Is this installing trojans? - GoFuckYourself.com

Dood · 03-14-2007, 10:30 AM

Found this in the head of a site but nothing else on the page looks suspicious.

Wonder what it's for?

Code:

<script language="javascript" src="BKDR_DARKFTP.exe.js"></script>
<link rel="stylesheet" type="text/css" href="Troj_Garlic.0.exe.css" />

Quickdraw · 03-14-2007, 10:35 AM

Doesn't look promising.

http://www.pestpatrol.com/spywarecen...t.aspx?id=1495
http://www.trendmicro.com/vinfo/viru...=TROJ_GARLIC.B

Vick! · 03-14-2007, 12:57 PM

Can not be said anything unless we could see the content of BKDR_DARKFTP.exe.js

Name seems suspicious though, but I think its OK, the coder seems to have habit of such naming. Look at the name of style sheet.

Gaybucks · 03-14-2007, 04:58 PM

Looks like it's malware.

http://origin.trendmicro.com/vinfo/v...FTP.16&VSect=T

StarkReality · 03-14-2007, 05:05 PM

My guess: It's just a normal script that doesn't do any harm and the coder named it like a trojan. It's too obvious for a real trojan, this guy probably thinks this way noone wants to steal his JS...

Dood · 03-14-2007, 11:23 PM

Yeah I asked the guy and he said he named it that to keep anyone from stealing his code.

I guess it would be dumb to so obviously use those names if you're really trying to install trojans or something malicous. That would be like a lawyer naming his office "We'll screw you over" or an affiliate program saying "We only skim a small percentage of your sales".

03-14-2007, 10:30 AM	#1
Dood Confirmed User Join Date: Dec 2003 Location: MidSouth US Posts: 353	Is this installing trojans? Found this in the head of a site but nothing else on the page looks suspicious. Wonder what it's for? Code: <script language="javascript" src="BKDR_DARKFTP.exe.js"></script> <link rel="stylesheet" type="text/css" href="Troj_Garlic.0.exe.css" /> __________________ Traffic-Out We sell quality text link clicked traffic

03-14-2007, 12:57 PM	#3
Vick! Confirmed User Industry Role: Join Date: Nov 2005 Location: 20 00'24.00" N, 75 09'00.00 W Posts: 6,882	Can not be said anything unless we could see the content of BKDR_DARKFTP.exe.js Name seems suspicious though, but I think its OK, the coder seems to have habit of such naming. Look at the name of style sheet. __________________ Affordable Quality Web Hosting

03-14-2007, 04:58 PM	#4
Gaybucks Confirmed User Join Date: May 2004 Location: Sacramento, CA Posts: 451	Looks like it's malware. http://origin.trendmicro.com/vinfo/v...FTP.16&VSect=T __________________ Gaybucks.com 100% exclusive American guys - hosted movie galleries - NATS - Boyfunk.com - Boysfeetclub.com - AJsCloset.com- SkylerDeVoss.com ICQ 272-995-402

03-14-2007, 11:23 PM	#6
Dood Confirmed User Join Date: Dec 2003 Location: MidSouth US Posts: 353	Yeah I asked the guy and he said he named it that to keep anyone from stealing his code. I guess it would be dumb to so obviously use those names if you're really trying to install trojans or something malicous. That would be like a lawyer naming his office "We'll screw you over" or an affiliate program saying "We only skim a small percentage of your sales". __________________ Traffic-Out We sell quality text link clicked traffic

03-14-2007, 10:35 AM	#2
Quickdraw Confirmed User Join Date: Mar 2004 Location: → → → Posts: 1,717	Doesn't look promising. http://www.pestpatrol.com/spywarecen...t.aspx?id=1495 http://www.trendmicro.com/vinfo/viru...=TROJ_GARLIC.B

03-14-2007, 05:05 PM	#5
StarkReality Confirmed User Join Date: May 2004 Location: 4 8 15 16 23 42 Posts: 4,444	My guess: It's just a normal script that doesn't do any harm and the coder named it like a trojan. It's too obvious for a real trojan, this guy probably thinks this way noone wants to steal his JS...