Mouseover/URL spoofing triggers virus scanners - GoFuckYourself.com

The Hun · 01-03-2004, 03:23 AM

Lately I've been getting a lot of reports about Trojan virusses, mostly stuff like URL.Spoof Exploits and such. I couldn't find anything on these machines though. I found what it was...

Somehow McAffee detects the following notation of a URL as a URL Spoof Exploit: http://www.sapphicerotica.comhahahah...0000&PA=445213 (if this somehow doesn't make sense, check the notation of the banners on http://www.xfreehosting.com/hardcore...0456/sss34.htm)

It's the '@' between the first part of the URL and the read URL. The first part is made to look like a full URL, but it's send as a password. Somehow McAffee things this is spyware. I'm going to adjust my bot not to accept this anymore since I'm getting a lot of reports. If you want to hide the 'real' URL it might be a better idea to use a mouseover or something...

Oh, and of course, happy new year! ;-)

klik · 01-03-2004, 03:24 AM

Quote:

Originally posted by The Hun

Oh, and of course, happy new year! ;-)

happy new year hun!

thanks for the heads up

SoundMan · 01-03-2004, 03:25 AM

seen many spoofs here..

http · 01-03-2004, 03:25 AM

Happy new year

Atahualpa

$5 submissions · 01-03-2004, 03:25 AM

Thanks for the heads up, Hun! Happy New Year!

Libertine · 01-03-2004, 03:26 AM

So you have nothing against on mouseovers being used in galleries you list?

The Hun · 01-03-2004, 03:29 AM

Why should I have something against a mouseover? As long as it's nothing to trick people in there (using a mouseover for a different domain, for instance, making it look as if people go to playboy.com) and there's no Javasc... included (Javasc... Over:window.location=''') I don't have a problem with it. Oh, for those thinking the javasc... thing is a good idea, my bot already takes care of these redirects ;-)

(very annoying that GFY replaces javasc with hahahahaha)

SoundMan · 01-03-2004, 03:50 AM

Quote:

Originally posted by The Hun
Why should I have something against a mouseover? As long as it's nothing to trick people in there (using a mouseover for a different domain, for instance, making it look as if people go to playboy.com) and there's no Javasc... included (Javasc... Over:window.location=''') I don't have a problem with it. Oh, for those thinking the javasc... thing is a good idea, my bot already takes care of these redirects ;-)

(very annoying that GFY replaces javasc with hahahahaha)

I think what he meant was 98% of tgps have a rule that SAYS no mouseovers and most live by that rule..

also some scripts wont let you submit with mouseover code.
I have not done any submiting for some time, but I am sure that is what it is...one bans it they all do.. type of rule..

$5 submissions · 01-03-2004, 03:54 AM

Quote:

Originally posted by SoundMan

I think what he meant was 98% of tgps have a rule that SAYS no mouseovers and most live by that rule..

also some scripts wont let you submit with mouseover code.
I have not done any submiting for some time, but I am sure that is what it is...one bans it they all do.. type of rule..

Exactly. One of my requirements for hand submit clients is ABSOLUTELY NO j a v a s c r i p t. Makes life much simpler.

Ron2k1 · 01-03-2004, 05:27 AM

Quote:

Originally posted by SoundMan

I think what he meant was 98% of tgps have a rule that SAYS no mouseovers and most live by that rule..

also some scripts wont let you submit with mouseover code.
I have not done any submiting for some time, but I am sure that is what it is...one bans it they all do.. type of rule..

98%? Not even close to that. I used mousover pretty much last year and only very few did not accept it like pichunter.com for example

Head · 01-03-2004, 06:08 AM

Thanx, we'll keep that in mind.
Happy New Year!

Vitasoy · 01-03-2004, 07:58 PM

Happy New Year, The Hun!

xanx · 01-03-2004, 08:00 PM

people still use mcafee

01-03-2004, 03:23 AM	#1
The Hun Confirmed User Join Date: Jan 2001 Location: The Netherlands Posts: 1,207	Mouseover/URL spoofing triggers virus scanners Lately I've been getting a lot of reports about Trojan virusses, mostly stuff like URL.Spoof Exploits and such. I couldn't find anything on these machines though. I found what it was... Somehow McAffee detects the following notation of a URL as a URL Spoof Exploit: http://www.sapphicerotica.comhahahah...0000&PA=445213 (if this somehow doesn't make sense, check the notation of the banners on http://www.xfreehosting.com/hardcore...0456/sss34.htm) It's the '@' between the first part of the URL and the read URL. The first part is made to look like a full URL, but it's send as a password. Somehow McAffee things this is spyware. I'm going to adjust my bot not to accept this anymore since I'm getting a lot of reports. If you want to hide the 'real' URL it might be a better idea to use a mouseover or something... Oh, and of course, happy new year! ;-)

01-03-2004, 03:25 AM	#5
$5 submissions I help you SUCCEED Industry Role: Join Date: Nov 2003 Location: The Pearl of the Orient Seas Posts: 32,195	Thanks for the heads up, Hun! Happy New Year! __________________ Need a NON-ADULT income stream? We build your YOUTUBE CHANNEL for only $20 per video! For Hire: $3/hour or $400 per month Marketing Specialist Virtual Assistants

01-03-2004, 03:26 AM	#6
Libertine sex dwarf Join Date: May 2002 Posts: 17,860	So you have nothing against on mouseovers being used in galleries you list? __________________ /(bb\|[^b]{2})/

01-03-2004, 03:29 AM	#7
The Hun Confirmed User Join Date: Jan 2001 Location: The Netherlands Posts: 1,207	Why should I have something against a mouseover? As long as it's nothing to trick people in there (using a mouseover for a different domain, for instance, making it look as if people go to playboy.com) and there's no Javasc... included (Javasc... Over:window.location=''') I don't have a problem with it. Oh, for those thinking the javasc... thing is a good idea, my bot already takes care of these redirects ;-) (very annoying that GFY replaces javasc with hahahahaha) Last edited by The Hun; 01-03-2004 at 03:40 AM..

01-03-2004, 06:08 AM	#11
Head Confirmed User Join Date: Nov 2003 Location: Starship Enterprise Posts: 8,278	Thanx, we'll keep that in mind. Happy New Year! __________________

01-03-2004, 03:25 AM	#3
SoundMan So Fucking Banned Join Date: Nov 2003 Location: MidWest Posts: 3,471	seen many spoofs here..

01-03-2004, 03:25 AM	#4
http Confirmed User Join Date: Oct 2001 Posts: 1,811	Happy new year Atahualpa

01-03-2004, 07:58 PM	#12
Vitasoy GFY HALL OF FAME DAMMIT!!! Join Date: Oct 2003 Posts: 58,202	Happy New Year, The Hun! __________________ [email protected]

01-03-2004, 08:00 PM	#13
xanx Confirmed User Join Date: Apr 2002 Location: Orlando, FL Posts: 3,711	people still use mcafee