Issue: Members being blocked from Forum!

[The 100 Mega Shock]

Dude I saw it replace my hosts file with another one.

It's coded in Visual Basic so naturally it's so badly done that it doesn't even work half the time.

 

[Gamer2020]

Virus, trojan whatever either way it's specifically designed to be malicious and disrupt people's usage according to someone else's' instructions.

It's malware.



While a program overwriting the contents of hosts is something that should probably be picked up on more closely by security applications, the user already gave the program express permission to modify the system via accepting the UAC popup, so that sort of makes it hard for such a thing to work like that.

Especially because a small, unknown application like this isn't going to trigger any scanning software if it doesn't contain any publicly known malware code or particularly blatant attempts to damage the system (above the scope of writing a new hosts file to the system)

(Heuristics doesn't really work that way anyway when we're only talking a small line of code embedded in a program to write one file)

And I wrote no such code. Go ahead and look at the source. Also the only reason it requires to be run as admin is because if it get's installed to the windows folder there will be errors when it tries to read the ini and start other programs.

Well, I looked at the address that was shown to have the modification (Windows\System32\Drivers\Ect\) and the last time anything was changed in that file was in 2010. It never did anything to my computer, besides it's intended purpose of modifying roms.

Is that the folder that file would be in for all operating systems? I'm going to see if I can fix whatever the program did, I just hope the file path would be the same every time.

Dude I saw it replace my hosts file with another one.

It's coded in Visual Basic so naturally it's so badly done that it doesn't even work half the time.

VB.Net actually. Send me the version that replaces the hosts file cause the one I have installed doesn't do it obviously cause I can still access the site.

 

[tlah]

I had (well, still have...) this problem. However, if it was in fact a purposeful virus, it obviously wasn't programmed to block subdomains of the website. I currently have this problem, and am writing this from the 'mail' subdomain of PC (mail.pokecommunity.com). The domain pokecommunity.mobi also works.

 

[Renii]

That's what the OP said, so I checked the said folder.

Perhaps, did Mewthree9000 help with building/compiling this? Just a hunch I have.

Some anti-virus software do prevent software from changing the hosts file. I have, in the past been notified either by Avast or Avira that some software tried to replace my hosts file.

 

[Ray Maverick]

Yeah the story so far makes me raise a few questions (???????????????????????)

a) If Gamer2020 is innocent, why troll the people who accused him on his forum?
b) Why is he acting so suspiciously?

Okay the last question was kind of generic, and I'm not going to give examples. Those who got what I'm saying should understand. Duh.

But.. we don't really have proof he did something, although he has a pretty good motive to block off people from PC (His own forum, he "doesn't like how people are treated here", etc. ).

 

[HarrisonH]

And I wrote no such code. Go ahead and look at the source. Also the only reason it requires to be run as admin is because if it get's installed to the windows folder there will be errors when it tries to read the ini and start other programs.

Okay. Looking through it now.

Additionally, there really is no reason for your program to have to be installed. As it uses .ini files, it could run perfectly fine from any folder. You could have just distributed it as a .zip, as I do with all of my (open source) applications.

EDIT 1: Oh god I'm dying here:

From /GBAPokemonGameEditor/GBAPokemonGameEditor/MainFrm.vb

If GetString(AppPath & "GBAPGESettings.ini", "Settings", "FirstRun", "Yes") <> "No" Then
  Process.Start("https://0xrh.net/?page_id=69")
  MsgBox("Since this is the first time you have run this program I, Gamer2020, would like you to read an article I wrote. Your web browser should have already opened to the article. Just in case you decided to close your browser it will come up again once this message box goes away. You might as well take some time out and read it. I hope you enjoy using this program. Have a nice day.")
  Process.Start("https://0xrh.net/?page_id=69")

  WriteString(AppPath & "GBAPGESettings.ini", "Settings", "FirstRun", "No")
End If

If GetString(AppPath & "GBAPGESettings.ini", "Settings", "FirstRun2", "Yes") <> "No" Then
  MsgBox("Hello. I would like to thank you for your support and for using this program. I will continue to update this program whenever I can. Please I would like you to take some time out and read something I have written.")
  Process.Start("https://0xrh.net/?page_id=145")

  WriteString(AppPath & "GBAPGESettings.ini", "Settings", "FirstRun2", "No")
End If

You call PC the "Pokecommunists", yet you're the one forcing propaganda upon someone when they first use your program. I don't know what it is about early generation ROM hacking that makes people go nuts, but at least the folks at Skeetendo seem immune from it.

Anyways, on topic. The file /GBAPokemonGameEditor/GBAPokemonGameEditor/MainFrm.vb was modified minutes before you uploaded the source. What's your reasoning behind that?

Note the times.

On your forums, Full Metal said:

Seriously, it would be a pain in the but to code that in a non platform-specific way. That would differ greatly even between different versions of Windows. It's not the program. Get over yourself.

The hosts file has been located in the same place on all versions of Windows since NT. So no, it'd be extremely simple to do it. It would be hardly any different from writing to a .ini file.

Unrelated, but there is absolutely no reason for MainFrm.vb to be over 1000 lines, instead of copy/pasting it could have all been consolidated into one function.

 

[Gamer2020]

Yeah the story so far makes me raise a few questions (???????????????????????)

a) If Gamer2020 is innocent, why troll the people who accused him on his forum?
b) Why is he acting so suspiciously?

Okay the last question was kind of generic, and I'm not going to give examples. Those who got what I'm saying should understand. Duh.

But.. we don't really have proof he did something, although he has a pretty good motive to block off people from PC (His own forum, he "doesn't like how people are treated here", etc. ).

a) I don't know what trolling is.
b) How am I acting suspicious?

Okay. Looking through it now.

Additionally, there really is no reason for your program to have to be installed. As it uses .ini files, it could run perfectly fine from any folder. You could have just distributed it as a .zip, as I do with all of my (open source) applications.

Actually, on windows 7 at least, the program needs admin rights to read the ini and start up other programs. This is because it is installed into the program folder. It is easier and better for me to release it as an installer.

(**Attention Everyone**

I have already figured out what happened and I already told an admin. One of my friends edited a copy of the source code to write to the hosts AND ONLY write to the hosts file. He then put it on the server since he had an FTP account to the site. Also the reason the program keeps updated is because he put up a clean version to try to cover it up but didn't edit the programs version. SO it will always think there is an update(Till I change the update file on the server.)

I am going to release an update over the next few days (It would be today but I'm very busy lately...) that will notify people on start up of the situation and that they should delete the hosts file in order to regain access to this site.

Since the issue has been found I will now remove the source from the internet so no one decides to make fake versions of it. If the admins of this site need to see it for some reason they can PM me.

All I really have to say about all this is that I am mad at my friend for doing this and I am mad at you people that decided to jump to conclusions and start accusing instead of informing me something is wrong. I am always reachable at [email protected] for any ROM hacking related things. If anyone still has any questions or concerns they may email me at that address.

Since the situation has been resolved I now ask that this thread be locked and marked as such.

**Attention Everyone**)

You posted at the same time LOL

Okay. Looking through it now.

EDIT 1: Oh god I'm dying here:

From /GBAPokemonGameEditor/GBAPokemonGameEditor/MainFrm.vb

If GetString(AppPath & "GBAPGESettings.ini", "Settings", "FirstRun", "Yes") <> "No" Then
  Process.Start("https://0xrh.net/?page_id=69")
  MsgBox("Since this is the first time you have run this program I, Gamer2020, would like you to read an article I wrote. Your web browser should have already opened to the article. Just in case you decided to close your browser it will come up again once this message box goes away. You might as well take some time out and read it. I hope you enjoy using this program. Have a nice day.")
  Process.Start("https://0xrh.net/?page_id=69")

  WriteString(AppPath & "GBAPGESettings.ini", "Settings", "FirstRun", "No")
End If

If GetString(AppPath & "GBAPGESettings.ini", "Settings", "FirstRun2", "Yes") <> "No" Then
  MsgBox("Hello. I would like to thank you for your support and for using this program. I will continue to update this program whenever I can. Please I would like you to take some time out and read something I have written.")
  Process.Start("https://0xrh.net/?page_id=145")

  WriteString(AppPath & "GBAPGESettings.ini", "Settings", "FirstRun2", "No")
End If

You call PC the "Pokecommunists", yet you're the one forcing propaganda upon someone when they first use your program. I don't know what it is about early generation ROM hacking that makes people go nuts, but at least the folks at Skeetendo seem immune from it.

Anyways, on topic. The file /GBAPokemonGameEditor/GBAPokemonGameEditor/MainFrm.vb was modified minutes before you uploaded the source. What's your reasoning behind that?

Note the times.

On your forums, Full Metal said:


The hosts file has been located in the same place on all versions of Windows since NT. So no, it'd be extremely simple to do it. It would be hardly any different from writing to a .ini file.

Unrelated, but there is absolutely no reason for MainFrm.vb to be over 1000 lines, instead of copy/pasting it could have all been consolidated into one function.

Like I have mentioned countless times I have a right to let people know what happened instead of it being covered up. Those links were going to be removed upon version 1.0.0.0

"Anyways, on topic. The file /GBAPokemonGameEditor/GBAPokemonGameEditor/MainFrm.vb was modified minutes before you uploaded the source. What's your reasoning behind that?"

I had started fixing some thing with the downloading of the tools. There was an error that when the download went wrong the name of the form would remain as "Please wait..." Also to defend against this I'm sure the already compiled exe in the debug folder was compiled before that date. Does that write a hosts file? No? Ok good.

"Unrelated, but there is absolutely no reason for MainFrm.vb to be over 1000 lines, instead of copy/pasting it could have all been consolidated into one function."

I'm very lazy LOL Also not every tool gets downloaded the same. For VBA-link I delete some useless files for example.