I'm sorry to see this about www.thekaktus.com

MeatPounder · 2009-11-09, 05:02 PM

But everyone of Kaktus sites from www.thekak tus.com are infected and downloading trojans

*edit* sorry just broke the url so no one clicks it by accident

MeatPounder · 2009-11-09, 05:25 PM

11/9/2009 4:55:18 PM Detected: Trojan-Downloader.JS.Gumblar.x Internet Explorer http://govhomeloan.org/_vti_cnf/builder.ph P

Bill · 2009-11-09, 08:11 PM

fucking gumblar

NY Jester · 2009-11-10, 06:21 AM

Would that be an intentional thing or could it be that his server was infected without his knowledge?

Bill · 2009-11-10, 06:47 AM

He's had his ftp password stolen probably, because his work machine was infected, and thru a script had an iframe inserted on every page on his server.

There are other ways this gumblar gets around, but that's the most common.

I think thats the modus operandi, but I'm no gumblar expert.

Chances are he has no idea.

we all fear this kind of hack - well, it scares me for sure.

MeatPounder · 2009-11-10, 12:25 PM

Yup, most likely unintentional, but I still removed 128 active freesites from my DB as unintentional or not I do not want to send my surfers there until it is fixed

I also got the redirect site removed by their host

-----Original Message-----
From: Netfirms Abuse Team [mailto:abuse@netfirms.com]
Sent: Tuesday, November 10, 2009 9:30 AM
To: steve@turtletalk.net
Subject: Re: [Interaction ID #SRJ-13658-362] Contact from netfirms.com

Hello,

Thank you for notifying us of this account. We have disabled it to prevent further abuse.

We appreciate your patience.

Regards,
Chris
www.netfirms.com
Netfirms Abuse Department

On Mon, 09 Nov 2009 17:36:38 -0500, <steve@turtletalk.net> wrote:
> One of your clients is hosting malicious malware, and is hacking sites putting the redirect to it up
> Trojan-Downloader.JS.Gumblar.x
> at
> http://govhomeloan.org/_vti_cnf/builder.php

justevilman · 2009-11-21, 05:47 AM

Quote:

Originally Posted by MeatPounder

11/9/2009 4:55:18 PM Detected: Trojan-Downloader.JS.Gumblar.x Internet Explorer http://govhomeloan.org/_vti_cnf/builder.ph P

i knew dali was the man

2009-11-09, 05:02 PM	#1
MeatPounder Women might be able to fake orgasms But men can fake whole relationships Join Date: Oct 2003 Location: Fort Lauderdale, Fl Posts: 2,408	I'm sorry to see this about www.thekaktus.com But everyone of Kaktus sites from www.thekak tus.com are infected and downloading trojans edit sorry just broke the url so no one clicks it by accident

2009-11-10, 06:21 AM	#4
NY Jester ICQ:147079406 Join Date: Oct 2007 Location: RockMEHardplace Posts: 2,996	Would that be an intentional thing or could it be that his server was infected without his knowledge? __________________ The Sexy Side of Porn

2009-11-09, 05:25 PM	#2
MeatPounder Women might be able to fake orgasms But men can fake whole relationships Join Date: Oct 2003 Location: Fort Lauderdale, Fl Posts: 2,408	11/9/2009 4:55:18 PM Detected: Trojan-Downloader.JS.Gumblar.x Internet Explorer http://govhomeloan.org/_vti_cnf/builder.ph P

2009-11-09, 08:11 PM	#3
Bill Selling porn allows me to stay in a constant state of Bliss - ain't that a trip! Join Date: Apr 2003 Posts: 3,914	fucking gumblar

2009-11-10, 06:47 AM	#5
Bill Selling porn allows me to stay in a constant state of Bliss - ain't that a trip! Join Date: Apr 2003 Posts: 3,914	He's had his ftp password stolen probably, because his work machine was infected, and thru a script had an iframe inserted on every page on his server. There are other ways this gumblar gets around, but that's the most common. I think thats the modus operandi, but I'm no gumblar expert. Chances are he has no idea. we all fear this kind of hack - well, it scares me for sure.

2009-11-10, 12:25 PM	#6
MeatPounder Women might be able to fake orgasms But men can fake whole relationships Join Date: Oct 2003 Location: Fort Lauderdale, Fl Posts: 2,408	Yup, most likely unintentional, but I still removed 128 active freesites from my DB as unintentional or not I do not want to send my surfers there until it is fixed I also got the redirect site removed by their host -----Original Message----- From: Netfirms Abuse Team [mailto:abuse@netfirms.com] Sent: Tuesday, November 10, 2009 9:30 AM To: steve@turtletalk.net Subject: Re: [Interaction ID #SRJ-13658-362] Contact from netfirms.com Hello, Thank you for notifying us of this account. We have disabled it to prevent further abuse. We appreciate your patience. Regards, Chris www.netfirms.com Netfirms Abuse Department On Mon, 09 Nov 2009 17:36:38 -0500, <steve@turtletalk.net> wrote: > One of your clients is hosting malicious malware, and is hacking sites putting the redirect to it up > Trojan-Downloader.JS.Gumblar.x > at > http://govhomeloan.org/_vti_cnf/builder.php