|
|
|
|
||||
|
Welcome to the GoFuckYourself.com - Adult Webmaster Forum forums. You are currently viewing our boards as a guest which gives you limited access to view most discussions and access our other features. By joining our free community you will have access to post topics, communicate privately with other members (PM), respond to polls, upload content and access many other special features. Registration is fast, simple and absolutely free so please, join our community today! If you have any problems with the registration process or your account login, please contact us. |
 |
|
|||||||
| Discuss what's fucking going on, and which programs are best and worst. One-time "program" announcements from "established" webmasters are allowed. |
|
|
Thread Tools |
07-02-2007, 07:54 PM
|
#1 |
|
Too lazy to set a custom title
Industry Role:
Join Date: May 2004
Location: West Coast, Canada.
Posts: 10,217
|
WARNING.. JoviCash/InstantAdultCash chubbyschool.com installs keylogger!!
I haven't checked all of the sites for that program so don't know if it's on more sites.. Given the program(s) seemed to have been abondoned I'm just going to remove all links and FHGs.
I was contacted today by one of my trades about this. There's javascript at the bottom of that site (probably all pages). Apparently it installs a keylogger on your system and then they use that to grab credit card info, FTP login etc. so they can compromise your sites etc. as well with the same code. Apparently this thing is ONLY detected and cleaned using "Kaspersky AntiVirus in full paranoid mode" The virus is called Trojan-Downloader.JS.Psyme. I'm still looking at the javscript so will post a little more info when I have it. |
|
|
|
07-02-2007, 08:10 PM
|
#2 |
|
Too lazy to set a custom title
Industry Role:
Join Date: May 2004
Location: West Coast, Canada.
Posts: 10,217
|
The encoded javascript inserts an iframe with a src to something on the domain dramcnt.com. It looks like the domain has been suspended so it might be "defunct" at this point. The email address on the whois info was honnodo @ yandex.ru
|
|
|
|
|
07-02-2007, 08:12 PM
|
#3 |
|
Too lazy to set a custom title
Industry Role:
Join Date: Jan 2001
Location: God's right hand
Posts: 19,789
|
burn enough bridges and you end up using questionable programs.
Let this be a lesson to the rest of you.
__________________
I'm not a dinosaur, I'm a crocodile. I've seen dinosaurs come and go and I'm left unimpressed.
|
|
|
|
|
07-02-2007, 08:14 PM
|
#4 | |
|
Too lazy to set a custom title
Industry Role:
Join Date: May 2004
Location: West Coast, Canada.
Posts: 10,217
|
Quote:
|
|
|
|
|
|
07-02-2007, 09:13 PM
|
#5 |
|
Too lazy to set a custom title
Industry Role:
Join Date: Dec 2004
Location: Happy in the dark.
Posts: 93,648
|
: / ... Not Jovicash!
__________________
Vacares - Web Hosting, Domains, O365, Security & More - Paxum and BTC Accepted Windows VPS now available Great for TSS, Nifty Stats, remote work, virtual assistants, etc. |
|
|
|
07-02-2007, 09:17 PM
|
#6 |
|
So Fucking Banned
Industry Role:
Join Date: Apr 2001
Location: the beach, SoCal
Posts: 107,089
|
tsk tsk tsk
|
|
|
|
