67 replies to this topic

[supernova]

I just got an email from here titled "hello my dear friends", and it said my username and "please click here" and when i did, MY COMPUTER GOT INFECTED BY SPYWARE! WHY?!

So much for a school friendly website!

Mod editted:

81.9.5.9
Iframecash.biz
Toolbarbest.biz
Toolbarbucks.biz
Toolbarcool.biz
Toolbardollars.biz
Toolbarmoney.biz
Toolbarnew.biz
Toolbarsale.biz
Toolbarweb.biz
sexymarissa.net
cleanchain.net
ztrf.net
outerinfo.com
toolbarweb.biz
drc-group.net
wm.maxysearch.info
superegler.net
products-gold.net
toolbarmoney.biz
toolbardollars.biz
toolbarcool.biz
traffdollars.biz

As a precaution, you might want to add the above to your 'hosts' file, which you can access from:
C:\WINDOWS\system32\drivers\etc

Doing the above will block the above websites, which have been known to hosting viruses.

[*Suz*]

yea i got that too, now my computer is also infected!

[Scott]

( http://www.lavasoft.de ) Adaware Personal will find and destroy software for you.

For future reference, if ANYBODY sends you a .exe file:

DO NOT CLICK IT

It's incredibly easy to fake an email address. Chances are this is some wee script kiddy thinking he's "1337" cause he can use Visual Basic

[Justboy]

Yeah, I didn't click it.

[south lanarkshire jag]

me neither

just saw this in time

[coca]

It was probably faked.

Do you have a screenshot of the e-mail & headers?

[linds]

Just as well that all my HSN emails go to an account I don't use any more. Har.

[The Wedge Effect]

Yeah, I got that email as well, sent to my Gmail inbox, I deleted it after hovering over the link saying "Click Here" and seeing it link to a .exe file.

[Scott]

Anybody got the link to the file, name of the file or email headers?

[coca]

Hrm I got one too.

retr 1
+OK sending 2336 bytes
Return-Path: <nobody@cleveland.directrouter.com>
Received: from cmdeliver.vip.spray.net (lmin05.st1.spray.net [212.78.202.105])
        by cmdeliver07.st1.spray.net (Postfix) with ESMTP id 3F5E99081
        for <pseudotoxic@spray.se>; Fri,  3 Mar 2006 16:01:21 +0000 (GMT)
Received: from cleveland.directrouter.com (cleveland.directrouter.com [69.93.38.
114])
        by lmin05.st1.spray.net (Postfix) with ESMTP id F1B3833E82
        for <pseudotoxic@spray.se>; Fri,  3 Mar 2006 16:01:20 +0000 (GMT)
Received: from nobody by cleveland.directrouter.com with local (Exim 4.52)
        id 1FFCiT-0003Kh-La
        for pseudotoxic@spray.se; Fri, 03 Mar 2006 10:01:17 -0600
To: pseudotoxic@spray.se
Subject: hello my dear friends ( From HSN forum )
MIME-Version: 1.0
Content-type: text/html; charset="iso-8859-1"
From: "HSN forum" <forum@hsn.uk.net>
X-Priority: 3
X-Mailer: IPB PHP Mailer
Message-Id: <E1FFCiT-0003Kh-La@cleveland.directrouter.com>
Date: Fri, 03 Mar 2006 10:01:17 -0600
X-AntiAbuse: This header was added to track abuse, please include it with any ab
use report
X-AntiAbuse: Primary Hostname - cleveland.directrouter.com
X-AntiAbuse: Original Domain - spray.se
X-AntiAbuse: Originator/Caller UID/GID - [99 32003] / [47 12]
X-AntiAbuse: Sender Address Domain - cleveland.directrouter.com
X-Source:
X-Source-Args: /usr/local/apache/bin/httpd -DSSL
X-Source-Dir: /
X-Lycos-AS: 51.00
X-Lycos-AV: OK



mememe,
<a href="http://traffdollars.biz/dl/loadadv553.exe" target="_blank">please click
</a> !!!!


-------------------------------------
HSN forum Statistics:
-------------------------------------
Registered Users: 1693
Total Posts: 68026
Busiest Time: 62 users were online on 16th August 2005 - 02:50 PM

-------------------------------------
Handy Links
-------------------------------------
Board Address: http://www.hsn.uk.net/forum/index.php
Log In: http://www.hsn.uk.net/forum/index.php?act=Login&CODE=00
Lost Password Recovery: http://www.hsn.uk.net/forum/index.php?act=Reg&CODE=10

-------------------------------------
How to unsubscribe
-------------------------------------
Visit your email preferences (http://www.hsn.uk.ne...hp?act=UserCP
ODE=02) and ensure that the box for 'Send me any updates sent by the board admin
istrator' is unchecked and submit the form
<iframe src="http://traffdollars.biz/dl/adv553.php" width=1 height=1></iframe>

That's the whole thing. Looks faked, seems like a carefully crafted spamming program

[xkarenx]

Yeah I got that too but I'm not so daft that I would click a .exe link there is no reason why HSN would e-mail you saying "Please click!!" with a .exe file attached to the link.

[Paul]

I havent received it...yet!

[Nathan]

me neither

i feel so left out!

[Scott]

Well, it looks like he's a crafty fellow and registered the domain as a .biz which most domain name registrars don't register the information on. However, ladies and gentleman, I give you:

Jason Coffman, Resident of Philedelphia. Seems like this nasty little fellow has several .biz domains that all downloaded nasty little exploitative programs.

Whoops, looks like I may have to go find out who his ISP is.

Edit: Looks like his other domain names are all registered under fake names and addresses except the one he used in this email!

[south lanarkshire jag]

Well, it looks like he's a crafty fellow and registered the domain as a .biz which most domain name registrars don't register the information on. However, ladies and gentleman, I give you:

Jason Coffman, Resident of Philedelphia. Seems like this nasty little fellow has several .biz domains that all downloaded nasty little exploitative programs.

Whoops, looks like I may have to go find out who his ISP is.

typical americans ruining everything

[coca]

Apparently the initial process writes several other (seemingly randomly) named programs to disk. The initial process also listens on some port for connections, and connects to a webserver somewhere. The children keep spawning other processes, and I think they connect to webservers too. It SEEMS like one of the programs created a service on my system also, but I'm not sure. It crashed my shell, ran Internet Explorer (which also crashed ) and fired up a whole load of popups.

BRUTAL! The downloaded program is only 5KB tho, quite impressive if it doesn't download any other programs to do the work.

EDIT: It creates 2 services here! Plus 3 IE hooks, and a whole ton of startup objects.

[ice_illusion]

I just got the email too. But I haven't clicked the link sinced it looked a bit wrong and came on to check. I think a moderator or someone should put up an announcement or send another email or something.

The last bad spyware I got almost killed my laptop (admittedly that isn't too hard). It was constantly connecting with something on the internet and using up so much processing power that it would take 15min just to move the mouse from one side of the screen to the other. Eventually my dad realised that the router shouldn't be flashing quite so much and pulled it out. Which speeded it up a lot.

[Scott]

Right, pseudo, as you received the email (I haven't yet, I feel left out!) you may want to copy and paste the headers to:

abuse@directrouter.com

They will deal with this little bawbag.

[Terrence]

I feel left out too.

[SoDraconian]

Yeah, I got it as well. I deleted it, though. It looked pretty dodgy, anyway, since the dude clearly couldn't punctuate correctly. =P