| Pages: 1 2 3 4 5 6 :: [one page] |
| Author |
Thread Statistics | Show CCP posts - 2 post(s) |

Barthez Thed
|
Posted - 2006.10.08 10:04:00 -
[1]
He's spamming all the active forum threads with read this link (i wouldn't, cos i smell something fishy) - so people beware!
|

Sovy Kurosei
Amarr Therianthropic Technologies
|
Posted - 2006.10.08 10:05:00 -
[2]
We're under attack!
Abdalion, Eris, whystler! Save us! ___________________
|

Jenny Spitfire
Caldari
|
Posted - 2006.10.08 10:05:00 -
[3]
Macro-spammer. --------- Cruelty is God's way of showing kindness and God is kind. Superior Vagabond pilots want http://oldforums.eveonline.com/?a=topic&threadID=405915 |

Barthez Thed
|
Posted - 2006.10.08 10:06:00 -
[4]
yeah thats what i thought, sad though....very sad of him/her
|

SentryRaven
Chaos Faction
|
Posted - 2006.10.08 10:06:00 -
[5]
*writes email to [email protected]....*
Ship Idea: Small Freighters EVE Activity Tracker |

Fey De'Way
|
Posted - 2006.10.08 10:06:00 -
[6]
Yeah some moderator should probably look inte getting him banned asap. Thx for the heads up
|

Minikrimi Extreme
Caldari Essence Privateers
|
Posted - 2006.10.08 10:07:00 -
[7]
Dunno what the link is to-- I clicked on it the first time I saw it and it sent IE into a tailspin. Canceling it had no effect, just sat there thinking about it until I pulled the power plug on my laptop :( So I moved to my desktop for this until I verify my laptop is clean. |

Lucian Corvinus
Gallente Expert Systems
|
Posted - 2006.10.08 10:07:00 -
[8]
he should have his nuts remove..
wake up gm's
|

Kazaam
Section XIII Tau Ceti Federation
|
Posted - 2006.10.08 10:07:00 -
[9]
His link goes to a webpage with a "Soft to hack eve" link to a .zip
DO NOT DOWNLOAD !! Could be some sort of trojan/keylogger or some crap of that kind _________________________________________
|

Jenny Spitfire
Caldari
|
Posted - 2006.10.08 10:07:00 -
[10]
/me presses the Crowd Control button. --------- Cruelty is God's way of showing kindness and God is kind. Superior Vagabond pilots want http://oldforums.eveonline.com/?a=topic&threadID=405915 |

Aeval Starwind
|
Posted - 2006.10.08 10:09:00 -
[11]
Its a link to a .zip file
Needless to say do not download or you deserve to lose your account and everything in it.
|

Patch86
Di-Tron Heavy Industries Knights Of the Southerncross
|
Posted - 2006.10.08 10:10:00 -
[12]
Edited by: Patch86 on 08/10/2006 10:10:41 Runa cleanup on your laptop before you plug the internet back in, it looks like its a nasty something or other.
Oh, and on Firefox it just linked to a site with a link to the download, but IE (might) be tricked into auto-downloading it, in the gullible way IE is often tricked. So, be careful, mmm'kay?
|

Jim McGregor
Caldari
|
Posted - 2006.10.08 10:11:00 -
[13]
He has done it in ALL forum channels....       --- Eve Wiki | Eve Tribune | Eve Pirate |

Barthez Thed
|
Posted - 2006.10.08 10:11:00 -
[14]
/me loves firefox, it stops these annoying auto pop-ups and prevents the computer from getting overwhelmed (at least mine did)
|

Sovy Kurosei
Amarr Therianthropic Technologies
|
Posted - 2006.10.08 10:12:00 -
[15]
He is almost as bad as Dark Shikari. 
Okay, I am joking.  ___________________
|

Jenny Spitfire
Caldari
|
Posted - 2006.10.08 10:13:00 -
[16]
The link goes to Ukraine.  --------- Cruelty is God's way of showing kindness and God is kind. Superior Vagabond pilots want http://oldforums.eveonline.com/?a=topic&threadID=405915 |

Exelsior
The Echelon
|
Posted - 2006.10.08 10:13:00 -
[17]
Ugh 
|

Reckart
|
Posted - 2006.10.08 10:14:00 -
[18]
I had a quick look at the prog and it's indeed a keylogger. No I didn't actually run the .exe but it's clear what it is from the config files.
|

Zhaine
B e l l u m
|
Posted - 2006.10.08 10:14:00 -
[19]
Oh for the love of Dog look at it! Blimey. . . - - - - - - - - - -
Quote: I don't even want a ship, ships are for carebears. Give me a fish bowl for my head (to keep space out) and smear me with lard, then armed with a toasting fork-
|

Barthez Thed
|
Posted - 2006.10.08 10:14:00 -
[20]
Edited by: Barthez Thed on 08/10/2006 10:13:49 and DenBrown seems like such a normal eve name (i suspect some poor sap has had his account taken over or something)
|

Polaskii
Amarr RONA Midgard Academy
|
Posted - 2006.10.08 10:15:00 -
[21]
Linkage 539 Posts!
|

Jim McGregor
Caldari
|
Posted - 2006.10.08 10:16:00 -
[22]
This is not good... alot of people will click that link and possibly get infected. :(
I hope ccp has some kind of software for mass-deleting.
--- Eve Wiki | Eve Tribune | Eve Pirate |

Patch86
Di-Tron Heavy Industries Knights Of the Southerncross
|
Posted - 2006.10.08 10:16:00 -
[23]
DenBrown is probably a play on Derren Brown, a psychological illusionist, magician, and stage trickster. He's famous for doing things like robbing people blind while they're looking right at him without them noticing (like one time when he stole a guys tie while he was wearing it). The Hacker probably thought this was ironic 
|

Forsch
Auctoritan Syndicate Curatores Veritatis Alliance
|
Posted - 2006.10.08 10:16:00 -
[24]
Originally by: Polaskii Linkage 539 Posts!
All today?
Forsch Defender of the empire
More love for side factions! |

Al Thorr
Caldari The Wheel
|
Posted - 2006.10.08 10:16:00 -
[25]
Alas its time for the devs to re evaluate the trialists privilages.
The few idiots and lame SOBs have done what they always do . Ruin it for newer players.
Regards
Al Thorr
"You cant polish a turd" - The new rendered font is living proof.
|

Laocoon
Veto.
|
Posted - 2006.10.08 10:16:00 -
[26]
ISK selling has now just cross the threshold of simply being 'anoyying', and is now in the dark, bleak bland of 'seriously concerning'.  
- Lao
Veto. Corp |

Polaskii
Amarr RONA Midgard Academy
|
Posted - 2006.10.08 10:17:00 -
[27]
Originally by: Forsch
All today?
Looks like it.
|

Laocoon
Veto.
|
Posted - 2006.10.08 10:18:00 -
[28]
I jsut went to ships & modules; holy ******* ****! 
I hope this is a serious wakeup for CCP & the issue of isk selling 
- Lao
Veto. Corp |

Jim McGregor
Caldari
|
Posted - 2006.10.08 10:19:00 -
[29]
They should close the forums tbh. This will cause alot of harm...
--- Eve Wiki | Eve Tribune | Eve Pirate |

Barthez Thed
|
Posted - 2006.10.08 10:19:00 -
[30]
yeah the darren brown analogy is noticed, though its isn't exactly a slight of hand tactic, more a sledghammer in the face and steals your wallet/account tactic
|

Polaskii
Amarr RONA Midgard Academy
|
Posted - 2006.10.08 10:20:00 -
[31]
Think its time trial accounts are banned from posting on the forums.
At this rate hes gonna have more posts than Dark S. himself
|

Rodj Blake
Amarr PIE Inc.
|
Posted - 2006.10.08 10:20:00 -
[32]
Well, there go the posting rights of all trial accounts.
Dulce et decorum est, pro imperator mori |

Polaskii
Amarr RONA Midgard Academy
|
Posted - 2006.10.08 10:20:00 -
[33]
Think its time trial accounts are banned from posting on the forums.
At this rate hes gonna have more posts than Dark S. himself
|

Rodj Blake
Amarr PIE Inc.
|
Posted - 2006.10.08 10:20:00 -
[34]
Well, there go the posting rights of all trial accounts.
Dulce et decorum est, pro imperator mori |

Sovy Kurosei
Amarr Therianthropic Technologies
|
Posted - 2006.10.08 10:21:00 -
[35]
Originally by: Rodj Blake Well, there go the posting rights of all trial accounts.
He also posted in the Corporation, Alliance and Organization Discussions forums so it can't be a trial account. ___________________
|

Exelsior
The Echelon
|
Posted - 2006.10.08 10:21:00 -
[36]
Originally by: Laocoon I jsut went to ships & modules; holy ******* ****! 
I hope this is a serious wakeup for CCP & the issue of isk selling 
It's not a link to isk afaik, it's a link to a keylogger.
|

Sovy Kurosei
Amarr Therianthropic Technologies
|
Posted - 2006.10.08 10:21:00 -
[37]
Originally by: Rodj Blake Well, there go the posting rights of all trial accounts.
He also posted in the Corporation, Alliance and Organization Discussions forums so it can't be a trial account. ___________________
|

Exelsior
The Echelon
|
Posted - 2006.10.08 10:21:00 -
[38]
Originally by: Laocoon I jsut went to ships & modules; holy ******* ****! 
I hope this is a serious wakeup for CCP & the issue of isk selling 
It's not a link to isk afaik, it's a link to a keylogger.
|

Patch86
Di-Tron Heavy Industries Knights Of the Southerncross
|
Posted - 2006.10.08 10:22:00 -
[39]
Originally by: Barthez Thed yeah the darren brown analogy is noticed, though its isn't exactly a slight of hand tactic, more a sledghammer in the face and steals your wallet/account tactic
Yah, it's hardly subtle. Probably just the hacker amusing himself 
|

Forsch
Auctoritan Syndicate Curatores Veritatis Alliance
|
Posted - 2006.10.08 10:22:00 -
[40]
Originally by: Sovy Kurosei He also posted in the Corporation, Alliance and Organization Discussions forums so it can't be a trial account.
In that case *some* account should be in trouble.
Forsch Defender of the empire
More love for side factions! |

Deadeye Dave
Amarr Lynx Frontier Inc. Ascendant Frontier
|
Posted - 2006.10.08 10:22:00 -
[41]
Its very annoying and I hope the mods/GMs will notice this character and ban him and delete all his posts. I just hope the mods check their inbox as many people would of mailed them about this issue.
|

JohnTheBaptist
Astronomic Influence
|
Posted - 2006.10.08 10:22:00 -
[42]
Just hope the mods have a 'delete all posts of this user' button. I would hate to have to go through all the threads cleaning them 
|

Barthez Thed
|
Posted - 2006.10.08 10:22:00 -
[43]
Originally by: Rodj Blake Well, there go the posting rights of all trial accounts.
yup, or probably at least a limit in the number of posts allowed per day (say 3?, noobs tend to have lots of questions as well)
|

Exelsior
The Echelon
|
Posted - 2006.10.08 10:22:00 -
[44]
Originally by: Forsch
Originally by: Polaskii Linkage 539 Posts!
All today?
690 now..
|

Patch86
Di-Tron Heavy Industries Knights Of the Southerncross
|
Posted - 2006.10.08 10:22:00 -
[45]
Originally by: Barthez Thed yeah the darren brown analogy is noticed, though its isn't exactly a slight of hand tactic, more a sledghammer in the face and steals your wallet/account tactic
Yah, it's hardly subtle. Probably just the hacker amusing himself 
|

Forsch
Auctoritan Syndicate Curatores Veritatis Alliance
|
Posted - 2006.10.08 10:22:00 -
[46]
Originally by: Sovy Kurosei He also posted in the Corporation, Alliance and Organization Discussions forums so it can't be a trial account.
In that case *some* account should be in trouble.
Forsch Defender of the empire
More love for side factions! |

Deadeye Dave
Amarr Lynx Frontier Inc. Ascendant Frontier
|
Posted - 2006.10.08 10:22:00 -
[47]
Its very annoying and I hope the mods/GMs will notice this character and ban him and delete all his posts. I just hope the mods check their inbox as many people would of mailed them about this issue.
|

JohnTheBaptist
Astronomic Influence
|
Posted - 2006.10.08 10:22:00 -
[48]
Just hope the mods have a 'delete all posts of this user' button. I would hate to have to go through all the threads cleaning them 
|

Barthez Thed
|
Posted - 2006.10.08 10:22:00 -
[49]
Originally by: Rodj Blake Well, there go the posting rights of all trial accounts.
yup, or probably at least a limit in the number of posts allowed per day (say 3?, noobs tend to have lots of questions as well)
|

Exelsior
The Echelon
|
Posted - 2006.10.08 10:22:00 -
[50]
Originally by: Forsch
Originally by: Polaskii Linkage 539 Posts!
All today?
690 now..
|

Exelsior
The Echelon
|
Posted - 2006.10.08 10:23:00 -
[51]
Someone log his IP and spam him back :P
|

Polaskii
Amarr RONA Midgard Academy
|
Posted - 2006.10.08 10:23:00 -
[52]
He must be mad because he lost all his stuff in jita.
|

Barthez Thed
|
Posted - 2006.10.08 10:23:00 -
[53]
Originally by: Sovy Kurosei
Originally by: Rodj Blake Well, there go the posting rights of all trial accounts.
He also posted in the Corporation, Alliance and Organization Discussions forums so it can't be a trial account.
probably an already hacked account (/me guesses)
|

Exelsior
The Echelon
|
Posted - 2006.10.08 10:23:00 -
[54]
Someone log his IP and spam him back :P
|

Polaskii
Amarr RONA Midgard Academy
|
Posted - 2006.10.08 10:23:00 -
[55]
He must be mad because he lost all his stuff in jita.
|

Barthez Thed
|
Posted - 2006.10.08 10:23:00 -
[56]
Originally by: Sovy Kurosei
Originally by: Rodj Blake Well, there go the posting rights of all trial accounts.
He also posted in the Corporation, Alliance and Organization Discussions forums so it can't be a trial account.
probably an already hacked account (/me guesses)
|

Al Thorr
Caldari The Wheel
|
Posted - 2006.10.08 10:24:00 -
[57]
The speediness of the devs to counter this is amazing.
He certainly did his homework as to the correct day to try this.
"You cant polish a turd" - The new rendered font is living proof.
|

Al Thorr
Caldari The Wheel
|
Posted - 2006.10.08 10:24:00 -
[58]
The speediness of the devs to counter this is amazing.
He certainly did his homework as to the correct day to try this.
"You cant polish a turd" - The new rendered font is living proof.
|

Jim McGregor
Caldari
|
Posted - 2006.10.08 10:27:00 -
[59]
Originally by: Al Thorr The speediness of the devs to counter this is amazing.
He certainly did his homework as to the correct day to try this.
Ive spammed the mod email and the irc... hoping they know by now.
--- Eve Wiki | Eve Tribune | Eve Pirate |

Jim McGregor
Caldari
|
Posted - 2006.10.08 10:27:00 -
[60]
Originally by: Al Thorr The speediness of the devs to counter this is amazing.
He certainly did his homework as to the correct day to try this.
Ive spammed the mod email and the irc... hoping they know by now.
--- Eve Wiki | Eve Tribune | Eve Pirate |

Reckart
|
Posted - 2006.10.08 10:28:00 -
[61]
lol we got one of his revived topics locked...only 600 to go...gogo isd!
|

Reckart
|
Posted - 2006.10.08 10:28:00 -
[62]
lol we got one of his revived topics locked...only 600 to go...gogo isd!
|

Deadeye Dave
Amarr Lynx Frontier Inc. Ascendant Frontier
|
Posted - 2006.10.08 10:29:00 -
[63]
Some pictures:
Linkage
Linkage
|

Deadeye Dave
Amarr Lynx Frontier Inc. Ascendant Frontier
|
Posted - 2006.10.08 10:29:00 -
[64]
Some pictures:
Linkage
Linkage
|

wierchas noobhunter
Caldari Praxiteles Inc.
|
Posted - 2006.10.08 10:30:00 -
[65]
kill him ! kill him now and all his family and bad his ip and ban his country ip   
join me be cool |

Barthez Thed
|
Posted - 2006.10.08 10:32:00 -
[66]
looks like a forum mod has removed the links now, \o/
|

Aiarmonus Pirtius
Amarr DarkStar 1 Ascendant Frontier
|
Posted - 2006.10.08 10:34:00 -
[67]
Originally by: Jim McGregor
Originally by: Al Thorr The speediness of the devs to counter this is amazing.
He certainly did his homework as to the correct day to try this.
Ive spammed the mod email and the irc... hoping they know by now.
It would seem someone's spammage got them to do something. From what I can see he didn't post anything since 10.06 GMT.
I suppose we can only hope he won't be able to do too much damage with the link he posted. I did open it to see what was in it, but my comp( well my parent's comp because that's where I am atm) decided to lock up. Still posting with an alt account just in case my quick is there anything weird search missed anything.
My main is the not at all famous Arthalion Thoidon.
|

Hydrian Alante
The Loot Company
|
Posted - 2006.10.08 10:37:00 -
[68]
I made a screenshot
This is a very sad day in EvE. Probably the sadest day ever.
It¦s not just the malware that will cause much trouble. The whole forum order is destroyed.
The problem with this is, if he gets banned then he will come back shortly after. And now there is such a forum spam macro in the internet. What will happen if multiple hacker with multiple trial accounts will spam the forum?
|

evistin
Multiverse Corporation
|
Posted - 2006.10.08 10:37:00 -
[69]
There is no way the mods can move fast enough, unless his account is deleted.
Anyhow I am looking at the link he has, anyone know what it does, I suspect a key logger. -----------
Management and Leadership û The Eve-online Guide |

Jim McGregor
Caldari
|
Posted - 2006.10.08 10:45:00 -
[70]
Edited by: Jim McGregor on 08/10/2006 10:46:04
Originally by: Hydrian Alante
And now there is such a forum spam macro in the internet.
Its very easy to create one, even for a novice programmer. I thought the forums had a limit to how many posts one person could do in a certain period of time. Appearently not. Im guessing they might put one in after this incident.
--- Eve Wiki | Eve Tribune | Eve Pirate |

Al Thorr
Caldari The Wheel
|
Posted - 2006.10.08 10:48:00 -
[71]
I agree it is indeed a sad day.
Yes the devs now have a very sticky issue to resolve,
Do they 1) continue the status quo and allow trial accounts access to the sites.
2) Treat all Trialists as potential spammers and not allow them any posting privilages.
I would personally err on the side of caution and go for 2
Regards
Al Thorr "You cant polish a turd" - The new rendered font is living proof.
|

Infinity Ziona
Privateers
|
Posted - 2006.10.08 10:50:00 -
[72]
Originally by: Hydrian Alante I made a screenshot
This is a very sad day in EvE. Probably the sadest day ever.
It¦s not just the malware that will cause much trouble. The whole forum order is destroyed.
The problem with this is, if he gets banned then he will come back shortly after. And now there is such a forum spam macro in the internet. What will happen if multiple hacker with multiple trial accounts will spam the forum?
Damn relax m8. Hes just one of a countless number of retards that do this to forums every day. Forums will adapt to him and his moment of fame will be forgotten in a blink of the uncaring eye of the internet and its peons (us). The Privateering Life |

Vireya
Broken Saints
|
Posted - 2006.10.08 10:50:00 -
[73]
still posting in new citizens.... i keep seeing posts appear then get deleted....
|

Torquemanda Corteaz
Gallente Infinite Improbability Inc Dusk and Dawn
|
Posted - 2006.10.08 10:56:00 -
[74]
people have so little to talk about that we get 5 general discussion threads about the same subject?
yeah slow day
|

Patch86
Di-Tron Heavy Industries Knights Of the Southerncross
|
Posted - 2006.10.08 11:03:00 -
[75]
Lol, good point. You'd think the general crappiness of the EVE-O forums would be defense enough, wouldn't you?
|

Barthez Thed
|
Posted - 2006.10.08 11:03:00 -
[76]
if anyone downloaded it, run virus scanner and delete the thing, normal tinfoil reactions should apply here:
Password changes etc (but make sure the keylogger is off your system first), i may even install a new eve client, just to be paranoid
could better qualafied people help out and give better advice :)
|

Torquemanda Corteaz
Gallente Infinite Improbability Inc Dusk and Dawn
|
Posted - 2006.10.08 11:03:00 -
[77]
has anyone actually emailed the mod team yet?
|

Barthez Thed
|
Posted - 2006.10.08 11:04:00 -
[78]
Originally by: Torquemanda Corteaz has anyone actually emailed the mod team yet?
I believe Jim McGregor has, and forum mods have deleted the link in some places so they know
|

Presidente Gallente
|
Posted - 2006.10.08 11:06:00 -
[79]
I am sure it's a trojan horse to capture the login data.
I downloaded the ZIP and checked it by AntiVir. No known virus there.
The ZIP contains: php5ts.dll hack_eve.exe config.ini README.txt
The config.ini: your_login = Login your_password = Password nick_to_hack = Nick_Hack new_pass = New_pass
This smells like: please insert your actual user/pwd to change to a new hack-login, or something like that.
I sent a petition to CCP to investigate that case.
Presidente Gallente
|

Hydrian Alante
The Loot Company
|
Posted - 2006.10.08 11:11:00 -
[80]
Edited by: Hydrian Alante on 08/10/2006 11:14:08
Originally by: Al Thorr I agree it is indeed a sad day.
Yes the devs now have a very sticky issue to resolve,
Do they 1) continue the status quo and allow trial accounts access to the sites.
2) Treat all Trialists as potential spammers and not allow them any posting privilages.
I would personally err on the side of caution and go for 2
It¦s not a trial account.
1. Its an already hacked account that is totally cleared up 2. A new account made that got probably paid by isk
Originally by: Infinity Ziona
Damn relax m8. Hes just one of a countless number of retards that do this to forums every day. Forums will adapt to him and his moment of fame will be forgotten in a blink of the uncaring eye of the internet and its peons (us).
I don¦t give a **** on other forums. And I¦m using many other forums and none of them was spammed like this. I¦m playing for 15 months now and this is first time I see this on the EvE forums. So this behavior is all but not common.
And I don¦t think that the forums will adept. This forum software was already outdated 2 years ago.
Just see how the mods work. They are totally powerless. They are closing all thread by hands and are just removing the links.
What aabout all this discussions? Closed for everytime? When I¦m looking for something, the first thing I do is a forum search.
|

Ozzie Asrail
FATAL REVELATIONS Lotka Volterra
|
Posted - 2006.10.08 11:11:00 -
[81]
lol how lame. Must just send what you put into the config.txt to php script or something.
poor modsgot hell of alot of post editing to do  -----
|

Tharrn
Amarr 1st Praetorian Guard Vigilia Valeria
|
Posted - 2006.10.08 11:13:00 -
[82]
The worst thing is that he has totally ****** up the frontpage - the old threads remain to be on top even if the mods delete his posts :/
****er.
Now recruiting!
|

Death Kill
Caldari direkte
|
Posted - 2006.10.08 11:15:00 -
[83]
Originally by: Lucian Corvinus he should have his nuts head removed..
wake up gm's
N=R* x fp x ne x fl x Fi x fc x L |

Elgar Lightfoot
Lightfoot Industries
|
Posted - 2006.10.08 11:18:00 -
[84]
Don't panic if you have clicked the link. It's not a keylogger or a trojan. You are safe to delete the file and continue as normal.
It is however an extremely illegal program and if you run it you are likely to lose your account and do some jail time on top.
It is highly illegal. It's definately traceable and anyone that runs it is going to show up on CCP's logs like a flashing red beacon.
|

Maumau Jimbo
|
Posted - 2006.10.08 11:20:00 -
[85]
Edited by: Maumau Jimbo on 08/10/2006 11:21:26
Originally by: Elgar Lightfoot Don't panic if you have clicked the link. It's not a keylogger or a trojan. You are safe to delete the file and continue as normal.
It is however an extremely illegal program and if you run it you are likely to lose your account and do some jail time on top.
It is highly illegal. It's definately traceable and anyone that runs it is going to show up on CCP's logs like a flashing red beacon.
lol
eve has the worst support ever. i wrote a mail last week an still got no answer. gms need 2-3 days to answer...
|

Death Kill
Caldari direkte
|
Posted - 2006.10.08 11:21:00 -
[86]
Originally by: Elgar Lightfoot Don't panic if you have clicked the link. It's not a keylogger or a trojan. You are safe to delete the file and continue as normal.
It is however an extremely illegal program and if you run it you are likely to lose your account and do some jail time on top.
It is highly illegal. It's definately traceable and anyone that runs it is going to show up on CCP's logs like a flashing red beacon.
Interesting.
Please elaborate?
N=R* x fp x ne x fl x Fi x fc x L |

Siigari Kitawa
Gallente HelpCorp United
|
Posted - 2006.10.08 11:23:00 -
[87]
Maybe someone could create a trial account (I know nobody EVER uses trial accounts, so this is stepping out on a limb) and give the program a try just to see what kind of results it gives.
Maybe then we can know what this guy is up to?
|

Elgar Lightfoot
Lightfoot Industries
|
Posted - 2006.10.08 11:25:00 -
[88]
Edited by: Elgar Lightfoot on 08/10/2006 11:25:57 refer to this link - http://oldforums.eveonline.com/?a=topic&threadID=406305
I've already pulled the program apart and know what it does. Suffice to say all you need to know is that it's highly illegal, traceable and DOES carry a long prison sentence in most countries for using such a h-a-c-king program.
|

viral storm
|
Posted - 2006.10.08 11:28:00 -
[89]
if it auto downloaded (i use IE) where would the file be? so i can delete it im running norton antivirus as we speak
|

Barthez Thed
|
Posted - 2006.10.08 11:30:00 -
[90]
it will probably be in the temp folder, order the files by date and it should be near the most recent
|

Death Kill
Caldari direkte
|
Posted - 2006.10.08 11:30:00 -
[91]
Edited by: Death Kill on 08/10/2006 11:30:29
Originally by: viral storm if it auto downloaded (i use IE) where would the file be?
I belive you would have to confirm an autodownload with a mouse click though I'm not sure.
Anyhow, stop using I.E. Switch to Firefox, there really isnt any reason to why you should be using I.E at all.
N=R* x fp x ne x fl x Fi x fc x L |

Patch86
Di-Tron Heavy Industries Knights Of the Southerncross
|
Posted - 2006.10.08 11:32:00 -
[92]
Originally by: Siigari Kitawa Maybe someone could create a trial account (I know nobody EVER uses trial accounts, so this is stepping out on a limb) and give the program a try just to see what kind of results it gives.
Maybe then we can know what this guy is up to?
Leave it to the GMs, its not worth risking things mucking around with it yourself. As one poster mentioned, using it could well be illegal, so don't.
|

Siigari Kitawa
Gallente HelpCorp United
|
Posted - 2006.10.08 11:32:00 -
[93]
Originally by: Elgar Lightfoot Edited by: Elgar Lightfoot on 08/10/2006 11:25:57 refer to this link - http://oldforums.eveonline.com/?a=topic&threadID=406305
I've already pulled the program apart and know what it does. Suffice to say all you need to know is that it's highly illegal, traceable and DOES carry a long prison sentence in most countries for using such a h-a-c-king program.
But the word "hack" means so many different things. How do you know of it's neferiousness if you have not decompiled the executable and the dll's to see what they contain? "Suffice it to say" I believe you are speculating. No offense. Everyone's a little frustrated by this guy.
|

Elgar Lightfoot
Lightfoot Industries
|
Posted - 2006.10.08 11:40:00 -
[94]
Quote: But the word "hack" means so many different things. How do you know of it's neferiousness if you have not decompiled the executable and the dll's to see what they contain? "Suffice it to say" I believe you are speculating. No offense. Everyone's a little frustrated by this guy.
I have decompiled it. I'm a programmer, as you will see by searching for my name in google. You may find a better hit if you search for 'ELTank'.
It uses a simple PHP scripting engine thats widely available from www.php.net and then carrys out it's nefarious tasks.
|

Xenofur
Di-Tron Heavy Industries Knights Of the Southerncross
|
Posted - 2006.10.08 11:47:00 -
[95]
lol, illegal, it's about as illegal as any other macro here.
you said before it's a bruteforcer, so all it does is try to logon to a certain accountname while cycling through a number of combinations of characters that culd be used in eve passwords. the program probably does that to the account management site as it offers the possibility to change it to a new password.
stop trying to fearmonger and lying to the people or feel free to provide actual links to government sites that detail the law pertaining to that. (i'm assuming you live in the us, so that would suffice.)
|

Elgar Lightfoot
Lightfoot Industries
|
Posted - 2006.10.08 11:51:00 -
[96]
Edited by: Elgar Lightfoot on 08/10/2006 11:54:50
News Link
He spent a year in prison. Six years on probation and was banned from using computers.
It's illegal, traceable and heavily prosecuted when caught. This hack is even more traceable as it hammers CCP's account login servers, while giving your own account details for it's authentication.
As to my location, I live in the UK.
Yes I'm a macro programmer. I'm a LEGAL macro programmer. Asheron's Call permits their use.
|

viral storm
|
Posted - 2006.10.08 11:52:00 -
[97]
Edited by: viral storm on 08/10/2006 11:53:04 oi leave Elgar Lightfoot alone. he told me how to search for the program (to see if i had it) and also told me how to remove it (if i had it) then running virus scans on my PC he has been helpful, unlike YOU (XENOFUR) coming in at the end and flaming his ***
|

Death Kill
Caldari direkte
|
Posted - 2006.10.08 12:02:00 -
[98]
Originally by: Xenofur Edited by: Xenofur on 08/10/2006 11:48:30 lol, illegal, it's about as illegal as any other macro here.
you said before it's a bruteforcer, so all it does is try to logon to a certain accountname while cycling through a number of combinations of characters that culd be used in eve passwords. the program probably does that to the account management site as it offers the possibility to change it to a new password.
stop trying to fearmonger and lying to the people or feel free to provide actual links to government sites that detail the law pertaining to that. (i'm assuming you live in the us, so that would suffice.)
rofl, i just searched for your eltank thingy, WOW, you're a MACRO programmer. lots of respect that gets you! :D

N=R* x fp x ne x fl x Fi x fc x L |

Baleorg
Gallente Guys of Sarcasm
|
Posted - 2006.10.08 12:03:00 -
[99]
Originally by: Polaskii Think its time trial accounts are banned from posting on the forums.
funny, just because of ONE event everyone cries "ohno no more posting, the forum gets closed, the eve game will be canceled, the end will be stopped"
*sigh* ---
BTW: A GOOD Cache-Cleaner |

Siigari Kitawa
Gallente HelpCorp United
|
Posted - 2006.10.08 12:05:00 -
[100]
Edited by: Siigari Kitawa on 08/10/2006 12:05:54
Originally by: Elgar Lightfoot
Quote: But the word "hack" means so many different things. How do you know of it's neferiousness if you have not decompiled the executable and the dll's to see what they contain? "Suffice it to say" I believe you are speculating. No offense. Everyone's a little frustrated by this guy.
I have decompiled it. I'm a programmer, as you will see by searching for my name in google. You may find a better hit if you search for 'ELTank'.
It uses a simple PHP scripting engine thats widely available from www.php.net and then carrys out it's nefarious tasks.
Oh, ok.
/me nods to Elgar
...so what does it do??
|

fuze
Gallente Chosen Path Lotka Volterra
|
Posted - 2006.10.08 12:06:00 -
[101]
And you thought all those ebay sellers were nice guys? They're criminals in for your money, one way or the other. |

Fuglife
Celestial Apocalypse
|
Posted - 2006.10.08 12:14:00 -
[102]
Very lame.
Please resize your e-peen to a maximum of 400 x 120, not exceeding 24000 bytes, ty - Cortes No - Fuglife Please its far too big - Eris |

Barthez Thed
|
Posted - 2006.10.08 12:16:00 -
[103]
Originally by: Gonada rofl, i just searched for your eltank thingy, WOW, you're a MACRO programmer. lots of respect that gets you! :D -------------------------
you know Xen, if you took your head out of your arse just long nuff to grow up a tad, you might actuall make it in the world.
1. the guy is honest about what he does 2. he appears to know what he is doing 3. he is using his knowlage to try and help people here
that's whats got my respect, So leave him alone
|

Elgar Lightfoot
Lightfoot Industries
|
Posted - 2006.10.08 12:18:00 -
[104]
Brute-force password hacks are totally illegal, in most countries. They are obtaining unauthorized access to machines, accounts and financial details.
The part that makes it illegal is that it's unauthorized.
But the whole point of my post was to reassure those who were panicked by the thought they they had been infected and were now going to have their accounts stolen from them. Note I said stolen, another illegal act.
|

Xenofur
Di-Tron Heavy Industries Knights Of the Southerncross
|
Posted - 2006.10.08 12:26:00 -
[105]
As i said before: Could you please quote actual laws or give solid evidence? I for one know at least 4 western countries that don't care in the least and no, none of these are small things like luxemburg(sp). ;) For me this is not only a matter of curiosity, but also a matter of real consequences, as i could use said knowledge for protection of my own sites. =)
|

Barthez Thed
|
Posted - 2006.10.08 12:37:00 -
[106]
Edited by: Barthez Thed on 08/10/2006 12:37:47
here is a link describing uk legislation on the subject:uk legislation
|

Patch86
Di-Tron Heavy Industries Knights Of the Southerncross
|
Posted - 2006.10.08 12:38:00 -
[107]
Edited by: Patch86 on 08/10/2006 12:38:14 Never mind
|

Death Kill
Caldari direkte
|
Posted - 2006.10.08 12:38:00 -
[108]
Originally by: Xenofur As i said before: Could you please quote actual laws or give solid evidence?
I think its your job to quote actual law that says its not illegal for someone to break into remote systems.
N=R* x fp x ne x fl x Fi x fc x L |

Dark Shikari
Caldari Imperium Technologies Firmus Ixion
|
Posted - 2006.10.08 12:41:00 -
[109]
Edited by: Dark Shikari on 08/10/2006 12:40:57
Originally by: Barthez Thed
Originally by: Gonada rofl, i just searched for your eltank thingy, WOW, you're a MACRO programmer. lots of respect that gets you! :D -------------------------
you know Xen, if you took your head out of your arse just long nuff to grow up a tad, you might actuall make it in the world.
1. the guy is honest about what he does 2. he appears to know what he is doing 3. he is using his knowlage to try and help people here
that's whats got my respect, So leave him alone
QFT.
People on these forums seem to explode when they hear the word "macro," even though not all games prohibit them and they are often used for good purposes.
He's helped us, why flame him?
-[23] Member-
Awesome new space games site, from the editor of E-ON! |

Xenofur
Di-Tron Heavy Industries Knights Of the Southerncross
|
Posted - 2006.10.08 12:45:00 -
[110]
6 months in the uk? not bad.
you have my thanks.
*goes trawl his access logs for uk ips*
sidenote: my main argument with his posts was that he came across like this: guy is lying on the street, crowd around him. random guy pipes up: "let me through, i'm a doctor, i have already used leeches on someone!" guy on the street coughs. previous guy: "get at least 50m away from him, it's highly contagious."
or in other words: good intentions, not necessarily true though.
|

Elgar Lightfoot
Lightfoot Industries
|
Posted - 2006.10.08 12:46:00 -
[111]
Not being a lawyer I cant quote laws, a can provide a few snippets that might help you though.
In 1986, Congress passed the Federal Computer Fraud and Abuse Act. The first person to be convicted under this Act was Robert Morris, a hacker who accidentally released an Internet worm and crashed 6,000 computer systems in 1988. He was fined $10,000 and hours of community service. Also in 1988, hacker Kevin Mitnick broke into the Digital Equipment Company's network and was sentenced to a year in jail. After his release he went on the run, hacking into computers, stealing corporate secrets, scrambling phone networks, and breaking into the national defense warning system. He was finally caught and arrested again in 1995, charged with stealing 20,000 credit card numbers and illegally using stolen cell phone numbers. He was released from prison on Jan. 21st, 2000.
But the best example that I find is one where students actualyl had the password but were not given permisison to access the network. They got a year in prison.
Linkage
In the UK most of it is covered by the Data protection act of 1984.
|

Xenofur
Di-Tron Heavy Industries Knights Of the Southerncross
|
Posted - 2006.10.08 12:55:00 -
[112]
btw, just i case any isd guys read this: please ask your forum people wether they can implement a post blocker based on certain words or in this case, urls. i was going to suggest extending the badword blocker you have, but it seems it doesn't actually modify the post, but only the presentation. o_O
|

Dark Shikari
Caldari Imperium Technologies Firmus Ixion
|
Posted - 2006.10.08 12:56:00 -
[113]
Originally by: Xenofur btw, just i case any isd guys read this: please ask your forum people wether they can implement a post blocker based on certain words or in this case, urls.
They'd just use TinyURL and put comments after the URL to change the tinyurl for each post.
-[23] Member-
Awesome new space games site, from the editor of E-ON! |

Patch86
Di-Tron Heavy Industries Knights Of the Southerncross
|
Posted - 2006.10.08 12:57:00 -
[114]
Note a new character is spamming the same link now: SiaKharn.
|

Caletha
|
Posted - 2006.10.08 12:57:00 -
[115]
It still doesnt make the program illegal. The act of breaking into a computer is illegal. And stealing peoples accounts is as well. The program however, is not. However I highly doubt this is just a bruteforce password hacker.
|

Barthez Thed
|
Posted - 2006.10.08 12:59:00 -
[116]
yup DenBrown morphs into a new identity
|

Elgar Lightfoot
Lightfoot Industries
|
Posted - 2006.10.08 13:00:00 -
[117]
Originally by: Caletha It still doesnt make the program illegal. The act of breaking into a computer is illegal. And stealing peoples accounts is as well. The program however, is not. However I highly doubt this is just a bruteforce password hacker.
True, but the use of the program is illegal. Therefor theres no point in having the program at all if it's illegal to use.
Just delete it and move on. Stay safe.
|

Dark Shikari
Caldari Imperium Technologies Firmus Ixion
|
Posted - 2006.10.08 13:01:00 -
[118]
Originally by: Caletha It still doesnt make the program illegal. The act of breaking into a computer is illegal. And stealing peoples accounts is as well. The program however, is not. However I highly doubt this is just a bruteforce password hacker.
DeCSS is another example of an illegal program.
-[23] Member-
Awesome new space games site, from the editor of E-ON! |

Xenofur
Di-Tron Heavy Industries Knights Of the Southerncross
|
Posted - 2006.10.08 13:06:00 -
[119]
Originally by: Dark Shikari
Originally by: Xenofur btw, just i case any isd guys read this: please ask your forum people wether they can implement a post blocker based on certain words or in this case, urls.
They'd just use TinyURL and put comments after the URL to change the tinyurl for each post.
they could use a link parser in that case: warning, pseudo-code: if url = *tinyurl* { grab_content(url); } if content in blocklist { block_post(); }
|

Peter Stuyvesant
Amarr
|
Posted - 2006.10.08 13:08:00 -
[120]
Originally by: Patch86 Note a new character is spamming the same link now: SiaKharn.
Have any of you looked up these spammers in-game? Denbrown is a 1 day old noobcorp member but SiaKharn sure isn't. Hope the guy didn't get his account hacked 
|

Dark Shikari
Caldari Imperium Technologies Firmus Ixion
|
Posted - 2006.10.08 13:11:00 -
[121]
Edited by: Dark Shikari on 08/10/2006 13:10:42
Originally by: Peter Stuyvesant
Originally by: Patch86 Note a new character is spamming the same link now: SiaKharn.
Have any of you looked up these spammers in-game? Denbrown is a 1 day old noobcorp member but SiaKharn sure isn't. Hope the guy didn't get his account hacked 
I'm guessing his account was sold or hacked.
-[23] Member-
Awesome new space games site, from the editor of E-ON! |
|

wystler
Forum Moderator Interstellar Services Department

|
Posted - 2006.10.08 13:12:00 -
[122]
I think that SiaKharn was someone who tried to use the hack program and got his account details pilfered.
|
|

Jim McGregor
Caldari
|
Posted - 2006.10.08 13:35:00 -
[123]
Edited by: Jim McGregor on 08/10/2006 13:35:45
Introduce a post/minute limit please.
--- Eve Wiki | Eve Tribune | Eve Pirate |

Xenofur
Di-Tron Heavy Industries Knights Of the Southerncross
|
Posted - 2006.10.08 13:44:00 -
[124]
ok, this time a real alarm: whoever uses this, DO NOT enter your login data. first thing it does is send that via icq/aim to someone. ethereal ftw. :D
|

Barthez Thed
|
Posted - 2006.10.08 15:03:00 -
[125]
i see the warning post from isd has been de-stickied, that mean all is calm now?
|

Soulis
Slacker Industries Exuro Mortis
|
Posted - 2006.10.08 15:09:00 -
[126]
Originally by: Jim McGregor Edited by: Jim McGregor on 08/10/2006 13:35:45
Introduce a post/minute limit please.
what?!?! that would seriously effect Dark Shikari posting ratio
pfffftttttt - Immy |

Hellspawn01
Amarr The Phantom Conglomerate
|
Posted - 2006.10.08 15:24:00 -
[127]
Any new news about this? Is ccp going after this guy or something?
Ship lovers click here |

Dark Shikari
Caldari Imperium Technologies Firmus Ixion
|
Posted - 2006.10.08 15:25:00 -
[128]
Originally by: Soulis
Originally by: Jim McGregor
Introduce a post/minute limit please.
what?!?! that would seriously effect Dark Shikari posting ratio
Doubt that. I generally think enough before posting that 1-2 posts a minute max wouldn't limit me 
-[23] Member-
Awesome new space games site, from the editor of E-ON! |
|

Karass Sayfo
Forum Moderator Interstellar Services Department

|
Posted - 2006.10.08 15:38:00 -
[129]
Don't worry folks, CRC has been taking care of it 
Try not to make too many DenBrown threads though.
- Karass Sayfo _______
|
|

Hellspawn01
Amarr The Phantom Conglomerate
|
Posted - 2006.10.08 15:46:00 -
[130]
Originally by: Karass Sayfo Don't worry folks, CRC has been taking care of it 
You got more details?
Ship lovers click here |

Hakera
Anari Higard
|
Posted - 2006.10.08 15:58:00 -
[131]
Originally by: Karass Sayfo Don't worry folks, CRC has been taking care of it 
Try not to make too many DenBrown threads though.
- Karass Sayfo
ya know a dev could of just ran a query by char ID on the backend and deleted his posts from the db in like 5 seconds? Would of saved you hours of work but hey ho.
GJ cleaning up anyway for us! o>
|

Hagen Stein
|
Posted - 2006.10.08 16:52:00 -
[132]
Edited by: Hagen Stein on 08/10/2006 17:04:53
Originally by: Xenofur As i said before: Could you please quote actual laws or give solid evidence?
In Germany: º118a, º119a and perhaps º225a StGB
Funny though that I just read another thread were you mentioned that you live in Germany. How comes you don't know the laws of our country? Or at least do a bit research of your own laws before posting statements like "I don't know any country where such laws exist"...
|

Sincere MarkXIII
|
Posted - 2006.10.09 14:08:00 -
[133]
I clicked on the link like the dope that I am.
I didn't download anything though, saw a firewall warning and immediately closed the browser and ran a virus check.
this morning turns out two of my three accounts have been hacked and cleaned out
|

Mortok Tristan
|
Posted - 2006.10.09 14:23:00 -
[134]
Be very carefull folks,
I clicked on it, saw my browser spin, immediatly rebooted the laptop. Upon starting up, zonealarm complained that a new process called csrss was trying to setup a new network port as a server. This program hides under the process name csrss, which is a standard windows process name, you should always see just 1 such process.
it also installs c:\windows\csrss.exe ( +/- size 34 kb ) And the registery is modified to automatically start this up at boot time.
needless to say it installs illegal software on your machine.
|

Sincere MarkXIII
|
Posted - 2006.10.09 14:27:00 -
[135]
how would you suggest i remove it without doing a fesh install of XP ?
|

Benco97
Gallente Fedo Appreciation Group
|
Posted - 2006.10.09 14:38:00 -
[136]
does nobody remember This?
it may look like a bad photoshop but it isn't, i've got shots of the first 10 pages of the forum all crammed with this. Beware the macro-spamming idiots.
Head of the Fedo Appreciation Group (FAG) and Registered Fedo breeder (Sig kindly supplied by Zurtur) |

Ghan Tylous
Caldari Caldari Provisions
|
Posted - 2006.10.09 14:41:00 -
[137]
Lysanter (or what his name is) is putting up links to that site again. He is spamming Ships and Moduls Section 
|

Mortok Tristan
|
Posted - 2006.10.09 14:41:00 -
[138]
Edited by: Mortok Tristan on 09/10/2006 14:42:05 If you see this illegal version of csrss.exe in c:\windows folder (34kb) I can only tell you what i did to resolve it. *** DSCLAIMER USE AT OWN RISK *** use regedit to remove refereces to c:\windows\csrss.exe you should find 1 or two... specifically in a folder called explorer. get rid of it.
Warning: do not remove references to c:\windows\system32\csrss that one is the genuine windows process ( also known as "Client Server Runtime Process").
Reboot... it wont load anymore the illegal csrss.exe program... you can now remove the file c:\windows\csrss.exe
This seems to have resolved it for me. I do not recommend this to ppl who are not familiar with the windows registry and how windows startup works.
|

Tharrn
Amarr 1st Praetorian Guard Vigilia Valeria
|
Posted - 2006.10.09 14:46:00 -
[139]
Not again!!
Now recruiting!
|

Jowen Datloran
Caldari Science and Trade Institute
|
Posted - 2006.10.09 14:46:00 -
[140]
Crap. Here we go again. ---------------- Mr. Science & Trade Institute |

Rodj Blake
Amarr PIE Inc.
|
Posted - 2006.10.09 14:46:00 -
[141]
And now this one too 
Dulce et decorum est, pro imperator mori |

Mad Vicky
Red Frog Investments Daikoku Trade Syndicate
|
Posted - 2006.10.09 15:03:00 -
[142]
The zip file was not the only payload the page was trying to deliver. There was also a kind of encrypted javascript trying to do document.write. I still have this script but for some reason it does not run correctly for me. It looks to me like the string he is trying to write is empty but maybe it actually does something on different computer configuration. I saw people complaining about keylogger being installed without even running the file included in the zip. So the zip may have just been a distraction and the page itself was using some kind of vulnerability to deliver actual payload.
http://www.eve-bookmarks.com (in-game only) |

Mortok Tristan
|
Posted - 2006.10.09 15:06:00 -
[143]
Originally by: Mad Vicky The zip file was not the only payload the page was trying to deliver. There was also a kind of encrypted javascript trying to do document.write. I still have this script but for some reason it does not run correctly for me. It looks to me like the string he is trying to write is empty but maybe it actually does something on different computer configuration. I saw people complaining about keylogger being installed without even running the file included in the zip. So the zip may have just been a distraction and the page itself was using some kind of vulnerability to deliver actual payload.
I fully agree with you, see my post above.
|

Death Kill
Caldari direkte
|
Posted - 2006.10.09 15:08:00 -
[144]
Originally by: Sincere MarkXIII how would you suggest i remove it without doing a fesh install of XP ?
Boot up windows in safe mode, then run cleaning software. Then reboot.
N=R* x fp x ne x fl x Fi x fc x L |

Leandro Salazar
Aeon Industries
|
Posted - 2006.10.09 15:09:00 -
[145]
Okay I stupidly clicked the link as I was browsing a thread and thought it was pointing to something contributing to the topic. The site went into loop and I closed it after about 5 seconds. My HD worked a bit, and that was that. But I don't find any csrss.exe or any other suspicious files. How do I find out if I have any problems? And did not having a C: drive possibly save me? --------- ZOMG my sig was concordokkened! Link removed due to bad language on remote site. -wystler
|

Sincere MarkXIII
|
Posted - 2006.10.09 15:14:00 -
[146]
Quote: If you see this illegal version of csrss.exe in c:\windows folder (34kb) I can only tell you what i did to resolve it. *** DSCLAIMER USE AT OWN RISK *** use regedit to remove refereces to c:\windows\csrss.exe you should find 1 or two... specifically in a folder called explorer. get rid of it.
Warning: do not remove references to c:\windows\system32\csrss that one is the genuine windows process ( also known as "Client Server Runtime Process").
Reboot... it wont load anymore the illegal csrss.exe program... you can now remove the file c:\windows\csrss.exe
This seems to have resolved it for me. I do not recommend this to ppl who are not familiar with the windows registry and how windows startup works.
You win the thread , many thanks, I managed to get ridd of it.
now only to wait till ccp manages to geive me back all my isk ^^
|

Benco97
Gallente Fedo Appreciation Group
|
Posted - 2006.10.09 15:14:00 -
[147]
Edited by: Benco97 on 09/10/2006 15:14:01
Originally by: Leandro Salazar And did not having a C: drive possibly save me?
depends how well it was written, you may have cut it off before it could finish but again, perform the aforementioned searches and cleanings just to be safe.
Head of the Fedo Appreciation Group (FAG) and Registered Fedo breeder (Sig kindly supplied by Zurtur) |

Barthez Thed
|
Posted - 2006.10.09 15:53:00 -
[148]
were those who had problems use IE to open the link, or did any using firefox have problems?
|

Mortok Tristan
|
Posted - 2006.10.09 16:20:00 -
[149]
Originally by: Sincere MarkXIII
Quote: If you see this illegal version of csrss.exe in c:\windows folder (34kb) I can only tell you what i did to resolve it. *** DSCLAIMER USE AT OWN RISK *** use regedit to remove refereces to c:\windows\csrss.exe you should find 1 or two... specifically in a folder called explorer. get rid of it.
Warning: do not remove references to c:\windows\system32\csrss that one is the genuine windows process ( also known as "Client Server Runtime Process").
Reboot... it wont load anymore the illegal csrss.exe program... you can now remove the file c:\windows\csrss.exe
This seems to have resolved it for me. I do not recommend this to ppl who are not familiar with the windows registry and how windows startup works.
You win the thread , many thanks, I managed to get ridd of it.
now only to wait till ccp manages to geive me back all my isk ^^
I also forgot to mention, the link installed autoexec.exe in c:\ i got rid of that too.
|

Exelsior
Endangered Species
|
Posted - 2006.10.09 16:27:00 -
[150]
Originally by: Barthez Thed were those who had problems use IE to open the link, or did any using firefox have problems?
Didn't download the file, just clicked on the link, and using firefox probably saved me. Got nothing ebil on my PC afaik...
|

Phaese
Gallente Fleshreaper Inc
|
Posted - 2006.10.09 18:59:00 -
[151]
So if those two .exe files aren't on your computer... You haven't been affected?
|

Barthez Thed
|
Posted - 2006.10.09 19:04:00 -
[152]
Originally by: Exelsior
Originally by: Barthez Thed were those who had problems use IE to open the link, or did any using firefox have problems?
Didn't download the file, just clicked on the link, and using firefox probably saved me. Got nothing ebil on my PC afaik...
yeah me too, just curious to know if only IE users were attacked, cos the second time the spammer attacked he put 'IE users only' at the bottom of the link.
Firefox ftw
|

Sincere MarkXIII
|
Posted - 2006.10.09 19:07:00 -
[153]
i was using IE at least...
well for the life of me I can't find c:\autoexec.exe, so i'm gonna assume that this didn't get through somehow.
|

Barthez Thed
|
Posted - 2006.10.09 19:11:00 -
[154]
Originally by: Sincere MarkXIII
i was using IE at least...
well for the life of me I can't find c:\autoexec.exe, so i'm gonna assume that this didn't get through somehow.
you probably have IE set-up properly
before i found firefox, i used to have to set up IE to not allow popups without confirmation first (and auto downlaods as well) can't remember now.
|

Grez
Minmatar The Raven Warriors
|
Posted - 2006.10.09 19:19:00 -
[155]
Edited by: Grez on 09/10/2006 19:19:44
Originally by: Mortok Tristan
Originally by: Sincere MarkXIII
Quote: If you see this illegal version of csrss.exe in c:\windows folder (34kb) I can only tell you what i did to resolve it. *** DSCLAIMER USE AT OWN RISK *** use regedit to remove refereces to c:\windows\csrss.exe you should find 1 or two... specifically in a folder called explorer. get rid of it.
Warning: do not remove references to c:\windows\system32\csrss that one is the genuine windows process ( also known as "Client Server Runtime Process").
Reboot... it wont load anymore the illegal csrss.exe program... you can now remove the file c:\windows\csrss.exe
This seems to have resolved it for me. I do not recommend this to ppl who are not familiar with the windows registry and how windows startup works.
You win the thread , many thanks, I managed to get ridd of it.
now only to wait till ccp manages to geive me back all my isk ^^
I also forgot to mention, the link installed autoexec.exe in c:\ i got rid of that too.
Process File: csrss or csrss.exe Process Name: Microsoft Client/Server Runtime Server Subsystem Description: csrss.exe is the main executable for the Microsoft Client/Server Runtime Server Subsystem. This process manages most graphical commands in Windows. This program is important for the stable and secure running of your computer and should not be terminated.
Smart move  ---
Cache Clearer
Still waiting for a Wrangler-edit! |

Mad Vicky
Red Frog Investments Daikoku Trade Syndicate
|
Posted - 2006.10.09 19:23:00 -
[156]
Grez, do everybody a favor, read what you quoted as many times as needed to understand and delete your post not to confuse people.
http://www.eve-bookmarks.com (in-game only) |

Grez
Minmatar The Raven Warriors
|
Posted - 2006.10.09 19:24:00 -
[157]
Edited by: Grez on 09/10/2006 19:25:55
Originally by: Mad Vicky Grez, do everybody a favor, read what you quoted as many times as needed to understand and delete your post not to confuse people.
Just a warning to some people who may skip the above posters post. Do not remove the C:\WINDOWS\SYSTEM32\ file, only the C:\WINDOWS one. A WXP system properly updated will force a crash in the trojan if it tries to start.
^ Read mine :P
[ edit ] I'll move around the post to make it less confusing though (and there was no need to be rude). ---
Cache Clearer
Still waiting for a Wrangler-edit! |

Inquisitor Berthez
Amarr
|
Posted - 2006.10.17 00:14:00 -
[158]
I guess the macro-miners are getting ****ed they don't get $$$ for their ISK. Should have chosen a real job then. .
Too lazy to make the sig any better. |
| |
|
| Pages: 1 2 3 4 5 6 :: [one page] |