Curse

**cosyfiep** · May 28, 2010, 03:52 PM // 15:52

Quote:

Originally Posted by Chris616263

Nope. I use Norton, haven't had a problem with my PC in over a year since I switched to Norton. It's funny that everybody hates on Norton; but I'm sure they all use different AV software and claim "it's the best". Note that nobody has actually said what AV they use when bashing Norton, either.

you had McAfee before???

I hope that anet takes this to heart and puts back that security layer that ncsoft removed. 'Just because it seems to be working is not a reason to stop using it'.

bhavv · May 28, 2010, 04:05 PM // 16:05

I've been using AVG Free for years, and also started using Microsoft Security Essentials after getting Windows 7.

Both of them are free and I've never had a problem with viruses or malware.

I also got a free copy of Kapersky bundled with a motherboard, but I havnt botherd installing it since I dont need it. I think it would only be a cut down version or just a 1 year license and then you have to pay, so never bothered using it.

kokoninja · May 28, 2010, 04:10 PM // 16:10

Quote:

Originally Posted by Nerel

I'm not sure if this is relevant to the thread, and I certainly don't want to join the Norton bashing (despite it being a bloated shitty product), but I recently noticed something in Guild Wars that seems Norton related whilst looking at some screen shots of Dhuum.

Screen shot linked... my apologies for my poor attempt at enlarging the interesting portion of the screen shot, my Photoshop skills are lacking

http://img171.imageshack.us/img171/649/dhuum01.jpg

O.M.G.
Such poetic irony.

Good find, my friend.

jray14 · May 28, 2010, 04:37 PM // 16:37

Quote:

Originally Posted by Gennadios

If anything, setting up a new password just ups your chances of it being noticed in any keyloggers that are hiding on one's system.

I've been wondering about the relative risks of changing vs. not changing passwords too. Normally it's a no-brainer, but NCSoft is so incompetent with security that I wouldn't be surprised if it's safer to just leave things alone. What are the risks of NCSoft accidentally sending your confirmation to the wrong person, a hacker listening to NCSoft's site and intercepting your password change, etc., compared to the risks of someone having your current password? Anyone here have enough actual security knowledge to hazard a good guess?

Nerel · May 28, 2010, 04:50 PM // 16:50

Quote:

Originally Posted by jray14

I've been wondering about the relative risks of changing vs. not changing passwords too. Normally it's a no-brainer, but NCSoft is so incompetent with security that I wouldn't be surprised if it's safer to just leave things alone. What are the risks of NCSoft accidentally sending your confirmation to the wrong person, a hacker listening to NCSoft's site and intercepting your password change, etc., compared to the risks of someone having your current password? Anyone here have enough actual security knowledge to hazard a good guess?

If there is any accuracy to that Symantec report, the threat lies in the fact that the bad guys have somehow obtained about 2 million NCsoft account credentials (NCsoft master, or various NCsoft games, I don't think it made a distinction), presumably by gaining access to NCsoft's servers at some time in the past... not by hacking/keylogging individual users... this means, according to Symantec at least, that old account credentials (username, password etc) are potentially vunerable, and the safest thing to do would be to update your passwords.

Remember of course, this comes from Symantec (aka Norton Internet Bloatware).

Also, they have no idea of how old these 'NCsoft credentials' are, for all we know the 'hackers' could have obtained their data ages ago, and indeed might be the cause of the (relatively) recent huge number of compromised accounts that NCsoft addressed by (among other things) adding the character name to the login credentials for Guild Wars.

If in doubt, check your system thoroughly for virus/spyware... use multiple sources to check, don't rely on just one AV program, if your system is clean with no risk of keyloggers... go update your passwords.

End · May 28, 2010, 08:59 PM // 20:59

Quote:

Originally Posted by Feathermoore Rep

i mean if my anti-virus doesn't catch, that means my anti-virus company (if updated) doesn't even know about it yet. If my anti-virus, whose job it is to find and protect against them, can't find then i surely dont have the time or knowledge to look for and tell if i have it.

Thank you for proving my point...you wouldn't know if your computer was infected...hence how can you say it worked wonders for you?

Quote:

Most anti-virus seem to be including more and more resident (active change monitor), so even trying to piggyback files tends to get noticed. And the number one source of keyloggers is third-party software.

Yet...this only got found after getting how many accounts? There is no perfect AV program out there...they will all miss stuff..usually they miss the same stuff

didis · May 29, 2010, 05:11 PM // 17:11

Reading the posts of fellow Guru-members, it´s ok, not to take the message seriously.
Only to the fact that it´s Symantec?

Symantec analyzed data in a discovered botnet. They stumbled upon the account information. It´s not about virus detection software, like norton 360 etc..
Be glad they found the information, that it is made public.

If Symantec discovered 2 million accounts possible to be hacked in the future, it's in my opinion Arenanet/Ncsoft who should be talking with Symantec to investigate whether or not the owners of the 2 million accounts should have an in game message/mail stating that they should change their passwords immediately. This will also give them conclusion to check the computer for malicious software.

Don't shoot the messenger, but the content....

EDIT:
It could be originated by the hacks of several gaming fora using outdated unsecure software, like wordpress, vbulletin etc
Trojan.Loginck
Risk Level 1: Very Low
Discovered: May 20, 2010
Updated: May 20, 2010 1:36:08 PM
Type: Trojan
Systems Affected: Windows 98, Windows 95, Windows XP, Windows Me, Windows Vista, Windows NT, Windows Server 2003, Windows 2000

Trojan.Loginck is a Trojan horse that logs on to gaming websites to check if stolen gaming credentials are valid.
Deatil: This Trojan can arrive on a computer through a variety of methods. As a result the file name of the Trojan will vary from one situation to another.

When the Trojan is executed, it contacts a predetermined server and downloads a list of stored user names and passwords for gaming websites.

Note: The Trojan does not steal these account details. They have likely been gathered by other information-stealing threats.

The Trojan then attempts to log into these gaming websites in order to determine if the account is valid.

Spyware website:
Trojan.Loginck Description
Trojan.Loginck is a dangerous Trojan infection. Trojan.Loginck will corrupt a computer system in a variety of ways, either by a spam email messages, malicious websites or file-sharing networks. The file name of the Trojan may differ from one situation to another. If Trojan.Loginck is executed on the computer system, it will contact a remote server and download a list of stored passwords for online gaming websites. The Trojan infection does not steal these account details. They have likely been collected by other information-stealing threats. The Trojan then will use the infected computer for trying to log into these gaming websites for checking if the account is valid. It is very important that a Trojan such as Trojan.Loginck is automatically detected and safely removed with a spyware removal tool.

Removal instruction:
To remove Trojan.Loginck, you must first stop any Trojan.Loginck processes that are running in your computer's memory. To stop all Trojan.Loginck processes, press CTRL+ALT+DELETE to open the Windows Task Manager. Click on the "Processes" tab, search for Trojan.Loginck, then right-click it and select "End Process" key.

To delete Trojan.Loginck registry keys, open the Windows Registry Editor by clicking on the Windows "Start" button and selecting "Run." Type "regedit" into the box and click "OK." Once the Registry Editor is open, search for the registry key "HKEY_LOCAL_MACHINE\Software\Trojan.Loginck." Right-click this registry key and select "Delete."

Finally, to completely get rid of Trojan.Loginck, you must manually remove other Trojan.Loginck files. These Trojan.Loginck files can be in the form of EXE, DLL, LSP, TOOLBAR, BROWSER HIJACK, and/or BROWSER PLUGIN. For example, Trojan.Loginck might create a file like
%PROGRAM_FILES%\Trojan.Loginck\Trojan.Loginck.exe. Locate and remove these files.

GoF · May 29, 2010, 05:28 PM // 17:28

There's something I don't get here...

it took me a few hours to read though every post about the bans, and 5 minutes about this?

Isn't 2 million compromised accounts something more alarming to you people than 3,700 banned people? Where's ArenaNet now?

tripplesix · May 29, 2010, 06:02 PM // 18:02

Quote:

Originally Posted by GoF

There's something I don't get here...

it took me a few hours to read though every post about the bans, and 5 minutes about this?

Isn't 2 million compromised accounts something more alarming to you people than 3,700 banned people? Where's ArenaNet now?

Look at it like this, because of the lack of responses in this thread, it means its no big deal.

PuppyEater · May 29, 2010, 08:15 PM // 20:15

Quote:

Originally Posted by End

Thank you for proving my point...you wouldn't know if your computer was infected...hence how can you say it worked wonders for you?

Its pretty safe to say that if the system hasn't been slowed down, taken over, or any kind of personal info has been compromised that they doesn't have a virus, or at least one that's anything to worry about...

If you feel fine then there's no reason to believe that you're sick and you just don't know it yet. Unless, of course, you're a hypochondriac...

Chthon · May 31, 2010, 02:55 AM // 02:55

This thread is not getting the kind of attention that it should be. I know there's WiK and the account bans and other stuff to keep people distracted, but still, we ought to be paying more attention to something of this magnitude.

Faer · May 31, 2010, 03:03 AM // 03:03

People would rather spam "QQ MOAR BOTTURZ LOL DHUUMSDAY" than discuss something important in an intelligent manner, Chthon.

Ka Tet · May 31, 2010, 03:16 AM // 03:16

Could someone please translate that article for the computer illiterate.
I get the part about the server, but how they got info I did not understand. Did the virus take info from the user's pc's or did they use the infected computers to search for databases and test passwords?
And yea that's pretty disconcerting. Would definitely be interested to find out what NC has to say about those accounts being new potential thefts or if it was old data from the accounts they worked to fix before.

edit: I went back to the Riverside page just to make sure I didn't miss something.
It might be good to relay that this is a new incident. I thought that it was an old thread that just had a new comment. I know I would have read this much sooner otherwise.

MisterB · May 31, 2010, 10:23 AM // 10:23

Is everyone too busy attacking one another to notice this? Thanks for posting. Password changed. Again. It sure wold be nice to see a response from NCSoft or ArenaNet about this.

I don't like Norton software either, but that has nothing to do with Symantec's report.

zwei2stein · May 31, 2010, 10:29 AM // 10:29

Quote:

Originally Posted by Chthon

This thread is not getting the kind of attention that it should be. I know there's WiK and the account bans and other stuff to keep people distracted, but still, we ought to be paying more attention to something of this magnitude.

Frankly, login anouncement would be great. Red "Change your password NOW!" popup after login even better.

People usually do not think kind of dange applies to them, so apathy is understandable, even if stupid.

Gill Halendt · May 31, 2010, 01:12 PM // 13:12

Check this out

Might be worth mentioning (and hopefully reassuring to you):

Quote:

Note: The Trojan does not steal these account details. They have likely been gathered by other information-stealing threats. The Trojan then attempts to log into these gaming websites in order to determine if the account is valid.

So, credentials were stolen in some other way (keylogging, phishing, scam).

Nothing new, but if I were you I'd change my password anyway.

GoF · May 31, 2010, 01:26 PM // 13:26

Quote:

Originally Posted by Gill Halendt

Check this out

Might be worth mentioning (and hopefully reassuring to you):

So, credentials were stolen in some other way (keylogging, phishing, scam).

Nothing new, but if I were you I'd change my password anyway.

Maybe the server just generates random credentials, and all infected systems just test them out. If it's used that way, they DO steal credentials

Perkunas · May 31, 2010, 04:45 PM // 16:45

I wonder if all the WoW emails I have been getting the past few days is part of this theft ring. I don't have a WoW account, but have been told 5 times over the past 3 days I need to first protect my account, then recover my account.

combatchuck · May 31, 2010, 05:49 PM // 17:49

Completely OT, I know, but I can't sit by and watch somebody recommend Nod32.

I can understand the vitriol regarding Symantec, especially where Norton is concerned. However, since the 2009 release of 360, the AV suite has actually been very well-reviewed. I've tried the version that my ISP gives out for free, and I think it's very passable. It's very fast, has great detection rates, and the company has good response times to outbreaks. It's not the best, but they're much better than ESET or Grisoft. The only free AV that's worth any time these days is probably Microsoft's own, unless your ISP offers Norton 360 for free. They're going to have a very tough time cleaning up their reputation of being the Quicktime of antivirus, but the new stuff is doing a good job of it.

Amy Awien · May 31, 2010, 05:58 PM // 17:58

Quote:

Originally Posted by tha walkin dude

I get the part about the server, but how they got info I did not understand.

I don't think they know, the database contained account info for a variety of games, this info was probably gathered using methods specific to each game - or game-publisher.

Quote:

... Did the virus take info from the user's pc's or did they use the infected computers to search for databases and test passwords?

The virus (a trojan actually) was used to test the passwords.