EasyMap for Diablo II v1.1 - Release

**Guju-** · 08-09-2005, 06:25 AM

Im glad this worked :)... you can still use d2loader too.

Edit : oh yea if you used this map hack or tried to use it and now you cant connect to battle.net. Do everything I said up there.

Im so MAD!!! :

:

**Shellz** · 08-09-2005, 06:30 AM

well i checked my log and i didnt that ip so am i safe i changed my pws also.

**Guju-** · 08-09-2005, 06:38 AM

Good but remove that stupid map hack... dont forget to go check the hosts file. If the hosts file look like this (see down) when opened with notepad... your comp is OK.

(the files is in : C:\WINNT\system32\drivers\etc)

# Copyright (c) 1993-1999 Microsoft Corp.
#
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
#
# This file contains the mappings of IP addresses to host names. Each
# entry should be kept on an individual line. The IP address should
# be placed in the first column followed by the corresponding host name.
# The IP address and the host name should be separated by at least one
# space.
#
# Additionally, comments (such as these) may be inserted on individual
# lines or following the machine name denoted by a '#' symbol.
#
# For example:
#
# 102.54.94.97 rhino.acme.com # source server
# 38.25.63.10 x.acme.com # x client host

127.0.0.1 localhost (EDIT : THIS IS OK, BUT IF YOU SEE 127.0.0.1 Battle.net. that isnt good)

**Micce** · 08-09-2005, 06:50 AM

Well first off, if you make that file read only before it's changed, you are one step safer. If you block port 1010 (which is what has been supposidly linked to the maphack), you are another step safer. If you target the program with your firewall and deny it any and all access to the internet, you are another step closer.

Before, i just looked at the .exe of it with Ollydbg and found nothing. But I failed to look in the .dll. Found a lot of variables named with "UserInfoHash", "UserPassHash", etc. I do believe this program isnt legit, I do believe it does save your information and maybe backdoor it, however, the fact still stands that it's the only MH out there right now. Take all precautions, and you should be safe.

**Shellz** · 08-09-2005, 07:17 AM

how i get there????????

**hawktheslayer** · 08-09-2005, 07:42 AM

its BD'd, its BD'd

**Micce** · 08-09-2005, 07:42 AM

Originally Posted by Kraka

how i get there????????

... What? No idea what you are refering too.

**Darklord999** · 08-09-2005, 08:00 AM

Hah, i dont really trust MH never did never will.

**psychobolt** · 08-09-2005, 08:40 AM

Well since on the d2sector news says that this mh opens on port 1010, I thinking about seeing it my self. Can anyone tell me a program to look for ports. Btw what is on port 1010?

Edit
NVM I don't wanna try it out. After researching about port 1010, it seems to be very bad. There is a backdoor to this port, seems to be named Doly Trojan. Btw is it possible to block that port and be able to use EasyMap?

**Dark.Zero** · 08-09-2005, 01:46 PM

thanks guys for this it helped a lot of people =D like my brother

**Micce** · 08-09-2005, 01:58 PM

WEEEE, www.gamemunchers.net

Anyway, he released a new version. Apparently, someone bugged his (which is easy to do because all you have to do is open the dll and inject a couple of lines of code, rather than Mousepads where you would have to completely reverse engineer the *****). Any downloaded from his site are garuenteed clean!

**slics** · 08-09-2005, 02:03 PM

Not to flame or nething on your thread and what not but.. Coming from a guy with 4 posts I think I will just wait until a download is cleared by a mod as I would suggest to others.

**Micce** · 08-09-2005, 02:11 PM

Not to flame or anything on your judgement, but have you read any of my posts recently against EasyMap? I decompiled the .dll and .exe of the one from his site for 1.1 with ollydbg. Saw nothing. Got my hands on the infected 1.0 and the legit 1.0 and saw an obvious difference in the .dll.

Ill just say all that I know and am confident in, but I still stand by one of my previous posts, block the program from accessing the internet and also block port 1010 (find a new firewall or something if you cant O.o).

**ICP_OvErLorD** · 08-09-2005, 02:36 PM

just to say... i deleted the files for mh and when i restarted the pc it said it couldnt find the dll for a keylogger rofl

ummm i think this may be bad

its called like blaze tools perfect keylogger

**Dark.Zero** · 08-09-2005, 02:38 PM

so what u going to do now???sounds like you got a problem..... dude just follow the guid up there and u should be fine

**LostTrance** · 08-09-2005, 04:13 PM

Definatly wouldn't use this. Wait for mousepad unless you want to spend a week going through it offset by offset. Have a nice day?:

**Fusion** · 08-09-2005, 04:30 PM

did you uninstall diablo and reinstall it?

**r0ck3r** · 08-09-2005, 07:50 PM

you can scan the file all you want, it most likely is not infected with anything, as someone said it opens a port that has no need to be opened.

theres a good way to see if actually SENDS anything out from your computer, if you have a firewall deny everything access to the internet that doesnt need it, run d2 and load the mh, if you get a popu saying that the mh is asking for permission to access the internet, dont allow it. it should not ask for access to the internet, cause if it gets granted it would most likely send an email out through winsock to him. i read a bunch of forums, the day it came out everyone was like 'this file is legit and clean', days later everyone says 'REMOVE THIS FILE ASAP'

get down to it though --- there is no proof it is bad, the guy has a bad rep for doing this before, but not 1 person has proof that it does it. word of mouth is enough though, i know i deleted mine and changed my password, why risk it? like everyone says, wait for mousepads... but as you know, mousepad had a rep for doing that as well... you cant trust someone you dont know.

you do realize you could even buy d2jsp, and he could insert a code in it to send him your password, afterall, you open his program and put your acct/password in there.

once again, it will most likely come back as a clean fine, but the rep is good enough for me.