So were the War Z server files 100% fake?

#######################################################################

Tile: WarZ, Warinc Hack
Author: H.J. Auditing Employee Brent Junker
E-mail: junker@HJauditing.com
Web:

You must be registered to see links

#######################################################################

============
Introduction
============

In this document we will be covering the points of entry into Hammerpoint.

============
Part 1 "point of entry"
============

The hacker started by auditing. thewarinc.com
Found an SQL Injection in the forums wich has been patched since then.
After finding the SQL Injection, then proceed to dump the user table.
And some of the admins had passwords like ******.

From researching the user table, the hacker found out that kewk
where using the same password on the forum, his email,
The WarInc and The WarZ. This was the point of entry.

============
Part 2 "The Shell"
============

The hacker then proceeded of logging in to the admin cp of The WarZ.
Then proceeded going to the plugins and adding a malicious plugin for executing basic commands.

Plugin contained.
***************
And then executed the command ******************** to get a more sofisticated backdoor up.

example:
*****************************

Then the hacker hid the shell in a discrete directory so the administators would not find it.

============
Part 3 "password logging"
============

This is where it is starting to get interesting. The hacker placed a password logger in the vBulletin login function.
Then we would be able to grab all login sessions with plain text passwords

============
Part 4 "Accessing emails"
============

About more than half of the employees used the same passwords on their email accounts along with their personal email.
So inside their email contained information about SVN, RDP, what hosting company they where using and conversations between
employees, witch contained some inappropriate content on their work emails.....


...... and more

Click to expand...

DragonKon said:

Here is a simple guide on how to remove the infection if you need help post here also make sure to download malwarebytes also i know this is in wrong section but i posted here so the infected users have a better chance to see.

Tips:
Having a problem removing restore your PC back to a previous date
Disconnect your pc from the internet well doing this, (to stop him from messing you up)

You must be registered to see links

Windows XP & Vista/7
1. First go to your start and select Run if you don't see run then seach for it.
2. Once you click on it type %appdata% and go to the bottom do you see java.exe
3. Now minimize that and go back to run type msconfig and then select startup disable java.exe
4. Now restart your PC and then login and go back to appdata and delete java.exe

Windows 8
1. First go to your start and search for run then type %appdata% and see if you got java.exe
2. Hold [CTRL] + [ALT] + [DELETE] then select startup disable java.exe
3. Restart your PC and then login then go back to your appdata and delete java.exe

Screenshots [Windows 8]
Notice i didn't get infected the program i was right clicked on in my startup wasn't the infected file was example

Click to expand...

Type regedit into search, navigate to this registry.

Code:

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System\]

Delete

Code:

DisableTaskMgr=1

or replace 1 with 0.

Click to expand...