virus in client ender

[Soroka]

03.06.2019 activity was noticed while loading the client ender
URL-адрес: http://survey-smiles.com/
after login the client breaks to the specified address, which belongs to hackers

please be careful, it started just today. Everything seems calm in latikai

[Taipion]

1.) Where did you download your enders?

2.) "breaks to the specified address" means what exactly?

3.) to which address? the one you mentioned?

[Soroka]

I will try to tell you in detail. Immediately apologize for my English, it is not very good.

I downloaded the client somewhere a year and a half ago and downloaded the client from the link in this forum. I have it installed on 2 different PCs, on the second one nobody is working now and nothing has changed there for two years already. I really like the ender and I use it.

This morning, suddenly after I’m logged in and my character is loaded, the firewall is triggered. the firewall started blocking the above address every second, and everything stopped after I closed the client.

As a test, I switched to the second machine and started the game there. It all happened again. After that, I was forced to change the ender to Latky. And the firewall did not report any more attempts by the PC to contact the remote host .

I changed the passwords on the account from which I logged in and calmed down on this, notifying of the problem on the official forum.

P.S. 03.06.2019 8:41:07 URL-адрес http://survey-smiles.com/, содержащий вредоносную программу, обнаружен
06/03/2019 8:41:07 AM URL http://survey-smiles.com/ containing malware detected

[Taipion]

That is, to say the least, incredibly strange.

- Enders client on github (salem, mind you, not hafen) has not been modified for years.
- Many people use it, and salem players tend to be paranoid, but no one ever reported anything like that.
- Latikais is based on enders, up to the last change, and should, by all means, include everything enders has, if latikais is "clean" but enders is not, that's suspicious to say the least.

From that, I'd guess that the problem is not coming from enders client, and it all does not quite fit together, yet.



Can anyone else shed some light on this issue?

[Soroka]

Then I will be grateful for the advice where I can look for a problem. I will explain

I checked the registry cleanly. Checked the tasks - clean. checked just in case the C drive with completely different antivirus software is clean.I read the logs in the Java machine - clean. there are only salem resources.

arranged brainstorming with friends, as a test for the same machine, where the problem was first detected again, the ender was installed from the distribution, which I download a long time ago. There are no problems at the moment. I did not reboot the machine in the morning, no software was loaded or unloaded.

I really do not understand why this problem was observed in the morning on two different machines. I am not well versed in Java. Perhaps someone who knows will tell how it could be.

[Kandarim]

You can see here that the game files for Ender's client have not changed for several years.
It appears that something differently fishy is going on with your internet connection. Or maybe some other unwarranted access to your machine poisoned some java files? (Should not be possible with the client .jars because the files are signed and changes are detected w.r.t. the github-hosted versions).

[lachlaan]

try downloading hijackthis https://sourceforge.net/projects/hjt/fi ... t/download

Or just checking your hosts file to see if there are any redirects of common urls you used to use.

I'd also clear java's cache, not sure what sort of redirects to other urls that could be storing.