RareBot Virus! (PROOF)

Source:

http://hackforums.net/showthread.php?tid=2280883

Change your passwords, I have changed mine. This guy is one of the original coders for this bot, don't get fooled.

 

this is only relevant if you put your logins in their login system right? oh and uninstalling it should be good? [ by using their uninstall thing]?

 

Since its a exe file they could force run diffrent programs and dl them. So they could force run keyloggers and pinstellers.

To be quite honest im not that supriced, they stole pb source and theirs antinuke. I would scam my computer, uninstall rarebot and change rs password if i used it. Kronor is wellkowned on HF, I have no reasons to doubt what he is saying.

Also dont dl the new update.

 

Well a noob account of mine got it's password changed right after using rarebot after they updated the time before the graphical updates so I just decided it is better to use Simba.

 

Simba and RID= only safe bot. Possibly runedream to. The owner would never EVER hack accounts.

 

If it's true, then I'm not suprised. Rarebot didn't seem very legitimate from the start.

 

Not using the .exe doesn't work (seriously believe that you can't make a virus in Java? )
Not using the Account Managament doesn't work (Injection/Reflection bots can get your Username and Password as its saved into a field, not encrypted. Also PIN numbers aren't save.)
Using a Virus Scanner doesn't work (Virus scanners skip .jar files and wont even test it).
System Recovery doesn't work (If you code a virus properly, its not gone).


Please not that both the coders added extra classes which most likely add extra functionality, its highly unlikely that they will actually download external files to steal you account.


How do I get rid of rarebot/epicbot?

1. De-install every version of java (Control Panel > Add/Remove Program)
2. Install "Search Everything"

Everything is a lightweight tool that can scan your pc for files (by filename) VERY fast.

3 Search for .jar
& Delete them all.

4 Install java again.

 

Can't say I didn't see this coming. Strange though, to go through so much effort getting a bot running just to steal account info?

 

Just as most people have said, I'm not surprised at all. The only clients which you can trust are SIMBA and RID. These developers sprung up out of nowhere with these projects and it was just far too sketchy to be legit.

 

Thanks for letting us know. I'll be sure to remove RareBot from VPSInfinity's servers and only support EpicBot for now (And of course, looking into Simba)

 

http://www.rarebot.com/community/index.php?topic=2788.0

Anyways, wouldn't you think it could be like a marketing stunt? He'll be like saying it isn't infected after the thread goes crazy. Plus, there's no such evidence. He could be hacked or anything, or maybe he was paid by another bot website to spread it, just so they'd move to the other bot.

Oh, and here's a quote regarding the guy who posted the bot infection:

 

I think they're after more than runescape accounts. I don't know if it was just a coincidence, but shortly after downloading it I got a full on keylogger, or possibly a RAT. My paypal got hacked, email, runescape account, and even my xbox gamertag. Fortunately I was able to recover them all, but seeing my paypal with my entire college fund almost getting stolen was enough to ruin my day.

 

imo i thought rarebot looked like a knock-off of runedream, so i didnt touch it

 

Well explains y they banned me for showing people there how to fully delete anything they got from rarebot on there computer.

 

I heard text on a screen is proof.

In that case, SIMBA and RID both have keyloggers I used to be a developer for both of them.

My source is this post.

Don't jump to conclusions.

 

Yeah, he also claimed he was "sperminator" without any proof. Jelly bot clients are jelly. Anyways, I'd rather bot NOW and wait for powerbot than sit there waiting for it.

 

This is hardly proof. I'm pretty sure it's clean (although I have just as much proof as OP -- which is "some guy on a forum says so").

Edit:
http://www.rarebot.com/community/index.php?topic=2788.0

 

so were is this "proof" cos all i see is a quote and a post on some other forums i cant see

and if im not mistaken a quote can not be used as proof in a scam report then why is it classed as proof in this post?

id like to see proof not words typed by someone

 

Because there are color bot fanboys who can't accept that injection is back.

 

I love how they wrote a whole letter about the accusation.
Makes them look guilty IMO.