GFY Installing Malware - Post If You've Got Hit - GoFuckYourself.com

candyflip · 05-11-2010, 08:19 AM

Seems like a bunch of people are getting hit and the one thing is common is GFY and that Malware Warning people are seeing.

If you've gotten hit, post here and maybe it'll get fixed when the ICS crew gets into the office today.

I got hit and was able to get rid of it using Malwarebyte's Anti-Malware app.

Tom_PM · 05-11-2010, 08:32 AM

IE (6.0 believe it or not) warned me that it'd blocked a download this morning and I saw Java started running. This was on the log-in page itself, pre-password.

I closed everything and retried and it didnt attempt it the second time.

candyflip · 05-11-2010, 08:33 AM

I just had another attempt.

David! · 05-11-2010, 08:33 AM

On Windows 7 and Firefox, it launches Adobe Acrobat Reader and give some kind of 3D error?

candyflip · 05-11-2010, 08:34 AM

Yep...definitely has something to do with Adobe, PDF and Reader.

seeandsee · 05-11-2010, 08:42 AM

fucking exploits

sextoyking · 05-11-2010, 08:42 AM

Quote:

Originally Posted by MCO_David

On Windows 7 and Firefox, it launches Adobe Acrobat Reader and give some kind of 3D error?

On Winxp pro and FF, same error.....

jerryb · 05-11-2010, 08:44 AM

Norton caught it as a Trojan for me. Thank you Norton. :-))

Jim_Gunn · 05-11-2010, 08:48 AM

I just opened up GoFuckYourself.com in FF on my Win XP Laptop and immediately got infected by one of those fake anti virus apps telling me I am infected. It would not even let me ctrl-alt-delete to open up the task manager. I did a hard reboot and opened up the task manager and keep it open before the exploit was able to launch. I am trying to use Malwarebytes to fix now and posting from my cell phone.

Amputate Your Head · 05-11-2010, 08:49 AM

No trouble here on the Macs.

candyflip · 05-11-2010, 08:51 AM

Quote:

Originally Posted by Amputate Your Head

No trouble here on the Macs.

Yep...No issues on any of the Mac boxes. Just a Windows issue as usual.

bloggerz · 05-11-2010, 08:51 AM

yup got it and removed it

Raf1 · 05-11-2010, 08:55 AM

no trouble here yet

Va2k · 05-11-2010, 08:57 AM

Quote:

Originally Posted by MCO_David

On Windows 7 and Firefox, it launches Adobe Acrobat Reader and give some kind of 3D error?

Same here on win xp 64

Barefootsies · 05-11-2010, 08:58 AM

Quote:

Originally Posted by Jim_Gunn

I did a hard reboot and opened up the task manager and keep it open before the exploit was able to launch. I am trying to use Malwarebytes to fix now and posting from my cell phone.

Yep. Same here.

It was a dead give away when JAVA/Adobe both launched. It's not the first time this has happened from GFY with this trojan. However, Malwarebytes typically will handle it. Had it handy from the last time.

Still, annoying all the same.

Fabien · 05-11-2010, 08:58 AM

See this also guys

http://gofuckyourself.com/showthread.php?t=967903

kristin · 05-11-2010, 09:00 AM

Glad I'm on my Mac. =)

LickMyBalls · 05-11-2010, 09:04 AM

atwleoqtssd.exe detected by SONAR
atwleoqtssd.exe accessed your network resources
whlu.exe detected by SONAR
whlu.exe modified your System Configuration

candyflip · 05-11-2010, 09:06 AM

Quote:

Originally Posted by kristin

Glad I'm on my Mac. =)

No shit, right? I've spent about 2 hours booted into Windows this week and 1/2 of it was spent trying to remove this shit.

Yngwie · 05-11-2010, 09:10 AM

No problems here on either FF or IE and Windows 7

CPimp · 05-11-2010, 09:10 AM

Adobe Flash crashed for me just now... there was a strange white box up by the mojohost banner.

Not saying anything at all, just posting my observations. Maybe it's getting installed that way by chance?

FilthyRob · 05-11-2010, 09:10 AM

I got hit, but I think I stopped it from exploiting. Explorer 6.0, I am old school I guess..lol

Klen · 05-11-2010, 09:13 AM

This doesn't happen to me,but again i have adblock installed and no banners visible here.

garce · 05-11-2010, 09:26 AM

Avast blocked this:

11/05/2010 12:22:49 PM h**p://91.216.3.108/ca1/main.php [L] JS:Pdfka-AET [Expl] (0)

Barefootsies · 05-11-2010, 09:28 AM

Quote:

Originally Posted by KlenTelaris

This doesn't happen to me,but again i have adblock installed and no banners visible here.

Yeah, I figured it must be in the banners somewhere.

Two machines were hit by it. However, a third was not.

Part of it, apparently, is because of the firewall. Adobe and Java are not auto approved to do anything. So when they pop up asking for permisson via firewall pop up, I hit deny. So it prevented the infection on the one machine. The others had different configurations where Adobe and Java can auto run/update.

Just an observation.

onwebcam · 05-11-2010, 09:30 AM

yep same here yesterday..

BIGTYMER · 05-11-2010, 09:32 AM

The Fix:

Reboot in Safe Mode
Run Malwarebytes
Restart normal
Open your browser (IE/Chrome/FF/Opera) and change the proxy settings. Remove: IP: 127.0.0.1 Port: 5555

BIGTYMER · 05-11-2010, 09:38 AM

Quote:

Originally Posted by tube2k

Adobe Flash crashed for me just now... there was a strange white box up by the mojohost banner.

I saw that little white box too. I'm trying to refresh so I can view the source but I'm not seeing it anymore.

BIGTYMER · 05-11-2010, 09:40 AM

Apple was onto something?

woj · 05-11-2010, 09:43 AM

does gfy host the banners themselves? or are they hotlinked from the advertiser's sites?

BIGTYMER · 05-11-2010, 09:45 AM

Quote:

Originally Posted by woj

does gfy host the banners themselves? or are they hotlinked from the advertiser's sites?

Can we use flash banners in our sigs? If so maybe it was a users sig.

Paul Markham · 05-11-2010, 09:45 AM

Alright here on Firefox.

JA$ON · 05-11-2010, 09:46 AM

+++++++++++1

sextoyking · 05-11-2010, 09:51 AM

I had norton on and ran Malwarebytes - didn't find anything..

Should I use another program to check or?

selena · 05-11-2010, 09:53 AM

Got it on my laptop. Can't say for sure that it was from here, as I had a few windows open.

Tom_PM · 05-11-2010, 09:55 AM

Quote:

Originally Posted by BIGTYMER

Can we use flash banners in our sigs? If so maybe it was a users sig.

No, not a sig. My first attempt was on the gofuckyourself.com page itself. I was not even logged in yet.

Davy · 05-11-2010, 09:56 AM

The page just refreshed itself, without me doing anything?
Other than that, I have not noticed anything, yet.
Had an error message earlier that Adobe Acrobat crashed in the browser. Maybe that was it...

MaximX · 05-11-2010, 09:58 AM

I had a software that was installed last night called Antivirus Soft. I have norton, but that didn't help so I ran Spyware doctor and everything seem to be working fine now.

CyberHustler · 05-11-2010, 10:01 AM

Nothing for me.. I browse this site under the GFY.com though, not GoFuckYourself.com.

CyberHustler · 05-11-2010, 10:03 AM

And I'm on chrome...

Barefootsies · 05-11-2010, 10:03 AM

This last part is important...

Quote:

Originally Posted by BIGTYMER

Open your browser (IE/Chrome/FF/Opera) and change the proxy settings. Remove: IP: 127.0.0.1 Port: 5555

... Even after you remove the scumware, if you do not do it. I.E. and some sites will not work. You have to switch your I.E. settings back to, 'detect automatic settings' or whatever.

Serge Litehead · 05-11-2010, 10:05 AM

happens with chrome on gfy.com
top banner duke dollars has some white square on the left of it
in chrome it tries to load adobe acrobat, then plugin crashes, html source looks clean.. didn't look into js

SmokeyTheBear · 05-11-2010, 10:05 AM

Quote:

Originally Posted by woj

does gfy host the banners themselves? or are they hotlinked from the advertiser's sites?

last i checked they let sponsors host them , which is ridiculous as you let one bad apple advertise and they can infect everyone else.

Icy · 05-11-2010, 10:05 AM

I posted this screenshoot in the thread i created, it showed up just when loading gofuckyourself, so it's not a sig but a banner, as it doesn't always pop, just from time to time (i guess when the banner enters in the rotation).

Microsoft security essentials gave me an alert about Exploit:Win32/Pdfjsc.FG trying to infect my computer and blocked it, so yes, seems related to that acrobat error some of you saw.

candyflip · 05-11-2010, 10:16 AM

Quote:

Originally Posted by NanoBot

Nothing for me.. I browse this site under the GFY.com though, not GoFuckYourself.com.

Quote:

Originally Posted by NanoBot

And I'm on chrome...

I do both of these as well AND somehow got infected. So don't think you're safe

I got it again, while I got up from the computer for a few minutes. Came back and the "Adobe Acrobat crashed in the browser" error.

SmokeyTheBear · 05-11-2010, 10:18 AM

heres the exploit in a pdf file

Code:

Removed.

candyflip · 05-11-2010, 10:20 AM

How are they loading it through GFY?

Barefootsies · 05-11-2010, 10:22 AM

Quote:

Originally Posted by SmokeyTheBear

last i checked they let sponsors host them , which is ridiculous as you let one bad apple advertise and they can infect everyone else.

Completely agree!

candyflip · 05-11-2010, 10:25 AM

Which scummy paid advertiser is it?

SmokeyTheBear · 05-11-2010, 10:28 AM

so now jademason has a giant botnet of gfy users .. ouch

05-11-2010, 08:19 AM	#1
candyflip Carpe Visio Industry Role: Join Date: Jul 2002 Location: New York Posts: 43,056	GFY Installing Malware - Post If You've Got Hit Seems like a bunch of people are getting hit and the one thing is common is GFY and that Malware Warning people are seeing. If you've gotten hit, post here and maybe it'll get fixed when the ICS crew gets into the office today. I got hit and was able to get rid of it using Malwarebyte's Anti-Malware app. __________________ Spend you some brain. Email Me

05-11-2010, 08:32 AM	#2
Tom_PM Porn Meister Industry Role: Join Date: Feb 2005 Posts: 16,443	IE (6.0 believe it or not) warned me that it'd blocked a download this morning and I saw Java started running. This was on the log-in page itself, pre-password. I closed everything and retried and it didnt attempt it the second time. __________________ 43-922-863 Shut up and play your guitar.

05-11-2010, 08:33 AM	#3
candyflip Carpe Visio Industry Role: Join Date: Jul 2002 Location: New York Posts: 43,056	I just had another attempt. __________________ Spend you some brain. Email Me

05-11-2010, 08:33 AM	#4
David! By the wrath of Agamemnon Industry Role: Join Date: Apr 2004 Location: Miami Posts: 6,501	On Windows 7 and Firefox, it launches Adobe Acrobat Reader and give some kind of 3D error? __________________ .

05-11-2010, 08:34 AM	#5
candyflip Carpe Visio Industry Role: Join Date: Jul 2002 Location: New York Posts: 43,056	Yep...definitely has something to do with Adobe, PDF and Reader. __________________ Spend you some brain. Email Me

05-11-2010, 08:42 AM	#6
seeandsee Check SIG! Industry Role: Join Date: Mar 2006 Location: Europe (Skype: gojkoas) Posts: 50,945	fucking exploits __________________ BUY MY SIG - 50$/Year Contact here

05-11-2010, 08:44 AM	#8
jerryb Confirmed User Join Date: Feb 2005 Location: Saginaw, Michigan USA Posts: 588	Norton caught it as a Trojan for me. Thank you Norton. :-)) __________________ - - Hot Phone Sex and Porn Search Engine Webmaster Opportunities Crazy Ernies Blog

05-11-2010, 08:48 AM	#9
Jim_Gunn Confirmed User Industry Role: Join Date: Feb 2003 Location: Where The Teens Are Posts: 5,702	I just opened up GoFuckYourself.com in FF on my Win XP Laptop and immediately got infected by one of those fake anti virus apps telling me I am infected. It would not even let me ctrl-alt-delete to open up the task manager. I did a hard reboot and opened up the task manager and keep it open before the exploit was able to launch. I am trying to use Malwarebytes to fix now and posting from my cell phone. __________________ Jim Gunn Filming Cinematic Porn Skype JimGunnProductions

05-11-2010, 08:49 AM	#10
Amputate Your Head There can be only one Industry Role: Join Date: Aug 2001 Location: Somewhere else Posts: 39,075	No trouble here on the Macs. __________________ SIG TOO BIG

05-11-2010, 08:51 AM	#12
bloggerz Too lazy to set a custom title Industry Role: Join Date: Dec 2006 Posts: 16,256	yup got it and removed it __________________ I SELL ADULT BACKLINKS! Email: eroticweb>gmail SKYPE: gfybloggerz $$$$$ MAKE HUGE MONEY IN CAMS - CLICK HERE $$$$$

05-11-2010, 08:55 AM	#13
Raf1 Too lazy to set a custom title Join Date: Oct 2003 Location: Writer for hire :) Gallery descriptions, articles, blog posts etc. ICQ: 209 356 106 Posts: 12,117	no trouble here yet __________________ 80% Revshare or 30$ PPS on $1 trials: 200 Niches = Vidz.com Galleries / FLVs / Embeds 3 & 5mins FLVs \| RSS & Tube Feeds \| Matching Thumbs \| FLV Browser & Exporter \| No Prechecked Xsales >> Mobile Redirection Script: mobile.vidz.com also paying 80% net Lifetime << ICQ: 198-394-557

05-11-2010, 08:58 AM	#16
Fabien Confirmed User Industry Role: Join Date: Jul 2003 Posts: 4,787	See this also guys http://gofuckyourself.com/showthread.php?t=967903

05-11-2010, 09:00 AM	#17
kristin GOO! Industry Role: Join Date: Sep 2002 Location: Back Home : ) Posts: 9,768	Glad I'm on my Mac. =) __________________ Vacares rules. "Usually only fat guys have the kind of knowledge and ability that Kristin has."

05-11-2010, 09:04 AM	#18
LickMyBalls So Fucking Banned Join Date: Oct 2009 Posts: 756	atwleoqtssd.exe detected by SONAR atwleoqtssd.exe accessed your network resources whlu.exe detected by SONAR whlu.exe modified your System Configuration

05-11-2010, 09:10 AM	#20
Yngwie I am an Alien from space Industry Role: Join Date: May 2003 Location: Ontario, Canada Posts: 11,118	No problems here on either FF or IE and Windows 7 __________________ ICQ: 16544251 - Skype: gator37 @ eastlink.ca - email: yngwie @ isys.ca

05-11-2010, 09:10 AM	#21
CPimp Confirmed User Industry Role: Join Date: Aug 2009 Posts: 2,346	Adobe Flash crashed for me just now... there was a strange white box up by the mojohost banner. Not saying anything at all, just posting my observations. Maybe it's getting installed that way by chance? __________________ three 997 three 55 three 1 ← That's my ICQ. Contact me there. Thanks.

05-11-2010, 09:10 AM	#22
FilthyRob Confirmed User Join Date: Feb 2004 Location: Anaheim - CA Posts: 6,741	I got hit, but I think I stopped it from exploiting. Explorer 6.0, I am old school I guess..lol __________________ AKA - Clubsexy

05-11-2010, 09:13 AM	#23
Klen Industry Role: Join Date: Aug 2006 Location: Little Vienna Posts: 32,235	This doesn't happen to me,but again i have adblock installed and no banners visible here.

05-11-2010, 09:26 AM	#24
garce Confirmed User Industry Role: Join Date: Oct 2001 Location: Toronto Posts: 7,103	Avast blocked this: 11/05/2010 12:22:49 PM h**p://91.216.3.108/ca1/main.php [L] JS:Pdfka-AET [Expl] (0)

05-11-2010, 09:30 AM	#26
onwebcam Fake Nick 1.0 Industry Role: Join Date: Oct 2005 Location: Rent free, your head Posts: 27,653	yep same here yesterday.. __________________ PLEASE WAIT WHILE BIDEN ADMIN UNINSTALLS ITSELF..... ██████████████████▒ 99.5% complete.

05-11-2010, 09:32 AM	#27
BIGTYMER Junior Achiever Industry Role: Join Date: Nov 2004 Location: Walled Garden Posts: 17,066	The Fix: Reboot in Safe Mode Run Malwarebytes Restart normal Open your browser (IE/Chrome/FF/Opera) and change the proxy settings. Remove: IP: 127.0.0.1 Port: 5555

05-11-2010, 09:40 AM	#29
BIGTYMER Junior Achiever Industry Role: Join Date: Nov 2004 Location: Walled Garden Posts: 17,066	Apple was onto something?

05-11-2010, 09:43 AM	#30
woj <&(©¿©)&> Industry Role: Join Date: Jul 2002 Location: Chicago Posts: 47,882	does gfy host the banners themselves? or are they hotlinked from the advertiser's sites? __________________ Custom Software Development, email: woj#at#wojfun#.#com to discuss details or skype: wojl2000 or gchat: wojfun or telegram: wojl2000 Affiliate program tools: Hosted Galleries Manager Banner Manager Video Manager Wordpress Affiliate Plugin Pic/Movie of the Day Fansign Generator Zip Manager

05-11-2010, 09:45 AM	#32
Paul Markham Too old to care Industry Role: Join Date: Jun 2001 Location: On the sofa, watching TV or doing my jigsaws. Posts: 52,943	Alright here on Firefox. __________________ Blowout deal. 880 videos, 2,400 image sets, plus many RAW videos. $500. PM me for a deal. Skype Paulmarkham70

05-11-2010, 09:46 AM	#33
JA$ON Confirmed User Join Date: Aug 2007 Location: I'm from Downtown....Im from Mitch & Murry Posts: 1,329	+++++++++++1

05-11-2010, 09:51 AM	#34
sextoyking Confirmed User Industry Role: Join Date: Dec 2001 Location: Portland, OR. Posts: 6,034	I had norton on and ran Malwarebytes - didn't find anything.. Should I use another program to check or? __________________ ICQ: 52344098 -------------------------------------- 50% Commissions on all Product Sales. http://www.wishing.com/money

05-11-2010, 09:53 AM	#35
selena Confirmed User Join Date: Aug 2004 Location: On The Edge Posts: 7,992	Got it on my laptop. Can't say for sure that it was from here, as I had a few windows open. __________________ ~ Doer of Things at MetArtMoney Where Flawless Beauty Meets Art ~The MetArt Network ~ selena.delgado9

05-11-2010, 09:56 AM	#37
Davy Confirmed User Industry Role: Join Date: Apr 2006 Location: Germany Posts: 4,323	The page just refreshed itself, without me doing anything? Other than that, I have not noticed anything, yet. Had an error message earlier that Adobe Acrobat crashed in the browser. Maybe that was it... __________________ --- ICQ 14-76-98 <-- I don't use this at all

05-11-2010, 09:58 AM	#38
MaximX Confirmed User Join Date: May 2009 Posts: 250	I had a software that was installed last night called Antivirus Soft. I have norton, but that didn't help so I ran Spyware doctor and everything seem to be working fine now.

05-11-2010, 10:01 AM	#39
CyberHustler Unregistered Abuser Industry Role: Join Date: Feb 2006 Posts: 25,247	Nothing for me.. I browse this site under the GFY.com though, not GoFuckYourself.com.

05-11-2010, 10:03 AM	#40
CyberHustler Unregistered Abuser Industry Role: Join Date: Feb 2006 Posts: 25,247	And I'm on chrome...

05-11-2010, 10:05 AM	#42
Serge Litehead Confirmed User Industry Role: Join Date: Dec 2002 Location: Behind the scenes Posts: 5,190	happens with chrome on gfy.com top banner duke dollars has some white square on the left of it in chrome it tries to load adobe acrobat, then plugin crashes, html source looks clean.. didn't look into js __________________ SilverCrocodile.com Adult web design since '05

05-11-2010, 10:05 AM	#44
Icy Confirmed User Industry Role: Join Date: Mar 2002 Location: Spain Posts: 864	I posted this screenshoot in the thread i created, it showed up just when loading gofuckyourself, so it's not a sig but a banner, as it doesn't always pop, just from time to time (i guess when the banner enters in the rotation). Microsoft security essentials gave me an alert about Exploit:Win32/Pdfjsc.FG trying to infect my computer and blocked it, so yes, seems related to that acrobat error some of you saw. __________________ Kimia: Make money with mobile traffic, both adult and mainstream Skype: sinlords - ICQ: 83-235-881 email: ivan at kimia.mobi

05-11-2010, 10:18 AM	#46
SmokeyTheBear ►SouthOfHeaven Join Date: Jun 2004 Location: PlanetEarth MyBoardRank: GerbilMaster My-Penis-Size: extralarge MyWeapon: Computer Posts: 28,609	heres the exploit in a pdf file Code: Removed. __________________ hatisblack at yahoo.com Last edited by BarryP; 05-11-2010 at 01:11 PM..

05-11-2010, 10:20 AM	#47
candyflip Carpe Visio Industry Role: Join Date: Jul 2002 Location: New York Posts: 43,056	How are they loading it through GFY? __________________ Spend you some brain. Email Me