Caution, JAVA Drive-By Warning

I saw on sythe today this thread

http://www.sythe.org/announcement.php?f=221

I recall seeing that exact same thread here....and see'ing that fishy game...I even opened it but denied the Java plug-in request, fortunately saving myself there.

If you played that game, reformat everything for you are at risk.

For those that can't view the link....

http://i1112.photobucket.com/albums/...fy/warning.png


Andddd the link to the offending thread, as found by Jakey

http://villavu.com/forum/showthread....ghlight=dexter

PLEASE DO NOT PLAY THAT GAME

Cant get on the link, maybe copy and paste here :) <3

Updated OP

Wasn't there a thread here like the one posted there? With the malicious link. Though I can't find it anymore.

Quote:

---

Originally Posted by RISK

Wasn't there a thread here like the one posted there? With the malicious link. Though I can't find it anymore.

---

Exactly why I posted this. I tried to find the thread aswell just now....can't seem to find it.

Well, anyhow, if anyone has viewed that link, it might explain the recent thread about the guy's account being robbed.

I wonder where the thread went...

I'm actually really annoyed if we got fucked over like that, ill have a search now


EDIT:

http://villavu.com/forum/showthread....ghlight=dexter

the fucker

Quote:

---

Originally Posted by RISK

Well, anyhow, if anyone has viewed that link, it might explain the recent thread about the guy's account being robbed.

I wonder where the thread went...

---

It would explain why several accounts all got robbed with the same evidence.....

I almost fell for it myself, except I refused to allow the "game" to use Java with an unregistered security token.

E: Updated OP again with the thread

What is a "Java drive-by"?

That thread on here has been unapproved, it will be pushed up.

Quote:

---

Originally Posted by josh81193

What is a "Java drive-by"?

---

Drive-by download means three things, each concerning the unintended download of computer software from the Internet:

1. Downloads which a person authorized but without understanding the consequences (e.g. downloads which install an unknown or counterfeit executable program, ActiveX component, or Java applet).

2.Any download that happens without a person's knowledge.

3.Download of spyware, a computer virus or any kind of malware that happens without a person's knowledge.[1]

Quote:

---

Originally Posted by jakeyboy29

Drive-by download means three things, each concerning the unintended download of computer software from the Internet:

1. Downloads which a person authorized but without understanding the consequences (e.g. downloads which install an unknown or counterfeit executable program, ActiveX component, or Java applet).

2.Any download that happens without a person's knowledge.

3.Download of spyware, a computer virus or any kind of malware that happens without a person's knowledge.[1]

---

oh ok, i get it

If ANYONE played this, please PM a staff member and we will ban your account until you can sort this out. This is for your security.

Oh crap, I played the game on that guy's thread; my Norton was able to Block the virus though.

>.<, let me go check my accounts...

E: They are all still not hacked; For safety's sake I will just change passwords.
EE: These are the pictures are what my Security managed to pickup.

http://i.imgur.com/PbjLY.png

Mind you the "medium" alerts don't mean anything, (I get them all the time, it is simply because of a separate firewall I have running)

https://addons.mozilla.org/en-US/fir...ddon/noscript/

But you had to approve to run the applet, didn't you? An unsigned Java shouldn't have access to your HD.

Clicked the link, but didn't allow the applet to run. I'm safe, right?

Quote:

---

Originally Posted by stuffs

Clicked the link, but didn't allow the applet to run. I'm safe, right?

---

should be, run a checker

Quote:

---

Originally Posted by jakeyboy29

should be, run a checker

---

Ran two scans each with Norton and Malwarebytes, still a little paranoid though.

Bleh.

Quote:

---

Originally Posted by stuffs

Ran two scans each with Norton and Malwarebytes, still a little paranoid though.

Bleh.

---

Your fine. I also opened it first time I saw it, but denied the Java applet to run. As a precaution I still ran a full-scan of McAfee and Malwarebytes and I'm good.

Sigh...why do people have to do this?

Quote:

---

Originally Posted by Kyle Undefined

Sigh...why do people have to do this?

---

Because they just don't care about what you feel. A lot of times they infect people just to fuck with them.

Also, Norton sucks ass.

I feel that reformatting is rather extreme. There's no need to wipe everything just to avoid a driveby; furthermore, you ought to have a proper anti-virus program. Seeing as the probability of a zero-day exploit is unlikely, to say the least, most AV software should be able to pick up and remove it with ease - if yours didn't, it's time to switch.

First, try to remove it with your current AV.
Then, if available as an option, call your AV company. They should have a licensed professional capable of taking remote control of your PC and removing it manually, for you.

Now, if you and/or customer support are unable to remove it, try going back to a restore point. If all else fails, reformat.

I still dont get what the this Fishy Game is about? I mean yes its a virus, but why are people opening it? Whats so great about it that you guys are tempted to open it?

Quote:

---

Originally Posted by nickrules

I feel that reformatting is rather extreme. There's no need to wipe everything just to avoid a driveby

---

Quote:

---

Originally Posted by http://technet.microsoft.com/en-us/library/cc512587.aspx

You can't clean a compromised system by patching it.

You can't clean a compromised system by removing the back doors.

You can't clean a compromised system by using some "vulnerability remover."

You can't clean a compromised system by using a virus scanner.

You can't clean a compromised system by reinstalling the operating system over the existing installation.

You can't trust any data copied from a compromised system.

You can't trust the event logs on a compromised system.

You may not be able to trust your latest backup.

The only way to clean a compromised system is to flatten and rebuild.

Jesper M. Johansson, Ph.D., CISSP, MCSE, MCP+I

Security Program Manager
Microsoft Corporation

---

The only way to be sure is a complete wipe. Is an hours worth of time to reformat and reinstall your commonly used programs (unless you have an insane setup, it shouldn't take more than an hour or two to get your system working almost exactly the same way it was pre-reformat), or worth the headache and time you lose dealing when your bank account/RS account/etc gets hacked?

I am so happy that I don't have AV or any protection. :) I love a good virus now and then. Keeps me sane.

I was reading that earlier today. It was a very nice catch by the fellow members at Sythe. I almost ended up playing a couple of those games but was to tired and said nawww.

Quote:

---

Originally Posted by R4nd0m

Oh crap, I played the game on that guy's thread; my Norton was able to Block the virus though.

>.<, let me go check my accounts...

E: They are all still not hacked; For safety's sake I will just change passwords.
EE: These are the pictures are what my Security managed to pickup.

http://i.imgur.com/PbjLY.png

Mind you the "medium" alerts don't mean anything, (I get them all the time, it is simply because of a separate firewall I have running)

---

Loled irl at typo (regietry) in norton sonar, shits like $100

Scanned with Malwarebytes, Norton, and did a system restore. Rescanned with Norton after the restore, and rescanning with Malwarebytes now. So far so good. I'm sure I'm clean, but I guess there's only one way to find out.

Shame I have too many important documents scattered around my computer to reformat.

Quote:

---

Originally Posted by Harry

The only way to be sure is a complete wipe. Is an hours worth of time to reformat and reinstall your commonly used programs (unless you have an insane setup, it shouldn't take more than an hour or two to get your system working almost exactly the same way it was pre-reformat), or worth the headache and time you lose dealing when your bank account/RS account/etc gets hacked?

---

Of course not - I'd be silly to say otherwise. But how do you suppose he found out it was a virus? Did he just stumble across it because he disassembles every java applet that he encounters? Probably not. Was he alerted by someone? If so, who and how did THEY know? Did they do that?

Or is it the more likely route, that he/someone else had their AV go off.

I imagine more than a few of the people on our forums are using shared or old computers. I don't know about you, but I keep a good deal of things which are important to me on my computer. For example, my laptop. At 4 years, it's somewhat old and quite slow, but there's too much "stuff" on it. You can't just download all those pictures from a vacation, or that night out with your friends (Of course, ignoring the fact that you should have a backup of important data - unfortunately, many neglect to do this). Reformatting before exhausting other options is downright silly and paranoid. It's a more likely than not a simple exploit, likely put there by some skiddie.

Change your password(s) on another computer (if you're really paranoid, do it on a different network than your own, too) and then exhaust other routes before you reformat. There's simply too much data lost for many people to make reformatting their go-to option right off the bat, just like you don't go to war with a country over something without first trying the diplomatic approach (or, usually atleast ;)).

And of course, make sure it's gone for good, and walk away from the experience with a lesson learned - regardless of how you go about solving the problem.

---------
E: Look at that, the post right before mine

Quote:

---

Originally Posted by stuffs

Shame I have too many important documents scattered around my computer to reformat.

---

A prime example of someone with too much stuff to just reformat. Suggesting a reformat off the bat is like being on the playground, and all the swings are being used, so you set the whole swingset on fire - sure, you removed the person(s) from your swing, but at what cost? You just "ruined" the whole swingset.
Admittedly a rather extreme example, but still gets the point of what I'm saying across.

Quote:

---

Originally Posted by nickrules

A prime example of someone with too much stuff to just reformat.

Suggesting a reformat off the bat is like being on the playground, and all the swings are being used, so you set the whole swingset on fire - sure, you removed the person(s) from your swing, but at what cost? You just "ruined" the whole swingset.
Admittedly a rather extreme example, but still gets the point of what I'm saying across.

---

Sounds like a personal problem that they don't have them backed up somewhere. Dropbox is quite simple and could hold most common people's amount of data. Not backing up is a silly excuse, I seriously hope most people back up important stuff...

More like, your swingset is already on fire, and you dump some water onto it to put out the fire. But the swingset is unsafe due to the damage before you put water onto it. You then try to ride on it, and crack your head open because the wood wasn't stable/safe enough to ride again on. :p

I actually have all of 'My' movies, games, PS2 games, e-books, mmorpg installs, application installs and CD-key lists all backed up on my 2TB external hard-drive. :p I couldn't imagine not backing things up, really.

Quote:

---

Originally Posted by nickrules

First, try to remove it with your current AV.
Then, if available as an option, call your AV company. They should have a licensed professional capable of taking remote control of your PC and removing it manually, for you.

Now, if you and/or customer support are unable to remove it, try going back to a restore point. If all else fails, reformat.

---

First, turn off your computer.
Second, insert a thumb drive.
Thirdly, reformat and re-install windows. (if quick format is selected installing from a usb drive will take 15 minutes tops)
Fourth, enjoy your cleaned system, tops 30 minutes.

or you could do all that spyware crap that MAY fully remove it...

Quote:

---

Originally Posted by footballjds

First, turn off your computer.
Second, insert a thumb drive.
Thirdly, reformat and re-install windows. (if quick format is selected installing from a usb drive will take 15 minutes tops)
Fourth, enjoy your cleaned system, tops 30 minutes.

or you could do all that spyware crap that MAY fully remove it...

---

And what of all your old data? I'm not arguing over if a reformat is a "fast" solution, I'm arguing practicality and data loss.

Unless you're saying to install over the old OS, in which case, that's not really reformatting....

Quote:

---

You can't clean a compromised system by reinstalling the operating system over the existing installation.

---

----

Quote:

---

Sounds like a personal problem that they don't have them backed up somewhere. Dropbox is quite simple and could hold most common people's amount of data. Not backing up is a silly excuse

---

But do you think that most of our (and scythes) users do so? You have to remember that most are pretty darn tech illiterate. And to simply say "Meh, we didn't really try any other method, but we'll just say bye bye to everything anyways" is downright silly.

Quote:

---

More like, your swingset is already on fire, and you dump some water onto it to put out the fire. But the swingset is unsafe due to the damage before you put water onto it. You then try to ride on it, and crack your head open because the wood wasn't stable/safe enough to ride again on.

---

Doesn't change the fact that he knew about it somehow, which likely means an AV picked it up. And thus, to extend the metaphor an AV is the swingsets automatic fire retardation system (it's a nice swingset :p)

It'd be pretty nifty chemical fire (virus) not to set off the protection ;)

Quote:

---

Originally Posted by nickrules

And what of all your old data? I'm not arguing over if a reformat is a "fast" solution, I'm arguing practicality and data loss.

Unless you're saying to install over the old OS, in which case, that's not really reformatting....

---

I mean reformatting, as far as data loss, if you don't back up everything on your computer you shouldn't care if you get viruses. Because you probably don't know you have a virus...

Quote:

---

Originally Posted by nickrules

Doesn't change the fact that he knew about it somehow, which likely means an AV picked it up. And thus, to extend the metaphor an AV is the swingsets automatic fire retardation system (it's a nice swingset :p)

It'd be pretty nifty chemical fire (virus) not to set off the protection ;)

---

Most viruses replicate, grab new data and such when you think it's all self-contained. Installing elsewhere, grabbing other undetected samples, etc. Even if you put the fire out on the swingset, it's already lit the dry grass on fire and it's spreading elsewhere. You could get lucky and manage to extinguish all the lit dry grass, or it will go and burn your entire house down.

Quote:

---

Originally Posted by footballjds

I mean reformatting, as far as data loss, if you don't back up everything on your computer you shouldn't care if you get viruses. Because you probably don't know you have a virus...

---

Someone's awfully presumptuous. Do you think 94% of PC users really don't care if they get a virus?

Oh, and http://money.cnn.com/2006/06/07/tech...loss/index.htm for additional statistics - to avoid bias, of course. A different number, but there isn't much detail on what was polled about.

@harry Most AVs nowadays scan files before they're allowed to execute.

Quote:

---

Originally Posted by nickrules

Someone's awfully presumptuous. Do you think 94% of PC users really don't care if they get a virus?

Oh, and http://money.cnn.com/2006/06/07/tech...loss/index.htm for additional statistics - to avoid bias, of course. A different number, but there isn't much detail on what was polled about.

@harry Most AVs nowadays scan files before they're allowed to execute.

---

I was saying in an over exaggeration that if you don't care enough about your data to back it up, why would you care if you have a virus? You most likely wouldn't even know unless it raped your CPU...

Quote:

---

Originally Posted by nickrules

@harry Most AVs nowadays scan files before they're allowed to execute.

---

And if it doesn't detect the first one? And if the Java goes and loads multiple viruses at once, one of which is undetected?

Google Chrome would have warned you about running an outdated version of Java and possibly detected the exploit.

Quote:

---

Originally Posted by footballjds

I was saying in an over exaggeration that if you don't care enough about your data to back it up, why would you care if you have a virus? You most likely wouldn't even know unless it raped your CPU...

---

I back up my data infrequently, at best. There are SOME things which I have backed up elsewhere, but very little, and I still have a decent amount of stuff that I don't want to lose. Does that mean I want a virus? Nope.

@harry, are you proposing a zero-day exploit (or similar) being used to target *runescape* accounts? And that this scythe admin decided to personally check random java/flash games for viruses, using methods other than an AV? More likely than not, it's a skiddy. And if it's a skiddy, it's likely a known exploit.