I'm sorry to see this about www.thekaktus.com

[MeatPounder]

But everyone of Kaktus sites from www.thekak tus.com are infected and downloading trojans

*edit* sorry just broke the url so no one clicks it by accident

[MeatPounder]

11/9/2009 4:55:18 PM Detected: Trojan-Downloader.JS.Gumblar.x Internet Explorer http://govhomeloan.org/_vti_cnf/builder.ph P

[Bill]

fucking gumblar

[NY Jester]

Would that be an intentional thing or could it be that his server was infected without his knowledge?

[Bill]

He's had his ftp password stolen probably, because his work machine was infected, and thru a script had an iframe inserted on every page on his server.

There are other ways this gumblar gets around, but that's the most common.

I think thats the modus operandi, but I'm no gumblar expert.

Chances are he has no idea.

we all fear this kind of hack - well, it scares me for sure.

[MeatPounder]

Yup, most likely unintentional, but I still removed 128 active freesites from my DB as unintentional or not I do not want to send my surfers there until it is fixed

I also got the redirect site removed by their host

-----Original Message-----
From: Netfirms Abuse Team [mailto:abuse@netfirms.com]
Sent: Tuesday, November 10, 2009 9:30 AM
To: steve@turtletalk.net
Subject: Re: [Interaction ID #SRJ-13658-362] Contact from netfirms.com

Hello,

Thank you for notifying us of this account. We have disabled it to prevent further abuse.

We appreciate your patience.


Regards,
Chris
www.netfirms.com
Netfirms Abuse Department


On Mon, 09 Nov 2009 17:36:38 -0500, <steve@turtletalk.net> wrote:
> One of your clients is hosting malicious malware, and is hacking sites putting the redirect to it up
> Trojan-Downloader.JS.Gumblar.x
> at
> http://govhomeloan.org/_vti_cnf/builder.php

[justevilman]

11/9/2009 4:55:18 PM Detected: Trojan-Downloader.JS.Gumblar.x Internet Explorer http://govhomeloan.org/_vti_cnf/builder.ph P

i knew dali was the man