Simple Wow Morpher for x86

[danyx493]

This is the e-mail i got from blizzard after talking to a gm
Account Action: Suspension (24 Hours)

Being scammed potentially negates hours of another customer’s time, and is against the spirit of the game.
Any gold, items, skills or abilities gained by your characters during this have been removed, in order to fully recover the other customer’s in-game properties.

Type of Violation: Scam
Category of Violation: GM Defraud
While we regret to take this type of action, we have determined it to be in the best interests of the World of Warcraft community as a whole, and for the integrity of the game.
Please note that should any further violations of our Rules and Policies occur, this incident will be taken into consideration when determining the consequences for your account. This could include further warnings, account suspension or account termination.
Also note, you must log into the game after the suspension has expired to update the status of the account shown on your Account Management page.

The gm told me that i'm lying to him, that i sold my gold to some gold sellers and i'm trying to scam blizzard, because the trade was made at my PC(wtf?)...so the one who did this is not an amator, the blame gets on me, i don't get my gold back and even further i'm getting banned for lying to a gm.

[jh16]

DO NOT DOWLOAD THIS, it contains a keylogger...my account was hacked this night, all my gold is gone! i started playing wow three years ago and my account was never hacked and believe me it had substantial summes on it..yesterday i downloaded the morph and attached it, haven't entered suspicious sites that could have contained any keyloggers..and guest what, the first night after i use this morph BAMMM 400k : ALL GONE!

Not true, I've even left it running and attached when I get disconnected and log back in, also "Persistent Morph" puts me right back to what I was looking like when I got disconnected.
By the way, here is the VirusTotal link: https://www.virustotal.com/url/55113...is/1356942215/

If your having so many problems with key-loggers get a firewall that works.

Also here is a picture of "simplemorpher.exe" while attached to "Wow.exe" through the "Resource Monitor."
I don't see it trying to contact anyone through the network, how about you?


Not going to say anything about the email that you just posted about, since it might lead to a disaster.

Do more research so you don't downgrade the wrong thing.

@dan934, keep up the good work. This community needs a reliable 32-bit morpher.

[l0l1dk]

Not true, I've even left it running and attached when I get disconnected and log back in, also "Persistent Morph" puts me right back to what I was looking like when I got disconnected.
By the way, here is the VirusTotal link: https://www.virustotal.com/url/55113...is/1356942215/

If your having so many problems with key-loggers get a firewall that works.

Also here is a picture of "simplemorpher.exe" while attached to "Wow.exe" through the "Resource Monitor."
I don't see it trying to contact anyone through the network, how about you?

Not going to say anything about the email that you just posted about, since it might lead to a disaster.

Do more research so you don't downgrade the wrong thing.

@dan934, keep up the good work. This community needs a reliable 32-bit morpher.

He might be right. There's a file in the newest version (115), Thumb.db. It wasn't there in the previous versions and it's XOR encrypted. Also, the virus scan associated with that download link isn't for the same file. The virus scan is from the 18th but the file was uploaded to Filebeam on the 25th. Here's the actual virus scan for the file. 10 of 46 detection ratio, while the previous versions were 0 of 46.

[danyx493]

It's so hard to believe man, i mean why did i got hacked in the night after i attached the morph to my wow account and never before in so many years eh? as i said i didn't entered any suspicious sites with keyloggers and viruses...i saw on this thread some people complaining that their gold was also gone after they used this morph, so the question again is why did i got hacked this night right after i used the morph and not a few days ago, one week ago, two weeks ago(i still had around 380k)?! but i can't understand one thing, the gm told me that the whole bussiness was made at my pc from my ip (that's why he thought that i'm lying him and sold my gold to gold sellers)..how is that possible?

[jh16]

He might be right. There's a file in the newest version (115), Thumb.db. It wasn't there in the previous versions and it's XOR encrypted. Also, the virus scan associated with that download link isn't for the same file. The virus scan is from the 18th but the file was uploaded to Filebeam on the 25th. Here's the actual virus scan for the file. 10 of 46 detection ratio, while the previous versions were 0 of 46.

Well heck the same "simplemorpher115.zip" that I downloaded didn't have the "Thumb.db" the only things it had was; sampledruidforms.txt, displayids.txt, fasmdll_managed.dll, sampleitems.ini, and simplemorpher.exe.

/shrug

[cdmichaelb]

Well heck the same "simplemorpher115.zip" that I downloaded didn't have the "Thumb.db" the only things it had was; sampledruidforms.txt, displayids.txt, fasmdll_managed.dll, sampleitems.ini, and simplemorpher.exe.

/shrug

If it's the same key logger that hit DB/HB then simply possessing an installed antivirus prevents it from infecting you.

Edit: Here is a guide by "Bugser" to checking if you are infected and removing it: Demonbuddy Beta infected

[Majormoonirl]

what do you have done for it working? it doesn't wirking for me.

[Majormoonirl]

fasmdll_managed have something wrong! who can help me

[Majormoonirl]

when i click the attach........
“fasmdll_managed.dll”
在 ..
(UInt32 , String[] )
在 ..
(UInt32 )
在 .
.(Object , EventArgs )
在 System.Windows.Forms.Control.OnClick(EventArgs e)
在 System.Windows.Forms.Button.OnClick(EventArgs e)
在 System.Windows.Forms.Button.OnMouseUp(MouseEventArgs mevent)
在 System.Windows.Forms.Control.WmMouseUp(Message& m, MouseButtons button, Int32 clicks)
在 System.Windows.Forms.Control.WndProc(Message& m)
在 System.Windows.Forms.ButtonBase.WndProc(Message& m)
在 System.Windows.Forms.Button.WndProc(Message& m)
在 System.Windows.Forms.Control.ControlNativeWindow.OnMessage(Message& m)
在 System.Windows.Forms.Control.ControlNativeWindow.WndProc(Message& m)
在 System.Windows.Forms.NativeWindow.Callback(IntPtr hWnd, Int32 msg, IntPtr wparam, IntPtr lparam)




************** 已加载的程序集 **************
mscorlib
程序集版本: 4.0.0.0
Win32 版本: 4.0.30319.17929 built by: FX45RTMREL
基本代码: file:///C:/Windows/Microsoft.NET/Framework/v4.0.30319/mscorlib.dll
----------------------------------------
wowapp
程序集版本: 1.0.0.0
Win32 版本: 1.0.0.0
基本代码: file:///D:/cwow/wow/morpher/simplemorpher.exe
----------------------------------------
System.Windows.Forms
程序集版本: 4.0.0.0
Win32 版本: 4.0.30319.17929 built by: FX45RTMREL
基本代码: file:///C:/Windows/Microsoft.Net/assembly/GAC_MSIL/System.Windows.Forms/v4.0_4.0.0.0__b77a5c561934e089/System.Windows.Forms.dll
----------------------------------------
System.Drawing
程序集版本: 4.0.0.0
Win32 版本: 4.0.30319.17929 built by: FX45RTMREL
基本代码: file:///C:/Windows/Microsoft.Net/assembly/GAC_MSIL/System.Drawing/v4.0_4.0.0.0__b03f5f7f11d50a3a/System.Drawing.dll
----------------------------------------
System
程序集版本: 4.0.0.0
Win32 版本: 4.0.30319.18014 built by: FX45RTMGDR
基本代码: file:///C:/Windows/Microsoft.Net/assembly/GAC_MSIL/System/v4.0_4.0.0.0__b77a5c561934e089/System.dll
----------------------------------------
System.Core
程序集版本: 4.0.0.0
Win32 版本: 4.0.30319.17929 built by: FX45RTMREL
基本代码: file:///C:/Windows/Microsoft.Net/assembly/GAC_MSIL/System.Core/v4.0_4.0.0.0__b77a5c561934e089/System.Core.dll
----------------------------------------
System.Windows.Forms.resources
程序集版本: 4.0.0.0
Win32 版本: 4.0.30319.17929 built by: FX45RTMREL
基本代码: file:///C:/Windows/Microsoft.Net/assembly/GAC_MSIL/System.Windows.Forms.resources/v4.0_4.0.0.0_zh-Hans_b77a5c561934e089/System.Windows.Forms.resources.dll
----------------------------------------
mscorlib.resources
程序集版本: 4.0.0.0
Win32 版本: 4.0.30319.17929 built by: FX45RTMREL
基本代码: file:///C:/Windows/Microsoft.Net/assembly/GAC_MSIL/mscorlib.resources/v4.0_4.0.0.0_zh-Hans_b77a5c561934e089/mscorlib.resources.dll
----------------------------------------

************** JIT 调试 **************
要启用实时(JIT)调试，
该应用程序或计算机的 .config 文件(machine.config)的 system.windows.forms 节中必须设置
jitDebugging 值。
编译应用程序时还必须启用
调试。

例如:

<configuration>
<system.windows.forms jitDebugging="true" />
</configuration>

启用 JIT 调试后，任何未经处理的异常
都将被发送到在此计算机上注册的 JIT 调试器，
而不是由此对话框处理。

[Majormoonirl]

Worked for me yesterday, today it wont work.

"Could not load file or assembly 'fasmdll_managed.dll' or one of its dependencies. The specified module could not be found."

- Not working for me on any version
-I've got 32bit windows
-4.5 Net frame
- fasmdll_managed.dll and the .exe is in the same folder
- Running the program as administrator
- not running any background programs



Any help?

I have the same problem,do you have solved it?

[dan934]

Well this is very interesting.

quoting my post here:

http://www.ownedcore.com/forums/worl...ml#post2618049 (Simple Wow Morpher for x86)

this has the proper non-infected file link. but somehow my original post has been updated (account compromise perhaps? perhaps a mod or admin can look into this for me).

in the mean time, I've replaced the links in the OP. and for everyone currently using this, please make sure the .zip file you downloaded is the following one:

Filebeam - Beam up that File Scottie!

CRC32: A9BF478B
MD5: 0a762f0266e6ce73d20f48e9a79a992d

I've also removed the old links in case they were also compromised.

i'm really sorry to anyone who was actually a victim of this.

If it's the same key logger that hit DB/HB then simply possessing an installed antivirus prevents it from infecting you.

Edit: Here is a guide by "Bugser" to checking if you are infected and removing it: Demonbuddy Beta infected

It does seem to be the same and/or similar. however whats got me stumped is how my Original post got hijacked :/

edit: looks like it is more then just Thumbs.db - if your zip file contains any of the following files do not use it:

Thumbs.db
simplemorpher.bak

it also looks like build 115 was the only one compromised. no other ones have been modified.

[jh16]

Glad to hear that it wasn't intentional. Honestly speaking I reckon I was defending the 18th's version of 115 and hadn't realized that the link was changed.

[zan2]

Every time I try to attach the morpher with wow I get an error saying "Could not load file assembly 'fasmdll_managed.dll' or one of its dependencies."

************** Exception Text **************
System.IO.FileNotFoundException: Could not load file or assembly 'fasmdll_managed.dll' or one of its dependencies. Navedenega modula ni bilo mogoče najti.
File name: 'fasmdll_managed.dll'
at ..
(UInt32 , String[] )
at ..
(UInt32 )
at .
.(Object , EventArgs )
at System.Windows.Forms.Control.OnClick(EventArgs e)
at System.Windows.Forms.Button.OnClick(EventArgs e)
at System.Windows.Forms.Button.OnMouseUp(MouseEventArgs mevent)
at System.Windows.Forms.Control.WmMouseUp(Message& m, MouseButtons button, Int32 clicks)
at System.Windows.Forms.Control.WndProc(Message& m)
at System.Windows.Forms.ButtonBase.WndProc(Message& m)
at System.Windows.Forms.Button.WndProc(Message& m)
at System.Windows.Forms.Control.ControlNativeWindow.OnMessage(Message& m)
at System.Windows.Forms.Control.ControlNativeWindow.WndProc(Message& m)
at System.Windows.Forms.NativeWindow.Callback(IntPtr hWnd, Int32 msg, IntPtr wparam, IntPtr lparam)




************** Loaded Assemblies **************
mscorlib
Assembly Version: 4.0.0.0
Win32 Version: 4.0.30319.17929 built by: FX45RTMREL
CodeBase: file:///C:/Windows/Microsoft.NET/Framework/v4.0.30319/mscorlib.dll
----------------------------------------
wowapp
Assembly Version: 1.0.0.0
Win32 Version: 1.0.0.0
CodeBase: file:///D:/Program%20Files/World%20of%20Warcraft/simplemorpher.exe
----------------------------------------
System.Windows.Forms
Assembly Version: 4.0.0.0
Win32 Version: 4.0.30319.17929 built by: FX45RTMREL
CodeBase: file:///C:/Windows/Microsoft.Net/assembly/GAC_MSIL/System.Windows.Forms/v4.0_4.0.0.0__b77a5c561934e089/System.Windows.Forms.dll
----------------------------------------
System.Drawing
Assembly Version: 4.0.0.0
Win32 Version: 4.0.30319.17929 built by: FX45RTMREL
CodeBase: file:///C:/Windows/Microsoft.Net/assembly/GAC_MSIL/System.Drawing/v4.0_4.0.0.0__b03f5f7f11d50a3a/System.Drawing.dll
----------------------------------------
System
Assembly Version: 4.0.0.0
Win32 Version: 4.0.30319.17929 built by: FX45RTMREL
CodeBase: file:///C:/Windows/Microsoft.Net/assembly/GAC_MSIL/System/v4.0_4.0.0.0__b77a5c561934e089/System.dll
----------------------------------------
System.Core
Assembly Version: 4.0.0.0
Win32 Version: 4.0.30319.17929 built by: FX45RTMREL
CodeBase: file:///C:/Windows/Microsoft.Net/assembly/GAC_MSIL/System.Core/v4.0_4.0.0.0__b77a5c561934e089/System.Core.dll
----------------------------------------

************** JIT Debugging **************
To enable just-in-time (JIT) debugging, the .config file for this
application or computer (machine.config) must have the
jitDebugging value set in the system.windows.forms section.
The application must also be compiled with debugging
enabled.

For example:

<configuration>
<system.windows.forms jitDebugging="true" />
</configuration>






Please help, any feed back will be appreciated, thanks !

[ThomBB]

hi, just to help you, i have windows 8 32bits and evrything is working oggd.

Thanks for your work.

[Brize]

Why can we save gear but not the mount, enchants, race etc?