Urgent

Etizag - Archosaur
Etizag - Archosaur Posts: 45 Arc User
edited September 2010 in Chronicles
I just got a pop up message while playing the game that said due to server updates I need to change my password in the next 15 mintues or my account will be deleted.
Post edited by Etizag - Archosaur on
«1345

Comments

  • Michael_Dark - Lost City
    Michael_Dark - Lost City Posts: 9,091 Arc User
    edited September 2010
    Screenshot or it's BS.

    Or you've installed some 3rd party software you shouldn't have.

    I've never heard of this, ever. Good luck!
    I post in forums. This one and others. That's why I post.
  • Etizag - Archosaur
    Etizag - Archosaur Posts: 45 Arc User
    edited September 2010
    Michael_dark - Lost City wrote: »
    Screenshot or it's BS.

    Or you've installed some 3rd party software you shouldn't have.

    I've never heard of this, ever. Good luck!

    Looks like this
    http://img714.imageshack.us/img714/894/edfbdeksjfds.png
  • Michael_Dark - Lost City
    Michael_Dark - Lost City Posts: 9,091 Arc User
    edited September 2010
    Etizag - Archosaur wrote: »
    Looks like this
    http://img714.imageshack.us/img714/894/edfbdeksjfds.png

    Well, your account will only get deleted after 1 year of inactivity.

    A GM will contact you directly, not through any popups.

    That does not look official. Their is misspelled as "there".

    I would submit a ticket with this. I have no clue how you got that, but you won't get any message like that from a GM or from Perfect World as far as I know.

    Looks extremely fishy to me.

    I would immediately run a virus/trojan scan.
    I post in forums. This one and others. That's why I post.
  • Rillien - Heavens Tear
    Rillien - Heavens Tear Posts: 569 Arc User
    edited September 2010
    That looks very suspicious. Although GMs have been known to use poor English, I would not follow that popup.

    edit: ninjaed. but I share the sentiments reflected above^^
  • Etizag - Archosaur
    Etizag - Archosaur Posts: 45 Arc User
    edited September 2010
    NEW SCREENSHOT.
    Am I being ****???

    http://img839.imageshack.us/img839/894/edfbdeksjfds.png
  • Rillien - Heavens Tear
    Rillien - Heavens Tear Posts: 569 Arc User
    edited September 2010
    Send a ticket with this stuff, and I'd run a scan on your entire computer with your antivirus software.
  • ChopChop - Raging Tide
    ChopChop - Raging Tide Posts: 119 Arc User
    edited September 2010
    Since when has GM's used Pop ups to announce anything ? never thats what there in game function is for .

    Sounds like you have d/loaded something with undue care and attention.
  • Michael_Dark - Lost City
    Michael_Dark - Lost City Posts: 9,091 Arc User
    edited September 2010
    Etizag - Archosaur wrote: »
    NEW SCREENSHOT.
    Am I being ****???

    http://img839.imageshack.us/img839/894/edfbdeksjfds.png

    That has to be fake. You will never get a popup telling you to change your password or your account will be deleted.

    Has anyone you know from PWI sent you any files through a chat program or email recently?

    Disregard it. Your account will not be deleted... however your system security has been compromised.
    I post in forums. This one and others. That's why I post.
  • Etizag - Archosaur
    Etizag - Archosaur Posts: 45 Arc User
    edited September 2010
    It does not say anything so far. I only have Maleware bytes.
    I do not download 3rd party software?
    Like **** websites or something right?
    As far as I know no one has sent me any links or things like that.
    And is GM BearClaw a real gm??
  • RedsRose - Lost City
    RedsRose - Lost City Posts: 12,354 Arc User
    edited September 2010
    Send in a ticket...run a MAJOR virus and spyware scan on your computer!

    This is NOT normal b:shocked
    [SIGPIC][/SIGPIC]
    RoidAbuse is awesome, only he would sell his sperm for gear!!

    "Toughest monster? ..... RedsRose b:surrender" - Kantorek
    Where is my 1 v 1 Kan? b:mischievous
  • Rillien - Heavens Tear
    Rillien - Heavens Tear Posts: 569 Arc User
    edited September 2010
    Also try running it by the tech support part of the forums perhaps? I know they can be helpful over there beyond what we are saying, but definitely scan and ticket. Don't worry about your char, and hopefully you weren't **** majorly.
  • Michael_Dark - Lost City
    Michael_Dark - Lost City Posts: 9,091 Arc User
    edited September 2010
    Etizag - Archosaur wrote: »
    It does not say anything so far. I only have Maleware bytes.
    I do not download 3rd party software?
    Like **** websites or something right?
    As far as I know no one has sent me any links or things like that.
    And is GM BearClaw a real gm??

    The message looks more like a system message or web browser popup.

    If I were you I would download and run (all of these are free and linked to their direct websites):

    SpyBot Search & Destroy
    http://www.safer-networking.org/index2.html

    Adaware Free version
    http://www.lavasoft.com/products/ad_aware_free.php

    Avast Antivirus
    http://www.avast.com/index
    I post in forums. This one and others. That's why I post.
  • ArchSaber - Sanctuary
    ArchSaber - Sanctuary Posts: 1,440 Arc User
    edited September 2010
    i use avg, its free and its really good anti virus software.
    AP classes are a real butt pounding...
  • Katzyn - Sanctuary
    Katzyn - Sanctuary Posts: 1,270 Arc User
    edited September 2010
    That's not a game pop-up, that's more like a firefox pop-up, so yeah, definitely run anti-virus/scans/everything that was already said.
    Katzyn, level 101 Demon Veno
    Kylenea, level 99 Demon Cleric
    ForestSonata, level 6x Mystic
    Proud wifeh of Yudai <3
    [SIGPIC][/SIGPIC]
    ~Courtesy of the amazing Forsakenx~
  • MANray_ - Sanctuary
    MANray_ - Sanctuary Posts: 2,311 Arc User
    edited September 2010
    Definitively an attack of some sort. Seems clumsy however, i don't get it that a keylogger would need to advertise itself being on your system, so this is probably some kid running a generic MMO script. Still, something you should take very seriously, your comp has certainly been compromised and i wouldn't try anything involving secure information until you're absolutely certain you've succesfully dealt with this.

    b:irritated It really is very annoying that someone would pull something like this...
  • Deora - Lost City
    Deora - Lost City Posts: 1,086 Arc User
    edited September 2010
    GM Rules of contact (how they will contact you)

    A GM will pm you in game if they chose to or email back and forth through tickets or live chat, they will never ask for username or password as they don't need to, they have access and ability to change it.

    Whenever a GM pms you in game, it NEVER says their name it always says this

    GM Whispers: Message here

    Most of the time GMs will also either teleport to you or teleport you to somewhere in the game to talk, players do not have the ability to do that

    Always make sure you are on a .perfectworld.com (and nothing after the .com unless it is a / like pwi.perfectworld.com/login) website when giving any login information or it may be stolen

    Hope this helps, and it is simple as that
  • Solandri - Heavens Tear
    Solandri - Heavens Tear Posts: 2,843 Arc User
    edited September 2010
    That looks suspiciously like an old Windows exploit where you could remotely cause alert messages (the ! in a yellow triangle) to pop up on any networked Windows box because of Windows' poor security. Microsoft patched it so you couldn't initiate the alert remotely, but I wouldn't be surprised if a process running locally could still do it to make it look like an app other than itself generated the alert.

    More than likely you have some sort of malware + keyboard logger installed on your computer which seems tailor-made to steal PWI passwords. Since it's so specifically targeted, I doubt any regular anti-virus or anti-malware software will pick it up, but give it a shot anyway. Hopefully it's not too well written, and a simple app to manage your startup programs (like SpyBot in advanced mode -> Tools -> Startup) will let you disable it, then set about finding a way to delete it.

    If none of the above fix it, you're going to have to bring out the big guns and try running HijackThis and ask for help with the problem on their forums. Or you can format and reinstall everything. Since there's probably a keylogger involved, DO NOT go to any websites which require a password on that computer, especially any banking sites.
    http://free.antivirus.com/hijackthis/
    http://hjt-data.trendmicro.com/hjt/analyzethis/index.php
  • Angarika - Harshlands
    Angarika - Harshlands Posts: 375 Arc User
    edited September 2010
    u have been ****, it most likely happened if u were trading with someone or in a party with someone. If you accept random friend invites im sure they can **** you that way as well, i dunno but i would uninstall and reinstall the game and also download avast and use it :).

    Can tell by these screen shots that pwi isn't all that good with their security. Good luck Op.b:surrender
  • vristion
    vristion Posts: 0 Arc User
    edited September 2010
    Lol@ Bdsm..
  • Golassic - Harshlands
    Golassic - Harshlands Posts: 143 Arc User
    edited September 2010
    Etizag - Archosaur wrote: »
    It does not say anything so far. I only have Maleware bytes.
    I do not download 3rd party software?
    Like **** websites or something right?
    As far as I know no one has sent me any links or things like that.
    And is GM BearClaw a real gm??

    how did u know that is BearClaw not Bearclaw like its on the image?
    Useing ↑ in Forsaken World forum too

    NightRage, WaffleChan, MistaBwanden, SoIar, WraithTanker, BeingHope, Zanyru won't be forgotten~!

    RedsRose,Boogiepanda,NiightmareXz,Airyll u guys said everything that i wanned to say =] b:victory[SIGPIC][/SIGPIC]
  • Etizag - Archosaur
    Etizag - Archosaur Posts: 45 Arc User
    edited September 2010
    I admit I freaked out yesterday but Luckily I have KeyScrambler (firefox add-on) so my passwords should be protected from keylogging. But still. I ran a maleware bytes scan, avg scan, and found a backdoor program disguised as a trojan. What's weird is i haven't downloaded anything or went to any random weird sites. I did trade with someone in the game but he ran off...I really have no clue. But I have just re-formatted my laptop and pass-coded a hidden SSID key. But thanks for all your help guys :)
    And as I could tell he was very Illiterate when typing and it would say I have 30 minutes to change my password or my accoutn will be deleted ****..yea I doubt that a real GM would do that.
    Whatever it was he/she was able to see what I was doing on my computer when out-putting information only. So im asumming it's some sort of strange program.
  • MANray_ - Sanctuary
    MANray_ - Sanctuary Posts: 2,311 Arc User
    edited September 2010
    I'm glad things turned out ok and that you were able to solve the problem. While there are certainly many things you can do to minimize risk, something like this is bound to happen every once in a while, especially if you're a gamer. Unfortunately the internet has become a haven for virtual predators...

    I do encourage you to send in a ticket to PWI in case you were unable to before, it is in part their responsability to keep us safe from this sort of attacks and we owe it to each other to keep them informed on this issues.
  • Lutirica - Harshlands
    Lutirica - Harshlands Posts: 1,437 Arc User
    edited September 2010
    well problems do happen
    Fail troll of harshlands
  • Etizag - Archosaur
    Etizag - Archosaur Posts: 45 Arc User
    edited September 2010
    Well I appreciate everyone's help. :)
    And sadly yes I am a big gamer girly with all my many emulators. (I always scan them though).
    I am rather new to Perfect World. So I figured I was not familiar with the security of the game but thanks to you guys it really helped me.
    Btw I did not change my password lol. Seemed to..Fake. lol.
    I will submit a ticket as well :) And I do hope no one falls prey to this program.
  • Sneakret - Heavens Tear
    Sneakret - Heavens Tear Posts: 618 Arc User
    edited September 2010
    Hmm tbh looks a bit like a java script program. Not to mention the god awful spelling "sceduled" <-lol'd


    Scanning aside hit Ctrl +Alt + Del once, this should give you a task manager prompt where you can check to see what is running, though I DO NOT SUGGEST doing so unless you know what is generally running on your system.

    As one tab holds applications "safe place to look" and the other holds "processes" which is a no touchy zone.


    Edit: glad you got it fixed ^^ (facepalms at being too tired to notice multiple pages)
    I can see what you see not,
    Vision milky, then eyes rot.
    When you turn, they will be gone,
    Whispering their hidden song.
    Then you see what cannot be,
    Shadows move where light should be.
    Out of darkness, out of mind,
    Cast down into the Halls of the Blind.
  • MistaBwanden - Sanctuary
    MistaBwanden - Sanctuary Posts: 2,803 Arc User
    edited September 2010
    Angarika - Harshlands wrote: »
    u have been ****, it most likely happened if u were trading with someone or in a party with someone. If you accept random friend invites im sure they can **** you that way as well, i dunno but i would uninstall and reinstall the game and also download avast and use it :).

    Can tell by these screen shots that pwi isn't all that good with their security. Good luck Op.b:surrender

    I facepalmed and LOL'ed.
  • Etizag - Archosaur
    Etizag - Archosaur Posts: 45 Arc User
    edited September 2010
    It's ok now. As far as I know.
    Now if someone posts a thread up saying "WTF" with the same problems as me you can always refer them to this thread I guess XD
  • MistaBwanden - Sanctuary
    MistaBwanden - Sanctuary Posts: 2,803 Arc User
    edited September 2010
    Question, why does your IMVU window say URGENT as well?
  • Nowitsawn - Heavens Tear
    Nowitsawn - Heavens Tear Posts: 4,864 Arc User
    edited September 2010
    MistaBwanden - Sanctuary wrote: »
    Question, why does your IMVU window say URGENT as well?

    I think that IMVU thing is just a toolbar.

    Btw, I honestly doubt things are ''ok'' now.
    [SIGPIC][/SIGPIC]
  • Miugre - Heavens Tear
    Miugre - Heavens Tear Posts: 2,390 Arc User
    edited September 2010
    Malwarebytes is good... also try Spybot: Search & Destroy if that fails to find the problem.

    Try opening your task manager (Ctrl-alt-del) and see what's running on the Processes tab. This is how you can isolate the name of the app sending you that box. Then search for the app and delete it. If it comes back on restarting your computer, restart it in safe mode, then delete the app again.

    Most likely this is a piece of malware that includes a keylogger... so that when you change your password, it'll know. But then, a keylogger might just get your password on logging into the game... so I dunno really. XD
    [SIGPIC][/SIGPIC]
    Yes, I'm still a stubborn holdout in favor of the old game. Haters gonna hate. ;]

    Other Active Characters:
    LigerKing (Barb), Girasole (BM), Shamsheer (Sin), ArborSoul (Mystic).
This discussion has been closed.

Categories