords would desire every packet(easily fitting in one) and would not need a consistent connection. So this isn't very likely.

Edit: Not saying they are safe. Just that the reasons listed so far aren't good enough to remotely convince me. Take a Fiddler report of its traffic along port 100 and show that to me and then I'll have much more basis for either side of the argument. Until then, I'm a devil's advocate.

From: VillaVuFTW
You don't realize… To check stats and shit would be port 80(HTTP) not Port 100

Post it on their official forum and see if the thread gets instant locked/deleted or if you get an answer :)

LOL, work IP is still blocked. Oh well.

Why's he getting so defensive