Comus Thumbs.com down after big hack? - GoFuckYourself.com

Spudman · 09-18-2009, 03:44 AM

hey,

Is http://comusthumbs.com/ down for you guys? I can't access it.

hjnet · 09-18-2009, 03:45 AM

Yes, looks like their Server is down

fpforum · 09-18-2009, 03:50 AM

Yup, the site is down here in central USA as well!

Spudman · 09-18-2009, 03:52 AM

Guessing this is the end of comus then. After this last hack i'm never using comus again anyway. I dont think the owner has giving a shit about comus for years now.

Darkhorse · 09-18-2009, 03:59 AM

Quote:

Originally Posted by Spudman

Guessing this is the end of comus then. After this last hack i'm never using comus again anyway. I dont think the owner has giving a shit about comus for years now.

Have to agree, I used it when it first came out oh so many years ago. Now fuck that shit smart thumbs is way to go....

Bhunter · 09-18-2009, 04:28 AM

even after deleting CT folder in your root and switichig to ST, the exploit code returns.

I'm done with CT

hjnet · 09-18-2009, 04:38 AM

Quote:

Originally Posted by Bhunter

even after deleting CT folder in your root and switichig to ST, the exploit code returns.

I'm done with CT

Maybe some script runs on your server that constantly inserts that code. Check your Server for files that have been changed on or around the date when the exploit first appeared

Bhunter · 09-18-2009, 04:39 AM

yup I'm affraid that's the case. working on it ;)

Davy · 09-18-2009, 04:43 AM

Weird. I only checked the site of comusthumbs a couple of days ago...

Anybody want to buy two spare comus licenses?

Bhunter · 09-18-2009, 04:46 AM

yesterday the site was up, but nobody in the forum mentioned about the hack

Spudman · 09-18-2009, 04:46 AM

Quote:

Originally Posted by Bhunter

even after deleting CT folder in your root and switichig to ST, the exploit code returns.

I'm done with CT

you have to change the permissions of ST after the install, the standard permissions are still vulnerable to the hack. I finally have a safe working version of ST on my server now and a script that will update all my new installs of ST to correct, safe permissions.

I installed ST to replace CT and it was hacked within about 2 mins until i did the above. Its a bitch of a hack

Bhunter · 09-18-2009, 04:47 AM

did you set it to 755?

katharos · 09-18-2009, 05:01 AM

the power of hackers ... there is always someone better, and if hackers want to put something down, they will find a way, and looks like its working ...

HEAT · 09-18-2009, 05:02 AM

Comus users, if you looking to buy ST license for migraton I found a great deal here.
http://www.gfy.com/sell-and-buy-forum/917058-wts-smart-thumbs-licenses.html

area51 - BANNED FOR LIFE · 09-18-2009, 05:04 AM

oh well, shit hasn't been updated forever, what do you expect to happen

Davy · 09-18-2009, 05:05 AM

Assuming there is a hack and that it is based on permissions, the comus staff is to blame.
They always advised people to "just chmod the whole comus folder to 777".
That's never a good idea. People should not have followed that advise in the first place.

HEAT · 09-18-2009, 05:16 AM

Quote:

Originally Posted by Spudman

you have to change the permissions of ST after the install, the standard permissions are still vulnerable to the hack. I finally have a safe working version of ST on my server now and a script that will update all my new installs of ST to correct, safe permissions.

I installed ST to replace CT and it was hacked within about 2 mins until i did the above. Its a bitch of a hack

You need to scan your PC first. the hacker might own your ftp login already.
I'm sure hacker running remote script that stored your login info. so it frequently injects JS/iframs code into your site files.

Clean your PC with anti-spyware then change all server passwords.
after that, remove the code in all files with text editor. Don't open infected webpages with browser until all removal is done.

it did work for me.

pornguy · 09-18-2009, 05:19 AM

man it sucks to see such a great program go.

Spudman · 09-18-2009, 05:21 AM

Quote:

Originally Posted by HEAT

You need to scan your PC first. the hacker might own your ftp login already.
I'm sure hacker running remote script that stored your login info. so it frequently injects JS/iframs code into your site files.

Clean your PC with anti-spyware then change all server passwords.
after that, remove the code in all files with text editor. Don't open infected webpages with browser until all removal is done.

it did work for me.

yeah done that, cleaned machine, changed all passwords, removed infected code from all pages but it still managed to spread to clean pages in a couple of minutes. thanks to my host we've got it locked down now and its not spreading.
Now i have to repair the sites and install ST over 40 times to replace CT

Spudstr · 09-18-2009, 05:24 AM

Quote:

Originally Posted by Spudman

you have to change the permissions of ST after the install, the standard permissions are still vulnerable to the hack. I finally have a safe working version of ST on my server now and a script that will update all my new installs of ST to correct, safe permissions.

I installed ST to replace CT and it was hacked within about 2 mins until i did the above. Its a bitch of a hack

Also need to check for malisious bots/programs running hidden as httpd. Easy to find if you do a ps auxwwwww and see something like [httpd] or related then followed by a blank line under it and some random word like start or log etc.

Also please check your /tmp folder so its set to noexec so pearl scripts cannot be ran out of this location after being uploaded.

I can go on and on but thats the jist of it.

Lace · 09-18-2009, 07:25 AM

Just checked one of my comus sites and sure enough - i've got the code being injected as well. Boo

Spudman · 09-18-2009, 07:35 AM

Quote:

Originally Posted by Lace

Just checked one of my comus sites and sure enough - i've got the code being injected as well. Boo

Anyone using Comus needs to get rid of it quickly if they haven't already been infected. Specially as it looks like its now a dead script.

sorry to here you got the hack, good luck getting rid of it.

brassmonkey · 09-18-2009, 07:40 AM

i said months ago ct was gone

smoothballs · 09-18-2009, 09:48 AM

grrrr dont even know where to start right now! need to get ST installed but also get all the links to trades,sponsors ect copied and pasted to hard drive! and reading about the exploit returning after a ST install! fuck its gonna be a long weekend for me! as well as for you guys!

smoothballs · 09-18-2009, 11:36 AM

fuck sake, cant even get pass install.php for smart thumbs here!

Altheon · 09-18-2009, 11:47 AM

Anyone know how to tighten Comus if we haven't been hacked yet? All I could think to do is change the permissions of the CT folder to 755.

smoothballs · 09-18-2009, 12:17 PM

Quote:

Originally Posted by Altheon

Anyone know how to tighten Comus if we haven't been hacked yet? All I could think to do is change the permissions of the CT folder to 755.

My hosts require 755 and still didnt stop my sites getting hacked....although I must add my sites seems to try and redirect rather then actual malicious code embedded in my html....

smoothballs · 09-18-2009, 12:50 PM

finally got thru to ST and having a go with with it to see what does what...kinda similar to comus but different interface....will be a few days till I can get my head round it and be up and running...hopefully!

boneless · 09-18-2009, 12:54 PM

Quote:

Originally Posted by Bhunter

yesterday the site was up, but nobody in the forum mentioned about the hack

so you failed to read my topic called important info ;)

boneless · 09-18-2009, 12:57 PM

Quote:

Originally Posted by Spudman

Now i have to repair the sites and install ST over 40 times to replace CT

wanna trade places and do my 100+ :D

Spudman · 09-18-2009, 01:05 PM

Quote:

Originally Posted by boneless

wanna trade places and do my 100+ :D

I feel your pain bro

I really do, give sixzeros a slap if you ever speak to him again ! Thanks for your help through out my conus days dude, you were a star! Good luck with the sites

Bhunter · 09-18-2009, 01:26 PM

Quote:

Originally Posted by boneless

so you failed to read my topic called important info ;)

... hmmm. now i remember there was such thread but i must have in hurry overlook it's content

beta-tester · 09-18-2009, 01:28 PM

too bad for comus... It was pretty good script.

I guess I'll have to make a switch over st too...

HEAT · 09-18-2009, 01:51 PM

Check your tmpl files in ct/templates directory. those are infected as well and also there are more .tmpl and .php(no Zend) files in some other dirs.
Just delete unnecessary files under the ct directory.(backups, welcome.html, example.html, old data, etc.)

But again, YOU MUST SCAN YOUR PC in advance of code removal.
The hacker has your ftp password. so he will inject the code again automatically. Moreover this hacker(his remote software) will scan other directories in /home. then it will attack other php sites too. My other TGPX and TEVS sites on the same box also got hit.
Once the hacker has your ftp login, changing file/dir permission won't be a solution.

I had found these malwares in my pc.
Exploit,PDF.JS-Gen
Trojan.Script.7685
These came from the injected code.

Remove them and reboot. Scan again with another antispyware, reboot, then change server passwords.
Now edit all infected files. Use server-side text editor or file manager.
If there is a blank line under the <body> tag. Scroll to right and you will find the hidden code.
DON'T load infected or suspicious php/html files with browser. Your PC will get malwares again and it will sniff new password when you using ftp.
So it's the most important that your pc is not infected by malwares during code removal.

Good luck.

smoothballs · 09-18-2009, 02:23 PM

Spudman....see you are from the UK too

send me a PM see if we can help each other out

czarina · 09-18-2009, 02:38 PM

can't get it here

Spudman · 09-18-2009, 02:51 PM

Quote:

Originally Posted by smoothballs

Spudman....see you are from the UK too

send me a PM see if we can help each other out

Yes dude, I'll hit you up in the morning

crockett · 09-18-2009, 02:53 PM

I wonder why the owner stopped giving a shit? It seemed like he bought out epower trader but shortly after that stopping doing much.

Did he have health problems or something or just give up?

Vendzilla · 09-18-2009, 03:03 PM

I remember Tony having health problems and it when down hill from there, havn't heard from him in a long time

qxm · 09-18-2009, 03:07 PM

Quote:

Originally Posted by Vendzilla

I remember Tony having health problems and it when down hill from there, havn't heard from him in a long time

yeap I remember seeing u there.... Comus was a great tool while it lasted.... luckily I moved away from TGPs a while back.... glad I did it too!

V_RocKs · 09-18-2009, 03:14 PM

I uninstalled it long ago when it kept getting hacked.

willwank · 09-18-2009, 03:28 PM

I sale 100 licenses of glorious script APTGP3

crockett · 09-18-2009, 03:32 PM

Quote:

Originally Posted by Vendzilla

I remember Tony having health problems and it when down hill from there, havn't heard from him in a long time

Yea that's what I was thinking. I wonder if he's ok or if it's because of the health problems. He used to always be pretty active with his scripts. He didn't seem like one that would just disappear.

stoner529 · 09-18-2009, 09:25 PM

this is my first time having to do this. i only have one site though. trying just to get that to work right. at least i have a dedicated managed server so they can take care of that crap for me. i have no clue about it. i think my site is okay though, but not to sure.

MoreMagic · 09-18-2009, 11:01 PM

http://comusthumbs.com/ is online again.

smoothballs · 09-19-2009, 05:31 AM

Quote:

Originally Posted by MoreMagic

http://comusthumbs.com/ is online again.

yeah but all the links at top of the page for support forum ect isnt there ...

Davy · 09-19-2009, 06:03 AM

Quote:

Originally Posted by HEAT

Check your tmpl files in ct/templates directory. those are infected as well and also there are more .tmpl and .php(no Zend) files in some other dirs.
Just delete unnecessary files under the ct directory.(backups, welcome.html, example.html, old data, etc.)

Good advice. Just go ahead and randomly delete files. That will stuff the security hole, for sure!

SuzzyQ · 09-19-2009, 07:24 AM

Besides Spybot S&D what is another good spyware removal progy?

smoothballs · 09-19-2009, 01:00 PM

jeez...this is gonna take forever! I'm tempted to just have static pages up...

escorpio · 09-19-2009, 01:52 PM

Quote:

Originally Posted by smoothballs

jeez...this is gonna take forever! I'm tempted to just have static pages up...

I've been thinking the same thing.

09-18-2009, 03:44 AM	#1
Spudman Confirmed User Join Date: Aug 2002 Location: UK Posts: 3,198	Comus Thumbs.com down after big hack? hey, Is http://comusthumbs.com/ down for you guys? I can't access it. __________________ Take it Easy !!!

09-18-2009, 03:50 AM	#3
fpforum Confirmed User Industry Role: Join Date: Dec 2006 Location: USA Posts: 1,045	Yup, the site is down here in central USA as well! __________________ Email: strikedata \|@\| gmail.com Skype: mistercashman

09-18-2009, 03:52 AM	#4
Spudman Confirmed User Join Date: Aug 2002 Location: UK Posts: 3,198	Guessing this is the end of comus then. After this last hack i'm never using comus again anyway. I dont think the owner has giving a shit about comus for years now. __________________ Take it Easy !!!

09-18-2009, 04:43 AM	#9
Davy Confirmed User Industry Role: Join Date: Apr 2006 Location: Germany Posts: 4,323	Weird. I only checked the site of comusthumbs a couple of days ago... Anybody want to buy two spare comus licenses? __________________ --- ICQ 14-76-98 <-- I don't use this at all

09-18-2009, 05:02 AM	#14
HEAT Confirmed User Join Date: Sep 2003 Posts: 2,255	Comus users, if you looking to buy ST license for migraton I found a great deal here. http://www.gfy.com/sell-and-buy-forum/917058-wts-smart-thumbs-licenses.html __________________ 254-282-542

09-18-2009, 03:45 AM	#2
hjnet Confirmed User Join Date: May 2002 Location: European Union Posts: 3,815	Yes, looks like their Server is down

09-18-2009, 04:28 AM	#6
Bhunter Confirmed User Industry Role: Join Date: Dec 2006 Location: Amsterdam Posts: 1,119	even after deleting CT folder in your root and switichig to ST, the exploit code returns. I'm done with CT

09-18-2009, 04:39 AM	#8
Bhunter Confirmed User Industry Role: Join Date: Dec 2006 Location: Amsterdam Posts: 1,119	yup I'm affraid that's the case. working on it ;)

09-18-2009, 04:46 AM	#10
Bhunter Confirmed User Industry Role: Join Date: Dec 2006 Location: Amsterdam Posts: 1,119	yesterday the site was up, but nobody in the forum mentioned about the hack

09-18-2009, 04:47 AM	#12
Bhunter Confirmed User Industry Role: Join Date: Dec 2006 Location: Amsterdam Posts: 1,119	did you set it to 755?

09-18-2009, 05:01 AM	#13
katharos So Fucking Banned Join Date: Nov 2005 Posts: 1,515	the power of hackers ... there is always someone better, and if hackers want to put something down, they will find a way, and looks like its working ...

09-18-2009, 05:04 AM	#15
area51 - BANNED FOR LIFE So Fucking Banned Join Date: Aug 2009 Posts: 3,164	oh well, shit hasn't been updated forever, what do you expect to happen

09-18-2009, 05:05 AM	#16
Davy Confirmed User Industry Role: Join Date: Apr 2006 Location: Germany Posts: 4,323	Assuming there is a hack and that it is based on permissions, the comus staff is to blame. They always advised people to "just chmod the whole comus folder to 777". That's never a good idea. People should not have followed that advise in the first place. __________________ --- ICQ 14-76-98 <-- I don't use this at all

09-18-2009, 05:19 AM	#18
pornguy Too lazy to set a custom title Industry Role: Join Date: Mar 2003 Location: Homeless Posts: 62,911	man it sucks to see such a great program go. __________________ PornGuy skype me pornguy_epic AmateurDough The Hottes Shemales online! TChicks.com \| Angeles Cid \| Mariana Cordoba \| MAILERS WELCOME!

09-18-2009, 07:25 AM	#21
Lace Too lazy to set a custom title Industry Role: Join Date: Mar 2004 Posts: 16,116	Just checked one of my comus sites and sure enough - i've got the code being injected as well. Boo __________________ Your Paysite Partner Strength In Numbers! StickyDollars \| RadicalCash \| KennysPennies \| HomegrownCash

09-18-2009, 07:40 AM	#23
brassmonkey Pay It Forward Industry Role: Join Date: Sep 2005 Location: Yo Mama House Posts: 77,084	i said months ago ct was gone __________________ TRUMP 2025 KEKAW!!! - The Laken Riley Act Is Law! DACA ENDED - SUPPORT AZ HCR 2060 52R - email: brassballz-at-techie.com

09-18-2009, 09:48 AM	#24
smoothballs Confirmed User Join Date: Aug 2004 Posts: 151	grrrr dont even know where to start right now! need to get ST installed but also get all the links to trades,sponsors ect copied and pasted to hard drive! and reading about the exploit returning after a ST install! fuck its gonna be a long weekend for me! as well as for you guys!

09-18-2009, 11:36 AM	#25
smoothballs Confirmed User Join Date: Aug 2004 Posts: 151	fuck sake, cant even get pass install.php for smart thumbs here!

09-18-2009, 11:47 AM	#26
Altheon Confirmed User Join Date: May 2004 Posts: 506	Anyone know how to tighten Comus if we haven't been hacked yet? All I could think to do is change the permissions of the CT folder to 755.

09-18-2009, 12:50 PM	#28
smoothballs Confirmed User Join Date: Aug 2004 Posts: 151	finally got thru to ST and having a go with with it to see what does what...kinda similar to comus but different interface....will be a few days till I can get my head round it and be up and running...hopefully!

09-18-2009, 01:28 PM	#33
beta-tester Rock 'n Roll Baby! Join Date: Sep 2004 Location: USA, temporarly Posts: 22,562	too bad for comus... It was pretty good script. I guess I'll have to make a switch over st too... __________________ Sig for sale. Affordable prices. Contact me and get a great deal ;) My contact: ICQ: 944-320-46 e-mail: manca {AT} HotFreeSex4All.com

09-18-2009, 01:51 PM	#34
HEAT Confirmed User Join Date: Sep 2003 Posts: 2,255	Check your tmpl files in ct/templates directory. those are infected as well and also there are more .tmpl and .php(no Zend) files in some other dirs. Just delete unnecessary files under the ct directory.(backups, welcome.html, example.html, old data, etc.) But again, YOU MUST SCAN YOUR PC in advance of code removal. The hacker has your ftp password. so he will inject the code again automatically. Moreover this hacker(his remote software) will scan other directories in /home. then it will attack other php sites too. My other TGPX and TEVS sites on the same box also got hit. Once the hacker has your ftp login, changing file/dir permission won't be a solution. I had found these malwares in my pc. Exploit,PDF.JS-Gen Trojan.Script.7685 These came from the injected code. Remove them and reboot. Scan again with another antispyware, reboot, then change server passwords. Now edit all infected files. Use server-side text editor or file manager. If there is a blank line under the <body> tag. Scroll to right and you will find the hidden code. DON'T load infected or suspicious php/html files with browser. Your PC will get malwares again and it will sniff new password when you using ftp. So it's the most important that your pc is not infected by malwares during code removal. Good luck. __________________ 254-282-542

09-18-2009, 02:23 PM	#35
smoothballs Confirmed User Join Date: Aug 2004 Posts: 151	Spudman....see you are from the UK too send me a PM see if we can help each other out

09-18-2009, 02:38 PM	#36
czarina Webmaster Extraordinaire Industry Role: Join Date: Jul 2002 Location: A beautiful beach... Posts: 10,748	can't get it here

09-18-2009, 02:53 PM	#38
crockett in a van by the river Industry Role: Join Date: May 2003 Posts: 76,806	I wonder why the owner stopped giving a shit? It seemed like he bought out epower trader but shortly after that stopping doing much. Did he have health problems or something or just give up? __________________ In November, you can vote for America's next president or its first dictator.

09-18-2009, 03:03 PM	#39
Vendzilla Biker Gnome Industry Role: Join Date: Mar 2004 Location: cell#324 Posts: 23,200	I remember Tony having health problems and it when down hill from there, havn't heard from him in a long time __________________ Webair died? Carbon is not the problem, it makes up 0.041% of our atmosphere , 95% of that is from Volcanos and decomposing plants and stuff. So people in the US are responsible for 13% of the carbon in the atmosphere which 95% is not from Humans, like cars and trucks and stuff and they want to spend trillions to fix it while Solar Panel plants are powered by coal plants think about that

09-18-2009, 03:14 PM	#41
V_RocKs Damn Right I Kiss Ass! Industry Role: Join Date: Dec 2003 Location: Cowtown, USA Posts: 32,406	I uninstalled it long ago when it kept getting hacked.

09-18-2009, 03:28 PM	#42
willwank Confirmed User Industry Role: Join Date: Sep 2006 Location: Hamilton, ON Posts: 628	I sale 100 licenses of glorious script APTGP3 __________________ icq 437 654 594 * HIM: I GOT FUCKED! HER: YES YOU DID! *

09-18-2009, 09:25 PM	#44
stoner529 Confirmed User Join Date: Aug 2008 Location: longwood, fl Posts: 421	this is my first time having to do this. i only have one site though. trying just to get that to work right. at least i have a dedicated managed server so they can take care of that crap for me. i have no clue about it. i think my site is okay though, but not to sure.

09-18-2009, 11:01 PM	#45
MoreMagic Confirmed User Join Date: Feb 2006 Posts: 2,848	http://comusthumbs.com/ is online again.

09-19-2009, 07:24 AM	#48
SuzzyQ Confirmed User Industry Role: Join Date: Dec 2006 Location: Along the shore. Posts: 1,557	Besides Spybot S&D what is another good spyware removal progy?

09-19-2009, 01:00 PM	#49
smoothballs Confirmed User Join Date: Aug 2004 Posts: 151	jeez...this is gonna take forever! I'm tempted to just have static pages up...