InsaneJournal

Current mood:	nervous
Entry tags:	everybody panic!, ffxi

Online Gamers!
If you play an MMO like FFXI, WoW, MxO, whatever, please pay attention!

For the past two weeks, FFXI accounts are being stolen at an unprecedented rate. While SE has remained silent about warning us or assisting, the community has isolated the problem.

MMO players of all games should pay attention, as this trojan is not native only to FFXI. I heard some rumors that it was created as a WoW keylogger, and pretty much confirmed it. It's a threat to all of us.

Players are being infected with a Trojan that keylogs your password, transmits this information to a third party, who then exploits it to get at your character and items. The character(s) is/are stripped via trades to a third party mule, who then sells the items via bazaar or auction house. The player's character is then transferred to another server and sometimes renamed. Some characters are then abandoned. Some are turned into RMT bots for farming, hunting, or PLing.

So far, the only confirmed virus scanner that will pick it up is the paid version of AVG.

Get informed. Learn what to look for, and protect your computer!

For the moment, people seem to be agreeing that the FFXI culprit is either:

• FFXI.Somepage.com (This is the most likely culprit, as the site owner is AWOL and there are screenshots suggesting a tiny IFRAME was embedded into the index page)
  
• FFXI-Atlas.com (for having a strange IFRAME/Javascript)
  
• FFXIAH.com (for complaints of spyware; there's some screenshots in the linked thread or this one)