Yesenia Zero Posted November 4, 2023 Share Posted November 4, 2023 Hey so I got messages saying I will copy and past remove link. Pretty sure is a scam X3 (Saved Tue Oct 31 19:58:49 2023)Hello, Are you tired of spending your hard-earned Linden Dollars? We've got an exciting solution just for you! Introducing our SecondLive Viewer, where everything is not only free but also open for endless possibilities. - Unlock unlimited Linden Dollars (L$) for all your virtual adventures. - Fly to unlimited heights. - Build on any land of your choice, all for free. But that's just the beginning. Link: https We're sincerely thankful to everyone who joins us in our mission to make SecondLife completely free. Don't miss this incredible opportunity! Best regards. removed the Link because in case something weird. Link to comment Share on other sites More sharing options...
Rowan Amore Posted November 4, 2023 Share Posted November 4, 2023 1 minute ago, Yesenia Zero said: Hey so I got messages saying I will copy and past remove link. Pretty sure is a scam X3 (Saved Tue Oct 31 19:58:49 2023)Hello, Are you tired of spending your hard-earned Linden Dollars? We've got an exciting solution just for you! Introducing our SecondLive Viewer, where everything is not only free but also open for endless possibilities. - Unlock unlimited Linden Dollars (L$) for all your virtual adventures. - Fly to unlimited heights. - Build on any land of your choice, all for free. But that's just the beginning. Link: https We're sincerely thankful to everyone who joins us in our mission to make SecondLife completely free. Don't miss this incredible opportunity! Best regards. removed the Link because in case something weird. It's a scam and discussed here... 2 Link to comment Share on other sites More sharing options...
AmeliaJ08 Posted November 4, 2023 Share Posted November 4, 2023 (edited) It's surprising that SL isn't hit with more of these sorts of scams. I guess the fact that there's real money involved isn't widely known amongst scammers though. For the avoidance of any doubt though: this is a scam, they're trying to get financial information and/or account details. If you receive one of these messages it's likely from an account of someone who was silly enough to fall for it, don't be like them. Always check URLs carefully etc when entering any credentials. Never download or use any Second Life viewer that you cannot absolutely trust, be aware that the SL viewer is open source software also so anyone could make a viewer that looks identical to the one you currently use but steals your account details, only ever download software from trusted locations (e.g. official websites, don't just Google for them either since search results can be and frequently are fake). Edited November 4, 2023 by AmeliaJ08 Link to comment Share on other sites More sharing options...
belindacarson Posted November 4, 2023 Share Posted November 4, 2023 it's a scam, just report it as such under fraud. Link to comment Share on other sites More sharing options...
Polenth Yue Posted November 4, 2023 Share Posted November 4, 2023 The unlimited money makes it impossible, so I'd hope people would realise it was too good to be true. But be careful of future attempts, as some will sound more realistic. The key point is they'll be random links in IM or spamming groups. Doesn't matter what words they attach. You know it's a scam just from that. 1 Link to comment Share on other sites More sharing options...
Yesenia Zero Posted November 4, 2023 Author Share Posted November 4, 2023 thanks everyone for your input :3 Link to comment Share on other sites More sharing options...
animats Posted November 5, 2023 Share Posted November 5, 2023 Oh, that thing. It appeared a few days ago. It's been reported to LL and Soft Linden is following it. If you find someone with an SL account distributing this, report it. Do NOT install it. It's not a viewer at all. It's an installer for at least four pieces of malware. It installs backdoors that let others take over your machine. After installing malware, it pops up a message box: "The OpenGL driver detected a problem with the display driver and is unable to continue. The application must close. Error code:3 ,0+64,"Error". There's no viewer in there at all, apparently. Not even a hacked one. Just a line of PowerShell to display that message. If you've downloaded this on a Windows box and run the download, major malware cleanup is required. This sort of thing is seriously annoying for us third-party viewer developers. Gives TPVs a bad name. 1 4 1 Link to comment Share on other sites More sharing options...
CaithLynnSayes Posted November 5, 2023 Share Posted November 5, 2023 5 hours ago, Yesenia Zero said: - Unlock unlimited Linden Dollars (L$)... 1 1 Link to comment Share on other sites More sharing options...
Anna Nova Posted November 5, 2023 Share Posted November 5, 2023 Does it run on Linux? I'm always looking for a new viewer that runs on Linux. Proly not..... 2 Link to comment Share on other sites More sharing options...
Conifer Dada Posted November 5, 2023 Share Posted November 5, 2023 I received this same "SecondLive" message yesterday in IM, offering what appeared to be a 'cheat' viewer for Second Life. The message was sent by a 'joined today' newbie. I didn't click on the link, for obvious reasons, but I did look up SecondLIve on Google. There's actually [what claims to be] a virtual world called SecondLive, complete with a website. There's also lots of links to info about it on XFT (X formerly Twitter). A video shows the graphics are different from SL, so it's not based on OpenSim. Anyway the avatars aren't up to much in what looks to be their in-world footage. Link to comment Share on other sites More sharing options...
Randy Pole Posted November 5, 2023 Share Posted November 5, 2023 I am slightly pleased that these people at least only target Windows and so I am safe on my Mac but I am not foolish enough to assume that one day they might change their tactics. Despite the fact that 99% of people getting such messages are smart enough to see it for the scam that it is they only need that 1% to click and install the file. 1 Link to comment Share on other sites More sharing options...
shireena1 Posted November 5, 2023 Share Posted November 5, 2023 (edited) Just wondering, wouldn't most real time virus protections notice it and block it? (assuming that peeps have it in their system of course). I have heard something about some ps.1 powershell files that can cause greif as well. Edited November 5, 2023 by shireena1 added extra info. Link to comment Share on other sites More sharing options...
Alwin Alcott Posted November 5, 2023 Share Posted November 5, 2023 (edited) 1 hour ago, Conifer Dada said: The message was sent by a 'joined today' newbie. my alt got it by a 4 yr old one, migt be a victim of being phished already, of course reported. Edited November 5, 2023 by Alwin Alcott Link to comment Share on other sites More sharing options...
Alwin Alcott Posted November 5, 2023 Share Posted November 5, 2023 (edited) 1 hour ago, shireena1 said: wouldn't most real time virus protections notice it and block it? malware isn't a virus, and you give it acces yourself. There are many programs that cause a warning when trying to install on windows systems, also firestorm gives such sometimes at a update, but if you know what the source is it's mostly safe to override the warning. Still there are situations we shouldn't, or there isn't warning and you'r sc****d Edited November 5, 2023 by Alwin Alcott Link to comment Share on other sites More sharing options...
AmeliaJ08 Posted November 5, 2023 Share Posted November 5, 2023 A screenshot posted on Reddit of what the message that is being distributed looks like. Credit to /u/Jman_Foxclaw from Reddit. Link to comment Share on other sites More sharing options...
AmeliaJ08 Posted November 5, 2023 Share Posted November 5, 2023 (edited) 1 hour ago, shireena1 said: Just wondering, wouldn't most real time virus protections notice it and block it? (assuming that peeps have it in their system of course). I have heard something about some ps.1 powershell files that can cause greif as well. It's possible, it's not in any way sophisticated and the 'viewer' being distributed just runs an elevated Powershell script to download a handful of remote access trojans which are definitely in the Windows Defender database. That said: not worth risking it to test but people have taken a look at what it is attempting to download and install. Also the fact that some people are receiving messages from old accounts suggests that something is slipping through since that points to account details (and presumably everything else on that PC) being stolen and used by whoever is distributing this attack. Edited November 5, 2023 by AmeliaJ08 Link to comment Share on other sites More sharing options...
Katherine Heartsong Posted November 5, 2023 Share Posted November 5, 2023 Seen this in at least two of my groups a couple of days ago. Thankfully everyone screams "SCAM!" as soon as it appears. Link to comment Share on other sites More sharing options...
Conifer Dada Posted November 5, 2023 Share Posted November 5, 2023 I'm still a bit puzzled though. As I said in my post above, checking Google indicates there is a virtual world called SecondLive, which has a website. It might just be vapourware but there are videos. This is different from the scam-spam IM, which claims SecondLive is a viewer for Second Life that gives you 'god' powers over L$, land, objects and anything else you care to think of. Link to comment Share on other sites More sharing options...
animats Posted November 5, 2023 Share Posted November 5, 2023 8 hours ago, Conifer Dada said: I received this same "SecondLive" message yesterday in IM, offering what appeared to be a 'cheat' viewer for Second Life. The message was sent by a 'joined today' newbie. I didn't click on the link, for obvious reasons, but I did look up SecondLIve on Google. There's actually [what claims to be] a virtual world called SecondLive, complete with a website. There's also lots of links to info about it on XFT (X formerly Twitter). A video shows the graphics are different from SL, so it's not based on OpenSim. Anyway the avatars aren't up to much in what looks to be their in-world footage. SecondLive seems to be a real thing, an Asian crypto social network. It's classic 2021 crypto metaverse stuff - wallet, coins, mining, play to earn. It's an Android phone app. You can overlay cute little dancing kawaii avatars on phone video of the real world, and share the videos. (YouTube link) It's kind of a mashup of Pokemon Go, Vocaloids, TikTok, casual gaming, and crypto. It's probably a Lose Money Fast scheme on the crypto side, but at least it has cute graphics. The fake Second Life viewer, on the other hand, is just a low-rent phishing attack to get malware installed. 1 2 Link to comment Share on other sites More sharing options...
Conifer Dada Posted November 6, 2023 Share Posted November 6, 2023 (edited) Today I got another spam / scam message, this time trying to get me to join something called AvatarLife! This is claimed to be a virtual world similar to SL. This time the message was not from a resident but from an object. The message was there when I logged in. It's a bit odd that I received two spams regarding two different virtual worlds within two days, when I can't remember getting any such messages during my previous 17 years in SL! Edited November 6, 2023 by Conifer Dada 1 Link to comment Share on other sites More sharing options...
shireena1 Posted November 6, 2023 Share Posted November 6, 2023 38 minutes ago, Conifer Dada said: Today I got another spam / scam message, this time trying to get me to join something called AvatarLife! This is claimed to be a virtual world similar to SL. This time the message was not from a resident but from an object. The message was there when I logged in. It's a bit odd that I received two spams regarding two different virtual worlds within two days, when I can't remember getting any such messages during my previous 17 years in SL! I got that when I logged in today too, this was in my chat when I logged in, it was not a notecard or I.M. I am fairly sure I have recieved that message in the not so distant past, but on saying that, I get messages like that from Krafties as well. I think all I did to get those was to visit their sim. Personally, I just ignore them, or if I can, block them. Link to comment Share on other sites More sharing options...
Caitlin Tobias Posted November 6, 2023 Share Posted November 6, 2023 1 hour ago, Conifer Dada said: Today I got another spam / scam message, this time trying to get me to join something called AvatarLife! This is claimed to be a virtual world similar to SL. This time the message was not from a resident but from an object. The message was there when I logged in. It's a bit odd that I received two spams regarding two different virtual worlds within two days, when I can't remember getting any such messages during my previous 17 years in SL! AvatarLife is an actual virtual platform, so this is unsolicited advertising. I got it too and reported it. Link to comment Share on other sites More sharing options...
CaithLynnSayes Posted November 6, 2023 Share Posted November 6, 2023 On 11/5/2023 at 11:59 AM, North Pole said: I am slightly pleased that these people at least only target Windows and so I am safe on my Mac 1 3 1 Link to comment Share on other sites More sharing options...
Perrie Juran Posted November 6, 2023 Share Posted November 6, 2023 Inara Pey has an excellent write up on this scam: https://modemworld.me/2023/11/06/dissecting-the-free-l-viewer-scam-chaser-zaks/ 4 1 Link to comment Share on other sites More sharing options...
Neremyn Posted November 8, 2023 Share Posted November 8, 2023 (edited) As other have said - it's a malware. Here's some basic analysis https://www.hybrid-analysis.com/sample/b06bc0bac2af08133893a604abe30e6ea0195539eee6fad7750c812a422de3de/6543df9d5ed6609e4305b5b7#sample-analysis Edited November 8, 2023 by Neremyn Link to comment Share on other sites More sharing options...
Recommended Posts
Please take a moment to consider if this thread is worth bumping.
Please sign in to comment
You will be able to leave a comment after signing in
Sign In Now