GFY Installing Malware - Post If You've Got Hit

**Tom_PM** · 05-11-2010, 07:32 AM

IE (6.0 believe it or not) warned me that it'd blocked a download this morning and I saw Java started running. This was on the log-in page itself, pre-password.

I closed everything and retried and it didnt attempt it the second time.

**candyflip** · 05-11-2010, 07:33 AM

I just had another attempt.

**David!** · 05-11-2010, 07:33 AM

On Windows 7 and Firefox, it launches Adobe Acrobat Reader and give some kind of 3D error?

**candyflip** · 05-11-2010, 07:34 AM

Yep...definitely has something to do with Adobe, PDF and Reader.

**seeandsee** · 05-11-2010, 07:42 AM

fucking exploits

**sextoyking** · 05-11-2010, 07:42 AM

Originally posted by MCO_David

On Windows 7 and Firefox, it launches Adobe Acrobat Reader and give some kind of 3D error?

On Winxp pro and FF, same error.....

**jerryb** · 05-11-2010, 07:44 AM

Norton caught it as a Trojan for me. Thank you Norton. :-))

**Jim_Gunn** · 05-11-2010, 07:48 AM

I just opened up GoFuckYourself.com in FF on my Win XP Laptop and immediately got infected by one of those fake anti virus apps telling me I am infected. It would not even let me ctrl-alt-delete to open up the task manager. I did a hard reboot and opened up the task manager and keep it open before the exploit was able to launch. I am trying to use Malwarebytes to fix now and posting from my cell phone.

**Amputate Your Head** · 05-11-2010, 07:49 AM

No trouble here on the Macs.

**candyflip** · 05-11-2010, 07:51 AM

Originally posted by Amputate Your Head

No trouble here on the Macs.

Yep...No issues on any of the Mac boxes. Just a Windows issue as usual.

**bloggerz** · 05-11-2010, 07:51 AM

yup got it and removed it

**Raf1** · 05-11-2010, 07:55 AM

no trouble here yet

**Va2k** · 05-11-2010, 07:57 AM

Originally posted by MCO_David

On Windows 7 and Firefox, it launches Adobe Acrobat Reader and give some kind of 3D error?

Same here on win xp 64

**Barefootsies** · 05-11-2010, 07:58 AM

Originally posted by Jim_Gunn

I did a hard reboot and opened up the task manager and keep it open before the exploit was able to launch. I am trying to use Malwarebytes to fix now and posting from my cell phone.

Yep. Same here.

It was a dead give away when JAVA/Adobe both launched. It's not the first time this has happened from GFY with this trojan. However, Malwarebytes typically will handle it. Had it handy from the last time.

Still, annoying all the same.

**Fabien** · 05-11-2010, 07:58 AM

See this also guys

http://gofuckyourself.com/showthread.php?t=967903

**kristin** · 05-11-2010, 08:00 AM

Glad I'm on my Mac. =)

**LickMyBalls** · 05-11-2010, 08:04 AM

atwleoqtssd.exe detected by SONAR
atwleoqtssd.exe accessed your network resources
whlu.exe detected by SONAR
whlu.exe modified your System Configuration

**candyflip** · 05-11-2010, 08:06 AM

Originally posted by kristin

Glad I'm on my Mac. =)

No shit, right? I've spent about 2 hours booted into Windows this week and 1/2 of it was spent trying to remove this shit.

**Yngwie** · 05-11-2010, 08:10 AM

No problems here on either FF or IE and Windows 7

**CPimp** · 05-11-2010, 08:10 AM

Adobe Flash crashed for me just now... there was a strange white box up by the mojohost banner.

Not saying anything at all, just posting my observations. Maybe it's getting installed that way by chance?

**FilthyRob** · 05-11-2010, 08:10 AM

I got hit, but I think I stopped it from exploiting. Explorer 6.0, I am old school I guess..lol

**Klen** · 05-11-2010, 08:13 AM

This doesn't happen to me,but again i have adblock installed and no banners visible here.

**garce** · 05-11-2010, 08:26 AM

Avast blocked this:

11/05/2010 12:22:49 PM h**p://91.216.3.108/ca1/main.php [L] JS:Pdfka-AET [Expl] (0)

**Barefootsies** · 05-11-2010, 08:28 AM

Originally posted by KlenTelaris

This doesn't happen to me,but again i have adblock installed and no banners visible here.

Yeah, I figured it must be in the banners somewhere.

Two machines were hit by it. However, a third was not.

Part of it, apparently, is because of the firewall. Adobe and Java are not auto approved to do anything. So when they pop up asking for permisson via firewall pop up, I hit deny. So it prevented the infection on the one machine. The others had different configurations where Adobe and Java can auto run/update.

Just an observation.

**onwebcam** · 05-11-2010, 08:30 AM

yep same here yesterday..

**BIGTYMER** · 05-11-2010, 08:32 AM

The Fix:

Reboot in Safe Mode
Run Malwarebytes
Restart normal
Open your browser (IE/Chrome/FF/Opera) and change the proxy settings. Remove: IP: 127.0.0.1 Port: 5555

**BIGTYMER** · 05-11-2010, 08:38 AM

Originally posted by tube2k

Adobe Flash crashed for me just now... there was a strange white box up by the mojohost banner.

I saw that little white box too. I'm trying to refresh so I can view the source but I'm not seeing it anymore.

**BIGTYMER** · 05-11-2010, 08:40 AM

Apple was onto something?

**woj** · 05-11-2010, 08:43 AM

does gfy host the banners themselves? or are they hotlinked from the advertiser's sites?

**BIGTYMER** · 05-11-2010, 08:45 AM

Originally posted by woj

does gfy host the banners themselves? or are they hotlinked from the advertiser's sites?

Can we use flash banners in our sigs? If so maybe it was a users sig.

**Paul Markham** · 05-11-2010, 08:45 AM

Alright here on Firefox.

**JA$ON** · 05-11-2010, 08:46 AM

+++++++++++1

**sextoyking** · 05-11-2010, 08:51 AM

I had norton on and ran Malwarebytes - didn't find anything..

Should I use another program to check or?

**selena** · 05-11-2010, 08:53 AM

Got it on my laptop. Can't say for sure that it was from here, as I had a few windows open.

**Tom_PM** · 05-11-2010, 08:55 AM

Originally posted by BIGTYMER

Can we use flash banners in our sigs? If so maybe it was a users sig.

No, not a sig. My first attempt was on the gofuckyourself.com page itself. I was not even logged in yet.

**Davy** · 05-11-2010, 08:56 AM

The page just refreshed itself, without me doing anything?
Other than that, I have not noticed anything, yet.
Had an error message earlier that Adobe Acrobat crashed in the browser. Maybe that was it...

**MaximX** · 05-11-2010, 08:58 AM

I had a software that was installed last night called Antivirus Soft. I have norton, but that didn't help so I ran Spyware doctor and everything seem to be working fine now.

**CyberHustler** · 05-11-2010, 09:01 AM

Nothing for me.. I browse this site under the GFY.com though, not GoFuckYourself.com.

**CyberHustler** · 05-11-2010, 09:03 AM

And I'm on chrome...

**Barefootsies** · 05-11-2010, 09:03 AM

This last part is important...

Originally posted by BIGTYMER

Open your browser (IE/Chrome/FF/Opera) and change the proxy settings. Remove: IP: 127.0.0.1 Port: 5555

... Even after you remove the scumware, if you do not do it. I.E. and some sites will not work. You have to switch your I.E. settings back to, 'detect automatic settings' or whatever.

**Serge Litehead** · 05-11-2010, 09:05 AM

happens with chrome on gfy.com
top banner duke dollars has some white square on the left of it
in chrome it tries to load adobe acrobat, then plugin crashes, html source looks clean.. didn't look into js

**SmokeyTheBear** · 05-11-2010, 09:05 AM

Originally posted by woj

does gfy host the banners themselves? or are they hotlinked from the advertiser's sites?

last i checked they let sponsors host them , which is ridiculous as you let one bad apple advertise and they can infect everyone else.

**Icy** · 05-11-2010, 09:05 AM

I posted this screenshoot in the thread i created, it showed up just when loading gofuckyourself, so it's not a sig but a banner, as it doesn't always pop, just from time to time (i guess when the banner enters in the rotation).

Microsoft security essentials gave me an alert about Exploit:Win32/Pdfjsc.FG trying to infect my computer and blocked it, so yes, seems related to that acrobat error some of you saw.

**candyflip** · 05-11-2010, 09:16 AM

Originally posted by NanoBot

Nothing for me.. I browse this site under the GFY.com though, not GoFuckYourself.com.

Originally posted by NanoBot

And I'm on chrome...

I do both of these as well AND somehow got infected. So don't think you're safe

I got it again, while I got up from the computer for a few minutes. Came back and the "Adobe Acrobat crashed in the browser" error.

**SmokeyTheBear** · 05-11-2010, 09:18 AM

heres the exploit in a pdf file

Code:

Removed.

**candyflip** · 05-11-2010, 09:20 AM

How are they loading it through GFY?

**Barefootsies** · 05-11-2010, 09:22 AM

Originally posted by SmokeyTheBear

last i checked they let sponsors host them , which is ridiculous as you let one bad apple advertise and they can infect everyone else.

Completely agree!

**candyflip** · 05-11-2010, 09:25 AM

Which scummy paid advertiser is it?

**SmokeyTheBear** · 05-11-2010, 09:28 AM

so now jademason has a giant botnet of gfy users .. ouch

GFY Installing Malware - Post If You've Got Hit

GFY Installing Malware - Post If You've Got Hit

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment