WARNING.. JoviCash/InstantAdultCash chubbyschool.com installs keylogger!!
 

I haven't checked all of the sites for that program so don't know if it's on more sites.. Given the program(s) seemed to have been abondoned I'm just going to remove all links and FHGs.

I was contacted today by one of my trades about this. There's javascript at the bottom of that site (probably all pages). Apparently it installs a keylogger on your system and then they use that to grab credit card info, FTP login etc. so they can compromise your sites etc. as well with the same code.

Apparently this thing is ONLY detected and cleaned using "Kaspersky AntiVirus in full paranoid mode"

The virus is called Trojan-Downloader.JS.Psyme.

I'm still looking at the javscript so will post a little more info when I have it.

The encoded javascript inserts an iframe with a src to something on the domain dramcnt.com. It looks like the domain has been suspended so it might be "defunct" at this point. The email address on the whois info was honnodo @ yandex.ru

burn enough bridges and you end up using questionable programs.
Let this be a lesson to the rest of you.

Huh??...

: / ... Not Jovicash!

tsk tsk tsk