SRL Archive - News and General

Now I now what your thinking, I must of got keylogged from somewhere else but hear me out.

I brought a new computer, (to only use for OSR botting), in late Febuary. Right after installing windows I created a brand new Runescape account. ONLY this computer has ever logged in, or used my account details. My username is an email unknown to anyone and completely different to my character name. I do not use the same password anywhere else.

Now, I have been using Simba (the only program installed on the new computer) to bot, but last week I installed wBot (second program I ever installed). I do not run any scripts just login and walk around with wBot.

Today I go on my account to find it stripped (tbh I only had like 50k) and the last login from some finnish proxy IP.

There is only two options:

1) Simba contains a keylogger
or
2) wBot does

I will leave that conclusion to you.

Below is a screenshot of the IP:

Show us the simba scripts you have been using. We can check for anyone trying to hack you with simba from there (Simba defiantly doesn't contain a key logger itself, it would have to be a script)

I am not a fool and have checked the Simba scripts I ran (which was only a wood chopper and Fletcher).

http://villavu.com/forum/showthread.php?t=97027

This is the only script.

It's possible for individual Simba scripts to contain keylogging, but as for the client itself, I'd doubt that. And as far as individual scripts go, I feel like the majority of them here on villa have had at least one person look into them for exactly that.

As far as Wbot goes, would you consider risking yourself further for some possible analysis and direct proof of this happening?

Edit: Noting you hadn't had the reply of having personally checked the simba scripts yet, my first part can be ignored.

From: slixor
I am not a fool and have checked the Simba scripts I ran (which was only a wood chopper and Fletcher).

http://villavu.com/forum/showthread.php?t=97027

This is the only script.

fair enough, I'm 99.9% sure it's not simba in that case.

What wBot script?

http://www.wbot.nl/community/index.php/topic/4718-wbot-contains-keylogger/#entry50560

wBot thread where developers and mods attempt to lie and cover up.

I did not put my details in a phisher app.

You may have been infected by a java drive-by without knowing it. It happened to me last month. You should scan with malwarebytes and see if it finds anything. It did for me.

Tbh this is one of those things you can never really prove or track down.

I have run virus cans from various programs, all showing nothing out of the ordinary.

Just be careful when using wBot is all I can say.

Meh, how much geeepeees did you lose? :s

From: slixor
Tbh this is one of those things you can never really prove or track down.

I have run virus cans from various programs, all showing nothing out of the ordinary.

Just be careful when using wBot is all I can say.

Are you familiar with the program Fiddler? You can use it to record incoming and outgoing traffic. Unless they have something that says "This account already sent their info, don't send it this time," they would likely send your info every time. Or maybe even 1/10th of the time, anything. However, you can have Fiddler running in the background recording all the traffic and save the session. After that, you could then run a simple search on the outgoing packets for anything not headed to an Official RS server; then knowing which packets they sent to themselves, read what they're taking.

I believe it. I've seen quite a few posts about people getting hacked shortly after using wbot. Has anyone decompiled wBot?

This is exactly why I just use Simba,

Sorry to hear you got hacked, someone who knows how to do it safely should look into it, but we can't really stop noobs using it anyway I suppose :/

Edit - why on earth would someone de-rep this post…? Lol

A few people also accused my script of being malacious -.-

Running 3 accounts with wBot currently on a fresh VM, will see how it goes!

Slixor more like

newbsnore.

HAhahahahahahahahahahahahahahahaaaaaaaa

OT:

It doesn't have a keylogger

I'll be interested when one of my bot accounts gets hacked (if it does) as I've only got wbot/eclipse on this VM and it does nothing but bot.

I can decompile Wbot if anyone wants to look at it.
It won't be de-obsfugated or refactored, but the code is still there.

That pointless De-rep :P

Anyway. Do the smart thing and stop complaining about wBot unless you have hard facts.

I'm looking forward to hear more about this wBot from the others who are up to test this.

From: NKN
I can decompile Wbot if anyone wants to look at it.
It won't be de-obsfugated or refactored, but the code is still there.

I wouldn't mind having a look at it.

Heard from multiple people that it's a keylogger.

By the way I found a failed account stealer in a script before, this guy stole a fight caver and just added in code that posts the users login details to a webpage

Eh, running 5 accounts, going onto 4th day, still no 'hack'

Idk' seems less than coincidence that the IP address is the same country as the owners/creators of the website

And why do people use other programs besides Simba? I believe it's a keylogger, merely on the fact that it's not an open source program.

From: Kyle Undefined
And why do people use other programs besides Simba? I believe it's a keylogger, merely on the fact that it's not an open source program.

That's a good way to go about it. I've been seeing many reports, directly relating to this particular bot, of accounts being whipped clean. I personally wouldn't touch it with a 10-foot pole.