WARNING: Optimus Infected with a Trojan!

[Jimmy]

Read here: http://optimusbot.com/showthread.php?p=11032#post11032
EDIT: It seems Synt[a]x removed the thread -.-
EDIT:EDIT: It seems that when I asked Synt[a]x why he deleted my post, he removed my post and closed the thread.
EDIT:EDIT:EDIT: The_Flames told me on msn that the above is implying that they purposefully infected the svn, so, just fyi, the_Flames says that this was not done purposefully.

CWSandbox Analysis of the Malware: http://www.cwsandbox.org/?page=report&analysisid=546590&password=unxhpphrih

To check if you're infected, I made a little thing in Java. It checks if the Hacker.exe file exists, and shows you a JOptionPane telling you weather or not you're infected.
Download here: http://uppit.com/v/LEMR20VN

In short: The virus modified the GameLoader to load an "Engine" class from a URL class loader, and this class downloaded a file called "RSBotUpdater.exe" to the user home directory, naming it "Hacker.exe". It proceeded to run the file. If you're on Linux/Mac, you're safe. It you're on Windows, then you're infected if you've run the latest OBot.

If you're infected, I reccommend you run some AntiVirus scans, and the usual stuff when you've gotten infected, etc.

 

[Repentless]

19:53 jim5410 Synt[a]x

19:53 Synt[a]x ?

19:53 jim5410 Why do you close all my posts relating to the infected SVN?

19:53 jim5410 *Delete all my posts

19:53 Justin because there is an official one?

19:54 Synt[a]x because

19:54 Synt[a]x its a fuckin shame

19:54 Synt[a]x that such a thing happens

19:54 Synt[a]x im sort of ashamed

19:54 Synt[a]x and scared of losing shitloads of ppl

19:54 jim5410 :\

 

[Jimmy]

Lol, what careless people.

Synt[a]x	jim5410
20:10	Synt[a]x	mrquarter commited it, his gmail probs got hacked because he uses same pw for everything
20:10	Synt[a]x	-.-
20:12	jim5410	-.-
20:12	jim5410	What a smart person
20:12	Synt[a]x	i used to do that too uno
20:12	Synt[a]x	lol
20:12	jim5410	lol
20:12	Synt[a]x	when i was 8
20:12	Synt[a]x	LOL
20:12	c|p	newbiehacker did that
20:12	jim5410	Lmao
20:12	c|p	cus

-.-

 

[Mike¥]

dont get the last post....
I was going to dl opti bot too lucky I didnt

 

[Jimmy]

dont get the last post....
I was going to dl opti bot too lucky I didnt

It got infected because one of their mod's gmail accounts got hacked, due to the fact that he used the exact same password everywhere.

 

[iDan]

Hey Jim, thanks for telling us all this. I downloaded oBOT about a day or two ago. I didn't type in any information and then I deleted it. Recommendations?

 

[Jimmy]

Hey Jim, thanks for telling us all this. I downloaded oBOT about a day or two ago. I didn't type in any information and then I deleted it. Recommendations?

Doubt you're infected, but you could run the little app that I gave in the first post. The information you entered into the bot is completely irrelevant to the virus. The bot simply downloaded and ran an infected .exe, so regardless of what you entered, you are either infected or not infected. :\

 

[Mike¥]

Any news on when it will be fixed
I heard ur the go-to guy for jmacro, should I get it over obot?

 

[Jimmy]

Any news on when it will be fixed
I heard ur the go-to guy for jmacro, should I get it over obot?

I believe Synt[a]x just fixed it (he made a new SVN).

Tbfh, just try them both and make a choice based off of that. Remember, though, I don't give svn access to anybody who doesn't have my complete trust (Currently I'm the only people with jmacro svn access xD).

 

[Mike¥]

I think I'll wait few days to make sure its safe
remind I'd what svn is :0

 

[Jimmy]

I think I'll wait few days to make sure its safe
remind I'd what svn is :0

I don't think waiting is really going to improve the situation. Synt[a]x is the only person atm with access to the new SVN, so, if that's infected, then Synt[a]x is knowingly infecting all of his users, and the bot is not at any time safe to use.

SVN: http://en.wikipedia.org/wiki/Subversion_(software)

 

[tehdragons]

I personally don't believe that any of these bots have viruses or trojans built in them/

 

[Jimmy]

I personally don't believe that any of these bots have viruses or trojans built in them/

Then you obviously didn't read the thread and/or are a very ignorant, stubborn person.

 

[peanuts cs]

If Jimmy says its infected then its infected. If Jimmy says that 1+1=4 then by god it equals 4, the math books have it all wrong, and logic needs to change its ways.

 

[Zak_rs2]

:embar: Glad i chose not to use this one.