Parry and Spar, or is it... Reluctant Admiral 4.2 Fulkerson(J) vs Moore (A)

[moore4807]

ORIGINAL: btbw

http://www.2-spyware.com/remove-fbi-gre ... virus.html
find bootable CD with antivirus and own operating system for boot from it and clean your HDD.
Im using DrWeb LiveCD.
For future use try Avira Antivir (it free) and Comodo Firewall. Also run LiveCd with AV check each month or after any sense you got virus.
Be safe.

B I N G O !!! - except for how we got into Windows Vista, the removal was similar -there definitely was both ctfmon & rool as apart of the file names. Neither the Symantec tech or I was able to find Greendot - probably because we spelled it wrong in the search. I am still waiting for the Symantec to finish the full system scan (+1.7M files scanned so far) but nothing found by PC Pitstops full scan.

btbw, thanks for the help and posting!

Manual FBI Green Dot Moneypak virus removal (special skills needed!):
1.Open Windows Start Menu, enter %appdata% into the search field, click Enter.
2.Go to: Microsoft\Windows\Start Menu\Programs\Startup.
3.Remove ctfmon (don't mix it with ctfmon.exe!).
4.Open Windows Start Menu, enter %userprofile% into the search field, click Enter.
5.Go to Appdata\Local\Temp and remove rool0_pk.exe
6.Delete [random characters].mof file
7.Delete V.class
8.Run a full system scan with updated SpyHunter to remove remaining FBI Green Dot Moneypak virus files.

[witpqs]

Jim,

I wouldn't say 'I told you so', we all do the best we can and take our shots! You seem to have a good handle on things. The one bit that I would point out is that the technical acumen of the hackers (and their hacks) varies. Sometimes they manage to do things that are not seen in scans, in logs, or even in full comparisons. Consider varieties of root-kits, including ones that infect the boot sector of the drive as examples. And not trying to make you paranoid just point out that sometimes they get to bypass anything that you fix in place.

Good luck! [8D]

George

[moore4807]

witpqs,

Yes you just hit a nerve - aren't the boot sectors in the CMD line and date changed is the last thing in the line?

Thats what I liked about Symantec - it records any changes to both the programs and the CMD/.exe files. I was able to track down the suspicious files pretty quickly. Once the backup files from the 23rd were restored, the two files stuck out.

The biggest challenge was getting into the Windows Vista. Safe mode didn't work because the hacker somehow got the setup files and the load wasn't completing before the screen showed up.

I'm pretty beat and I am having trouble being clear here -even to myself... LOL If I dont make sense I apologize, I'll try again tomorrow.
Jim

[moore4807]

Turns to you! So far - so good!

[larryfulkerson]

i FINALLY woke up from my nap, which means I slept late again. More time wasted. Anyway I found Jim's moves in my inbox and did the
combat replay and mailed some files to Jim and now I'm doing my moves. Actually, that's not quite the exact truth. Rob mailed me his
moves just before Jim did so I feel obligated to work on his moves first ( first come first served....except for exciting periods ...Then the
AAR comes first ......to help spread the joy around. Everybody gets to smell the salt in our AAR.). Anyway, this is the "before" shot of
Miri and Balikpapan. I intend to take an after shot to compare the fuel and oil levels of these two cities after one turn to get an idea of
how much fuel / oil flows per day. Not that that figure is more helpful than say a month......actually it is isn't it. I'd really like to know how
much flows in one day. This will give us a raw rough draft of how much next turn when we compare the figures. I'll try to remember to
make it an animation too. They are eye catching I think.

Edit: This particular shot is from Rob's game as I do my moves for him first. We'll compare the flow per day of the stock scnerio w/
Reluctant Admiral and see has the flow-per-day changed and if so how much.

[larryfulkerson]

I feel like a frikken scientist now doing an experiment and waiting for the data to spill out. Like I can't wait to see what the fuel / oil levels are tomorrow already. I'll post the figures for all of us.

[larryfulkerson]

Here's Jim's first post.....notice the date of the post 5/21/2012

[larryfulkerson]

Here's the next post I make......... it's got a date/time almost 5 weeks later. This is that many hits in about 5 weeks. Thanks all you guys.

[larryfulkerson]

That's about 289 hits per day. Remarkable.........thanks everybody. I'll try to keep up the good work and make it readable for you.

[larryfulkerson]

Now that I've turned on the refineries at Balikpapan and Tarakan we should start seeing some higher numbers for fuel there.

EDIT: This image too is from Rob's game but the numbers should be really close to these. Or are they? I'll try to remember to
look at Jim's numbers for Borneo and we'll compare to see what change there is. Or will we? I guess I ought to try to make the
comparison on the same day in each game or else we'll be stuck with a rough ballpark figure instead of something more accurate.

[moore4807]

ORIGINAL: larryfulkerson

Here's the next post I make......... it's got a date/time almost 5 weeks later. This is that many hits in about 5 weeks. Thanks all you guys.

Larry,
[;)][;)][;)] Your math is a little off, unless I'm reading this wrong...
May is month 5 September is month 9. I'm roughly figuring 4 weeks per month and we are probably over 16 weeks not 5! But I'm still pretty awed by the numbers anyway!

[larryfulkerson]

ORIGINAL: moore4807

ORIGINAL: larryfulkerson

Here's the next post I make......... it's got a date/time almost 5 weeks later. This is that many hits in about 5 weeks. Thanks all you guys.

Larry,
Your math is a little off, unless I'm reading this wrong...
May is month 5 September is month 9. I'm roughly figuring 4 weeks per month and we are probably over 16 weeks not 5! But I'm still pretty awed by the numbers anyway!

Of course you're right.....I don't know what I was thinking. That'll make it about 90 hits per day.........still a respectable figure.

[moore4807]

AFTER ACTION REPORTS FOR Feb 05, 42
--------------------------------------------------------------------------------

Larry told me in the e-mail CL Sumatra's being a pest... The Dutchmen couldn't be happier...[:D][:D][:D]

Night Time Surface Combat, near Soerabaja at 56,102, Range 6,000 Yards
Japanese Ships
CVE Hosho
CVE Taiyo
DD Asashio
DD Oshio

Allied Ships
CL Sumatra, Shell hits 1

What I've haven't figured out - is the 1 hit each time or is it a report of what happened to it so far?

Day Time Surface Combat, near Soerabaja at 56,103, Range 9,000 Yards
Japanese Ships
PB Senyo Maru, Shell hits 24, and is sunk

Allied Ships
CL Sumatra, Shell hits 1


Day Time Surface Combat, near Soerabaja at 56,102, Range 14,000 Yards
Japanese Ships
PB Kantori Maru, Shell hits 6, heavy fires, heavy damage
AV Sanyo Maru, Shell hits 10, heavy fires, heavy damage

Allied Ships
CL Sumatra, Shell hits 1


"We get by with a little help from our friends..."

Submarine attack near Soerabaja at 56,101
Japanese Ships
AV Sanyo Maru, Torpedo hits 1, heavy fires, heavy damage

Allied Ships
SS KXV

A couple of rainouts keep this one from getting interesting - too bad Sumatra didnt Kamikaze them!

Day Time Surface Combat, near Soerabaja at 56,102, Range 21,000 Yards
Japanese Ships
CVE Hosho
CVE Taiyo
DD Asashio
DD Oshio

Allied Ships
CL Sumatra


Day Time Surface Combat, near Soerabaja at 56,102, Range 21,000 Yards
Japanese Ships
CVE Hosho
CVE Taiyo
DD Asashio
DD Oshio

Allied Ships
CL Sumatra


Meanwhile Larry is STILL hammering Cebu, methinks I might have annoyed him here...[:D][:D][:D]

Night Naval bombardment of Cebu at 80,86 - Coastal Guns Fire Back!
Japanese Ships
BB Hyuga
BB Haruna
CA Aoba
CA Myoko
CA Chokai
CL Abukuma
CL Yura
CL Jintsu
DD Karii
DD Arashio
DD Hamakaze


Allied ground losses:
243 casualties reported
Squads: 1 destroyed, 8 disabled
Non Combat: 8 destroyed, 22 disabled
Engineers: 0 destroyed, 1 disabled
Vehicles lost 14 (4 destroyed, 10 disabled)


Manpower hits 5
Fires 600
Airbase hits 2
Airbase supply hits 2
Runway hits 5
Port hits 6

This isn't going to improve his mood...[:D][:D][:D] EDIT: I found a pix of Japan's 24cm howitzer...



Amphibious Assault at Cebu (80,86)
TF 408 troops unloading over beach at Cebu, 80,86

24cm T45 Howitzer lost from landing craft during unload of 1st Hvy.Artillery Rgt /2
24cm T45 Howitzer lost in surf during unload of 1st Hvy.Artillery Rgt /2
24cm T45 Howitzer dropped into water during unload of 1st Hvy.Artillery Rgt /2
24cm T45 Howitzer lost overboard during unload of 1st Hvy.Artillery Rgt /2
24cm T45 Howitzer lost in surf during unload of 1st Hvy.Artillery Rgt /2
24cm T45 Howitzer lost overboard during unload of 1st Hvy.Artillery Rgt /2
24cm T45 Howitzer dropped into water during unload of 1st Hvy.Artillery Rgt /2
24cm T45 Howitzer dropped into water during unload of 1st Hvy.Artillery Rgt /2
24cm T45 Howitzer lost in surf during unload of 1st Hvy.Artillery Rgt /2
24cm T45 Howitzer lost in surf during unload of 1st Hvy.Artillery Rgt /2
24cm T45 Howitzer lost from landing craft during unload of 1st Hvy.Artillery Rgt /2
24cm T45 Howitzer accidentally lost during unload of 1st Hvy.Artillery Rgt /2



Back on Port Moresby - A warm welcome is given to ships arriving to the party...

Pre-Invasion action off Port Moresby (98,130) - Coastal Guns Fire Back!
Defensive Guns engage approaching landing force
52 Coastal gun shots fired in defense.
Japanese Ships
xAK Kosei Maru, Shell hits 2, on fire
xAK Liverpool Maru

Amphibious Assault at Port Moresby (98,130)
TF 529 troops unloading over beach at Port Moresby, 98,130

Invasion Support action off Port Moresby (98,130)
Defensive Guns engage approaching landing force
33 Coastal gun shots fired in defense.
Japanese Ships
xAK Liverpool Maru
xAK Kosei Maru, Shell hits 12, heavy fires, heavy damage


Invasion Support action off Port Moresby (98,130)
Defensive Guns engage approaching landing force
37 Coastal gun shots fired in defense.

Japanese Ships
xAK Liverpool Maru, Shell hits 12, on fire, heavy damage

Larry of course brings some fireworks to the party too...

Morning Air attack on Port Moresby Coastal Gun Battalion, at 98,130 (Port Moresby)
Weather in hex: Light rain
Raid detected at 81 NM, estimated altitude 17,000 feet.
Estimated time to target is 28 minutes

Japanese aircraft
A6M2 Zero x 7
G4M1 Betty x 15

Japanese aircraft losses
G4M1 Betty: 1 damaged

Aircraft Attacking:
15 x G4M1 Betty bombing from 15000 feet
Ground Attack: 2 x 250 kg GP Bomb, 4 x 60 kg GP Bomb

Also attacking 49th Australian Battalion ...
Also attacking Port Moresby Coastal Gun Battalion ...


Finally Port Moresby's ground combat still brings good news...


Ground combat at Port Moresby (98,130)
Japanese Bombardment attack
Attacking force 726 troops, 74 guns, 0 vehicles, Assault Value = 131
Defending force 7838 troops, 68 guns, 9 vehicles, Assault Value = 173

Assaulting units:
144th Infantry Regiment
1st Sasebo Assault/A Division
5th Mortar Battalion
3rd Mortar Battalion
41st Field AA Battalion

Defending units:
53rd Australian Battalion
39th Australian Battalion
49th Australian Battalion
Port Moresby Coastal Gun Battalion
D Coy/NG Rifles
Torres Strait Battalion
Port Moresby Brigade
14th RAAF Base Force
15th RAAF Base Force


Ground combat at Port Moresby (98,130)
Allied Bombardment attack
Attacking force 4103 troops, 38 guns, 2 vehicles, Assault Value = 173
Defending force 5969 troops, 167 guns, 4 vehicles, Assault Value = 131

Japanese ground losses:
242 casualties reported
Squads: 2 destroyed, 18 disabled
Non Combat: 0 destroyed, 3 disabled
Engineers: 0 destroyed, 2 disabled
Guns lost 9 (1 destroyed, 8 disabled)

Allied ground losses:
16 casualties reported
Squads: 1 destroyed, 0 disabled
Non Combat: 0 destroyed, 0 disabled
Engineers: 0 destroyed, 0 disabled

Assaulting units:
D Coy/NG Rifles
Port Moresby Coastal Gun Battalion
39th Australian Battalion
Torres Strait Battalion
49th Australian Battalion
53rd Australian Battalion
Port Moresby Brigade
14th RAAF Base Force
15th RAAF Base Force

Defending units:
144th Infantry Regiment
1st Sasebo Assault/A Division
3rd Mortar Battalion
5th Mortar Battalion
41st Field AA Battalion



And in this corner of the world, I figure Kuantan is a good a place to slaughter my trapped troops...

Morning Air attack on 22nd Indian Brigade, at 51,80 , near Kuantan
Weather in hex: Overcast
Raid spotted at 38 NM, estimated altitude 10,000 feet.
Estimated time to target is 10 minutes

Japanese aircraft
Ki-21-IIa Sally x 17
Ki-43-Ib Oscar x 17

No Japanese losses

Allied ground losses:
28 casualties reported
Squads: 0 destroyed, 5 disabled
Non Combat: 0 destroyed, 0 disabled
Engineers: 0 destroyed, 0 disabled

Aircraft Attacking:
17 x Ki-21-IIa Sally bombing from 10000 feet
Ground Attack: 4 x 250 kg GP Bomb

Well I didnt expect this result considering the details BUT -"I like it like that!"

Ground combat at 51,80 (near Kuantan)
Japanese Shock attack
Attacking force 3050 troops, 38 guns, 0 vehicles, Assault Value = 65
Defending force 3290 troops, 16 guns, 2 vehicles, Assault Value = 78

Japanese adjusted assault: 3

Allied adjusted defense: 79

Japanese assault odds: 1 to 26

Combat modifiers
Defender: terrain(+), op mode(-), morale(-), experience(-)
Attacker: shock(+), leaders(+), fatigue(-)

Japanese ground losses:
496 casualties reported
Squads: 1 destroyed, 57 disabled
Non Combat: 0 destroyed, 4 disabled
Engineers: 0 destroyed, 0 disabled

Allied ground losses:
23 casualties reported
Squads: 0 destroyed, 4 disabled
Non Combat: 0 destroyed, 0 disabled
Engineers: 0 destroyed, 1 disabled


Assaulting units:
66th Infantry Regiment

Defending units:
8th Indian Brigade
1st Hyderabad Battalion
22nd Indian Brigade
1st ISF Base Force


And to close out our show, Orphan Annie has nothing to sing about... Thats all for tonight, folks!

[witpqs]

ORIGINAL: moore4807

witpqs,

Yes you just hit a nerve - aren't the boot sectors in the CMD line and date changed is the last thing in the line?

Thats what I liked about Symantec - it records any changes to both the programs and the CMD/.exe files. I was able to track down the suspicious files pretty quickly. Once the backup files from the 23rd were restored, the two files stuck out.

The biggest challenge was getting into the Windows Vista. Safe mode didn't work because the hacker somehow got the setup files and the load wasn't completing before the screen showed up.

I'm pretty beat and I am having trouble being clear here -even to myself... LOL If I dont make sense I apologize, I'll try again tomorrow.
Jim

I have no idea. I certainly am not saying that the hack you got hit with did those things, just making sure you know they are possibilities in case that helps you, either in this instance or a future one. Heck, it's even been shown they can hide viruses in the flash memory on components like the video card - crikey! I've not heard of that being done in the wild yet.

[moore4807]

Thanks again witpqs,

I understand your point and appreciate it. I went to bed around 1:30a after getting both turns done, then rechecking everything.

I got up at 8:30a and reread everything (and did Symantec customer survey questionaire...) It all seems OK... so far. what bothers me is that we never found the delivery vehicle. I was in my e-mail when the site hit me, but didn't have any open e-mails and e-mail scanning is on for both antiviruses. Maybe it was a time -bomb hack?

We did find 2 files in the exe.startup which we copied to Symantec and then deleted. Thats what makes your observation so unsettling and probably accurate too!

[witpqs]

ORIGINAL: moore4807

Thanks again witpqs,

I understand your point and appreciate it. I went to bed around 1:30a after getting both turns done, then rechecking everything.

I got up at 8:30a and reread everything (and did Symantec customer survey questionaire...) It all seems OK... so far. what bothers me is that we never found the delivery vehicle. I was in my e-mail when the site hit me, but didn't have any open e-mails and e-mail scanning is on for both antiviruses. Maybe it was a time -bomb hack?

We did find 2 files in the exe.startup which we copied to Symantec and then deleted. Thats what makes your observation so unsettling and probably accurate too!

It's hard to say. For sure check that all the software on your PC that either can be accessed directly from the Internet or that you use with the Internet in any way is fully patched (up to date). There is a category of exploits called 'drive-by exploits' wherein you merely visit a web site - just load a page - and they can hack you. Like many hacks those depend on some flaw/weakness in the software involved (browser, etc.). Like others these can be undiscovered by the good guys ('zero-day'). But the place to start is to make certain that all your stuff is up to date. BTW the web sites involved in drive-bys are often innocent in that they were hacked and the owners/operators are unaware of the infection.

There are enormous numbers of PCs that get infected because various software (including the OS) was never updated. Literally viruses from a decade ago still infect machines out there. It's amazing but true. For someone like you who is careful, the issue is to stay as current as possible so that you benefit from all the fixes that have been made.

[moore4807]

Witpqs

Very true statements, Yes I do, Yes I did, Yes I did again last night![8D][8D][8D]

I've done everything I can think of, it will have to play itself out - if it happens again I will wipe the drive and restore from backup.

Thanks for everything!

Edit: I am posting a copy of PC Pitstops Exterminate scan - it doesnt find any major malware problems either.

[moore4807]

Ingtar,

I'm sorry for not responding to you last night, I didnt understand what you were speaking of...

I'm much more awake now and will look into this company, thanks for posting!

Jim

[witpqs]

ORIGINAL: moore4807

Ingtar,

I'm sorry for not responding to you last night, I didnt understand what you were speaking of...

I'm much more awake now and will look into this company, thanks for posting!

Jim

NOD-32 is also the product I use.

eset.com

[larryfulkerson]

I'm still going through my moves for Rob's game but I've run into a situation where it might be of interest to Jim and / or my readers:
I've run a TF up to adjacent to the target hex and I've turned on "full speed" setting so as to get as much troops and supplies on the
beach and get the ships out of gun range as soon as possible so that they don't get shot at at all, if possible and I intend to turn it
back to missiion speed after the ships are headed out of immediate danger, sometime next turn perhaps or a soon subsequent turn.
I'll have to keep these guys in mind to switch the speed setting ( and I can't forget to switch the speed for very long because these guys are out where the Allied subs roam ) so I'll have to reconnect him w/ his escort at the same time as soon as possible after the unload.

EDIT: Sound Track for this next paragraph...click this line

This is the first time I've tried this technique and I don't remember any human AAR opponent trying this, full-speeding the ships this way
during the emergency unload across the beach during the deep of night working under searchlight(s) and the crash of the surf is the
loudest noise allowed with the itchy feeling you get when the cross-hairs reach the base of your throat on the back-side of your head
Again And again, fighting down urges to run and hide to survive.Because deep down inside you sometimes feel like you're not as
good as the next man and your number might come up real soon now.....living each day as if it were your last and maybe after your
dead you might know the truth at last. All the big bigger and biggest questions get answered. Maybe. Maybe not.........maybe I'll just
be dead.

That kind of situation.