There has been a hacker at work... - GoFuckYourself.com

The Hun · 07-17-2002, 03:56 PM

Some guy installed spyware on people's machines through most likely exploiting security flaws in MicroSoft's Internet Explorer. This code is doing the same thing gator's programs are doing: put advertising on pages that weren't there before. Smutserver.com is one of the main targets of this hack right now...

I just got off the phone with smutserver and we went in to the problem in detail. The code that was posted by Grumpy in the other thread wasn't found anywhere on any of the machines on smutserver, and it looks like it it locally generated by a piece of spyware on people's computers. I know in Grumpy's office there's a machine that is infected with this, so I'm pretty sure that by tomorrow morning we'll have a fix available...

The code that is loaded is loading offshoreclicks consoles and then the original page in a frame, but pointed to with an IP-address instead of the original URL to prevent the spyware program to trigger again on the frame that is loaded. This does open possibilities to post an easy fix though.

I'll be writing offshoreclicks to see if they're willing to close down these consoles. I worked with 'em before in the past and I'm pretty confident they're willing to look in to this.

In the mean time I'm tracing down what sites are affected by this Russian cheater to make sure the listings of those sites are layed off for a while.

As soon as a fix is available I'll post it here. This hacker has the possibility right now to ad domains to his program and pop offshoreclicks consoles on any site he whishes... So I think it's pretty important this guy is stopped.

If anybody has any ideas that might be useful, please post 'em here. Remember that this is not something that is "only affecting the free Internet"... if this guy ads gofuckyourself.net to his list offshoreclicks consoles will start popping up every time you close a page here. ALL sites are in risk of being infected...

Gary · 07-17-2002, 03:59 PM

This wouldnt be a problem if you would stop giving away free porn!

Haha, just kidding. thats serious shit, good luck getting a fix for it. fucking bastards

vegasdude · 07-17-2002, 04:00 PM

they killed kenny!

revbuddylove · 07-17-2002, 04:12 PM

Have you tried using adaware? If this spyware/scumware isn't wide spread they might not have it in their definitions yet, but I have had great luck with them. The URL is:
http://www.lavasoftusa.com/

If anyone doesn't know: adaware is like anti virus software, but for spyware/scumware. They release updated definitions for it to keep you protected from the latest in scumware.

Give it a try, um, or don't.

-Rev

The Hun · 07-17-2002, 04:13 PM

I was on a machine today that had the infection. When I saw it I thought of spyware myself, so we ran ad-aware on it. It found nothing...

jimmyf · 07-17-2002, 04:20 PM

Got any file names we could look for?? Or any thing to look for??
In the Reg.

Amputate Your Head · 07-17-2002, 04:25 PM

too much free porn!

The Hun · 07-17-2002, 04:25 PM

Nope, it's 1:24am here right now. The office where the infected machine is is closed now. I'll call 'em first thing tomorrow morning.

The Hun · 07-17-2002, 04:26 PM

AYH... please read the entire message. This hacker can easily adapt his spyware to make the same consoles pop up on your site...

quiet · 07-17-2002, 04:28 PM

Quote:

Originally posted by Amputate Your Head
too much free porn!

it's true. none of this would have happened if there was no free porn!

Shoplifter · 07-17-2002, 04:37 PM

Russian Cheater! Hah now that's anticlimactic.

Gary · 07-17-2002, 04:39 PM

Quote:

Originally posted by The Hun
AYH... please read the entire message. This hacker can easily adapt his spyware to make the same consoles pop up on your site...

LOL he was joking dude.

some_idiot · 07-17-2002, 04:40 PM

Quote:

Originally posted by The Hun
AYH... please read the entire message. This hacker can easily adapt his spyware to make the same consoles pop up on your site...

The code in the other thread seems pretty basic...

This another one of those encoded lines like the guy
last week?

Seems that should be ruled out before you go looking
for adware burrowing into the system. Perhaps a quick
check for "window." hex encoded in the script check
routine.

Amputate Your Head · 07-17-2002, 04:48 PM

I was joking dude...

my sarcastic humor is unwanted..... I suddenly feel lonely..... someone hold me....

The Hun · 07-17-2002, 04:49 PM

This is definately something that's generated locally... there's no headers and footers or anything in that code, the code as posted in that other thread was all that showed up on the page. If this was done with javascript it would show in the source and the headers and footers of smutserver would be there...

Also, if it would be something in the HTML the original URL and the URL with the IP-address should give the same result, but on an infected machine, they don't. This is really caused by spy-ware

hyper · 07-17-2002, 04:53 PM

well i think offshoreclicks would have personal information on the guy, after all they pay him.

So i guess the authorities should be contacted

Lightning · 07-17-2002, 05:36 PM

Quote:

Originally posted by hyper
well i think offshoreclicks would have personal information on the guy, after all they pay him.

So i guess the authorities should be contacted

Good thought......I wonder if Offshoreclicks actually has something to do with this??...I mean they are known for some of the worst consoles in the business??.....Just a thought.

pr0 · 07-17-2002, 06:03 PM

OPERA

OPERA

OPERA

www.opera.com

gothweb · 07-17-2002, 06:10 PM

Funny how Mac users don't have to deal with Micro$oft exploits, huh?

RockDaddy · 07-17-2002, 06:55 PM

Quote:

This is definately something that's generated locally... there's no headers and footers or anything in that code

Can't that be worked around with a SSI Include statement??

eru · 07-17-2002, 06:59 PM

Quote:

Originally posted by pr0
OPERA

OPERA

OPERA

www.opera.com

Hell yea!!!

Amputate Your Head · 07-17-2002, 07:01 PM

I'm still feeling unloved here guys......

chodadog · 07-17-2002, 07:05 PM

Quote:

Originally posted by Amputate Your Head
my sarcastic humor is unwanted..... I suddenly feel lonely..... someone hold me....

*caresses Amp*

Jayson · 07-17-2002, 07:12 PM

Quote:

Originally posted by pr0
OPERA

OPERA

OPERA

www.opera.com

Absolutley - faster and you got to love the tabbed windows.

Amputate Your Head · 07-17-2002, 07:13 PM

Quote:

Originally posted by chodadog

*caresses Amp*

startin' to feel some love here.....

RockDaddy · 07-17-2002, 07:14 PM

Or something as simple as this?

http://www.bignosebird.com/sdocs/nested.shtml

BruceM · 07-17-2002, 07:17 PM

*gives Amp a six pack and some smokes*

Amputate Your Head · 07-17-2002, 07:25 PM

Quote:

Originally posted by BruceM
*gives Amp a six pack and some smokes*

now that's fuckin' love man!

chodadog · 07-17-2002, 07:28 PM

**gives Amp a six pack and some smokes... and touches him*

Touche

DrGuile · 07-17-2002, 07:40 PM

Popov, Konstantin [email protected]
Vavilova str.
47-1-27
Moscow, NA 117312
RU
722-4068

http://www.xrenoder.com/tgp/

CDSmith · 07-17-2002, 07:44 PM

Hey... ha ha ..... I'm laughing out loud here.... ha ha ........ and I'd just like to send out a big.... ha ha ha ........ a great big "FUCK YOU"... ha ha ha..... to all those that pissed all over smutserver when this issue first came to light......

ha ha ha

Stupid fuckers. Get your heads out of your asses and realize that freehosts like smutserver are just the opposite of evil... they are excellent. Stupid fucks.

Again,..... ha ha ha. Laugh with me now. I've had pages on smutserver since they started, and have nothing but great things to say about them. My word is final. Get it?

Amputate Your Head · 07-17-2002, 07:44 PM

you know I love you CD.....

SleazyDream · 07-17-2002, 10:37 PM

Quote:

Originally posted by quiet

it's true. none of this would have happened if there was no free porn!

false, this hacker would just hack the paysites with traffic.

kmanrox · 07-17-2002, 10:38 PM

what's a Hun? i dont get it ..

;-)

Joe Sixpack · 07-18-2002, 12:00 AM

Quote:

Originally posted by CDSmith
Hey... ha ha ..... I'm laughing out loud here.... ha ha ........ and I'd just like to send out a big.... ha ha ha ........ a great big "FUCK YOU"... ha ha ha..... to all those that pissed all over smutserver when this issue first came to light......

ha ha ha

Stupid fuckers. Get your heads out of your asses and realize that freehosts like smutserver are just the opposite of evil... they are excellent. Stupid fucks.

Again,..... ha ha ha. Laugh with me now. I've had pages on smutserver since they started, and have nothing but great things to say about them. My word is final. Get it?

Shut yer hole biatch!

Fletch XXX · 07-18-2002, 12:02 AM

hmmm, I killed that name awhile back, but I remember "Xrenoder" signed up for a trade shit, maybe 4 months ago? Killed it tho.

Aussie · 07-18-2002, 12:10 AM

There is Never enough free porn on the Net.

Well it keep us Kids off the street Anyhow

wsjb78 · 07-18-2002, 12:15 AM

Quote:

Originally posted by eru

Hell yea!!!

Best browser to use!

www.opera.com

Amputate Your Head · 07-18-2002, 12:16 AM

Quote:

Originally posted by wsjb78

Best browser to use!

www.opera.com

good for running multiple bots... but for anything else, it's still 2nd best.

The Hun · 07-18-2002, 12:57 AM

We are getting closer... The consoles have stopped. So I guess the hacker is reading this board or offshoreclicks cancelled his account. The spyware is still active, we found a configuration file of it which seems to be updateable...

07-18-2002, 01:08 AM

this thread is full o' luv.

Both cheaters and Amp get their share of hq man luving.

grumpy · 07-19-2002, 08:45 AM

any more news yet?

qdtobbe · 07-19-2002, 08:50 AM

Goodluck Hun!

One_post_only · 07-19-2002, 08:54 AM

Quote:

Originally posted by Gary
This wouldnt be a problem if you would stop giving away free porn!

Haha, just kidding. thats serious shit, good luck getting a fix for it. fucking bastards

I just wonder...how many folks here contribute to Hun's coffers?
I DO love his business model-
pure money thru other people' efforts
;-)

Frank W · 07-19-2002, 09:16 AM

Quote:

Originally posted by RockDaddy

Can't that be worked around with a SSI Include statement??

Yeah, this is pretty much the standard way hackers change start pages and add bookmarks. Norton's latest antivirus now have a "malicious" .js detector that locked this down. It used to be pretty bad last year.

One site that used this method [auto start page modification] is blussy.com -- some gimp ass wannabe search directory.

Frank W · 07-19-2002, 09:22 AM

Quote:

Originally posted by DrGuile
Popov, Konstantin [email protected]
Vavilova str.
47-1-27
Moscow, NA 117312
RU
722-4068

http://www.xrenoder.com/tgp/

Its not surprising that a lot of the cheat/hacks out there come from Russia. The exchange rate between USD and Rus R is big enough to make it worth Russian cheaters' time to hack paysite programs either through scummy promo tactics or maybe outright reassigning aff ref codes at the processor level. In addition to the exchange rate, Russians have a high level of technical training. Unlike "script kiddies" a higher proportion of Russian hackers actually write and research their own code.

Frankly, I'm surprised that we haven't heard more stories of card processors being duped into paying cheaters instead of the webmasters that legitimately sent the conversion.

Honeyslut · 07-19-2002, 09:39 AM

Quote:

Originally posted by Amputate Your Head
I was joking dude...

my sarcastic humor is unwanted..... I suddenly feel lonely..... som
one hold me....

Okay !
Amp's pic at ratethewebmaster is so hot that it shuts down my computer !

Wooo hoooo ! Sexy Pic !

07-17-2002, 03:56 PM	#1
The Hun Confirmed User Join Date: Jan 2001 Location: The Netherlands Posts: 1,207	There has been a hacker at work... Some guy installed spyware on people's machines through most likely exploiting security flaws in MicroSoft's Internet Explorer. This code is doing the same thing gator's programs are doing: put advertising on pages that weren't there before. Smutserver.com is one of the main targets of this hack right now... I just got off the phone with smutserver and we went in to the problem in detail. The code that was posted by Grumpy in the other thread wasn't found anywhere on any of the machines on smutserver, and it looks like it it locally generated by a piece of spyware on people's computers. I know in Grumpy's office there's a machine that is infected with this, so I'm pretty sure that by tomorrow morning we'll have a fix available... The code that is loaded is loading offshoreclicks consoles and then the original page in a frame, but pointed to with an IP-address instead of the original URL to prevent the spyware program to trigger again on the frame that is loaded. This does open possibilities to post an easy fix though. I'll be writing offshoreclicks to see if they're willing to close down these consoles. I worked with 'em before in the past and I'm pretty confident they're willing to look in to this. In the mean time I'm tracing down what sites are affected by this Russian cheater to make sure the listings of those sites are layed off for a while. As soon as a fix is available I'll post it here. This hacker has the possibility right now to ad domains to his program and pop offshoreclicks consoles on any site he whishes... So I think it's pretty important this guy is stopped. If anybody has any ideas that might be useful, please post 'em here. Remember that this is not something that is "only affecting the free Internet"... if this guy ads gofuckyourself.net to his list offshoreclicks consoles will start popping up every time you close a page here. ALL sites are in risk of being infected...

07-17-2002, 03:59 PM	#2
Gary Confirmed User Join Date: Aug 2001 Location: Kimmykims couch Posts: 6,110	This wouldnt be a problem if you would stop giving away free porn! Haha, just kidding. thats serious shit, good luck getting a fix for it. fucking bastards __________________ Up to 35$ per join...!

07-17-2002, 04:12 PM	#4
revbuddylove Confirmed User Join Date: Jun 2002 Location: In the hizouse... Posts: 402	Have you tried using adaware? If this spyware/scumware isn't wide spread they might not have it in their definitions yet, but I have had great luck with them. The URL is: http://www.lavasoftusa.com/ If anyone doesn't know: adaware is like anti virus software, but for spyware/scumware. They release updated definitions for it to keep you protected from the latest in scumware. Give it a try, um, or don't. -Rev __________________ -Rev. Buddy Love Code Monkey at Adult.com

07-17-2002, 04:20 PM	#6
jimmyf OU812 Join Date: Feb 2001 Location: California Posts: 12,651	Got any file names we could look for?? Or any thing to look for?? In the Reg. __________________ Epic CashEpic Cash works for me Solar Cash Paysite Plugin Gallery of the day freesites,POTD,Gallery generator with free hosting

07-17-2002, 04:53 PM	#16
hyper Confirmed User Join Date: Mar 2002 Location: Mass Ass Posts: 5,294	well i think offshoreclicks would have personal information on the guy, after all they pay him. So i guess the authorities should be contacted __________________

07-17-2002, 04:00 PM	#3
vegasdude Confirmed User Join Date: Jul 2001 Location: The Royal Family Crew Posts: 3,649	they killed kenny!

07-17-2002, 04:13 PM	#5
The Hun Confirmed User Join Date: Jan 2001 Location: The Netherlands Posts: 1,207	I was on a machine today that had the infection. When I saw it I thought of spyware myself, so we ran ad-aware on it. It found nothing...

07-17-2002, 04:25 PM	#7
Amputate Your Head There can be only one Industry Role: Join Date: Aug 2001 Location: Somewhere else Posts: 39,075	too much free porn!

07-17-2002, 04:26 PM	#9
The Hun Confirmed User Join Date: Jan 2001 Location: The Netherlands Posts: 1,207	AYH... please read the entire message. This hacker can easily adapt his spyware to make the same consoles pop up on your site...

07-17-2002, 04:37 PM	#11
Shoplifter Richest man in Babylon Industry Role: Join Date: Jan 2002 Location: Posts: 10,002 Posts: 5,727	Russian Cheater! Hah now that's anticlimactic.

07-17-2002, 04:48 PM	#14
Amputate Your Head There can be only one Industry Role: Join Date: Aug 2001 Location: Somewhere else Posts: 39,075	I was joking dude... my sarcastic humor is unwanted..... I suddenly feel lonely..... someone hold me....

07-17-2002, 04:49 PM	#15
The Hun Confirmed User Join Date: Jan 2001 Location: The Netherlands Posts: 1,207	This is definately something that's generated locally... there's no headers and footers or anything in that code, the code as posted in that other thread was all that showed up on the page. If this was done with javascript it would show in the source and the headers and footers of smutserver would be there... Also, if it would be something in the HTML the original URL and the URL with the IP-address should give the same result, but on an infected machine, they don't. This is really caused by spy-ware

07-17-2002, 06:03 PM	#18
pr0 rockin tha trailerpark Industry Role: Join Date: May 2001 Location: ~Coastal~ Posts: 23,088	OPERA OPERA OPERA www.opera.com __________________ __________ Loadedca$h - get sum! - Revengebucks - mmm rebills! - webair (gotz sErVrz)

07-17-2002, 06:10 PM	#19
gothweb Confirmed User Join Date: Jun 2002 Location: Back in the USSA Posts: 8,849	Funny how Mac users don't have to deal with Micro$oft exploits, huh? __________________ Photos by Ian X.: Distinctive photos of goth babes. Blood Money:Your traffic, my sites, our money. MojoHost: Still the best.

07-17-2002, 07:01 PM	#22
Amputate Your Head There can be only one Industry Role: Join Date: Aug 2001 Location: Somewhere else Posts: 39,075	I'm still feeling unloved here guys...... __________________ SIG TOO BIG

07-17-2002, 07:14 PM	#26
RockDaddy Confirmed User Join Date: Jul 2001 Posts: 750	Or something as simple as this? http://www.bignosebird.com/sdocs/nested.shtml

07-17-2002, 07:17 PM	#27
BruceM Confirmed User Industry Role: Join Date: Jul 2001 Posts: 4,084	gives Amp a six pack and some smokes __________________ SellHealth - Sell Herbal Sex Enhancers, HGH Releasers and more! Skype: brucemorrey

07-17-2002, 07:28 PM	#29
chodadog Confirmed User Join Date: Apr 2002 Posts: 9,736	*gives Amp a six pack and some smokes... and touches him Touche

07-17-2002, 07:40 PM	#30
DrGuile Confirmed User Join Date: Jan 2002 Posts: 2,025	Popov, Konstantin [email protected] Vavilova str. 47-1-27 Moscow, NA 117312 RU 722-4068 http://www.xrenoder.com/tgp/ __________________ LiveBucks / Privatefeeds - Giving you money since 1999 Up to 50% Commission! 25% Webmaster Referal Powered by Gamma

07-17-2002, 07:44 PM	#31
CDSmith Too lazy to set a custom title Industry Role: Join Date: May 2001 Location: My network is hosted at TECHIEMEDIA.net ...Wait, you meant where am I located at? Oh... okay, I'm in Winnipeg, Canada. Oops. :) Posts: 51,460	Hey... ha ha ..... I'm laughing out loud here.... ha ha ........ and I'd just like to send out a big.... ha ha ha ........ a great big "FUCK YOU"... ha ha ha..... to all those that pissed all over smutserver when this issue first came to light...... ha ha ha Stupid fuckers. Get your heads out of your asses and realize that freehosts like smutserver are just the opposite of evil... they are excellent. Stupid fucks. Again,..... ha ha ha. Laugh with me now. I've had pages on smutserver since they started, and have nothing but great things to say about them. My word is final. Get it? __________________ *Promote Wildmatch, ImLive, Sexier.com, and more!!* ALWAYS THE HIGHEST PAYOUTS: Big Bux/ImLive SIGNUP ON NOW!!! Put some PUSSYCA$H in your pocket. ICQ me at: 31024634

07-17-2002, 07:44 PM	#32
Amputate Your Head There can be only one Industry Role: Join Date: Aug 2001 Location: Somewhere else Posts: 39,075	you know I love you CD..... __________________ SIG TOO BIG

07-17-2002, 10:38 PM	#34
kmanrox aka K-Man Industry Role: Join Date: Oct 2001 Location: The Gutter Posts: 29,292	what's a Hun? i dont get it .. ;-) __________________ Crypto HODLr Crypto mining Angel investor

07-18-2002, 12:02 AM	#36
Fletch XXX GFY HALL OF FAME DAMMIT!!! Join Date: Jan 2002 Location: that 504 Posts: 60,840	hmmm, I killed that name awhile back, but I remember "Xrenoder" signed up for a trade shit, maybe 4 months ago? Killed it tho. __________________ Want an Android App for your tube, membership, or free site? Need banners or promo material? Hit us up (ICQ Fletch: 148841377) or email me fletchxxx at gmail.com - recent work - About me

07-18-2002, 12:10 AM	#37
Aussie Confirmed User Join Date: Jan 2001 Location: Earth Posts: 262	There is Never enough free porn on the Net. Well it keep us Kids off the street Anyhow

07-18-2002, 12:57 AM	#40
The Hun Confirmed User Join Date: Jan 2001 Location: The Netherlands Posts: 1,207	We are getting closer... The consoles have stopped. So I guess the hacker is reading this board or offshoreclicks cancelled his account. The spyware is still active, we found a configuration file of it which seems to be updateable...

07-18-2002, 01:08 AM	#41
X37375787 Guest Posts: n/a	this thread is full o' luv. Both cheaters and Amp get their share of hq man luving.

07-19-2002, 08:45 AM	#42
grumpy Too lazy to set a custom title Join Date: Jan 2002 Location: Holland Posts: 9,870	any more news yet? __________________ Don't let greediness blur your vision \| You gotta let some shit slide icq - 441-456-888

07-19-2002, 08:50 AM	#43
qdtobbe Confirmed User Join Date: Apr 2002 Location: Sweden Posts: 1,688	Goodluck Hun! __________________ Trade Hardlinks at Linkspun \| Domains For Sale