Thread: ------CA - virus or not?

GCA=Full-fledged keylogger.

Don't be crying you kiddies when your dad/mom yells at you because they have gotten a huge bill on their bank account.

<3

Originally Posted by M4st3rH4ck3r
[Dear Visitor, you're restricted from viewing links until you are registered & logged on.
Click Here To Register Today

Nobody listened when I said there safe....thanks someone smart. @Oloha: you got to be retarded to actually think ------ can access your PC while using his hacks. It's safe trust me, nothing has happened to all the people that downloaded all his hacks since his like first release including me.

then don't blame me when your comp gets owned by ------

the safest thing to do is to not download it.
just dont risk it...

Originally Posted by Iamazn
[Dear Visitor, you're restricted from viewing links until you are registered & logged on.
Click Here To Register Today

._.

Theres still a FEW questions that remain. freedompeace says GCA is clean, but I dont think so. Why?
-WHY does GCA put the "one time use files INSIDE the SYSTEM folder? Why not the desktop? The TEMP folder?
-WHY are the files HIDDEN and RANDOMLY named? Why not "GCATemp"?
-WHY are the files STILL in the SYSTEM folder AFTER Combat Arms closes?

I'm keeping an objective view of this; I've been IP banned by ------CA admins for no reason (No reason specified)

-WHY does GCA put the "one time use files INSIDE the SYSTEM folder? Why not the desktop? The TEMP folder?
Here could be one possible explanation. The TEMP and DESKTOP folders change on each computer, on each operating system. ------ codes his hack in C++, which does not have the simple "My.Computer.FileSystem.SpecialDirectories.Tem p" function that Visual Basic does. Unlike the TEMP and DESKTOP folders, SYSTEM32 stays the same throughout all 32-bit OS's, the only architecture it was designed and compiled for.

-WHY are the files HIDDEN and RANDOMLY named? Why not "GCATemp"?
Hidden : They're not on mine o.o
Randomly named : That is a common practice to randomly name files, so that you run a much lower risk of returning an exception when copying a file to a directory where that filename already exists.

-WHY are the files STILL in the SYSTEM folder AFTER Combat Arms closes?
When ------CA, or any DLL of that matter, is injected into a running executable, a new thread is created for that DLL to run. This thread is not separate from the game, it is within the game itself. When you close the game, all threads within Engine.exe are termintated, and therefore the thread is unable to execute any ending processes, like clean up.

Originally Posted by freedompeace
[Dear Visitor, you're restricted from viewing links until you are registered & logged on.
Click Here To Register Today

I'm keeping an objective view of this; I've been IP banned by ------CA admins for no reason (No reason specified)

-WHY does GCA put the "one time use files INSIDE the SYSTEM folder? Why not the desktop? The TEMP folder?
Here could be one possible explanation. The TEMP and DESKTOP folders change on each computer, on each operating system. ------ codes his hack in C++, which does not have the simple "My.Computer.FileSystem.SpecialDirectories.Tem p" function that Visual Basic does. Unlike the TEMP and DESKTOP folders, SYSTEM32 stays the same throughout all 32-bit OS's, the only architecture it was designed and compiled for.

-WHY are the files HIDDEN and RANDOMLY named? Why not "GCATemp"?
Hidden : They're not on mine o.o
Randomly named : That is a common practice to randomly name files, so that you run a much lower risk of returning an exception when copying a file to a directory where that filename already exists.

-WHY are the files STILL in the SYSTEM folder AFTER Combat Arms closes?
When ------CA, or any DLL of that matter, is injected into a running executable, a new thread is created for that DLL to run. This thread is not separate from the game, it is within the game itself. When you close the game, all threads within Engine.exe are termintated, and therefore the thread is unable to execute any ending processes, like clean up.

1.
-It cant be that hard to find the TEMP/Desktop Folders.
-Couldnt ------ just find the Folder where GCA is located, and put the randomly named, hidden, suspicious MPH/DLL files there?

2.
-They were hidden on mine
-Why would a file be named GCATemp?
-Just add some error handling.
-Randomly naming a file + making it hidden is very suspicious.

3. Cant counter that

Originally Posted by Iamazn
[Dear Visitor, you're restricted from viewing links until you are registered & logged on.
Click Here To Register Today

Originally Posted by freedompeace
[Dear Visitor, you're restricted from viewing links until you are registered & logged on.
Click Here To Register Today

I'm keeping an objective view of this; I've been IP banned by ------CA admins for no reason (No reason specified)

-WHY does GCA put the "one time use files INSIDE the SYSTEM folder? Why not the desktop? The TEMP folder?
Here could be one possible explanation. The TEMP and DESKTOP folders change on each computer, on each operating system. ------ codes his hack in C++, which does not have the simple "My.Computer.FileSystem.SpecialDirectories.Tem p" function that Visual Basic does. Unlike the TEMP and DESKTOP folders, SYSTEM32 stays the same throughout all 32-bit OS's, the only architecture it was designed and compiled for.

-WHY are the files HIDDEN and RANDOMLY named? Why not "GCATemp"?
Hidden : They're not on mine o.o
Randomly named : That is a common practice to randomly name files, so that you run a much lower risk of returning an exception when copying a file to a directory where that filename already exists.

-WHY are the files STILL in the SYSTEM folder AFTER Combat Arms closes?
When ------CA, or any DLL of that matter, is injected into a running executable, a new thread is created for that DLL to run. This thread is not separate from the game, it is within the game itself. When you close the game, all threads within Engine.exe are termintated, and therefore the thread is unable to execute any ending processes, like clean up.

1.
-It cant be that hard to find the TEMP/Desktop Folders.
-Couldnt ------ just find the Folder where GCA is located, and put the randomly named, hidden, suspicious MPH/DLL files there?

2.
-They were hidden on mine
-Why would a file be named GCATemp?
-Just add some error handling.
-Randomly naming a file + making it hidden is very suspicious.

3. Cant counter that

1. Whatever works, and is easiest - he's not being paid for it uch: It would be quite a pain to have to locate those folders yourself...

2.
"They were hidden on mine". Hmmm... Well, whatever. I hide files too
"Why would a file be named GCATemp?" That would mean?
"Just add some error handling." Again, the error handling is a pain in the arse, especially for something free. Copying a new file is ultimately easier.
> What kind of error handling did you have in mind, anyway? Even if you did find that the file already existed, you'd have to hash check it to see if it was the real one, or another identically named file.

3. Yay :3

It is DEFINITELY a virus, we should refrain from releasing it to this forum. I had to install a clean version of Windows 7. Am not sure if its only this effective with Windows 7, but Norton warned me about GCA1.2.7 being a virus. I ignored it. Several hours after, the 'blue screen of death' appeared. I restarted but the problem persisted. After that I reinstalled Windows 7 Ultimate 64-bit. And all was good.

Really, I downloaded GCA just to see what it had. I decompiled all of its cintents... it contains NOTHING of a virus. Although.. seemingly... they can't code worth a shit and like to steal from other hacks

Originally Posted by Eclipse
[Dear Visitor, you're restricted from viewing links until you are registered & logged on.
Click Here To Register Today

When I used 1.2.6, I never once got a mysterious .mph file.

My Virus protection caought something after it got patched o-o

Originally Posted by killerofmen
[Dear Visitor, you're restricted from viewing links until you are registered & logged on.
Click Here To Register Today

if you want to see those "hidden files" got to control panel/folder options/view/ an tick the show hidden files and folders , an then those .MPH files will be there for you to see, scan each 1 (if you want to , i did jus cause i was bored) an sure i got "suspicious" an the like from virustotal , but when scan with AVG Pro,Avast and Norton came back all clean (which i KNEW they would) an i talk to ------ every now an then too an he doesnt seem to me to me the type to dupe/scam/hack anyone BUT nexon!!!

Yes yes yes, we all know how to show hidden files and folders; there are 19,400,000 indexes on Google of how to do that.

Originally Posted by Dagga
[Dear Visitor, you're restricted from viewing links until you are registered & logged on.
Click Here To Register Today

It is DEFINITELY a virus, we should refrain from releasing it to this forum. I had to install a clean version of Windows 7. Am not sure if its only this effective with Windows 7, but Norton warned me about GCA1.2.7 being a virus. I ignored it. Several hours after, the 'blue screen of death' appeared. I restarted but the problem persisted. After that I reinstalled Windows 7 Ultimate 64-bit. And all was good.

The BSOD can be caused by reasons other than the hack.

Originally Posted by ckw100
[Dear Visitor, you're restricted from viewing links until you are registered & logged on.
Click Here To Register Today

Really, I downloaded GCA just to see what it had. I decompiled all of its cintents... it contains NOTHING of a virus. Although.. seemingly... they can't code worth a shit and like to steal from other hacks

I highly doubt you did that...

Originally Posted by combat11
[Dear Visitor, you're restricted from viewing links until you are registered & logged on.
Click Here To Register Today

My Virus protection caought something after it got patched o-o

Yet another false positive. Your new antivirus' definitions heuristics detected some part of ------'s hack as a virus.

I really didn't decompile the WHOLE thing... lol I made that a little unclear as it seems I said I did. But I went through the things I could. And really I have no more suspition. but I did "lol" at the things that were in it.