Wersja do druku
Cześć. Mam taki problem, dziś z rana dostałem hacka na all chary w Tibii. Pobierałem chyba tylko program do zakładania kont w tibii z dicebot.pl wiec raczej wątpię żeby w tym coś siedziało. Tak czy inaczej, same itemki mi nie znikły. Wrzucam skan z OTL. Jakby ktoś mógł pomoc to byłbym wdzięczny :)
http://wklej.org/id/1342900/
http://wklej.org/id/1342898/
chyba chodziło o to xD
programik jest czysty, w razie co mogę w każdej chwili sc zapodać jakiemuś modkowi na pw ;p
poczekaj na @Vadim ; jak bedzie to sprawdzi ci logi
Tylko to nie jest żaden dowód.Cytuj:
BBsrv napisał
Jest czysty. Ja go pisalem i ręczę głową. @Szczery ; może ktos podsluchał pakiety na Lanie.
Zaraz sprawdze logi OTL
@EDIT
Pobierz Fiddlera, odpal go i daj nasłuch na wszystkie procesy.
Potem odpal Tibie i sie zaloguj.
Jesli fiddler wykryje jakies połączenie HTTP, sprawdz z jakiego procesu, dokąd i czy zawiera twoje passy (GET/POST)
Nawet jak podsłucha, to nie ma prywatnego klucza RSA żeby zdekodować pakiet. A zarowno pakiet logowania do serwera, i wejscia do game serwera jest zaszyfrowany przez RSA.Cytuj:
LordCompi napisał
Nie widze infekcji. Sporo adware tylko.
Uruchom OTL i wklej na dole ten skrypt http://wklej.org/id/1342972/ i nacisnij "wykonaj skrypt".
Mozesz uzyc jeszcze AdwCleaner, "szukaj" > "usun".
Dlatego nie zmieni hasła, ale o ile klient nie wysyła podczas logowania nic poza passami i paroma informacjami własnymi to zalogować się da podmieniajac własny ruch przejetymi danymi, right?
Wykonałem ten skrypt i takie coś wyskoczyło
Kod:All processes killed
========== OTL ==========
No active process named pricemeterw.exe was found!
Process PluginService.exe killed successfully!
Process PriceMeterLiveUpdate.exe killed successfully!
Service IePluginService stopped successfully!
Service IePluginService deleted successfully!
C:\ProgramData\IePluginService\PluginService.exe moved successfully.
Service pricemeterliveUpdatem stopped successfully!
Service pricemeterliveUpdatem deleted successfully!
C:\Program Files (x86)\PriceMeterLiveUpdate\Update\PriceMeterLiveUpdate.exe moved successfully.
Service pricemeterliveUpdate stopped successfully!
Service pricemeterliveUpdate deleted successfully!
File C:\Program Files (x86)\PriceMeterLiveUpdate\Update\PriceMeterLiveUpdate.exe not found.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{11111111-1111-1111-1111-110511071178}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{11111111-1111-1111-1111-110511071178}\ deleted successfully.
C:\Program Files (x86)\Plus-HD-7.6\Plus-HD-7.6-bho.dll moved successfully.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C}\ deleted successfully.
C:\Program Files (x86)\SupTab\SupTab.dll moved successfully.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{39F7E362-828A-4B5A-BCAF-5B79BFDFEA60}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{39F7E362-828A-4B5A-BCAF-5B79BFDFEA60}\ deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\tvncontrol deleted successfully.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\PriceMeterW deleted successfully.
C:\Users\Samsung\AppData\Local\PriceMeter\pricemeterw.exe moved successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{0ee46fda-aad3-11e3-a240-4cedde804a36}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0ee46fda-aad3-11e3-a240-4cedde804a36}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{0ee46fda-aad3-11e3-a240-4cedde804a36}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0ee46fda-aad3-11e3-a240-4cedde804a36}\ not found.
File E:\setup.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{23253365-7d43-11e3-87fc-4cedde804a36}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{23253365-7d43-11e3-87fc-4cedde804a36}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{23253365-7d43-11e3-87fc-4cedde804a36}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{23253365-7d43-11e3-87fc-4cedde804a36}\ not found.
File E:\SETUP.EXE not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{23253365-7d43-11e3-87fc-4cedde804a36}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{23253365-7d43-11e3-87fc-4cedde804a36}\ not found.
File E:\SETUP.EXE not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{23253365-7d43-11e3-87fc-4cedde804a36}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{23253365-7d43-11e3-87fc-4cedde804a36}\ not found.
File E:\SETUP.EXE not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{768d743b-9f56-11e3-8f6e-4cedde804a36}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{768d743b-9f56-11e3-8f6e-4cedde804a36}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{768d743b-9f56-11e3-8f6e-4cedde804a36}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{768d743b-9f56-11e3-8f6e-4cedde804a36}\ not found.
File E:\Autorun.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c3f04c22-ab1e-11e3-ad7b-4cedde804a36}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{c3f04c22-ab1e-11e3-ad7b-4cedde804a36}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c3f04c22-ab1e-11e3-ad7b-4cedde804a36}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{c3f04c22-ab1e-11e3-ad7b-4cedde804a36}\ not found.
File E:\setup.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c4e549f6-a5d0-11e3-97a4-4cedde804a36}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{c4e549f6-a5d0-11e3-97a4-4cedde804a36}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c4e549f6-a5d0-11e3-97a4-4cedde804a36}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{c4e549f6-a5d0-11e3-97a4-4cedde804a36}\ not found.
File F:\setup.exe not found.
ADS C:\ProgramData\TEMP:6BE50C2B deleted successfully.
========== REGISTRY ==========
Registry key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\mountpoints2\ deleted successfully.
========== COMMANDS ==========
[EMPTYTEMP]
User: All Users
User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
User: Public
User: Samsung
->Temp folder emptied: 370474145 bytes
->Temporary Internet Files folder emptied: 59013861 bytes
->Google Chrome cache emptied: 383639197 bytes
->Flash cache emptied: 847 bytes
User: Szczery
User: UpdatusUser
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 602963 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 128 bytes
RecycleBin emptied: 12023413 bytes
Total Files Cleaned = 788,00 mb
OTL by OldTimer - Version 3.2.69.0 log created on 04252014_170645
Files\Folders moved on Reboot...
C:\Users\Samsung\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.
C:\Users\Samsung\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\EBX264UT\gui[2].htm moved successfully.
C:\Users\Samsung\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\EBX264UT\k3k702ZOKiLJc3WVjuplzHZ2MAKAc2x4R1uOSeegc5U[1].eot moved successfully.
C:\Users\Samsung\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\EBX264UT\startup[1].htm moved successfully.
C:\Users\Samsung\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\A3AZG8HG\cJZKeOuBrn4kERxqtaUH3fY6323mHUZFJMgTvxaG2iE[1].eot moved successfully.
C:\Users\Samsung\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\A3AZG8HG\DXI1ORHCpsQm3Vp6mXoaTXZ2MAKAc2x4R1uOSeegc5U[1].eot moved successfully.
C:\Users\Samsung\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\A3AZG8HG\thesans-plain-webfont[1].eot moved successfully.
C:\Users\Samsung\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat moved successfully.
File move failed. C:\Windows\temp\_avast_\Webshlock.txt scheduled to be moved on reboot.
PendingFileRenameOperations files...
Registry entries deleted on Reboot...
Wieczorem wyczyszcze przez AdwCleaner
Też nie wypali, przy 1. połączeniu do serwera gry, klient dostaje tzw. ticket (każde połączenie do serwera to inny ticket). Ponadto, w 1. pakiecie do serwera logowania, i do serwera gry wysyłany jest klucz XTEA (generowany na podstawie polozenia kursora myszy). Podsumowując, to prawie nie wykonalne technicznie zeby przejać taką sesje z game serwerem.Cytuj:
zakius napisał
Mmm, skoro takie coś już wymyślili to spoko, albo niedawno wprowadzili, albo nieogarnąłem, czytałem kiedyś część logowania tfsa i nie widziałem nic, co by ignorował chyba...
Rozumiem, że klient wysyła passy, serv zwraca ticket i klient oddaje zaszyfrowany RSA ticket czy coś takiego? no to nie jest tak łatwo