Small Account Risk
 

Hello,

Today a link has been spread around, the link, said to be a place "you can talk about bad staff members, etc", is actually a malicious website created by the hacker that he uses to get access to your computer/accounts.

The link ended in "booter.info/index.html" and required you to accept a Java applet. If you accepted it, then the hackers may have access to your PC. Please note that the hackers may change the URL in the future to infect further people, please do not fall for their trick.

If you're unsure whether or not you're infected, check your C:\Windows\ directory for a file called "sch.exe" or "\\sch.exe" and delete it. The reboot your computer and change your passwords.

Please note that it is not guaranteed that this will fix the problem, and we strongly urge you not to accept any java applets on a website sent to you by a strange/unknown person on Graal.

Thanks,
Graal Administration

SCH.exe is known to

• Added as a Registry auto start to load Program on Boot up
• Created as a new Background Service on the machine
• Executed as a Process
• Created as a process on disk

is this the same type of trick i've heard of people using where they inject hidden HTML into PMs to make people accept things like this?

very clever

Lol, wow. I gota weird link earlier today and I hardly ever click links on graal so good thing I didn't. Thanks for the heads up though!

I was sent the link through AIM :(

That is just sad, Come on people.. Are you really so in the game that you are hacking people for items?

I got one of these today, I ignored it because it was a link to a chat room and a guy told met to accept something. Thanks for the heads up.

I didn't click the link because it was massed by a person called Scouser. Don't trust people from Liverpool ever, I think this is the real moral of the story.

what happens if we don't delete it? Nothing bad has happened yet, and I hate messing around with my computer

uh oh

The virus is actually a key-logger, They will get all your password.. Nothing bad happend yet for you, But it will happen if you don't delete it.

whatever man idc

idc lol

They can get more then only your graal password if it is actually a keyllogger, like bank account and more.

No one would be mean to me online cuz they all like me too much

schtasks and schtasks.exe.mui all good? cause you just said sch.exe?

Everyone here is like 14 no one has an actual bank account.

17 - 20 years old is average age according to the poll in this thread and I wouldn't take a threat like this lightly because the stakes for ignoring it could be very high.

http://forums.graalonline.com/forums...hp?t=134256162

I can definitely vouch for the validity of this, I was testing it in a sandbox and one of the "hackers" IMed me the name of one of the files in the folder I was viewing (which happened to be what I was using to "decode" the java applet).

It's also the same people responsible for the "Era Hotkeys" keylogger that caused some trouble a while back.

Thanks for the warning Tig. And good detective work chris.

Thanks for telling us this too. :)

I talked to the people who its trying to be blamed on and they said it isn't them, and that was actually the first they heard about it

Fortunately the site's down now, including the PHP file where the data was being sent. Not sure if they took it down or if it was a result of the abuse complaints that were sent in, but the domain and URL were hard coded into the virus, so I guess things are safe for now.

I have been told that someone (cjclark) works for UPS or something and shut the server down ;]

United Parcel Service?

He must have mailed explosives to the server room.

The virus was never meant for graalonline,it was spread onto due to a friend who IM'd me that he did it.
The virus did not steal anything,or install any extra.
Sorry for inconvenience i have closed the hosting,the domain is still existing.

He lied.

schtasks and schtasks.exe.mui are fine the virus droped to \WINDOWS\system32\sch.exe or \WINDOWS\sch.exe depending on your OS
The virus installs itself to
\WINDOWS\system32\sdra64.exe
\WINDOWS\system32\lowsec\local.ds
\WINDOWS\system32\lowsec\user.ds

-Darow

lol'd
Good to hear :).

Not sure how well I could trust a registered/active/scripter for the Graal Hack team.

Sorry, but everyone should still take it seriously just in case.

same here.

I have not been apart of their team since the backdoor incident,I am in no way against graalonline i was there for coding experience.

Yea, I was in al-Qaeda just for the experience!

Still means I'm trustworthy, right?!1

!!! Ban the hax0r!!!

You said "Not sure how well I could trust a registered/active/scripter for the Graal Hack team."

I'm not registered,active or a scripter for GH
Your point is invalid, raise your IQ level and come back.The reasons for the virus's were explained no need for skids who don't understand them to get involved.
Thread needs to be locked the risk is gone and is just causing randoms to rage.

The fact that you knew who started the virus spreadings, and what it was originally intended for is unnerving enough that I don't think Shadow is out of line with his responses.

He said the virus wasn't mean't for graal online. How is that unnerving?

Darow is a brilliant coder, and if he gets experience now he can go into the coding field and who knows maybe he will be the next bill gates.

I know he's already made his own systems (Nothing bad about them)
In the field that he runs in, he probably runs into a lot of coders who make bad things, thats probably why he knew about the virus

Equating a geek hobby with terrorism? Seriously, now?

I took a plane and crashed it into a building killing thousands of people just for the experience. V.S. I coded a small program that could potentially hurt your computer. hm...