*}

Warning: keyloggers active on messaging clients

Posted by Camiel jetset R. on 2010-01-31 15:35:39
Dear visitors,

We would hereby like to send out an official warning to all our visitors of potential keylogging attempts through any type of messaging programs.

We have had several alarming messages about fake Clanbase links being spreaded via IRC and Xfire, using "clanbase-ggl" (DO NOT TRY) instead of the regular clanbase.ggl.com. Clicking these links have resulted in a keylogger being installed on a person's computer, stealing their cdkeys and possibly more.

We advice everyone not to click on any links of people you do not know or trust (this also goes for our website!) and to always be careful with links from people you do know.

In addition, to prevent people from being tricked into opening a fake link (like http://www.google.nl, which could refer to a different website, as you can see), advanced linking is no longer possible on this website and will simply display the actual weblink.

Share |

40 comments

27 months ago
+0 thumbs
=/
27 months ago
+0 thumbs
www.tek-9.com is next
27 months ago
+0 thumbs
lol
27 months ago
+0 thumbs
Should really buy that domain up and have it forwarding to this to prevent that!
27 months ago
+0 thumbs
That domain is taken, its just not in use.
27 months ago
+0 thumbs
or tek9.org
27 months ago
+0 thumbs
sux :<
27 months ago
+0 thumbs
I haz Kaspersky Internet Security 2010, nothing will happen :D
27 months ago
+0 thumbs
Just from opening a browser it installs a key logger? wtf?

As far as I know opening something let's say with FireFox, it won't let install anything unless I allow, so isn't it safe to visit the pages, just not run / install anything from it?
27 months ago
+0 thumbs
If you visit the wrong site, you can get infected via a javascript keylogger. An option would be to turn off javascript (Froster gave me this link: davidhasselhoff.tek-9.org/blog/how_to_turn_off_java_applets-664.html ). The noscript firefox plugin is apparantly quite handy as well, no experience with it myself though. addons.mozilla.org/nl/firefox/addon/722

edited 2010-01-31 16:58:16
27 months ago
+0 thumbs
Ban Smithstar AKA chris-wow from tek 9.
27 months ago
+2 thumbs
He has been banned already
27 months ago
+0 thumbs
+1
27 months ago
+0 thumbs
seriously pathetic these attempts are
27 months ago
+0 thumbs
How does Tek9 ban people? By username or ip or what? I mean a prime example would be erasus, he doesn't do any actual harm except troll but he makes a new account everytime the other is banned.
27 months ago
+0 thumbs
I think he will soon have made every proxy known to man useless to come onto these forums...
27 months ago
+0 thumbs
We can do both.
27 months ago
+0 thumbs
What if you clicked one? Some1 sended me cb link on mirc for war I clicked =/
27 months ago
+0 thumbs
Before you start scanning, check your irc logs and see if the link is an actual clanbase link or the fake one.

Normal clanbase links are like: clanbase.ggl.com/, the fake clanbase link with a keylogger had a - in the middle.

Don't post the link here but just tell me if this is the case. If its the link with a keylogger, I will give you some useful links that might help.

edited 2010-01-31 18:22:37
27 months ago
+0 thumbs
what would these tools be?
27 months ago
+0 thumbs
I would probably try the things I currently have on my pc:
- Kaspersky 2010 Full Scan
- Hitman Pro 3.5
- Malwarebytes Antimalware
- SuperAntiSpyware
- HijackThis
- Spybot Search & Destroy
- CCleaner

Not an expert of course, so maybe some more knowledgeable people could give their thoughts.

Froster thought the keylogger stole the cdkey and then completely removed itself. I don't have any proof of this myself though, so I can't guarantee it.
27 months ago
+0 thumbs
Since this is just a script kiddie these tools should do. Especially HijackThis is helpful for analyzing your system if you know how to read the logs (or know someone who does).

If he was able to pull off something nastier like MBR based rootkits, I might have more tools at hand :)

Regarding the "self destruction" thing, I also think this one is more of a data miner than an actual keylogger.
27 months ago
+0 thumbs
how old is smith star / chris wow?
27 months ago
+0 thumbs
someone on alexzans xfire gave me this link too, they were doing it early all this morning at like 10am too
27 months ago
+0 thumbs
Got a msg from him at ~7am CET this morning.
27 months ago
+0 thumbs
BITDEFENDER FFS :p
criswOw got multiacount on this
27 months ago
+0 thumbs
In addition, to prevent people from being tricked into opening a fake link (like www.google.nl, which could refer to a different website), advanced linking is no longer possible on this website and will simply display the actual weblink.
27 months ago
+0 thumbs
nice
27 months ago
+0 thumbs
It isn't probably the right place to ask, but what happened with the "hot girls" topic :(?
27 months ago
+0 thumbs
How stupid do you have to be to click on websites you dont know
27 months ago
+0 thumbs
i knowwho it is its DoobZ cuz hes a fucking dick he got klogged now ehs doing it 2 every1else!
27 months ago
+0 thumbs
This comment has been deleted due to inappropriate content.
27 months ago
+0 thumbs
keylogger ffs ^
27 months ago
+0 thumbs
please dont try to be funny
26 months ago
+0 thumbs
what? it tested what you said you had fixed, linkning the text" "google" to tinypic. , and it changed to the tinypic andress like it's supposed to. i didn't try to be funny..
27 months ago
+0 thumbs
im not gonna press any link in my life anymore
27 months ago
+0 thumbs
Prolly a daft question, but i have no idea...

Is it still possible to do it through a site that does URL shortening?
27 months ago
+0 thumbs
we need to do something tho against these dirty cunts,sorry for my language.

edited 2010-02-01 05:42:15
27 months ago
+0 thumbs
so u click it ur fucked?
26 months ago
+0 thumbs
mysql injectors...after opening that link cookie will be stored "deep" at your system and it will steal your key via this path:
HKEY_LOCAL_MACHINE\SOFTWARE\Activision\Call of Duty 4\codkey

Owner of keystealer will recive a .txt file at his ftp or mail with your key.

edited 2010-02-01 19:40:58
Please login or register to post comments.