Jump to content

Recommended Posts

Posted

http://www.l2revengeserver.com/site.html

 

my hosts is this

 

127.0.0.1 localhost

127.0.0.1 vip.tt2xz.com

127.0.0.1 vip1.tt2xz.com

127.0.0.1 vip2.tt2xz.com

127.0.0.1 vip3.tt2xz.com

127.0.0.1 vip4.tt2xz.com

127.0.0.1 vip5.tt2xz.com

127.0.0.1 vip6.tt2xz.com

127.0.0.1 vip7.tt2xz.com

127.0.0.1 vip.towalker.com

127.0.0.1 vip1.towalker.com

127.0.0.1 vip2.towalker.com

127.0.0.1 vip3.towalker.com

127.0.0.1 vip4.towalker.com

127.0.0.1 vip5.towalker.com

127.0.0.1 vip6.towalker.com

127.0.0.1 vip7.towalker.com

192.168.1.4 L2authd.lineage2.com

192.168.1.4 lineage2

127.0.0.1 nprotect.lineage2.com

 

I dont know wath hapened. My server is L2Revenge.

I search ip and see two diferents ips

75.126.0.178 ports 2106

74.86.34.10 ports 7777

 

 

Posted

I'm wondering, how the hell the client can detect rootkited l2w?

It cannot kill it's process, but still, not everyday I'm seeing games better at detecting rootkits than some of AV soft :o

 

Any idea how to hide one process from another? Also, any idea why starting l2.exe from <1.78 l2w is not possible and 1.85 doesn't have a problem with that?

Posted

I'm wondering, how the hell the client can detect rootkited l2w?

It cannot kill it's process, but still, not everyday I'm seeing games better at detecting rootkits than some of AV soft :o

 

Any idea how to hide one process from another? Also, any idea why starting l2.exe from <1.78 l2w is not possible and 1.85 doesn't have a problem with that?

Cause I wrote it :P  Actually, rootkits aren't really that hard to get around if you're still running them inside the same Windows process space.

 

If you can see me, I can see you.

  • 3 weeks later...
Posted

22:08:00 WP v5.04F © Sauron

22:08:01 Link LoginServer Succeed.

22:08:04 Login LoginServer Succeed.

22:08:04 服务器[01]当前在线率:4.30%,能否登陆:能

22:08:08 Link GameServer Succeed.

22:08:09 ->Login GameServer Fail.

 

This is as far as I got to, if anyone could help, please do so.

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.
Note: Your post will require moderator approval before it will be visible.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

×
×
  • Create New...