ATTN:True Classic Players, Removing TC Worm/Malware

[NocturnalG]

I am reposting by request. Perhaps more people will see it here rather than buried in a hack thread. The latest set of patches for the True Classic(Formerly found @) server, was actually malware that installed a worm into your computer to recruit you into the owners botnet. For those who do not know a botnet is a collection of compromised computers connected to the Internet, termed bots, that are used for malicious purposes. When a computer becomes compromised, it becomes a part of a botnet. This botnet is used to commit illegal activites such as DDOSing webhosts or stealing information. The worm has self-replicating feature and can spread via P2P so it is urgent that you get rid of it as soon as you realize you are infected.

It's a sad case of a formerly legitimate program/server turned to malicious after earning users trust. Anyone infected by will have their bandwidth/internet used to be used to commit illegal activity. If you used True Classic past patch 1044 (IE: Patch 1045 and Patch 1046) you are at risk. Fortunately the worm is designed by a novice and is quite to remove.

Automatic Removal
Just download and install that actually detected this worm.

, , , , or and running a complete scan with one of them, ideally at run-time. It will find this worm and possibly other infections and remove it. If your antivirus isn't one of the above then it wont be found.

Manual Removal
Just enable the ability to view hidden files in folders. For instructions on how to do view hidden files in , , and .
Once this is turned on simply START-->SEARCH your computer for TCAntiBot.EXE

Delete the file(s) and dump your recycle bin to remove all

The search should find the files located at
True Classic\c3\effect\601289

C:\windows\system32
If it does not, please go to those folders and manually look for TCAntibot.exe

If you are using Windows Vista or Windows 7. Please also check this folder
C:\Users\YOURNAMEHERE\AppData\Roaming

Replace 'YOURNAMEHERE' with your windows user name

If you are using Windows XP. Please also check this folder
Documents and Settings\YOURNAMEHERE\Application Data

Replace 'YOURNAMEHERE' with your windows user name

If you are unable to delete the file you will have to open your Task Manager via Ctrl+Shift+ESC. Switch to the process list and end the TCAntibot process.

For more information about this malware read which the information was originally posted in.

For anyone interested, the TCAntibot.exe file I'm talking about can be found (b460e03ac2f9ec50572fd93f32eb967d) and it's virustotal scan . If you use a scanner that doesn't detect it, I suggest you submit the file to them so these kids can't use this as easily again.

It's really pathetic that a server would be desperate enough to infect 150 of their users just to win a DDOS war. And they ended up losing not only the war but also their credibility(lol). If you know someone who was unfortunate enough to play True Classic in the last few days(the latest patches) please direct them here.

[BaussHacker]

I guess, that's what they used to ddos others. What a fail server.

[SeeKer91]

*****, so now that we know this they shut down the server and the website ?

[ernis007]

Originally Posted by SeeKer91

*****, so now that we know this they shut down the server and the website ?

No, first they shut the serv and web, and now you know this couse someone like this thread creator, found suspicious process running, and figured all this **** out, which is said on the first post...

[xStainD]

I still don't understand why they would throw out their server just to DDoS another server, which only brought it down for a few hours.

[NocturnalG]

Originally Posted by ernis007

No, first they shut the serv and web, and now you know this couse someone like this thread creator, found suspicious process running, and figured all this crap out, which is said on the first post...

I started to write the above post on their official forums, then they took down the server and web. I think they were trying to prevent more people(such as the ones who don't read epvpers) from finding out about it. So he may be right in saying that this is one of the reasons why they shut down their server and web so quickly (I'm sure it was going to go down eventually once they installed it anyway). But not the only reason.


I'd also contribute the attacks from enemies which causes their server to go down/lag and the flooding from spam bots which caused them to disable registration as factors in the eventual take down. Apparently the owner was "getting attacked by around 6 people" and "can't stop the attacks while at work".

I still don't understand why they would throw out their server just to DDoS another server, which only brought it down for a few hours.

I don't get it either. It was a completely desperate suicide bomb-like move that ultimately backfired. It's a shame because I did enjoy the server. The only remaining "classic on a 2.0 client" servers are European and as a American they don't appeal to me. For people who don't mind a European server though, I do urge you to check out

[Bumper]

if any of you true classic spawns are reading this, you came and you lost. come at us.

[Rohagi]

ya I was a TC player, prolly one of the best on the server, I only spent 35 dollars on it and in process of getting my money back, but I do want to say after exploring this website, hacking and the botting, thats really stupid for all you who enjoy doing it, really sad, but what do I know huh? Get a life, and stop massacering servers, lifes to short you noops!

[_tao4229_]

I'm pretty sure I know the real reason they "shut down" their server.

[SeeKer91]

Originally Posted by _tao4229_

I'm pretty sure I know the real reason they "shut down" their server.

Mind sharing it with us ?

[BCO_KAREN]

this ***** tao4229 hacked like 500 accs. thats the tl;dr.

******* on em.

HOLLA @ ME ON THE COAI FORUMZ.

[Sorrow62]

I and my sons, we played on trueclassic and I have to say that it is (was) one of the best server ever, but the "iron underwear" I set up on my PCs blocked that malware and when I posted a warning on trueclassic forum it was ignored and deleted in few days.

Still I don't understand why they tried to set up a botnet in a so "naive" manner...

Surely they're not a real danger for web surfers ;-)

[_DreadNought_]

Originally Posted by _tao4229_

I'm pretty sure I know the real reason they "shut down" their server.

If what BCO_K is saying is true, I <3 you.

[Bumper]

Originally Posted by Sorrow62

I and my sons, we played on trueclassic and I have to say that it is (was) one of the best server ever, but the "iron underwear" I set up on my PCs blocked that malware and when I posted a warning on trueclassic forum it was ignored and deleted in few days.

Still I don't understand why they tried to set up a botnet in a so "naive" manner...

Surely they're not a real danger for web surfers ;-)

well your server hosters liked attacking other servers. See it as a group effort that we returned the favour. only ones to blame is themselves. The real victims are the ones that played trueclassic. They got screwed over like mad.

oh well, the only server worth mentioning that is classic would be love2hater now, and that one is EU based.

[ClassicConquer]

Not really the only classic server hosted in EU. There is this one as well