Cookie Grabbers/ Keyloggers/ Backdoor
This page was initially created
only to inform the public about Auto Adopters, realizing how many users it was
I decided to add some definitions and tips regarding account protection and
hacks. This section has now become a bit extensive ever since the Cookie Grabber hysteria... First and foremost, a few definitions:
definition: small data file that contains your information/preferences
from sites you visit
neopet.relation: stores your information such as
username and word
notes: deleting cookies logs you out of all
accounts on all sites on that browser
definition: program/script that tricks your browser into sending a cheater
neopet.relation: scammers try to make you visit
their sites that contain cookie grabbers
notes: cookies are not
shared by browsers example: You use Firefox to browse only on Neopets and
Internet Explorer to browse other sites. If you visit a site with a
cookie grabber on it in Internet Explorer, only the IE cookies will be
grabbed, not your Firefox cookies. see
Cookie Grabbers Extended for more
info on CGs
definition: program that
seems legit, but internally programmed to disrupt/damage computer
neopet.relation: see backdoor Trojan
definition: program used by a hacker to
take control over your computer via the internet
can do whatever he wants in your account
note: much more
dangerous than a cookie grabber. Once this program is installed, the hacker has
access to everything on your computer through the internet. This is when
you'd have to consult with antivirus sites, not TNT.
definition: captures user's keystrokes. used to determine errors in
neopet.relation: cheaters use it to record what you
type, most importantly your username and word
definition: one who uses programs to gain access to your computer
note: many hackers are kids who think installing these programs on your computers are fun. Its illegal but many do not understand this and had to find out the hard way. Not by getting their 3675th Neopet account iced but their families being banned from internet providers like
Comcast and receiving fines, which their parents have to pay for.
Anti-Virus & Spyware Programs
The following programs are what I consider
to be "must haves" for anyone that cares about their computer's
protection. These can all be conveniently found at Download.com.
It is a completely safe site.
Avast Home Edition 4.6- I
highly recommend this anti-virus program as it is one of the highest
rated programs on the market as of now, but also is FREE. It
scans your computer for viruses, worms, and Trojan horses but also has
real-time protection, meaning as soon as it detects a new problem
with your computer, you will be alerted. Did I mention this was free?
Spybot- This is a FREE
removal program that will scan your computer for spyware such as
keyloggers and cookie grabbers. There are many different types of
spyware, some are harmless, however, they should not be on your
computer, especially if they were from a hacker.
Ad Aware- Another FREE spyware removal program that has
recently surpassed Spybot in popularity. I personally suggest
downloading both because one may find something the other did not.
I use these three programs and highly recommend them. You
do not have to pay to have your computer protected, so take advantage.
Dagnabbit. Can't Believe they Grabbed it.
Do not scan your
computer with different programs at the same time
to use your computer while a program is scanning
The first time
you use a program, do a thorough scan instead of the quick/smart scan
If you visit
many different sites, I suggest thorough scans every couple of days,
quick scan whenever you don't do a thorough.
If you primarily
browse on Neopets, I suggest quick scans every few days, thorough scan once a week
Length of thorough scan depends on your computer (esp. hard drive size) so I
recommend thorough scanning when you will not need to use the computer in
at least an hour. I usually thorough scan when watching a movie, getting
dinner, etc. Basically, a time when I will not be on the computer but will
be around to check up on it.
Before you scan, update the program so it has it's latest definition file
because they may not find the newest forms of spyware if not updated
a new update is found for a spyware/anti-virus program, update immediately.
I know "Remind me later" seems convenient but many get into the habit of
choosing it every time!
So someone had the
munchies and stole your cookies? Are you sure? Alright, maybe someone got into
your account but are you
sure it was from an on site cookie grabber.. because it probably wasn't. Do you know what a cookie grabber
There are many
people who have no idea what a CG looks like, or what it actually does.
Therefore, do not know the proper way to protect their computers. A cookie
grabber is typically a blank popup that will appear and close quickly. When it
is opened, it tricks your browser into thinking you are visiting neopets.com, so
your browser sends your cookie to it. This is how it works
If you opened a
cookie, you'd see nothing but strange code. The hacker only needs to replace his
cookie file with yours and BAM, he's in your account. But hold on, the hacker
needs to do this manually. So if you quickly change your word, you have nothing
to fear. Log out=deletes your login cookie
. They are the same thing. That
is what logging out does, it deletes your cookie so
neopets.com no longer remembers you. Did you forget what cookies do? Here's a
reminder: Cookies are the files that remember your information.
If logging out deletes the cookie, why bother change my
If you have already been CG'd, the hacker has your word.
However, he will only have the word you currently had when you visited the
page. So if you word was "baNaNabL1zxkh" and you were CG'd, the hacker would
have your username and "baNaNabL1zxkh" stored in the program. So lets say you
realized that you were CG'd.. your account won't be stolen until the hacker sits
down and does it himself. After you've been CG'd, you quickly
word then log out (which deletes your old word cookie). When you relogin, this
creates a new cookie but with your new word. So when that hacker is done on the
toilet and comes to see what new cookies he has, yours will not work for him.
He can either
replace his cookie with your cookie, in which case, he would never actually know
your word. OR he can import the cookie into a program that will decode the
cookie language, spitting out a username and word. So when he puts in your
username and "baNaNabL1zxkh", he will get a friendly message saying That
username/word combination is
invalid. Either click here to log in
as a different user or sign up and get an account at our
On a side note, what annoys me
most are people who create topics about CGs that have no good news or protection
tips to offer. These type of topics create panic and spread rumors. People should be making topics about how to protect your computer from
malicious scripts and programs, not how to have less fun on Neopets. Telling
everyone not to view lookups, pet's pages, shops etc is paranoia, not
protection. You might as well disconnect your LAN cable and not explore the
internet if that's how you protect yourself from malicious scripts and programs.
Also, there are those who say they are protected by the best programs but still avoid
lookups, pet's pages and shops? Can someone please explain the intelligence in
this? That is right. There isn't any.
which has the right idea but is totally blown out of proportion is "deleting all cookies." Cookies are not created by hackers, they are
helpful tools on the internet that make browsing easier for you. However,
hackers take advantage of them. A cookie grabber only steals one
so why are you deleting all your cookies? You just logged yourself out of every
account you own on the internet! Yes, seriously.
When you log into
a site, that creates a new cookie. Do you understand why I say deleting
cookies is useless? As soon as you sign back in, Neopets.com creates another
cookie for you, because that is what logging in does. Period. I'm not suggesting, I am telling you, protecting your computer
overrules deleting cookies and is the way to fight this issue.
When a keylogger is installed
on your computer, it doesn't matter how many
times you change your word because the information is sent back to the
hacker. Its even easier for them through people who are always
connected to the internet. Again, which is why you must equip your computer with powerful spyware
removal and anti-virus programs. If they install one of the keyloggers or trojans on your
computer, hack your account then take all your stuff, they could do it again,
. They could wait for you to rebuild a new account, make a couple
million and hack you, again. You know why? Because that illegal program is
your computer. They could also steal a bit of NP time to time.. an item here and
there. Even if you do realize its going on but have no protection programs to
delete the malware, what can you do? Nothing.
In 2004, I
noticed neopoints missing from my bank account every week. I reported it.. changed my word, deleted
cookies, scanned my computer.. I'm not even going to say what help I got from
the boards.. ok, fine, since you asked: I told people about this, usually once a week
on the boards about it.. people started saying.. why do I always
complain? Do you believe that? Of course you do because there are so many
rude players. What I did not do however, was update my
programs. I used to sit back and click "remind me later" when there was an
update. This is why the scanning could not find this malicious program on my computer giving
access to the hacker whenever he pleased. A minimum of 300k to 1 million
neopoints were stolen at a time. Fortunately, the person doing this wasn't as
mindless as many other hackers. Instead of just stealing my stuff, he stayed
there and grabbed neopoints as I made them. I realized my problem was that I
wasn't updating my programs but I researched so much that I learned about all
these other malicious programs. And I don't mean I sat one afternoon and read
about bad programs, this was weeks of reading and re-reading because I knew I
wanted to take this program off but also learn how to protect myself even
better. So I updated my program and guess what I found.. a keylogger.Neopets.com
is a fun site"- Captain Obvious, Daily Bugle, but it is also a business. If new players signed up for Neopets and let's say,
posts on the News "Alright everyone, the cookie grabber issue has been dealt
with"... new players are going to say "whoa whoa whoa, hold the phone, cookie
grabbers? I am not joining Neopets.com to get hacked and I'm going to tell all
my friends not to join this hacked site." Thats just an answer to those that wonder why TNT doesn't
so I recommend protecting your computers,
update your programs and get on with your Neopian life.
announcement: Stop calling cheaters' by
their names. I can't stand seeing people say "SO & SO has hacked whoever." He's
a cheater. She's a cheater. They are cheaters. That's their name and nothing
else. They do not deserve our respect by calling them by their names. Its
disgusting and only pushes them to do more. I almost laughed at some people in
the Battledome chat who said "cheater can't be hacking right now, he's on
vacation in Florida," but I felt sorry for them.
Example: Lets say
you are incredibly proud of your lookup and want everyone to see it. But no one
calls you by your username, they call you a generic term, "neopian." So on the
boards people are saying "Hey, neopian has a great lookup!"..which neopian?
Wouldn't you feel disrespected? You did all that work and no one even cares that
YOU did it? You want people to say "#visitor made that awesome lookup!" because
then you will get credit and people compliment YOU. Now apply this to cheaters.
definition: one who competes to
adopt a painted pet at the Neopian Adoption Centre
reversed: rettis dnoup
definition: one who uses illegal programs to capture
synonyms: autofresher (AFer), auto adopter (AAs)
Many of us use the pound to transfer our
avatar pets. We have space for four pets and there are more than four
avatar pets. Therefore, most of us leave our avatar pets on storage
accounts since we're allowed to have
five accounts total; However, the only way to do this is by
transferring. We are provoked into transferring.
Goal: Acquire pet avatars
Result: Spend neopoints on avatar
pets, which we transfer after since we had to use our hard earned NP to
Haven't met many using a single pet to obtain all pet avatars.
(Remorphing and Re-painting) That is a waste of neopoints, not to
mention there is a high probability that you will need a certain pet
Many people work hard and create their own avatar pets. However, they
must spend NP to morph/paint/add petpets, therefore, do not want to give
that pet up once it spits out its avatar.
...you cannot charge people to adopt a pet you have nursed, nor can
you ensure a particular Neopet will go to a certain person. As soon
as a Neopet is placed in the pound it is available for anybody to
adopt." -The Neopets Team
This in not encouraged by TNT because once your pet is in the pound, its
up for grabs by anyone and people complain if they lose it. You risk
it, so be it.
However, the pound absolutely is not fair game when there are
cheaters. Like criminals, there are people who can't make it on their
own legitimately, so they do it illegally. Don't throw your beer bellies around
saying "Well, you should have known the consequences."
Why am I reading this, Mr. Sin?
Sounds like a bunch of rambling."
Listen child, I have a story to tell.
Similar to the auto purchasing of items in the
shops, there are sad, lonely, bad Neopians who refresh your pets' adopt links.
..but.. but I use the quick
adopt link to transfer my pets too, Mr. Sin, am I a bad neopian
Please, let me finish. They do not sit at
their computers hitting Refresh, do ABers do that? Certainly not.
Fact: There are programs in which an URL(s) can be refreshed
continuously. Autofreshers. Cheaters use these programs to refresh pets'
So, how exactly do you
Like I explained before, people move their avatar pets to their storage
accounts. Aug 8th: Blumaroo Day. Avatar: Blumaroo- Fire!. My
girlfriend had a pet with aged Ghoti on it, therefore, we made it a
Blumaroo then painted it and the Ghoti, fire. We now had our avatars. I did not want to keep
our Fire Blumaroo with Fire Ghoti on my main, it was not my wish to own on e. And he was not free, by a long shot, so I was not
going to pound him. Cheaters know this and pounce on you when you decide
to take them off your main.
I've been playing for years and know very well how to move pets easily
through the pound, as do other veteran players. My record for losing
pets in the pound, before my girlfriend's Fire Blumaroo, was an
unbelievably low zero. When I lost our pet
recent, no need to console me), I knew something was wrong.
Twas the early hours of the morning, when most of you are asleep and
there was no lag during the transfer. No pound sitter could have clicked
faster than someone button mashing F5 (refresh). There are a number of
handicaps a legit pound sitter has versus a quick adopt link user:
Quick Adopt Link User
Must load adopt page (sidebar, banners,
3 pounded pets, etc)
on e small "Back" image, but doesn't need to wait for it to load
Must see the pet, then decide whether
or not to adopt
Already knows what pet it is, doesn't need .0001 second to think
Has to click adopt, then click Yes on
the pop up
Button mashes F5
(I actually had to add in this table because some people still like to
argue that Pound sitters are faster than the Quick adopt link. Of
course, there are rare occasions where the QAL user might break his
finger when button mashing F5 leaving the pet open to Pound sitters.
Back to my story, I looked at this user who "adopted" our pet. A side
account. Go figure. I neomailed him and he did not reply until the next
day. (He used a program, so he wasn't there to reply minutes after
adopting.) So the next day, he said he was a pound sitter, but I did not believe
him purely because of the facts I stated above; I knew there was no
possibility a human being just clicked several links in that millisecond
where F5 wasn't pushed down. He probably thought I was going to say
"d4rn, i new i shudnt hav transfured" because I have no idea who he
thought he was fooling.
My Plan pretty much had an A and B.
Maturely convince him to give it back
B: Continue talking to
him so he doesn't transfer the pet and buy TNT time to freeze the
account, then provide TNT with evidence that the Blumaroo was ours with
screenies and dates.
(Broken Rule: You are allowed a MAXIMUM of one main account and up to
four additional accounts).
With this lookup code, he was hiding all his pets and information.
(Broken Rule: All your stats
MUST BE VISIBLE. You can move them around the page, put them in a
scrolling div, or whatever you wish... but everyone must be able to see
your joined date, shop, Neopets, etc.).
So I watched this account, no harm in that.. the next day
he had another avatar pet. Day after, another. Now for all you pound
sitters out there, how often to you actually see and adopt a
pricy pet in the pound? Not often, if ever right? And when I
mean pricy, I mean over 1 million neopoints to paint. (Pirate, Maraquan,
Grey etc) So he then transferred one to another side account, which had
three other avatar pets on it. So I copied the names of those pets and
waited for him to transfer another which he did. I did this for three
weeks. Let me tell you, he has a lot of accounts and uses the same
lookup code for most. More than 5 had the same lookup code
However, I can tell he was using IE because I was on Firefox and could
still see the links to the pets. He probably still has no clue how I
found out he was doing this. He had repeats of avatar pets like
Halloween Rukis with Baby Mummies. I had plenty of information to report
him so I did. It was a long report; I had been
doing this for 3 weeks give or take. Three of his accounts were frozen
last I checked.
I continued speaking with him through Neomail
and I'm not gullible. He told me he didn't play much. So, wait a minute..
when he actually did play, he sat in the pound refreshing and had over 15 pricy
pets ALL on side accounts? Excuse my chatspeak but
(Boy, haven't used that one in years!) I've tried pound sitting for a
couple days only to see what its like, and its boring, might I add, I
saw not a single painted pet, but this guy (who didn't play much) could get two and three a
day. To get an awesome pet
in the pound is one thing, but several everyday?
Please, make it stop. '_';
Frightening, huh? When I had enough information, I made it known
publicly that I knew what was going on and as a result, met owners of
some of the other pets on these accounts. The cheater's reaction: He made a desperate rush
to the Avatar/Signatures board and created a topic about pounding a Fire Blumaroo. Why would he do that? He obviously lied about being a
pound sitter. Is it just me, or when you hear this, you totally think of
a criminal, being chased by the authorities, so he tries to ditch the
evidence? Neopets is just a game, but funny how many aspects of it can
resemble real life.
This obvious display of guilt by the
cheater was almost amusing to watch besides the fact that hundreds of
vicious ACers were going to massacre our poor Blumaroo in the pound. You
could only imagine how fast that board moved.. so I didn't even bother
attempting to tell everyone on the board what that pet was a victim of.
As if they'd believe me there anyway, right? It was the AC.
I won't get into where he ended up because
it is not relevant to the issue at hand, but as a memorial, will say my
girlfriend put much time training him, and we put many neopoints into
making him an avatar pet. What is more important? Helping fellow
Neopians or selfish greed? More importantly, profiting off a cheater is
not the way to go.
R.I.P. our beloved Fire Blumaroo
Don't let cheaters help you in your quest
to be a successful Neopian.
Why am I telling you this? It was brought to my attention by a friend,
that someone had lost his draik. Most of the uncaring people reading
this are probably saying "Big deal, he should have known the
How could anyone say big deal?
He lost his Draik, Sin! '_';
Well, I checked out the new owner's lookup.. side account. Four draiks.
Remember how I said the other cheater had repeats of avatar pets? Well,
guess what was the most recent pet avatar of the time.
Hatched. Meaning, cheaters were on a frenzy at the boards looking for
people with Draiks. I'm not superman and cannot track them all down but
they are here, and they are taking advantage because no one knows. Many
people just go "Darn! Lost my pet!" *cry to AC*
You post on the boards with a Draik on your account, you're provoking
cheaters to autofresh him, because they now see the name of the Draik,
and add it to their list in their program.
I took the time to write this to make you aware. The cheater who stole
our Fire Blumaroo has had three, probably more, of his pound accounts
frozen so far. I reported him and all these accounts in great detail
through premium. There was no way I was mistaken. He was a
cheater. Like I said earlier, I know how to use the pound and when my
pet was stolen, I was shocked since there was absolutely no lag at
3am and I have a great connection. There was no way I was going to sit back and say,
"ohemgee 1ost meh pet 2 a poudnsiter."
I did not create this page for people to console me about our Blumaroo. I have my main pets which will never be pounded because I'm
positive they are all probably being targeted right now.
Don't lend pets that have emotional value to you.
This page was made to help you. So that you know that
this is going on.
I spent quite some time updating, hope you understand I just want this
type of cheating to be as widely known as ABing is. Recently, I came
across people arguing whether this is true or not. I'll make it known
that I have seen sites and know of programs that can do this, but
ABSOLUTELY will not post them
here nor tell people where they can see them because I do not want more
people auto adopting. Have you seen the "restockers" ABing
program? Probably not. Do you need proof to know that its real?..
I did a lot of investigating before reporting this cheater. However,
most people lose their pets to legit pound sitters.