Beware Of Key Loggers

[Henceforth]

Originally Posted by crazyhunter

u need more peds to buy one)

lol its not my screen, I searched it in the gallery

And offcourse I already have a GC

[crazyhunter]

just found that funny sry

[Rowdoc]

Originally Posted by Will Henceforth

That my problem too 200ped & I have less than 20ped
Maybe this dirty keylogging scum can make more than I can with 'Rowdoc'
joking!

[sob]

for the more curious:

Originally Posted by sob

im not sure if this has been reported on the forum before but there is atleast one person walking around asking people about goldcards (where to get them, are they any good, do you use it).
if you tell this avatar that you dont have a gc "she" becames very chatty. obviously "she" is very quick to offer a slideshow of herself daincing (she is a stripper that owns a club ).

after playing around with "her" for a while i got the slideshow.exe file, recorded all the chats, took screenshots and got "her" ip address before sending all the info to support.
"she" insisted on using yahoo, since this appears to be one of the few webmails that wont reject the file she is sending.

so if anyone ask you if you use a goldcard, always say yes no matter what. and dont trust stippers with a slideshow fetish on yahoo mail!

Support Case 137256 history

14 Mar 2008 You wrote:
Hi.
I was approached by the avatar "xxx xxx xxx" in Twin for the second time at around 21.00. The first time she asked me where she could get a gold card and if I had one.
The second time (I was wearing different clothes) she approached me again asking the same thing. She has also approached several other people with the same questions (even people in my society).
Since I told her that I didnt have a gold card this time she became very chatty and wanted to exchange pictures. I agreed and created a new email account for her to send me some "slideshows". The file she was sending was an .exe file possibly with a keylogger attached. I didnt open it but I have it stored on my email.
The email was sent via yahoo webmail from a xxx IP address, xxx (xxx). The email address was xxx@xxx.
If you need it I can provide screenshots and logs of the conversations as well as the email and exe file.
Hopefully you will lock and ban this and any related accounts permanently before anyone gets hacked.
Regards,
Anders

14 Mar 2008 Entropia Support:
Hello and thank you for reporting, could you please send the keylogger to xxx@xxx and the screenshots/logs to xxx@xxx
Please write the number of this case in the subject field.
Regards,
Entropia Support

14 Mar 2008 You wrote:
Hi.
I have now sent the two emails. I hope this will be helpful.
Have a good weekend.
Regards,
Anders

14 Mar 2008 You wrote:
Hi.
The email I sent to xxx@xxx with the possible keylogger was rejected, Remote host said: 552 5.7.0 Illegal Attachment l38si28623253waf.27.
This avatar had problems sending to my gmail address as well so she/he requested that I opened up an email account at Yahoo.
You can have the account detail for my yahoo email/messenger since I created it only for this purpose. If you are lucky you might even get the chance to talk to this person from the buddy list.
You will find the email with the attachment there.
http://www.yahoo.com
Username: xxx
Password: xxx
Regards,
Anders

17 Mar 2008 Entropia Support:
Hi and thank you for sending us this file. We will now start our investigation.
Regards,
Entropia Support

and i would have to say this person was very patient as i tried my best to be timeconsuming i think he/she spent like 1 hour trying to send me the file (since i wanted it by email, not just messenger). when i finally got it i told her that there was an emergency so i would have to open it later.

[Kimmi]

Coloring armor!!!!!

TODAY ONLY 100PED
GET YOUR SHADOW COLORED!!!

[crazyhunter]

thats cheap)

[PW3CKA]

Im happy that i got my goldcard :),

Im in italy and when i ordered it i must wait almost one month for trip to czech and than the activation was not working but it was solved almost imeditialy by support :), i was pretty nervous :D

[Acronoid]

Originally Posted by Kimmi

Coloring armor!!!!!

TODAY ONLY 100PED
GET YOUR SHADOW COLORED!!!

Upgrading shadow to pixie for free

[Wistrel]

Well done sob on getting enough info to catch the hacker! Most don't think to do this so really - great job!

If you are interested, you can probably find out exactly what is in that exe by virus scanning it.

If you don't have a scanner you can use the online one at www.antivirus.com which is pretty good.

Incidentally for anyone who is interested in stories on catching hackers the following may be of interest. Its a fun read!

http://www.crime-research.org/library/grcdos.pdf

Its interesting though... this is the first time I have heard of such directed attacks so although its simplistic it seems people are starting to try a little harder with PE. I wonder what will happen when the troops arrive...

[Frigid]

If Mindark was worried about keyloggers, they would allow the log-in to let me paste in my username and password...but it doesn't. Can anyone? Perhaps it is just the setting on my OS...