Richard Oliver==SCUM - GoFuckYourself.com

grumpy · 10-23-2002, 07:21 AM

Anybody knows this shithead?

the article translated by google :-)
=======================================
The Trojan knight 'Cytron' selfless , is one browser stopper - within until Resident Investigate , what by consumer ( yet more ) puppet ups with sign worn they wing sustain , thus report SecurityFocus. Internetters turn the site with the Trojan knight vow through one e - mail with egreetings@yahoocom ( one debase petition ). Yonder realm who they one e card may weigh towards Surprisecardsnet. Yonder aangekomen appears to one stopper - within necessary within are in front the look at with the ticket. The stopper - within it is Trojan knight. The ticket appears to yonder ultimate not within one's. Yet receives the unwary internetter yet well-being the one near the other pornoadvertentie voorgeschoteld. Cytron is a success through the words with one internetpagina within look at. When yonder seksgerelateerde lexicon within prevent , is being one new sekssite geopend. With that dead body Cytron the solely provided within have worn visitors with other pornosites. Solely one test with SecurityFocus wise out of who too visitors with the periodical USA Today doorgestuurd turn unpleasant one sekspagina. When they solely the 'verkeerde' section read. The proprietor with the delegate pornosites , Rich man Oliver , play down the problem. " I pitcher thus hundred various ( perpetrate ) perpetrate quote who very many vex things take then I doe "

Thumbelina · 10-23-2002, 07:35 AM

Here is the article from Securityfocus.com

E-card Sneakware Delivers Web Porn

A Trojan horse program created by an Internet adult entertainment company routes surfers to racy sites.
By Kevin Poulsen, Oct 21 2002 12:08AM

It's no coincidence that one of the most recent Trojan horse programs to enter the FBI's bi-weekly rogues gallery of malicious code is named after an Internet porn company.

The program, dubbed "Cytron" by the bureau's National Infrastructure Protection Center (NIPC)and some anti-virus vendors, is a covert browser plug-in that gives Internet Explorer users something they probably don't want: more pop-up ads, promoting a slew of adult websites.

Users are lured into accepting the program through a wholesome e-mail from [email protected] -- a forged return address. The mail looks convincingly like an electronic greeting card notification, with a cute smiley face background and the text "You have received an e-card" in squiggly block letters.

Clicking on the graphic of a cartoon hand holding an envelope takes the recipient to surprisecards.net, where the surprise is an "e-card viewer plug-in" that they have to accept to read the card. If the user accepts the ActiveX control, which is signed with a credibility-boosting digital certificate, Internet Explorer will begin selectively feeding them racy full-sized pop-up ads for adult websites, mostly operated by Canada-based Cytron Communications Ltd. They never do get a greeting card.

Small touches like the convincing domain name and the authentic digital certificate make the ruse smarter than the average covert adware delivery mechanism. "A lot of people see that it's an authentic certificate... and will just mindlessly click okay," says Jonathan Zdziarski, a Georgia software developer who was among the first to detect the spammy scam late last month after receiving one of the e-mails. "I can certainly see how your average doctor or oil change technician or anyone who's not in the technology field would fall for something like that."

The e-card porn Trojan is the latest advancement in an industry known for pushing the envelope.

"There some perfectly legitimate Internet porn operators, but it is a ruthlessly competitive industry that's constantly looking for new ways to get the click," says Jason Catlett, president of the anti-spam company Junkbusters. "They've always been at the leading edge of tactics, legitimate and illegitimate, for getting more traffic."

Key Phrase Matching
The Cytron program works by scanning the Web sites the victim views for key phrases like "hot sex" or "hard core," then serving up ads based on the matches. The technique seems designed to target only people in the market for porn, luring them away from Cytron competitors while catering to the user's particular sexual inclinations.

But the covert phrase-matching software suffers from the same problem as keyword-based filtering programs: it's easily triggered by destinations that don't necessarily indicate a taste for adult content. In tests by SecurityFocus, browsing a USA Today story about the constitutionality of Internet porn spawned a window promoting the gay men's adult site "Tyler's Room," complete with thumbnail teaser photos of well-endowed models. Surfing to a Christian website selling the video "Porn: the Tragedy Exposed" exposed the front page of another Cytron site offering "The nets [sic] youngest women online," with a topless photo of one of them.

Though Cytron is based in British Columbia, by luring U.S. netizens into installing the covert adware under false pretenses, the company may run afoul of U.S. computer crime laws and regulations prohibiting deceptive trade practices, says Catlett. "It's very ingenious... But if they're fooling people into downloading software, that's still going to be illegal under the Computer Fraud and Abuse act."

The surprisecards.net site is served from a San Diego hosting company unrelated to Cytron, but the domain name is registered to Cytron president and CEO Richard Oliver.

Reached by telephone Friday, Oliver didn't deny pulling the e-card scam. But Oliver says it's a jungle out there, pointing to the spyware and adware routinely bundled with popular file-swapping applications, without the average user knowing it.

"I can name you about a hundred different companies, publicly traded companies, that are doing far worse than I am," said Oliver. "You've never heard of Kazaa, you've never heard of Morpheus, nobody's ever heard of any of these file-sharing companies that put all kinds of software on your computer?... Well, now you've heard of us."

cherrylula · 10-23-2002, 09:37 AM

Yes I just got rid of this fucking virus...there have been some other threads about it also. (ill go find them i suppose)

I got it by visiting a Cybersexent site.

I had to delete a bunch of shit in my registry, which kept showing up again. I think I finally rid myself of it last night,

fucking criminals

Dammit to fuck. I am still getting these FUCKING popups for Cybersexent sites.

Seriously this is not cool.

Here are more threads about this shit:

http://gofuckyourself.com/showthrea...ighlight=cytron
http://gofuckyourself.com/showthread...48#post1000448

[Labret] · 10-23-2002, 09:57 AM

Damn, I use Cytron for video feeds.

Fletch XXX · 10-23-2002, 10:21 AM

Quote:

Originally posted by [Labret]
Damn, I use Cytron for video feeds.

Looks like tyhe people who install the videoware get the virus?

Bizump this shit needs to be heard.

cherrylula · 10-23-2002, 10:24 AM

And I thought I fixed my problem. I am STILL getting these fucking cybersexent pop ups again as of five minutes ago. What the fuck.

mother fucks.

pimplink · 10-23-2002, 10:27 AM

That's hilarious. For every ingenious method exposed by the feds, I'm sure there's HUNDREDS out there. Some are perfectly legit and completely viral [pushed by users themselves willingly]. You'd just have to be a stupid newb or an ego whore to blab about new techniques you've discovered.

421Fill · 10-23-2002, 10:28 AM

damn that sucks.

now I'll never surf any of his sites... looks like his intent will be rversed when everyone gets scared of surfing like me.

cherrylula · 10-23-2002, 10:32 AM

gee maybe I should list all their fucking sites that keep popping so people can make sure to NOT visit them.

421Fill · 10-23-2002, 10:36 AM

Quote:

Originally posted by cherrylula
gee maybe I should list all their fucking sites that keep popping so people can make sure to NOT visit them.

I for one would appreciate it.

just don't put the http://www part so people don't click it impulsively.

pr0 · 10-23-2002, 10:39 AM

HS-Trixxxia · 10-23-2002, 10:44 AM

I also get a virus from ultravideos.com one of the topbucks sites.
which shows up with the nocreditcard.com pop-up.
the virus is JS/Seeker.gen.e virus.

BTW, grumpy I love the new look of sexplorer.com - GREAT work!

cherrylula · 10-23-2002, 10:52 AM

well I was infected when I visited trixiecam.com

And it has nothing to do with Trixie for the record. And out of respect for her I will not go into details. But its not her fault.

Fletch XXX · 10-23-2002, 10:55 AM

Quote:

Originally posted by cherrylula
well I was infected when I visited trixiecam.com

And it has nothing to do with Trixie for the record. And out of respect for her I will not go into details. But its not her fault.

Because her viewers are getting it installed.

That is their target.

Quote:

Originally posted by Fletch XXX

Looks like the people who install the videoware get the virus?

Imagine the guys theyare catching with that shit.

All the viewers and even folks who use their ware? Is this what I am getting?

daaaamn.

cherrylula · 10-23-2002, 11:15 AM

motherfucking porn virus.

another window pops:

themensnetwork.com

I guess until I can rid myself of this virus, I will have to post about every single fucking pop up I get until I get it fixed.

Oh well.

I am getting tired of cracking my registry and deleting shit. Nothing will detect or rid this shit on my pc. Its a seriously malicious virus.

cherrylula · 10-23-2002, 11:25 AM

ya know, fuck this. I refuse to post their shitty sites here.

Fletch XXX · 10-23-2002, 01:24 PM

fucking assholes.

Fletch XXX · 10-23-2002, 01:28 PM

http://www.cnn.com/2002/TECH/interne....ap/index.html

these are fun hehehe

http://gofuckyourself.com/showthread...threadid=84332

JustACamGirl · 10-23-2002, 02:08 PM

http://online.securityfocus.com/archive/75/293472

garmann · 10-23-2002, 03:25 PM

registry keys to delete:

-------------------------------------------------------------------

HKEY_LOCAL_MACHINE\software\Microsoft\Windows\curr ent versión\explorer\browser helper objects\{3750BFA3-1392-4AF3-AF86-9D2D4776E5A4}

(I deleted the whole numbered folder on the left side of the registry window)

------------------------------------------------------------------

HKEY_LOCAL_MACHINE\software\POTD\POTD Helper\CS

(I deleted just the CS fólder)

------------------------------------------------------------------

HKEY_CURRENT_USER\software\potd\potd helper

(I deleted the whole potd helper folder in this part)

--------------------------------------------------------------------

hkey_local_machine\software\microsoft\code store database\distribution units\{3750BFA3-1392-4AF3-AF86-9D2D4776E5A4}

(delete the whole numbered folder on the left side of the window)

-------------------------------------------------------------------

HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Explorer Bars\{C4EE31F3-4768-11D2-BE5C-00A0C9A83DA1}\FilesNamedMRU

(Inside the "FilesNamedMRU" folder you'll see several keys to delete including but not limited to "cytron" "Cybersex" "Cybersexent" "Cyber" "cnry" "eacdownload" you should be able to tell which ones on the right window need to be deleted)

__________________________________________________ _________

I think that's it so far....just so you know i haven't had a pop-up since mid yesterday....so all is good so far.

drunkdollars · 10-23-2002, 07:29 PM

Can some one please tell me what feeds cytron run?
I want to make sure I dont have them in our members section?

[Labret] · 10-23-2002, 07:30 PM

Quote:

Originally posted by drunkdollars
Can some one please tell me what feeds cytron run?
I want to make sure I dont have them in our members section?

http://www.cybersexent.com/frameset.cfm

Thats them.

Fletch XXX · 10-24-2002, 04:34 PM

Now they are popping "EXPLOITED LOLITAS" processed by DutchBill.

Fucking assholes.

I hope they burn.

10-23-2002, 07:21 AM	#1
grumpy Too lazy to set a custom title Join Date: Jan 2002 Location: Holland Posts: 9,870	Richard Oliver==SCUM Anybody knows this shithead? the article translated by google :-) ======================================= The Trojan knight 'Cytron' selfless , is one browser stopper - within until Resident Investigate , what by consumer ( yet more ) puppet ups with sign worn they wing sustain , thus report SecurityFocus. Internetters turn the site with the Trojan knight vow through one e - mail with egreetings@yahoocom ( one debase petition ). Yonder realm who they one e card may weigh towards Surprisecardsnet. Yonder aangekomen appears to one stopper - within necessary within are in front the look at with the ticket. The stopper - within it is Trojan knight. The ticket appears to yonder ultimate not within one's. Yet receives the unwary internetter yet well-being the one near the other pornoadvertentie voorgeschoteld. Cytron is a success through the words with one internetpagina within look at. When yonder seksgerelateerde lexicon within prevent , is being one new sekssite geopend. With that dead body Cytron the solely provided within have worn visitors with other pornosites. Solely one test with SecurityFocus wise out of who too visitors with the periodical USA Today doorgestuurd turn unpleasant one sekspagina. When they solely the 'verkeerde' section read. The proprietor with the delegate pornosites , Rich man Oliver , play down the problem. " I pitcher thus hundred various ( perpetrate ) perpetrate quote who very many vex things take then I doe " __________________ Don't let greediness blur your vision \| You gotta let some shit slide icq - 441-456-888 Last edited by grumpy; 10-23-2002 at 07:26 AM..

10-23-2002, 07:35 AM	#2
Thumbelina Confirmed User Join Date: Jan 2002 Location: Canada Posts: 675	Here is the article from Securityfocus.com E-card Sneakware Delivers Web Porn A Trojan horse program created by an Internet adult entertainment company routes surfers to racy sites. By Kevin Poulsen, Oct 21 2002 12:08AM It's no coincidence that one of the most recent Trojan horse programs to enter the FBI's bi-weekly rogues gallery of malicious code is named after an Internet porn company. The program, dubbed "Cytron" by the bureau's National Infrastructure Protection Center (NIPC)and some anti-virus vendors, is a covert browser plug-in that gives Internet Explorer users something they probably don't want: more pop-up ads, promoting a slew of adult websites. Users are lured into accepting the program through a wholesome e-mail from [email protected] -- a forged return address. The mail looks convincingly like an electronic greeting card notification, with a cute smiley face background and the text "You have received an e-card" in squiggly block letters. Clicking on the graphic of a cartoon hand holding an envelope takes the recipient to surprisecards.net, where the surprise is an "e-card viewer plug-in" that they have to accept to read the card. If the user accepts the ActiveX control, which is signed with a credibility-boosting digital certificate, Internet Explorer will begin selectively feeding them racy full-sized pop-up ads for adult websites, mostly operated by Canada-based Cytron Communications Ltd. They never do get a greeting card. Small touches like the convincing domain name and the authentic digital certificate make the ruse smarter than the average covert adware delivery mechanism. "A lot of people see that it's an authentic certificate... and will just mindlessly click okay," says Jonathan Zdziarski, a Georgia software developer who was among the first to detect the spammy scam late last month after receiving one of the e-mails. "I can certainly see how your average doctor or oil change technician or anyone who's not in the technology field would fall for something like that." The e-card porn Trojan is the latest advancement in an industry known for pushing the envelope. "There some perfectly legitimate Internet porn operators, but it is a ruthlessly competitive industry that's constantly looking for new ways to get the click," says Jason Catlett, president of the anti-spam company Junkbusters. "They've always been at the leading edge of tactics, legitimate and illegitimate, for getting more traffic." Key Phrase Matching The Cytron program works by scanning the Web sites the victim views for key phrases like "hot sex" or "hard core," then serving up ads based on the matches. The technique seems designed to target only people in the market for porn, luring them away from Cytron competitors while catering to the user's particular sexual inclinations. But the covert phrase-matching software suffers from the same problem as keyword-based filtering programs: it's easily triggered by destinations that don't necessarily indicate a taste for adult content. In tests by SecurityFocus, browsing a USA Today story about the constitutionality of Internet porn spawned a window promoting the gay men's adult site "Tyler's Room," complete with thumbnail teaser photos of well-endowed models. Surfing to a Christian website selling the video "Porn: the Tragedy Exposed" exposed the front page of another Cytron site offering "The nets [sic] youngest women online," with a topless photo of one of them. Though Cytron is based in British Columbia, by luring U.S. netizens into installing the covert adware under false pretenses, the company may run afoul of U.S. computer crime laws and regulations prohibiting deceptive trade practices, says Catlett. "It's very ingenious... But if they're fooling people into downloading software, that's still going to be illegal under the Computer Fraud and Abuse act." The surprisecards.net site is served from a San Diego hosting company unrelated to Cytron, but the domain name is registered to Cytron president and CEO Richard Oliver. Reached by telephone Friday, Oliver didn't deny pulling the e-card scam. But Oliver says it's a jungle out there, pointing to the spyware and adware routinely bundled with popular file-swapping applications, without the average user knowing it. "I can name you about a hundred different companies, publicly traded companies, that are doing far worse than I am," said Oliver. "You've never heard of Kazaa, you've never heard of Morpheus, nobody's ever heard of any of these file-sharing companies that put all kinds of software on your computer?... Well, now you've heard of us." __________________ <a href="http://www.bimbolinks.com"><img src="http://www.12circle.com/banners/bimbo_120x60.jpg"border="0"></a><BR>

10-23-2002, 09:37 AM	#3
cherrylula lol Industry Role: Join Date: Jan 2002 Posts: 15,969	Yes I just got rid of this fucking virus...there have been some other threads about it also. (ill go find them i suppose) I got it by visiting a Cybersexent site. I had to delete a bunch of shit in my registry, which kept showing up again. I think I finally rid myself of it last night, fucking criminals Dammit to fuck. I am still getting these FUCKING popups for Cybersexent sites. Seriously this is not cool. Here are more threads about this shit: http://gofuckyourself.com/showthrea...ighlight=cytron http://gofuckyourself.com/showthread...48#post1000448 Last edited by cherrylula; 10-23-2002 at 09:56 AM..

10-23-2002, 10:27 AM	#7
pimplink Confirmed User Join Date: Jun 2001 Location: Closer than you think Posts: 9,535	That's hilarious. For every ingenious method exposed by the feds, I'm sure there's HUNDREDS out there. Some are perfectly legit and completely viral [pushed by users themselves willingly]. You'd just have to be a stupid newb or an ego whore to blab about new techniques you've discovered. __________________ Need Mainstream Content and SEO? SEO * Website Copy * Blogs Blogging - PR Work - Forum Marketing - Social Marketing - Link building - Articles 100% Guaranteed Content!

10-23-2002, 10:28 AM	#8
421Fill Super Mario Industry Role: Join Date: Nov 2001 Location: Swenson's Avatar Posts: 19,464	damn that sucks. now I'll never surf any of his sites... looks like his intent will be rversed when everyone gets scared of surfing like me. __________________ RELEASE THE EPSTEIN FILES!!!

10-23-2002, 09:57 AM	#4
[Labret] Registered User Industry Role: Join Date: May 2001 Location: Са́нкт-Петербу́рг Posts: 10,945	Damn, I use Cytron for video feeds.

10-23-2002, 10:24 AM	#6
cherrylula lol Industry Role: Join Date: Jan 2002 Posts: 15,969	And I thought I fixed my problem. I am STILL getting these fucking cybersexent pop ups again as of five minutes ago. What the fuck. mother fucks.

10-23-2002, 10:32 AM	#9
cherrylula lol Industry Role: Join Date: Jan 2002 Posts: 15,969	gee maybe I should list all their fucking sites that keep popping so people can make sure to NOT visit them.

10-23-2002, 10:39 AM	#11
pr0 rockin tha trailerpark Industry Role: Join Date: May 2001 Location: ~Coastal~ Posts: 23,088

10-23-2002, 10:44 AM	#12
HS-Trixxxia Confirmed User Join Date: Mar 2002 Location: Montreal Canada Posts: 2,946	I also get a virus from ultravideos.com one of the topbucks sites. which shows up with the nocreditcard.com pop-up. the virus is JS/Seeker.gen.e virus. BTW, grumpy I love the new look of sexplorer.com - GREAT work!

10-23-2002, 10:52 AM	#13
cherrylula lol Industry Role: Join Date: Jan 2002 Posts: 15,969	well I was infected when I visited trixiecam.com And it has nothing to do with Trixie for the record. And out of respect for her I will not go into details. But its not her fault.

10-23-2002, 11:15 AM	#15
cherrylula lol Industry Role: Join Date: Jan 2002 Posts: 15,969	motherfucking porn virus. another window pops: themensnetwork.com I guess until I can rid myself of this virus, I will have to post about every single fucking pop up I get until I get it fixed. Oh well. I am getting tired of cracking my registry and deleting shit. Nothing will detect or rid this shit on my pc. Its a seriously malicious virus.

10-23-2002, 11:25 AM	#16
cherrylula lol Industry Role: Join Date: Jan 2002 Posts: 15,969	ya know, fuck this. I refuse to post their shitty sites here. Last edited by cherrylula; 10-23-2002 at 11:27 AM..

10-23-2002, 01:24 PM	#17
Fletch XXX GFY HALL OF FAME DAMMIT!!! Join Date: Jan 2002 Location: that 504 Posts: 60,840	fucking assholes. __________________ Want an Android App for your tube, membership, or free site? Need banners or promo material? Hit us up (ICQ Fletch: 148841377) or email me fletchxxx at gmail.com - recent work - About me

10-23-2002, 01:28 PM	#18
Fletch XXX GFY HALL OF FAME DAMMIT!!! Join Date: Jan 2002 Location: that 504 Posts: 60,840	http://www.cnn.com/2002/TECH/interne....ap/index.html these are fun hehehe http://gofuckyourself.com/showthread...threadid=84332 __________________ Want an Android App for your tube, membership, or free site? Need banners or promo material? Hit us up (ICQ Fletch: 148841377) or email me fletchxxx at gmail.com - recent work - About me

10-23-2002, 02:08 PM	#19
JustACamGirl Registered User Join Date: Oct 2002 Posts: 5	http://online.securityfocus.com/archive/75/293472

10-23-2002, 03:25 PM	#20
garmann Registered User Join Date: Oct 2002 Location: SeARTtle Posts: 4	registry keys to delete: ------------------------------------------------------------------- HKEY_LOCAL_MACHINE\software\Microsoft\Windows\curr ent versión\explorer\browser helper objects\{3750BFA3-1392-4AF3-AF86-9D2D4776E5A4} (I deleted the whole numbered folder on the left side of the registry window) ------------------------------------------------------------------ HKEY_LOCAL_MACHINE\software\POTD\POTD Helper\CS (I deleted just the CS fólder) ------------------------------------------------------------------ HKEY_CURRENT_USER\software\potd\potd helper (I deleted the whole potd helper folder in this part) -------------------------------------------------------------------- hkey_local_machine\software\microsoft\code store database\distribution units\{3750BFA3-1392-4AF3-AF86-9D2D4776E5A4} (delete the whole numbered folder on the left side of the window) ------------------------------------------------------------------- HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Explorer Bars\{C4EE31F3-4768-11D2-BE5C-00A0C9A83DA1}\FilesNamedMRU (Inside the "FilesNamedMRU" folder you'll see several keys to delete including but not limited to "cytron" "Cybersex" "Cybersexent" "Cyber" "cnry" "eacdownload" you should be able to tell which ones on the right window need to be deleted) __________________________________________________ _________ I think that's it so far....just so you know i haven't had a pop-up since mid yesterday....so all is good so far.

10-23-2002, 07:29 PM	#21
drunkdollars Confirmed User Join Date: Apr 2002 Location: Club Drunk Posts: 2,734	Can some one please tell me what feeds cytron run? I want to make sure I dont have them in our members section? __________________ SIGS ARE GAY 98055668 icq

10-24-2002, 04:34 PM	#23
Fletch XXX GFY HALL OF FAME DAMMIT!!! Join Date: Jan 2002 Location: that 504 Posts: 60,840	Now they are popping "EXPLOITED LOLITAS" processed by DutchBill. Fucking assholes. I hope they burn. __________________ Want an Android App for your tube, membership, or free site? Need banners or promo material? Hit us up (ICQ Fletch: 148841377) or email me fletchxxx at gmail.com - recent work - About me