RareBot Virus! (PROOF)

[lol12345]

Well it wasn't infected until, i was going to update the bot today. I obfuscated the bot, to check if anything new was added since i was taking a vacation from rarebot.

Since i check, i see a whole new class (Which should not be there) Possibly could be a storer to store all the accounts saved, then in scripts there is another one for possibly pins.

Asked beta & delta what it was, started to tell me something else. And at the end they told me it was just for the update, i'm not retarded to believe that.

After that i decided, to quit developing for rarebot.

I'm nothing apart of rarebot, and it's infected.

* If anybody in HF are developing a client, and need help don't hesitate to ask.

* I've always taken Rarebot, seriously never infected it.

Source:

http://hackforums.net/showthread.php?tid=2280883

Change your passwords, I have changed mine. This guy is one of the original coders for this bot, don't get fooled.

 

[TheBigassGamer]

this is only relevant if you put your logins in their login system right? oh and uninstalling it should be good? [ by using their uninstall thing]?

 

[weeps]

Since its a exe file they could force run diffrent programs and dl them. So they could force run keyloggers and pinstellers.

To be quite honest im not that supriced, they stole pb source and theirs antinuke. I would scam my computer, uninstall rarebot and change rs password if i used it. Kronor is wellkowned on HF, I have no reasons to doubt what he is saying.

Also dont dl the new update.

 

[Emperor Nero]

Well a noob account of mine got it's password changed right after using rarebot after they updated the time before the graphical updates so I just decided it is better to use Simba.

 

[lol12345]

Simba and RID= only safe bot. Possibly runedream to. The owner would never EVER hack accounts.

 

[Phantom866]

If it's true, then I'm not suprised. Rarebot didn't seem very legitimate from the start.

 

[mercatres]

Not using the .exe doesn't work (seriously believe that you can't make a virus in Java? )
Not using the Account Managament doesn't work (Injection/Reflection bots can get your Username and Password as its saved into a field, not encrypted. Also PIN numbers aren't save.)
Using a Virus Scanner doesn't work (Virus scanners skip .jar files and wont even test it).
System Recovery doesn't work (If you code a virus properly, its not gone).


Please not that both the coders added extra classes which most likely add extra functionality, its highly unlikely that they will actually download external files to steal you account.


How do I get rid of rarebot/epicbot?

1. De-install every version of java (Control Panel > Add/Remove Program)
2. Install "Search Everything"

Everything is a lightweight tool that can scan your pc for files (by filename) VERY fast.

3 Search for .jar
& Delete them all.

4 Install java again.

 

[Kratom]

Can't say I didn't see this coming. Strange though, to go through so much effort getting a bot running just to steal account info?

 

[Grrr]

Just as most people have said, I'm not surprised at all. The only clients which you can trust are SIMBA and RID. These developers sprung up out of nowhere with these projects and it was just far too sketchy to be legit.

 

[TJ!]

Thanks for letting us know. I'll be sure to remove RareBot from VPSInfinity's servers and only support EpicBot for now (And of course, looking into Simba)

 

[spitter goo]

http://www.rarebot.com/community/index.php?topic=2788.0

Anyways, wouldn't you think it could be like a marketing stunt? He'll be like saying it isn't infected after the thread goes crazy. Plus, there's no such evidence. He could be hacked or anything, or maybe he was paid by another bot website to spread it, just so they'd move to the other bot.

Oh, and here's a quote regarding the guy who posted the bot infection:

Funny how at first you said you weren't affiliated with Rarebot, then you said you were a developer, then you said you were in it for the advertising profits, now you say you quit AFTER they infected it. Sounds like a load of horse shit. You are probably saying that now because they have already started hacking the accounts.

 

[Mastastick2]

I think they're after more than runescape accounts. I don't know if it was just a coincidence, but shortly after downloading it I got a full on keylogger, or possibly a RAT. My paypal got hacked, email, runescape account, and even my xbox gamertag. Fortunately I was able to recover them all, but seeing my paypal with my entire college fund almost getting stolen was enough to ruin my day.

 

[ilvtfu]

imo i thought rarebot looked like a knock-off of runedream, so i didnt touch it

 

[Sokil59]

Well explains y they banned me for showing people there how to fully delete anything they got from rarebot on there computer.

 

[D R U M]

I heard text on a screen is proof.

In that case, SIMBA and RID both have keyloggers I used to be a developer for both of them.

My source is this post.

Don't jump to conclusions.

 

[spitter goo]

Yeah, he also claimed he was "sperminator" without any proof. Jelly bot clients are jelly. Anyways, I'd rather bot NOW and wait for powerbot than sit there waiting for it.

 

[sonic_fanrs]

This is hardly proof. I'm pretty sure it's clean (although I have just as much proof as OP -- which is "some guy on a forum says so").

Edit:
http://www.rarebot.com/community/index.php?topic=2788.0

 

[muddycat]

so were is this "proof" cos all i see is a quote and a post on some other forums i cant see

and if im not mistaken a quote can not be used as proof in a scam report then why is it classed as proof in this post?

id like to see proof not words typed by someone

 

[spitter goo]

so were is this "proof" cos all i see is a quote and a post on some other forums i cant see

and if im not mistaken a quote can not be used as proof in a scam report then why is it classed as proof in this post?

id like to see proof not words typed by someone

Because there are color bot fanboys who can't accept that injection is back.

 

[mercatres]

I love how they wrote a whole letter about the accusation.
Makes them look guilty IMO.