| Pages: 1 2 :: [one page] |
| Author |
Thread Statistics | Show CCP posts - 1 post(s) |
Matchitehew
   |
Posted - 2007.05.15 00:19:00 -
[1]
Hi I have just loged onto my account and to my horror to see that all my money items and ships are gone, with an email saying clone jumped. I do not now how this has happend as I docked at a station b4 I exited the game and no one has my logon infomation. any 1 else had this problem ?
|
smashsmash
|
Posted - 2007.05.15 00:35:00 -
[2]
did you log into the correct character? maybe it's an alt. you should check your journal history it goes back pretty far and see if there were any suspicious transfers. hope it was just a mistake :)
|
Damien8you
|
Posted - 2007.05.15 00:42:00 -
[3]
Nope it wasnt a alt I have 2 other alts and the same has happend to them, I dont no what the hell has happend, I was on it a few hours ago was mining then docked and quit then loged back on about 30 mins ago and every thing gone. I hope eve will give me some kind of compensation or I will have to ask for my subscription payment and the money I have spent each month on this game. I have put loads of time into this game and with all the bugs, lag spikes and stupid errors that I have had then it does this to me.
|
Damien8you
|
Posted - 2007.05.15 00:52:00 -
[4]
OK I have just found out that Hawk pryde has some how hacked my account and sent a player donation of all my cash, items and ships to him.
|
SiJira
|
Posted - 2007.05.15 00:52:00 -
[5]
 Originally by: Damien8you
Nope it wasnt a alt I have 2 other alts and the same has happend to them, I dont no what the hell has happend, I was on it a few hours ago was mining then docked and quit then loged back on about 30 mins ago and every thing gone. I hope eve will give me some kind of compensation or I will have to ask for my subscription payment and the money I have spent each month on this game. I have put loads of time into this game and with all the bugs, lag spikes and stupid errors that I have had then it does this to me.
log off and on possible you are having some sort of error
other than that i must ask you if you have downloaded anything suspicious lately - relating to eve or not
____ __ ________
_sig below_
the jet cans are made so that people that dont mine can get free ore
miners ritually donate the ore to anyone wishing to take some |
SiJira
|
Posted - 2007.05.15 00:53:00 -
[6]
Originally by: Damien8you
OK I have just found out that Hawk pryde has some how hacked my account and sent a player donation of all my cash, items and ships to him.
you want to petition this not post stories that seem shady on the forums
____ __ ________
_sig below_
the jet cans are made so that people that dont mine can get free ore
miners ritually donate the ore to anyone wishing to take some |
CrestoftheStars
Perkone
|
Posted - 2007.05.15 00:55:00 -
[7]
well patition it..
___________________________________________
When i was a child i thought like a child i acted like a child and i spoke like a child.
But when I became an adult I laid away childish things.
|
Niccolado Starwalker
Shadow Templars
|
Posted - 2007.05.15 00:55:00 -
[8]
Originally by: Damien8you
OK I have just found out that Hawk pryde has some how hacked my account and sent a player donation of all my cash, items and ships to him.
Im afraid we on the forums cant help you much, and neither can the moderators really. All you can do is petition the case, and hope for the best. It is sad when such things happend.
Originally by: Eldo Davip
PORTRAITS OMFG WOOT.
WE R GONIG FOR MROE BREEE!!!!11
|
Matchitehew
|
Posted - 2007.05.15 12:50:00 -
[9]
Any 1 now if there is a posabilty that he could obtain my ip from eve or some eve player ip program ? |
|
Huitzilopochtli Tlaloc
Forum Moderator
Interstellar Services Department
|
Posted - 2007.05.15 13:13:00 -
[10]
You need to petition this as soon as possible.
- Thanks Hutch.
____
forum rules | [email protected] | ME
They call me Hutch. I have forgotten why  |
|
hydraSlav
Synergy Evolved
Sparta Alliance
|
Posted - 2007.05.15 13:28:00 -
[11]
Edited by: hydraSlav on 15/05/2007 13:26:50
Originally by: Matchitehew
Any 1 now if there is a posabilty that he could obtain my ip from eve or some eve player ip program ?
Teamspeak  Or even your corp's forum if he is admin
==
Above comments are my personal views
Oveur >Local shouldn't be a tactical tool, it's for chat
|
Damien8you
|
Posted - 2007.05.15 13:30:00 -
[12]
I have done, no reply yet and I dout they will do anything because the same thing happend to a corp member a few months ago by some 1 and eve didnt care
|
Noluck Ned
FATAL REVELATIONS
FATAL Alliance
|
Posted - 2007.05.15 13:32:00 -
[13]
can I have your...Oh wait!
F4T4L Recruitment |
Matchitehew
|
Posted - 2007.05.15 13:36:00 -
[14]
my what dude ???
|
Buxaroo
Reikoku
Band of Brothers
|
Posted - 2007.05.15 13:38:00 -
[15]
Possibly a keylogger? Some tips for the future:
Change passwords for accounts weekly.
Don't use same passwords for forums and accounts.
Don't use Internet Explorer or Outlook Express (use Firefox or other non-IE-based browser).
Run spyware and virus scanners whenever you can.
Some will argue about the IE tip. But everyone who is smart uses anything besides IE especially if they value their security and a clean system.
"No matter where you go, there you are" - Buckaroo Banzai |
Drasked
North Face Force
Anarchy Empire
|
Posted - 2007.05.15 13:39:00 -
[16]
You wont find any help on these forums with this issue, write a petiton.
|
Thommy
|
Posted - 2007.05.15 13:50:00 -
[17]
There are several steps you need to take in these incidents.
The most important one is to make sure you file a petition (not sure under which catagory this would fit the best).
You should realise that with just an IP no one can actually take over your account because this actually requires them to have your password and account name.
several things that should be checked:
- Do you use any 3rd party tools for eve?
- Do you use any websites outisde eve-online specificly for eve online?
- Do you regularly virus / spyware scan your computer and keep your operating system updated?
In case of 1 never ever trust anything with your password / account name other then the legit eve-online client downloaded from the official site (yes there are specific tools that got trustworthyness but since they are out of ccp their control no guarantees can be made).
In case 2 choose a username / password to access those websites that is DIFFERENT then your login name and password on eve-online.
If for example you choose matchitehew as login name here on eve with for example the password "password" and did the same on such a site the owner of that site could use those details to gain access to your account.
In case 3 always keep your computer secured no matter what.
Eve-online theft is the least of the bad things that can happen to you on a compromised system consider what would happen if they gain access to your banking details.
Guide to fix eve problems.
Cleanup your cache with my cache tool |
Matchitehew
|
Posted - 2007.05.15 13:59:00 -
[18]
Yea I use firefox. My computer was quite safe up 2 a few weeks ago when my motherboard and harddrive died , I never got round to put zonealarm back on it but have now but its 2 late, And I need to find out how he got my ip because I have other ppl using my connection for business and there credit cards may have been logged by this guy.
|
Thommy
|
Posted - 2007.05.15 14:05:00 -
[19]
Did zonelabs alarm show any strange exe files trying to access the net (example being c:\<randomname>.exe)?
To get access to your account someone must know or be able to guess your login credentials.
You do not have an easy to guess password or username (like your ingame charactername and a password like 12345678 or something)?
Guide to fix eve problems.
Cleanup your cache with my cache tool |
Matchitehew
|
Posted - 2007.05.15 14:11:00 -
[20]
The only thing I have seen trying to get access is crez.exe and I have now blocked, And no my password wasn't a simple pass no 1 would of been able to find it out with out keyboard login me which I dont no how he did it.
|
Your Name
|
Posted - 2007.05.15 14:15:00 -
[21]
Have you changed your password since this has happended? I think it would be possible for this person to log back in again and cancel your petitions otherwise.
|
Thommy
|
Posted - 2007.05.15 14:17:00 -
[22]
well there you have your culprit
C:\WINDOWS\crez.exe probably?
this is an Trojan Downloader
Guide to fix eve problems.
Cleanup your cache with my cache tool |
Matchitehew
|
Posted - 2007.05.15 14:24:00 -
[23]
Yea I have changed my password. What I dont get is that there is on adverage 26 thousand players online when I play so how could he of found my Ip out of the 26k ips. I have tried to removed the file but it wont go any ideas ?
|
Akita T
Caldari
Caldari Navy Volunteer Task Force
|
Posted - 2007.05.15 14:34:00 -
[24]
What's your IP got to do with anything ?
Your IP is worthless.
He couldn't, wouldn't and shouldn't have cared about your IP at all.
All he needed to know was your EVE username/pass, nothing more, nothing less.
_
MySkills | Module/Rig stacknerfing explained |
Thommy
|
Posted - 2007.05.15 14:34:00 -
[25]
Just deleteing the file wont work because the virus is active in the memory aswell and will restore itself (aswell as possibly prevent you from deleteing it anyway).
The best advise is to download an antivirus program (my advise is avast).
This virusscanner can do a prescan before it actually installs itself though you will have to uninstall your old antivirus scanner if you have installed one.
If it doesnt find it in the prescan you need to continue the installation and let it update itself after the bootup scan that it wants to schedule automaticly.
After that it should update itself and be able to find it if it did not find the virus at this point allready.
However because this is a trojan downloader there can now be so much junk on your computer that even an virusscanner may not be able to restore the computer to an safe to use state anymore and a complete reinstall may be adviseable in this circumstance (even though it may sound very drastic).
If you decide to reinstall do NOT re-use ANY of your old exe files / drivers that you have because any of those can be infected allready.
Even cd's burned while infected may be compromised with boot virusses so only use the material you can be sure about that it is safe.
Virusses are very nasty and can root themselves very deeply within anything so alot of caution is advised.
Guide to fix eve problems.
Cleanup your cache with my cache tool |
Matchitehew
|
Posted - 2007.05.15 14:35:00 -
[26]
Then how did he get my eve password, no one knows it but me.
|
Matchitehew
|
Posted - 2007.05.15 14:38:00 -
[27]
I use NOD32 and that didnt pick it up, I only picked up the exe when saw it in the blocked list on zonealarm
|
Akita T
Caldari
Caldari Navy Volunteer Task Force
|
Posted - 2007.05.15 14:41:00 -
[28]
Edited by: Akita T on 15/05/2007 14:42:18
If you had a keylogger / trojan downloader / whatever virus-like entity that can steal passwords, he wouldn't have needed to target YOU specifically, the needed info would have been given away by your computer to whoever spread the virus in the first place (and you were guillable or careless enough to let it get installed on your machine).
Probably the only "useful" thing he could collect from your PC was your EVE user/pass combo (you just admited to using them "just before"), but maybe he collected much more than this already.
___
The smartest thing you can do now is:
a) unplug your internet connection or shut down this machine
b) plug in clean machine (or reinstall windows from scratch on this one if you can't get to a clean machine fast enough)
c) change all passes you used in the recent past
_
MySkills | Module/Rig stacknerfing explained |
Thommy
|
Posted - 2007.05.15 14:43:00 -
[29]
He can get it because the virus inserted on your system is a trojan downloader.
It listens on an port to commands from the "master" and can open an download (ftp) connection to recieve additional files containing more malware.
Trough this method he can then install an keylogger (which basicly like it says records any key you pressed aswell connecting to which application this is typed under).
So this is how he got your username and password because after its recorded it is stored and then send at an specific time to the reciepant (either by email or by upload (again ftp) connection.
At this point there can be multiple things on the system which you may be unaware off which include virusses specifically designed to disable / circumvent antivirus programs like nod32.
This is why possibly a complete reinstall may be needed to be sure to get rid of all culprits.
Guide to fix eve problems.
Cleanup your cache with my cache tool |
Matchitehew
|
Posted - 2007.05.15 14:44:00 -
[30]
I now it was him because he has been giving me and my corp m8s crap for the past few months, then a player donation to him and his friend from my account and I did not do that.
|
Akita T
Caldari
Caldari Navy Volunteer Task Force
|
Posted - 2007.05.15 14:49:00 -
[31]
Originally by: Matchitehew
I now it was him because he has been giving me and my corp m8s crap for the past few months, then a player donation to him and his friend from my account and I did not do that.
So, if you "know" it was him (and let's assume for a minute it really was that guy, and I suppose you petitioned him already), try to remember...
What have you done recently that could have triggered a trojan download ?
Did you go to any links he sent any of you guys ?
Did you get any links from new members, or people you thought you trusted (might have been "scammed" too) ?
Did you download anything new on recommendation of corpmates or EVE aquaintances ?
_
MySkills | Module/Rig stacknerfing explained |
Matchitehew
|
Posted - 2007.05.15 14:51:00 -
[32]
Yea I have petition him, and no to the rest of your questions
|
Akita T
Caldari
Caldari Navy Volunteer Task Force
|
Posted - 2007.05.15 14:55:00 -
[33]
Well, viruses don't get written all by themselves.
If indeed, you're the only one knowing the password (i.e. you DON'T use the same username/pass combo for anything else, like, say, a forum), then it's either something you did, or something somebody using your PC did.
_
MySkills | Module/Rig stacknerfing explained |
Matchitehew
|
Posted - 2007.05.15 15:04:00 -
[34]
Thing is tho I dont no how this player has given me a trojan, I havent clicked on any thing from his corp him self or and other players from corp.
|
Frederick Sheh
Caldari
Hadean Drive Yards
Archaean Cooperative
|
Posted - 2007.05.24 01:58:00 -
[35]
did you by any chance sign up for his stupid play by email game?
Ensign Frederick Sheh - Military Division - Hadean Drive Yards
|
Alpo Coop
Amarr
|
Posted - 2007.06.19 21:38:00 -
[36]
I have come accross CREZ.EXE. After a small investigation I have found that it is in fact a key logger. In the C:\windows\system32 directory you will find 2 things CREZ.EXE and a file with no extension named CREZ .. The file without the file extension is the actual log file. Go ahead and open it with your notepad. It is a very good keylogger. It hides itself very well. I am in the process of cleaning it off my machine that I play eve with right now. I will post an update on removal after I have completed the process. A note to anyone that finds that they have this file on thier system. It does no good to change your password until it is removed from your system.
|
ForceM
Gallente
POS Builder Inc.
|
Posted - 2007.06.19 21:40:00 -
[37]
May called .. it wants its topic back
I aint playing eve that much .. i just spend very little time on anything else :) |
DubanFP
Caldari
Four Rings
D-L
|
Posted - 2007.06.19 21:50:00 -
[38]
Originally by: Alpo Coop
I have come accross CREZ.EXE. After a small investigation I have found that it is in fact a key logger. In the C:\windows\system32 directory you will find 2 things CREZ.EXE and a file with no extension named CREZ .. The file without the file extension is the actual log file. Go ahead and open it with your notepad. It is a very good keylogger. It hides itself very well. I am in the process of cleaning it off my machine that I play eve with right now. I will post an update on removal after I have completed the process. A note to anyone that finds that they have this file on thier system. It does no good to change your password until it is removed from your system.
The smart idea would be to change it with a second computer.
____________
Dark Shikari> If at first you don't succeed, whine about t20. |
Alpo Coop
Amarr
|
Posted - 2007.06.19 21:52:00 -
[39]
I realize that this thread was a couple months ago .. However this is a risk to many players and as long as someone can come here and find out what they are up against and how to repair it, does it really matter when? I find very very little record of this keylogger ... I am researching this issue to help people not to get a hard time because no one else could give resolution on this issue.
|
Alpo Coop
Amarr
|
Posted - 2007.06.19 22:34:00 -
[40]
Spybot seems to have removed it after a restart and a scan. The following did not find this keylogger. Adaware, Windows Defender, AVG anti-Virus (It did however find the program that created the keylogger), Panda online scan. I hope this information helps others.  .
|
Na'Kunni
Amarr
RSP Enterprises
|
Posted - 2007.06.19 22:36:00 -
[41]
Originally by: Noluck Ned
can I have your...Oh wait!
rofl
|
Steel Tigeress
Gallente
Steel-Wolfs
|
Posted - 2007.06.19 22:40:00 -
[42]
Originally by: Thommy
You do not have an easy to guess password or username (like your ingame charactername and a password like 12345678 or something)?
Damn, now I have to change the combination on my luggage......
|
Ask Unbeatable
Gallente
HighTech Marines Ltd.
FREGE Alliance
|
Posted - 2007.06.19 22:42:00 -
[43]
Originally by: Noluck Ned
can I have your...Oh wait!
So cruel 
New video: Dont Ask 1 |
Drachma Golea
Caldari
School of Applied Knowledge
|
Posted - 2007.06.19 22:43:00 -
[44]
Originally by: Matchitehew
I now it was him because he has been giving me and my corp m8s crap for the past few months, then a player donation to him and his friend from my account and I did not do that.
Please Petition and stop talking about it... it is indeed worse enough... you have a huge PC or Social problem, because else this would not have happened
|
Ti anna
Caldari
Playboy Enterprises
|
Posted - 2007.06.19 22:52:00 -
[45]
I would recommand both AVG antivirus and AVG Antispyware, They work well for me. I also use AD-Aware as a backup for spyware.
Both can be downloaded from HERE These will be the free versions that are fully functional. The registered paid versions have more functionality.
You can get AD-Aware (make sure its from lavasoft and is spelled exactly like this) from Download.com
|
Rashmika Clavain
Gallente
Revelation Space
|
Posted - 2007.06.19 22:57:00 -
[46]
It's a bit late now, but I think in future you'll always remember to install your AV/Firewall/spyware before connecting to the internet 
|
Haniblecter Teg
F.R.E.E. Explorer
EVE Animal Control
|
Posted - 2007.06.19 23:03:00 -
[47]
Originally by: Buxaroo
Possibly a keylogger? Some tips for the future:
Change passwords for accounts weekly.
Don't use same passwords for forums and accounts.
Don't use Internet Explorer or Outlook Express (use Firefox or other non-IE-based browser).
Run spyware and virus scanners whenever you can.
Some will argue about the IE tip. But everyone who is smart uses anything besides IE especially if they value their security and a clean system.
I'd much rather be always vigilant and a smart surfer with IE, than have a false sense of security that netscape users such as yourself has.
-----------------
Friends Forever
Kill.
BoB.
Dead. |
Hawk Pryde
|
Posted - 2007.09.04 17:02:00 -
[48]
This is such BS...Its a long time after the original post...but it just got me booted out of a corp that i was interested in.. Anyway... If this was true and i stole everything you had... Seems the best thig to have done was to screenshot your donations and posted it... Otherwise you just another person that is upset and trying to grief me.. |
Frug
Zenithal Harvest
|
Posted - 2007.09.04 17:20:00 -
[49]
This thread is fascinating. I don't know who to believe!
- - - - - - - - - Do not use dotted lines - - - - - - -
If you think I'm awesome, say BOOO
BOOO!! - Ductoris
Neat look what I found - Kreul
Hey, my marbles |
Kazuma Saruwatari
|
Posted - 2007.09.04 17:24:00 -
[50]
Originally by: Huitzilopochtli Tlaloc
You need to petition this as soon as possible.
Do it dude, and now!
-
Odd Pod Out, a blog of EVE Online |
Asestorian
Minmatar
Domination.
|
Posted - 2007.09.04 17:26:00 -
[51]
As annoyed as you are, don't necro threads
---
---
|
| |
|
| Pages: 1 2 :: [one page] |