GFY on the MALWARE list? google is saying so. - GoFuckYourself.com

gleem · 03-26-2010, 02:21 PM

For some reason I'm guessing either an iframe from a banner or gfy is actually being assfucked somehow, I'm getting malware warnings out of safari which just uses google's safebrowsing DB, picking up "nigya.com" on GFY's pages:

The Duck · 03-26-2010, 02:21 PM

I get warnings from my antivirus software in many threads from peoples signature images / codes.

Serge Litehead · 03-26-2010, 02:22 PM

same here.. been acting weird lately.. had acrobat reader start up just now coming to the main forum.

alias · 03-26-2010, 02:23 PM

I got this too, same domain.

roly · 03-26-2010, 02:26 PM

i've just had java start up when visiting the main forum, zonealarm blocked it from accessing 66.197.237.165

BV · 03-26-2010, 02:27 PM

same here

Barefootsies · 03-26-2010, 02:27 PM

Quote:

Originally Posted by The Duck

I get warnings from my antivirus software in many threads from peoples signature images / codes.

Correct.

Many of the sig images are causing shit to go off.

chupachups · 03-26-2010, 02:28 PM

Its teencat cookie stuffing and haxxoring your asses

roly · 03-26-2010, 02:29 PM

Quote:

Originally Posted by Barefootsies

Correct.

Many of the sig images are causing shit to go off.

well i just got something very suspicious before visiting a thread, just this forum.

gleem · 03-26-2010, 02:30 PM

Quote:

Originally Posted by Barefootsies

Correct.

Many of the sig images are causing shit to go off.

nope, couldn't be since I was loading the main forum page, not a thread which set this thing off... so it had to be GFY itself or a banner they have.

redwhiteandblue · 03-26-2010, 02:30 PM

Kaspersky say so too.

Cyber Fucker · 03-26-2010, 02:31 PM

Yup, same here, right after I opened GFY now I got an avast alarm.

Code:

2010-03-26	21:23:10		SYSTEM	884	Sign of "JS:Pdfka-gen [Expl]" has been found in "http://66.197.237.165/g54ty/tmp/newplayer.pdf" file.  
2010-03-26	21:23:10		SYSTEM	884	Sign of "JS:Pdfka-gen [Expl]" has been found in "http://66.197.237.165/g54ty/tmp/all.pdf" file.  
2010-03-26	21:23:34		SYSTEM	884	Sign of "JS:Pdfka-gen [Expl]" has been found in "http://66.197.237.165/g54ty/tmp/newplayer.pdf" file.

Stuntpig · 03-26-2010, 02:33 PM

Quote:

Originally Posted by BV

same here

Thats what I got too.

RyuLion · 03-26-2010, 02:33 PM

I've been getting this for months but its all good..

Eric · 03-26-2010, 02:33 PM

we are looking into this, hope to have it figured out shortly

Jman · 03-26-2010, 02:38 PM

Quote:

Originally Posted by Eric

we are looking into this, hope to have it figured out shortly

Yay for Save a Hoe

BarryP · 03-26-2010, 02:39 PM

Can you guys give me some more details on this? So far I am unable to duplicate. What OS are you running? Browser? any Antivirus? Thanks..

kristin · 03-26-2010, 02:41 PM

Quote:

Originally Posted by Barefootsies

Correct.

Many of the sig images are causing shit to go off.

Seems like quite a few more people complaining about this for it to be sigs, since well, sigs have been around for quite some time.

Cyber Fucker · 03-26-2010, 02:42 PM

Quote:

Originally Posted by BarryP

Can you guys give me some more details on this? So far I am unable to duplicate. What OS are you running? Browser? any Antivirus? Thanks..

WindowsXP, FireFox 2.0.0.20, Avast

BarryP · 03-26-2010, 02:43 PM

Does this alert happen every time a page loads? is it intermittent?

TheDoc · 03-26-2010, 02:45 PM

I got it in chrome.. when I clicked to come to gfy, a plugin for a banner tried to load, I clicked no and the banner failed to load. I have flash installed so I assume it wasn't flash.

halfpint · 03-26-2010, 02:46 PM

Im running avast and getting nothing here nor on google when I search for it. GFY has been tampered with I think

Aric · 03-26-2010, 02:50 PM

Happens here too in all browsers, but not on every page load, so must be a banner in rotation.

Juicy D. Links · 03-26-2010, 02:51 PM

fuck i getting it also i just made apost about it

The site at njgya.com has been reported as an attack site and has been blocked based on your security preferences.

Juicy D. Links · 03-26-2010, 02:52 PM

Quote:

Originally Posted by BarryP

Can you guys give me some more details on this? So far I am unable to duplicate. What OS are you running? Browser? any Antivirus? Thanks..

Kaspersky 2010 , FF 3.6 , happening intermittently XP SP3

gleem · 03-26-2010, 03:00 PM

Quote:

Originally Posted by BarryP

Does this alert happen every time a page loads? is it intermittent?

I've been browsing on and off for 2 hours and it happened three times. I am guessing it's in your banner rotation since I wasn't in a thread when it happens, just these pages:

http://www.gfy.com/fucking-around-and-business-discussion/
http://www.gofuckyourself.com/forumdisplay.php?f=26

I am browsing with safari on osx 10.6

Domain Broker · 03-26-2010, 03:00 PM

I haven't seen this on any of my boxes or browsers.

DeanCapture · 03-26-2010, 03:03 PM

I'm on Mac OSX - running Safari. Sometimes it does it - sometimes not. Right now I'm on Firefox - not having any issues....

halfpint · 03-26-2010, 03:06 PM

Quote:

Originally Posted by Cyber Fucker

Yup, same here, right after I opened GFY now I got an avast alarm.

Code:

2010-03-26	21:23:10		SYSTEM	884	Sign of "JS:Pdfka-gen [Expl]" has been found in "http://66.197.237.165/g54ty/tmp/newplayer.pdf" file.  
2010-03-26	21:23:10		SYSTEM	884	Sign of "JS:Pdfka-gen [Expl]" has been found in "http://66.197.237.165/g54ty/tmp/all.pdf" file.  
2010-03-26	21:23:34		SYSTEM	884	Sign of "JS:Pdfka-gen [Expl]" has been found in "http://66.197.237.165/g54ty/tmp/newplayer.pdf" file.

just looked on may avast log and have exactly the same from today something did pop up but I wassent browsing GFY but it was open in my bottom tab and I assumed it was something else which I was browsing the log time is 20:37:35 so im guessing this is from gfy now

Juicy D. Links · 03-26-2010, 03:06 PM

Quote:

Originally Posted by DeanCapture

I'm on Mac OSX - running Safari. Sometimes it does it - sometimes not. Right now I'm on Firefox - not having any issues....

i think Achmed is running this attack

BarryP · 03-26-2010, 03:40 PM

The issue has been located! Thanks for the help guys, will be fixed soon!

TurboAngel · 03-26-2010, 03:42 PM

Quote:

Originally Posted by BV

same here

That's what I get from time to time.

Juicy D. Links · 03-26-2010, 03:49 PM

Quote:

Originally Posted by BarryP

The issue has been located! Thanks for the help guys, will be fixed soon!

3/26/2010 6:47:38 PM Detected: Exploit.JS.Pdfka.bxa hXXp://mjgjo.com/cgi-bin/clido/s002102317801r0409J11000601R742f0b63Xb4122ccfYffbe fb92Z03002f36//data0000[/url] Firefox

3/26/2010 6:47:38 PM Denied: Exploit.JS.Pdfka.bxa hXXp://mjgjo.com/cgi-bin/clido/s002102317801r0409J11000601R742f0b63Xb4122ccfYffbe fb92Z03002f36//data0000[/url] Firefox

just got that on KIS while on GFY

BarryP · 03-26-2010, 05:10 PM

I'll be making some updates today and tomorrow, but please let me know if this error is still occurring.

CamTraffic · 03-26-2010, 05:16 PM

yeah same here on Chrome

biskoppen · 03-26-2010, 05:27 PM

Smells like a trojan to me

Sly · 03-26-2010, 05:28 PM

I keep getting it sporadically.

seeandsee · 03-26-2010, 05:57 PM

I blocked some pages with Avira because i get trigger on them

WiredGuy · 03-26-2010, 07:54 PM

I've been getting this all day too, I'm guessing its a sig or banner that's triggering it?
WG

candyflip · 03-26-2010, 08:16 PM

I always get one when I open a thread and someone posting with an AdultGruntWork.com has posted in that thread already.

tiger · 03-27-2010, 02:43 AM

I'm running avast and no problems here.

Chosen · 03-27-2010, 02:51 AM

Hope it will get fixed soon...

Abracadabra_nl · 03-27-2010, 02:54 AM

I don't get any of these messages. (Running Mac OSX here)

Waddymelon · 03-27-2010, 02:56 AM

I have a feeling that fatfoo is behind this.

Tamashi · 03-27-2010, 03:07 AM

Quote:

Originally Posted by seeandsee

I blocked some pages with Avira because i get trigger on them

Avira must be one of the shittiest scanners ever. I'm getting warnings on every single site that runs on smarty lol.

Contacted avira to make them aware of the fake warnings, and they don't even reply. There have been several threads about smarty and avira and hundreds of people reporting the same thing, but they don't seem to care

roly · 03-27-2010, 03:56 AM

Quote:

Originally Posted by Tamashi

Avira must be one of the shittiest scanners ever. I'm getting warnings on every single site that runs on smarty lol.

Contacted avira to make them aware of the fake warnings, and they don't even reply. There have been several threads about smarty and avira and hundreds of people reporting the same thing, but they don't seem to care

just turn the heuristic level down to medium that will stop most false positives.

RadicalSights · 03-27-2010, 03:57 AM

Quote:

Originally Posted by biskoppen

Smells like a trojan to me

how do they smell?

roly · 03-27-2010, 03:59 AM

Quote:

Originally Posted by tiger

I'm running avast and no problems here.

it might be worth scanning with something else like malwarebytes or something just to double check. i would be concerned if i didn't have any obvious problems when everyone else did. you could be lucky or its just undetected.

NaughtyRob · 03-27-2010, 09:28 AM

Got it during the day yesterday (Mac OSX on Safari) but not at all last night or today.

Serge Litehead · 03-27-2010, 09:53 AM

Quote:

Originally Posted by Tamashi

Avira must be one of the shittiest scanners ever. I'm getting warnings on every single site that runs on smarty lol.

Contacted avira to make them aware of the fake warnings, and they don't even reply. There have been several threads about smarty and avira and hundreds of people reporting the same thing, but they don't seem to care

smarty doesn't leave any traces of itself in html. we use smarty behind silvercrocodile.com - until this fact is made known, how would anyone be able to tell? it works on server side before any html is outputted to a client side. what i'm saying is that no client can determine if smarty used or not by looking at source code. headers also don't show any smarty traces.

03-26-2010, 02:21 PM	#1
gleem Confirmed User Industry Role: Join Date: Jun 2001 Location: Sunny Land Posts: 5,593	GFY on the MALWARE list? google is saying so. For some reason I'm guessing either an iframe from a banner or gfy is actually being assfucked somehow, I'm getting malware warnings out of safari which just uses google's safebrowsing DB, picking up "nigya.com" on GFY's pages: __________________ Contact me: \\// E: webmaster /at/ unprofessional.com

03-26-2010, 02:21 PM	#2
The Duck Adult Content Provider Industry Role: Join Date: May 2005 Location: Europe Posts: 18,243	I get warnings from my antivirus software in many threads from peoples signature images / codes. __________________ Skype Horusmaia ICQ 41555245 Email [email protected]

03-26-2010, 02:22 PM	#3
Serge Litehead Confirmed User Industry Role: Join Date: Dec 2002 Location: Behind the scenes Posts: 5,190	same here.. been acting weird lately.. had acrobat reader start up just now coming to the main forum. __________________ SilverCrocodile.com Adult web design since '05

03-26-2010, 02:23 PM	#4
alias aliasx Join Date: Apr 2001 Posts: 19,010	I got this too, same domain. __________________ https://porncorporation.com

03-26-2010, 02:28 PM	#8
chupachups Confirmed User Join Date: Dec 2002 Location: Sweden/Spain you sum bitch! Posts: 6,576	Its teencat cookie stuffing and haxxoring your asses __________________

03-26-2010, 02:26 PM	#5
roly Confirmed User Join Date: Aug 2002 Posts: 1,844	i've just had java start up when visiting the main forum, zonealarm blocked it from accessing 66.197.237.165

03-26-2010, 02:27 PM	#6
BV wtf Industry Role: Join Date: Sep 2001 Location: Bikini State, FL USA Posts: 10,914	same here

03-26-2010, 02:30 PM	#11
redwhiteandblue Bollocks Industry Role: Join Date: Jun 2007 Location: Bollocks Posts: 2,792	Kaspersky say so too. __________________ Interserver unmanaged AMD Ryzen servers from $73.00

03-26-2010, 02:33 PM	#14
RyuLion ClubDomCash.com Industry Role: Join Date: Mar 2003 Location: San Diego Posts: 32,171	I've been getting this for months but its all good.. __________________ Adult Biz Consultant A tech head since 1995

03-26-2010, 02:33 PM	#15
Eric Confirmed User Industry Role: Join Date: Dec 2000 Location: The Helm! Posts: 8,818	we are looking into this, hope to have it figured out shortly __________________ No One

03-26-2010, 02:39 PM	#17
BarryP Confirmed User Industry Role: Join Date: Oct 2002 Posts: 145	Can you guys give me some more details on this? So far I am unable to duplicate. What OS are you running? Browser? any Antivirus? Thanks.. __________________ Who will be the next MissGFY?! Attention Industry Females & Solo Girls - Register Now for MissGFY Q4 GoFuckYourself.com Have a Suggestion? Issue? Interested in Advertising? Contact me! Barryp AT adult.com \| icq 559539603

03-26-2010, 02:43 PM	#20
BarryP Confirmed User Industry Role: Join Date: Oct 2002 Posts: 145	Does this alert happen every time a page loads? is it intermittent? __________________ Who will be the next MissGFY?! Attention Industry Females & Solo Girls - Register Now for MissGFY Q4 GoFuckYourself.com Have a Suggestion? Issue? Interested in Advertising? Contact me! Barryp AT adult.com \| icq 559539603

03-26-2010, 02:45 PM	#21
TheDoc Too lazy to set a custom title Industry Role: Join Date: Jul 2001 Location: Currently Incognito Posts: 13,827	I got it in chrome.. when I clicked to come to gfy, a plugin for a banner tried to load, I clicked no and the banner failed to load. I have flash installed so I assume it wasn't flash. __________________ ~TheDoc - ICQ7765825 It's all disambiguation

03-26-2010, 02:46 PM	#22
halfpint GFY's Halfpint Industry Role: Join Date: Jun 2007 Location: UK Posts: 15,223	Im running avast and getting nothing here nor on google when I search for it. GFY has been tampered with I think __________________ Get FREE website listings on Cryptocoinshops.net

03-26-2010, 02:50 PM	#23
Aric Confirmed User Industry Role: Join Date: Sep 2002 Posts: 1,209	Happens here too in all browsers, but not on every page load, so must be a banner in rotation. __________________ Awesome cloud hosting by DigitalOcean

03-26-2010, 02:51 PM	#24
Juicy D. Links So Fucking Banned Industry Role: Join Date: Apr 2001 Location: N.Y. -Long Island -- Posts: 122,992	fuck i getting it also i just made apost about it The site at njgya.com has been reported as an attack site and has been blocked based on your security preferences.

03-26-2010, 03:00 PM	#27
Domain Broker So Fucking Banned Industry Role: Join Date: Oct 2004 Posts: 2,427	I haven't seen this on any of my boxes or browsers.

03-26-2010, 03:03 PM	#28
DeanCapture Haters & Trolls SUCK! Industry Role: Join Date: Dec 2002 Location: Los Angeles, CA Posts: 9,275	I'm on Mac OSX - running Safari. Sometimes it does it - sometimes not. Right now I'm on Firefox - not having any issues.... __________________ Twitter: @DeanCapture Instagram: @TheDeanCapture DeanCapture "at" Gmail.com

03-26-2010, 03:40 PM	#31
BarryP Confirmed User Industry Role: Join Date: Oct 2002 Posts: 145	The issue has been located! Thanks for the help guys, will be fixed soon! __________________ Who will be the next MissGFY?! Attention Industry Females & Solo Girls - Register Now for MissGFY Q4 GoFuckYourself.com Have a Suggestion? Issue? Interested in Advertising? Contact me! Barryp AT adult.com \| icq 559539603

03-26-2010, 05:10 PM	#34
BarryP Confirmed User Industry Role: Join Date: Oct 2002 Posts: 145	I'll be making some updates today and tomorrow, but please let me know if this error is still occurring. __________________ Who will be the next MissGFY?! Attention Industry Females & Solo Girls - Register Now for MissGFY Q4 GoFuckYourself.com Have a Suggestion? Issue? Interested in Advertising? Contact me! Barryp AT adult.com \| icq 559539603

03-26-2010, 05:16 PM	#35
CamTraffic Confirmed User Industry Role: Join Date: Feb 2008 Location: Paris - Miami Posts: 6,535	yeah same here on Chrome __________________ I am always buying traffic and white labels. Hit me up. Email me HERE!

03-26-2010, 05:27 PM	#36
biskoppen Confirmed User Join Date: Mar 2003 Location: Very small penis Posts: 5,809	Smells like a trojan to me

03-26-2010, 05:28 PM	#37
Sly Let's do some business! Industry Role: Join Date: Sep 2004 Location: Austin, TX Posts: 31,288	I keep getting it sporadically. __________________ Vacares - Web Hosting, Domains, O365, Security & More - Paxum and BTC Accepted Wanted: CCBill pay sites for sale

03-26-2010, 05:57 PM	#38
seeandsee Check SIG! Industry Role: Join Date: Mar 2006 Location: Europe (Skype: gojkoas) Posts: 50,945	I blocked some pages with Avira because i get trigger on them __________________ BUY MY SIG - 50$/Year Contact here

03-26-2010, 07:54 PM	#39
WiredGuy Pounding Googlebot Industry Role: Join Date: Aug 2002 Location: Canada Posts: 34,451	I've been getting this all day too, I'm guessing its a sig or banner that's triggering it? WG __________________ I play with Google.

03-26-2010, 08:16 PM	#40
candyflip Carpe Visio Industry Role: Join Date: Jul 2002 Location: New York Posts: 43,052	I always get one when I open a thread and someone posting with an AdultGruntWork.com has posted in that thread already. __________________ Spend you some brain. Email Me

03-27-2010, 02:43 AM	#41
tiger Confirmed User Industry Role: Join Date: Apr 2002 Location: Los Angeles Posts: 6,986	I'm running avast and no problems here. __________________

03-27-2010, 02:51 AM	#42
Chosen VIPPay.com \| AdultWebSponsors.com Industry Role: Join Date: Aug 2001 Posts: 63,151	Hope it will get fixed soon...

03-27-2010, 02:54 AM	#43
Abracadabra_nl Confirmed User Industry Role: Join Date: Jun 2005 Location: Rotterdam, Netherlands Posts: 147	I don't get any of these messages. (Running Mac OSX here) __________________ TubeUploads.com – The #1 Upload Service for Professionals

03-27-2010, 02:56 AM	#44
Waddymelon So Fucking Banned Industry Role: Join Date: Oct 2009 Location: The Whitehouse Posts: 17,349	I have a feeling that fatfoo is behind this.

03-27-2010, 09:28 AM	#49
NaughtyRob Two fresh affiliate progs Industry Role: Join Date: Nov 2004 Location: Inside teen pussy Posts: 29,602	Got it during the day yesterday (Mac OSX on Safari) but not at all last night or today. __________________ [email protected] Skype: 17026955414 Vacares Web Hosting - Protect Your Ass with Included Daily Backups