In regards to the ichsuger hack pack that many of you downloaded..

CampStaff · #1 03-09-2009, 08:12 PM

ichsuger //former// CS mod at this site handed each of you a hackpack that claimed to be undetected. Seems he decieved many of you, by adding a trojan that uploaded your important information. This is a problem here.

Heres the documentation, followed by how you can fix your system, in order to clean his infected trojan from your computer.:

Quote:

Seems you are adding a program to each of the undetected hack folders. You have downloaded three currently Undetected cheats, added to a RAR, but added on program to each of the three folders.

Code:

antivacsystemso.exe

The three cheats you added, two of them are from my site at MP-Hacks. So I have major interest here. Lets begin:

Downloading your cheatpack from your supplied link gives us antivacsystemso.rar. Funny name to call a 'gathered cheat pack'. ANYWAYS.. when we download it, our antivirus program goes haywire... it could be a false positive, maybe it's a trojan.

Lets investigate your hack pack and find out:

Uploading it to anibus shows us invaluable information. Here's the results
As you see, it modifies users registry and creates and monitors keys. This should not even be in a "antivac" program. But lets continue..

Seems your trojan also connects to the internet, creates a file that has the following information:

Internet explorer usernames/ passwords
Mozilla Firefox usernames/passwords
Steam usernames/passwords
MSN, Yahoo, GoogleTalk ( Pidgin & Trillian ) usernames/passwords

It creates a file in temp folder

Code:

\Temp\u16event.html

and even calls on

Code:

C:\WINDOWS\system32\services.exe

Lets view the file in Olly:

GetProcAddress LoadLibraryA ( Standard )
GetComputerNameA ( why are you calling this? )
FindCloseUrlCache FindNextUrlCacheEntry FindFirstUrlCacheEntry ( what??! why )
FtpPutFile InternetConnect InternetOpen ( so, your antivac program puts all the assembled information into a file, opens the users internet connection, then connects to your FTP server and gives the file to you.

to be continued..

To remove this infection from your system, you will need to locate the antivacsystemso.exe and delete it fully from your computer. Next you will have to locate u16event.html from you temp file folder and remove that as well, fully and completely from your system. Clean your computer next fully with HIjackThis ( use their help forum to find any other problems that could have come with this trojan ). Then use a updated AntiVirus program to scan your entire system.

Then I suggest you change all your passwords. Every single one of them.

Sorry to see this has happened, but children with a bit of power...

Serverman · #2 03-09-2009, 08:57 PM

Thanks for this..... ICHSUGER!!!! HOW COULD YOU???????????

Jolinar · #3 03-09-2009, 09:02 PM

He just had no money and no friends to get any steam accounts, so he did it this way, I guess.

Serverman · #4 03-09-2009, 09:05 PM

XD i tink it was the dude who hacked him who did this... but still...

dog_keeper · #5 03-10-2009, 11:02 AM

thanks for this info. To all who downloaded it please follow the steps that Campstaff gave

Reinn · #6 03-10-2009, 09:11 PM

Quote:

Originally Posted by Serverman

XD i tink it was the dude who hacked him who did this... but still...

He admitted it to me over msn.

Thanks, you own. Hope you will applicate as Counter Strike mod, when you get more reputation. You will fit PERFECT there.

from me.

Jan.

CampStaff · #7 03-27-2009, 01:30 AM

Seems he has not stopped uploading trojans to the internet to steam peoples Steam accounts.

Read : This ( he uploaded this March 26 w/ his name )

Hallowsend · #8 03-27-2009, 01:33 AM

VERY good job CampStaff. Thank you very much for your hard work on this and CS altogether for us.

I added rep.

djstathis · #9 05-31-2009, 10:21 PM

OooO thanks for this!!