Character Gone

Totally kinda unrelated question, but if you have a token on your account do you actually get it back in a timely manner, or is it a 3-4-6 month long ordeal like it is for non-token users?

Can anyone confirm this 100%?

A key logger will not be able to trace the interactive keyboard; however if they (the hackers) realize you're using that they'll monitor your movements and possibly record the key strokes and get in that way.

At least, that's how I was told it works...

It doesn't fishy, it sounds guilty.

I just recently woke up, and found both FFXI and FFXIV accounts "suspended" for supposedly suspicious activity. Which was odd because I don't log into POL or Lodestone from this laptop, where I have my FFXI folders, and I play FFXIV on my PS3.

this is happening to so many ppl somethng strange is going on I think SE just does not care anymore people are hacking left and right it is HELP I AM TRAPPED IN 2006 PLEASE SEND A TIME MACHINE

***i hope i can finish my burtgang before this happens to me >_> then i'll be happy

Square-Enix had something amazing, but this is happening in just a mere 2 weeks after having purchased 6 months worth of play time for 14. And now I have to wait MONTHS for this chicken and donkey show of an investigation to get my characters back and able to play for the content already paid for?

I just reactivated my 14 also on friday and i got hacked the next day this is stupid. I am sure someone got in to SE servers

the problem is, if you think you've been key logged, and try to change your password on the SE site, you HAVE to type it the first time, there's no onscreen keyboard for that. which totally blows.

there's no refund either, you have to keep paying while they do their investigation, so kiss 1,2,3 months of that prepaid time goodbye.

Yup And I Can tell you from first hand experience they you wont see a penny of that money back if you get your account back, because as it was explained to me by 3 different people Game Date Recovery is a paid service. If you Don't want to pay for your account They Wont Look in to it You Can't even Opt out of Paying for 1-2 Mules (FFXI happened to get hacked well a couple Marble Mules were still on had to pay for all or none) it's pretty crap imo.

how many of you guys who got hacked play/played FFXIV? cause i know for sure it doesnt have the onscreen keyboard, and they use the same SE account, maybe u got some XIV keylogger.

No... if you lost your 14 account to... its something on your computer, don't blame SE for your poor computer security.

my 14 was tied to my square enix account -.- it was not my computer if this is happening to alot of people also

So far, the pattern I'm seeing is that people are getting hacked a short while after logging into the Account Management website. It's either because the site is less secure than the game, or because the keylogger has been programmed to monitor keystrokes used on that website specifically.

In any case, I think everyone needs to be more careful when logging into that website. Use the windows On-Screen Keyboard if you have to.

It is most likely a keylogger on his computer. At this point who cares how he got it,or how it happend. The question is knowing that you account got hacked the first time what steps did you take to make sure that your computer was clean? Because what you should have done is wipe your computer clean and do a fresh install of everything. If you did not do anything before you got you account back and it got hacked for the second time, well that is your own fault not SE.

Yes several people on 14 who 11 account are tied together got hacked, but again they got hit with a keylogger for downloading or clicking on some site, or not having a token. If I were you I would wipe my computer clean before you get your character back. If you do not and it happens again, you deserve it.

Maybe someone hacked windower, since most of this happened when windower was broken after the last update. So many people were looking for a quick fix, they probably downloaded any patch that said it got windower working again...maybe a patch from a non-windower admin was a key logger of some sort.

For all we know, it could've been embedded in an animated advertisement on a FFXI site. I couldn't even tell you which sites have ads - ever since I was hacked several years ago, I've had everything perma-blocked.

On-screen keyboard can easily be traced by a program tracking keystrokes. Windows onscreen keyboard actually sends the same routines as pressing the keys so it can be traced in an identical manner to keyboard strokes. FF's onscreen keyboard doesn't, but a program designed to steal xi/xiv information will record the mouse click positions as well as the window's coordinates. This is not very hard to do, there's no reason to believe on-screen keyboard will save you from anything but the most primitive keylogger.

Copy/paste is similar. A good keylogger will have access to everything that goes through your clipboard.

Don't get ***on your PC and it won't be an issue. Barring that, 'safe' is relative and it's childs play to make a keylogger that can track onscreen keyboard and your clipboard. While it's possible some keyloggers are designed that poorly, you don't really want to gamble on that.

A couple tips:

-Check your running processes before doing anything with your password. If you see cupper.exe running and you don't have cupper open.. that's a red flag. If you have programs you don't know of in your running processes, figure out what they are. Run any unfamiliar executables through a virus scan.

-If you have any programs you don't completely trust open, close them and make sure the related tasks are gone before you enter your password anywhere.

-Using Firefox with noscript will help guard against some exploits, but it does nothing if you willingly download a program with malware in it. Make sure to virus scan anything from a source that isn't trustworthy.

-Most virus scanners look through assembly level instructions for specific routines that are either commonly done by other viruses or inherently suspect. They do not have any way to tell 'for sure' if something is malicious. For example, it's extremely easy to make a program capable of session hijacking xiv that won't flag a virus scanner because it only has to access the launch args. However, anything capable of stealing an XI account SHOULD be flagged, so you shouldn't skip using them.

-If you get a well designed virus on your computer, there's often little to no evidence it's there. These steps are unlikely to help. If you think something is skeptical but can't get a result from a scan, consider reformatting and reinstalling windows.

Just going to throw this out there. Anyone with half of a brain or some I.T. background should check any newly downloaded software used to enhance your FFXI gameplay.

Both version of said software are publicly available via google. One has 0/47 detections, other has 3 with 2 of the variants being keyloggers. Congrats, you have nobody to blame but yourself at that point.

Good riddance if you need to use that too :P

It's not really coincidental or weird that people are getting hacked after updates or after they log in to the se management site.

1) people will download any clipper (and other 3rd party stuff) after update. just be patient and wait a few days for stuff from trusted sources to be updated. not saying that it applies to the people in this thread, but this is probably where a decent amount of keyloggers come from

2) they can't get into your account without your se account name, which is usually saved on pol, and which you generally only type in when you log in to your se account on their webpage, which is why people get hit after logging into the se account page. They could have your password for months if you're just logging into the game and it doesn't help them much without the se account name to actually get into your account.

If you're sharing accounts and someone around them has a keylogger, that's a good way to get nabbed too.

Just mentioning, you know you can use the JOYSTICK/GAMEPAD to interact with the software keyboard if you setup PlayOnline properly ?

This is what I was thinking, it seems all the people have this in common. Zaxtiss had just been reactivated too.
And I just tried to get mine back via the character reactivation service (just in case it was any easier) I got this:
Greetings,

Thank you very much for contacting the SQUARE ENIX Support Center regarding your request to have a deleted FINAL FANTASY XI character reactivated.

We have reviewed the information you have provided us. Unfortunately, we were unable to find a restorable data for this particular character. Therefore, it cannot be reactivated.

We deeply apologize that we are unable to fulfill your request and thank you for your understanding.

If you believe that you may have entered the incorrect character data or PlayOnline ID, please resubmit your application with the correct information.

Thank you very much for your continued support of FINAL FANTASY XI.

--------------------------------------
Please keep the Email subject as it is when sending your reply.
SQUARE ENIX Support Center
http://support.na.square-enix.com/
At this point I'd say it's au revoir vana'diel.

this now has me worried that my charecter might be gone for good

If you even have any interest in playing the game again, I'd still get all your information in order call Square up explain to them your account was hacked. Fill out the GDR Paper work and see what they say, call them daily/weekly what ever you can put with seeing as your on hold and they don't even have music. Just keep pressing them about it they took forever dealing with mine but they restored my account to before it was hacked (albeit a few days before it was hacked thus I lost stuff but not the point) so if you even have the smallest drive to play I'd say call them, the faster you get the ball rolling the better.

So when you got your account back what all were you missing?

I got hacked on the April 2nd (Tues) Square rolled me back to sometime before March 31st and after March 27th. I know this because Sunday(31st) used to be an event night and I got an Odin II Body and Arch-Ultima Heart That I was Missing As well as the Bayld gear I farmed after the events were over, on top of my Kclub that was returned to me Monday night, the reason I know it was after the 27th is because a LS member did a Blue Mage cleave party on the 27th and I leeched my BST up to 97 and when I logged in I still had all the bomb ash cluttering my bags and my BST was still 97.

Edit: And before anyone ask I didn't play between the 27th and the 31st that's why I Can't narrow it down more.

I thought I'd try an experiment, make a chara on the empty slot, level it a bit, then delete it. Try to undelete in a few days. When I signed into POL I got the "incorrect password" message. Changed it, signed in again and got "this account has been restricted." So I looked up that in the knowledge base. It said "Once a login restriction is placed, it can only be removed by the account owner. The Square Enix Information Center cannot remove login restrictions on behalf of users." And to change my SE password. Did that, relogged in. Got the same message. So much for that idea. Not encouraging, though it might explain why I got the previous message about being unable to find restorable data.

My character was stripped once and all I lost was a ring after the restore and that only took a week, got it back on Christmas Eve lol