GFY Installing Malware - Post If You've Got Hit - Page 2 - GoFuckYourself.com

OY · 05-11-2010, 10:29 AM

I use FF and have not seen warning - coincidence, is FF "better" or is it just not picking it up?

SmokeyTheBear · 05-11-2010, 10:31 AM

my guess would be this isn't an attack against gfy users but more likely a compromised advertiser ( it has happened before several times), this should be a wake up call to admin to stop letting advertise host the ads

CIVMatt · 05-11-2010, 10:31 AM

Mother fucker...

this laptop is ok but my desktop is trashed, cant start or do anything keep getting the "your infected, run this antivirus" bs... can't start any antivirus software or anything

And yes using FF

candyflip · 05-11-2010, 10:35 AM

Quote:

Originally Posted by CIVMatt

Mother fucker...

this laptop is ok but my desktop is trashed, cant start or do anything keep getting the "your infected, run this antivirus" bs... can't start any antivirus software or anything

And yes using FF

Directions to get rid of it are posted here somewhere. But yeah...it's a bitch of a hijacking.

iSpyCams · 05-11-2010, 10:40 AM

well I got some messages and a fake adware eliminator thingy but I closed it all out and rebooted and so far I think I'm fine. This is a disposable win7 install anyway.

KillerK · 05-11-2010, 10:41 AM

It's probably quickbucks, like what the did with the nats guys on porngraph.

Barefootsies · 05-11-2010, 10:42 AM

Quote:

Originally Posted by KillerK

It's probably quickbucks, like what the did with the nats guys on porngraph.

quantum-x · 05-11-2010, 10:43 AM

Quote:

Originally Posted by Oystein

I use FF and have not seen warning - coincidence, is FF "better" or is it just not picking it up?

The 'red window' is a Chrome invention, if I am not mistaken

quantum-x · 05-11-2010, 10:43 AM

Quote:

Originally Posted by KillerK

It's probably quickbucks, like what the did with the nats guys on porngraph.

We love speculation like that.

BestXXXPorn · 05-11-2010, 10:49 AM

Windows 7, Chrome... No anti-virus, no anti-malware...

Got the 3D rendering popup, closed it, no malware installed...

cypocrypt · 05-11-2010, 10:58 AM

Quote:

Originally Posted by CIVMatt

Mother fucker...

this laptop is ok but my desktop is trashed, cant start or do anything keep getting the "your infected, run this antivirus" bs... can't start any antivirus software or anything

And yes using FF

This for me also :-\

R

Serge Litehead · 05-11-2010, 11:00 AM

white square i was talking about earlier next to top banner

CyberHustler · 05-11-2010, 11:05 AM

Quote:

Originally Posted by candyflip

I do both of these as well AND somehow got infected. So don't think you're safe

I got it again, while I got up from the computer for a few minutes. Came back and the "Adobe Acrobat crashed in the browser" error.

Finally tried to get me. It's not a certain GFY sponsor banner, because I get hit whenever I click the first page of this thread now and for any banner. I'm not an expert on this, but maybe it's somebodies sig who posted in this thread on the first page?

Avast for the win

Just Mike · 05-11-2010, 11:09 AM

it got me this morning.

I just deleted it but took me an hour to run the damn AV software to purge it.

DAMN YOU SPYWARE

Tom_PM · 05-11-2010, 11:16 AM

If it's in a sig, then it's *ALSO* in a sig. Because as I said, it hit me before I was even logged in this morning. It has tried to install several times since, but I have Java disabled now.

AVG (current as of this moment) has YET to warn me of it, and it's been around for months now.

halfpint · 05-11-2010, 11:17 AM

Well I finally got rid of it using Malwarebytes in safe mode and changing the proxy settings thanks to advice from peeps on GFY It took me best part of half the day cause of the amount of programs I have on my pc and the two large hardisks which I have. What a complete waste of a day...

I think waht was happening was when I was talking on GFY it just re-installed itself after I ran malewarebytes the first time in safe mode

Eric could you please let us know if this was indeed from GFY

CIVMatt · 05-11-2010, 11:20 AM

Thanks Candy I'm working the solution right now... how do I change that port setting on firefox?

Loki · 05-11-2010, 11:24 AM

NanoBot: page 1 of this thread is setting off your Avast due to Smokey posting the code he found of the exploit, I can not get past that post (not his sig as it appears prior) but the actual post unless I manually type "&page=2" in my address bar.

I also can't quote reply to you or anyone else here for the same reason.

For those of you with Avast reload page 1 of this thread and look where it stops loading the page.

However the real problem IS in fact one or more of the banner ads up top

-Loki-

candyflip · 05-11-2010, 11:25 AM

Quote:

Originally Posted by halfpint

Eric could you please let us know if this was indeed from GFY

We are definitely being infected while surfing GFY.

halfpint · 05-11-2010, 11:25 AM

Quote:

Originally Posted by CIVMatt

Thanks Candy I'm working the solution right now... how do I change that port setting on firefox?

Go to tools/options/advanced then click on the network tab and then settings It will let you congifure your proxy settings

Serge Litehead · 05-11-2010, 11:26 AM

Quote:

Originally Posted by Loki

NanoBot: page 1 of this thread is setting off your Avast due to Smokey posting the code he found of the exploit, I can not get past that post (not his sig as it appears prior) but the actual post unless I manually type "&page=2" in my address bar.

I also can't quote reply to you or anyone else here for the same reason.

For those of you with Avast reload page 1 of this thread and look where it stops loading the page.

However the real problem IS in fact one or more of the banner ads up top

-Loki-

avast maybe triggered by text string, but Smokey's copy is just plain text - it's harmless

candyflip · 05-11-2010, 11:27 AM

Thanks for posting that Firefox info. I couldn't find it myself and actually had to change it still.

HAPPYPEEKERS · 05-11-2010, 11:28 AM

It fucked my computer ALLLL up :-(

Zverka · 05-11-2010, 11:32 AM

Quote:

Originally Posted by candyflip

How are they loading it through GFY?

It seems like "iframe injection" to me. Google it to see more info.
Someones box was compromised, gfy server or advertisers server.
They load virus thru injected iframe.
I strongly recommend to have good firewall like comodo firewall and
good antivirus like avira free. Both are free options and are golden to me
for last 3 years ;).

mechanicvirus · 05-11-2010, 11:33 AM

what a fucking disaster, who is responsible for this mess

MikeFold · 05-11-2010, 11:36 AM

it just tried to get me again on this machine (with FF)
i have been to no other sites since booting this box up

Nikki_Licks · 05-11-2010, 11:36 AM

Yep, just got hit...mother fucker!!!!!!

I am using FF.
all I got was windows security alert...attacked through port#.....

halfpint · 05-11-2010, 11:39 AM

could this be anything to do with it JS:Pdfka-AFK [Expl] Just got it up with avast

Man we need the mods in here to sort this shit out

CyberHustler · 05-11-2010, 11:39 AM

Quote:

Originally Posted by Loki

NanoBot: page 1 of this thread is setting off your Avast due to Smokey posting the code he found of the exploit, I can not get past that post (not his sig as it appears prior) but the actual post unless I manually type "&page=2" in my address bar.

I also can't quote reply to you or anyone else here for the same reason.

For those of you with Avast reload page 1 of this thread and look where it stops loading the page.

However the real problem IS in fact one or more of the banner ads up top

-Loki-

I think GFY's OpenX installation is hacked!

And I only get hit in this thread and on the first page, I'm guessing thanks to smokey. I get hit nowhere else on GFY.

BIGTYMER · 05-11-2010, 11:40 AM

White banner and the java console popped up....

halfpint · 05-11-2010, 11:42 AM

Quote:

Originally Posted by candyflip

Thanks for posting that Firefox info. I couldn't find it myself and actually had to change it still.

Your welcome and thanks to you and bigtymer and all the other users for helping me to get rid of this

quantum-x · 05-11-2010, 11:42 AM

URL causing issues is coinurlredirect.com

BIGTYMER · 05-11-2010, 11:43 AM

Quote:

Originally Posted by halfpint

Your welcome and thanks to you and bigtymer and all the other users for helping me to get rid of this

No problem man! Glad to help. Its a nasty little problem.

BIGTYMER · 05-11-2010, 11:45 AM

Quote:

Originally Posted by quantum-x

URL causing issues is coinurlredirect.com

http://www.malwareurl.com/listing.ph...edirection.com

Zverka · 05-11-2010, 11:45 AM

I have forgot to warning you that if you are infected and have
ftp accounts stored somewhere in your computer that high
chances all your sites resides in that ftp accounts are infected
also. So check it out now or your sites will be flagged by google
as spyware source. Good luck lads. It is such pain in the ass.
When that happened to me I was in killing mood for days.

Loki · 05-11-2010, 11:46 AM

holograph: That might be true BUT all I can say is Avast will NOT load anything past part of that code, It does not load his sig, it just cut's off at the code snippit, IF it was his sig though, why are the prior posts loaded with it?

What post came after Smokey's code snippit? maybe that is what Avast is blocking then?

I'll make and post a shot real quick

-Loki-

CIVMatt · 05-11-2010, 11:46 AM

CyberHustler · 05-11-2010, 11:47 AM

You know what's not cool is that dudes are quick to ban people over petty shit around these parts, but we can sit here getting infected with whatever and nobody gives a shit. I guarantee if post: "Hey guys, meet me over at (insert another adult board here) since GFY is fucking up", I will be banned within minutes.

If it's the banners then all somebody would have to do is remove the ad codes, fix this shit, then put them back... right? Or at least give that a try?

Barefootsies... try working your mod magic, bro. Pretend somebody just broke a rule and you need to contact somebody in charge asap so you can make a banned thread.

BIGTYMER · 05-11-2010, 11:47 AM

Quote:

Originally Posted by adultish

I have forgot to warning you that if you are infected and have
ftp accounts stored somewhere in your computer that high
chances all your sites resides in that ftp accounts are infected
also. So check it out now or your sites will be flagged by google
as spyware source. Good luck lads. It is such pain in the ass.
When that happened to me I was in killing mood for days.

What makes you think that?

tical · 05-11-2010, 11:48 AM

yup got hit too, had to do a system restore... it wouldn't let me execute anything after it loaded (kept saying "whatever.exe is infected"). i updated acrobat reader, not sure if that will help future attempts...

what a pain in the ass

halfpint · 05-11-2010, 11:50 AM

Quote:

Originally Posted by Loki

holograph: That might be true BUT all I can say is Avast will NOT load anything past part of that code, It does not load his sig, it just cut's off at the code snippit, IF it was his sig though, why are the prior posts loaded with it?

What post came after Smokey's code snippit? maybe that is what Avast is blocking then?

I'll make and post a shot real quick

-Loki-

I had avast running when I got it and it did not give me any warning at all and it still does not even when I view Smokey's Code snippet

I am running a full scan with avast now and so far it has come up with this JS:Pdfka-AFK [Expl] which was in the temp folder in firefox

Loki · 05-11-2010, 11:50 AM

lol took me 5 tries to get page 1 to actually load again, Avast was blocking the entire page, BUT I finally got it to load up to the stopping point....

-Loki-

tical · 05-11-2010, 11:50 AM

Quote:

Originally Posted by BIGTYMER

What makes you think that?

some of these adware installations will dump password data from browsers and ftp clients and send them to a host somewhere... i've seen it happen on several machines of mine over the years

i would find a plain text file on my system that had all of my usernames/passwords in it (ie, firefox, cuteftp)

BIGTYMER · 05-11-2010, 11:52 AM

Quote:

Originally Posted by tical

some of these adware installations will dump password data from browsers and ftp clients and send them to a host somewhere... i've seen it happen on several machines of mine over the years

i would find a plain text file on my system that had all of my usernames/passwords in it (ie, firefox, cuteftp)

Fuck... I better change all passwords just to be safe.

Nikki_Licks · 05-11-2010, 11:52 AM

It wont let me run mallwarebytes. A windows security window pops up preventing me opening mallware...WTF?

halfpint · 05-11-2010, 11:53 AM

Quote:

Originally Posted by Loki

lol took me 5 tries to get page 1 to actually load again, Avast was blocking the entire page, BUT I finally got it to load up to the stopping point....

-Loki-

Thats weird how your avast is stopping it and mine aint doing shit

Loki · 05-11-2010, 11:54 AM

halfpint: this is what I have been seeing for the last two hours now:

Notice the address is this thread, I tab GFY most times, so I had just opened this thread in a new tab and got that warning, and the other screenshot above (stop shot) is as far as I can get without manually coming to the 2nd page

What I'm using:
Avast 5.0.507
Virus Definitions version: 100511-0

All live scans are enabled (or shields)

-Loki-

halfpint · 05-11-2010, 11:55 AM

Quote:

Originally Posted by Nikki_Licks

It wont let me run mallwarebytes. A windows security window pops up preventing me opening mallware...WTF?

restart you computer in safemode then run malwarebytes and then change the proxy settings in your browsers

CyberHustler · 05-11-2010, 11:58 AM

Quote:

Originally Posted by Loki

halfpint: this is what I have been seeing for the last two hours now:

Notice the address is this thread, I tab GFY most times, so I had just opened this thread in a new tab and got that warning, and the other screenshot above (stop shot) is as far as I can get without manually coming to the 2nd page

What I'm using:
Avast 5.0.507
Virus Definitions version: 100511-0

All live scans are enabled (or shields)

-Loki-

Your avast looks cooler than mine. Was there some kind of upgrade I missed out on?

sandman! · 05-11-2010, 11:58 AM

http://www.eset.com/download
http://www.eset.com/download
http://www.eset.com/download
http://www.eset.com/download
http://www.eset.com/download
http://www.eset.com/download

05-11-2010, 10:29 AM	#51
OY Industry Pioneer Industry Role: Join Date: Oct 2002 Location: USA/EU/ASIA Posts: 5,401	I use FF and have not seen warning - coincidence, is FF "better" or is it just not picking it up? __________________ Around since 1997, and the company that introduced "Cascading Billing" in MPA3® Affiliate Management and Tracking Software Outsourcing With A Norwegian Twist - NordBits - Inquire within!

05-11-2010, 10:31 AM	#52
SmokeyTheBear ►SouthOfHeaven Join Date: Jun 2004 Location: PlanetEarth MyBoardRank: GerbilMaster My-Penis-Size: extralarge MyWeapon: Computer Posts: 28,609	my guess would be this isn't an attack against gfy users but more likely a compromised advertiser ( it has happened before several times), this should be a wake up call to admin to stop letting advertise host the ads __________________ hatisblack at yahoo.com

05-11-2010, 10:31 AM	#53
CIVMatt Amateur Pimpin Industry Role: Join Date: Aug 2004 Location: Orlando, FL Posts: 13,075	Mother fucker... this laptop is ok but my desktop is trashed, cant start or do anything keep getting the "your infected, run this antivirus" bs... can't start any antivirus software or anything And yes using FF __________________ Make easy money with Webcams

05-11-2010, 10:49 AM	#60
BestXXXPorn Confirmed User Join Date: Jun 2009 Location: Asheville, NC Posts: 2,277	Windows 7, Chrome... No anti-virus, no anti-malware... Got the 3D rendering popup, closed it, no malware installed... __________________ ICQ: 258-202-811 \| Email: eric{at}bestxxxporn.com

05-11-2010, 11:00 AM	#62
Serge Litehead Confirmed User Industry Role: Join Date: Dec 2002 Location: Behind the scenes Posts: 5,190	white square i was talking about earlier next to top banner __________________ SilverCrocodile.com Adult web design since '05

05-11-2010, 10:40 AM	#55
iSpyCams Amateur Gynecologist Industry Role: Join Date: May 2009 Location: Medellin Posts: 4,436	well I got some messages and a fake adware eliminator thingy but I closed it all out and rebooted and so far I think I'm fine. This is a disposable win7 install anyway.

05-11-2010, 10:41 AM	#56
KillerK Confirmed User Join Date: May 2008 Posts: 3,406	It's probably quickbucks, like what the did with the nats guys on porngraph.

05-11-2010, 11:09 AM	#64
Just Mike Confirmed User Industry Role: Join Date: Sep 2002 Location: In a land FAR FAR away Posts: 3,726	it got me this morning. I just deleted it but took me an hour to run the damn AV software to purge it. DAMN YOU SPYWARE __________________ EMAIL: [email protected] / ICQ: 56205262 AWEMPIRE

05-11-2010, 11:16 AM	#65
Tom_PM Porn Meister Industry Role: Join Date: Feb 2005 Posts: 16,443	If it's in a sig, then it's ALSO in a sig. Because as I said, it hit me before I was even logged in this morning. It has tried to install several times since, but I have Java disabled now. AVG (current as of this moment) has YET to warn me of it, and it's been around for months now. __________________ 43-922-863 Shut up and play your guitar.

05-11-2010, 11:17 AM	#66
halfpint GFY's Halfpint Industry Role: Join Date: Jun 2007 Location: UK Posts: 15,223	Well I finally got rid of it using Malwarebytes in safe mode and changing the proxy settings thanks to advice from peeps on GFY It took me best part of half the day cause of the amount of programs I have on my pc and the two large hardisks which I have. What a complete waste of a day... I think waht was happening was when I was talking on GFY it just re-installed itself after I ran malewarebytes the first time in safe mode Eric could you please let us know if this was indeed from GFY __________________ Get FREE website listings on Cryptocoinshops.net

05-11-2010, 11:20 AM	#67
CIVMatt Amateur Pimpin Industry Role: Join Date: Aug 2004 Location: Orlando, FL Posts: 13,075	Thanks Candy I'm working the solution right now... how do I change that port setting on firefox? __________________ Make easy money with Webcams

05-11-2010, 11:24 AM	#68
Loki Confirmed User Industry Role: Join Date: Feb 2004 Location: Michigan Posts: 4,420	NanoBot: page 1 of this thread is setting off your Avast due to Smokey posting the code he found of the exploit, I can not get past that post (not his sig as it appears prior) but the actual post unless I manually type "&page=2" in my address bar. I also can't quote reply to you or anyone else here for the same reason. For those of you with Avast reload page 1 of this thread and look where it stops loading the page. However the real problem IS in fact one or more of the banner ads up top -Loki- __________________ MAKE MONEY WITH 3D TOONS! Need hosting? LokiCa$h Uses Amerinoc and love them! Skype: LokiPorn Or Email 3dloki\|at\|gmail.com

05-11-2010, 11:27 AM	#72
candyflip Carpe Visio Industry Role: Join Date: Jul 2002 Location: New York Posts: 43,057	Thanks for posting that Firefox info. I couldn't find it myself and actually had to change it still. __________________ Spend you some brain. Email Me

05-11-2010, 11:28 AM	#73
HAPPYPEEKERS Confirmed User Industry Role: Join Date: Feb 2004 Location: Margaritaville Posts: 7,559	It fucked my computer ALLLL up :-( __________________ Please Read All Of My Posts In A Sarcastic Tone So You Get The Full Effect!! HappyPeekers - April

05-11-2010, 11:33 AM	#75
mechanicvirus Confirmed User Industry Role: Join Date: Feb 2005 Location: Southern California Posts: 3,759	what a fucking disaster, who is responsible for this mess

05-11-2010, 11:36 AM	#76
MikeFold Confirmed User Join Date: Nov 2001 Location: semi-retired Posts: 465	it just tried to get me again on this machine (with FF) i have been to no other sites since booting this box up __________________ nothing to promote

05-11-2010, 11:36 AM	#77
Nikki_Licks Confirmed User Join Date: May 2005 Location: Behind The Lens Posts: 6,323	Yep, just got hit...mother fucker!!!!!! I am using FF. all I got was windows security alert...attacked through port#..... __________________ Amateur Content ICQ: 292 356 077 Last edited by Nikki_Licks; 05-11-2010 at 11:39 AM..

05-11-2010, 11:39 AM	#78
halfpint GFY's Halfpint Industry Role: Join Date: Jun 2007 Location: UK Posts: 15,223	could this be anything to do with it JS:Pdfka-AFK [Expl] Just got it up with avast Man we need the mods in here to sort this shit out __________________ Get FREE website listings on Cryptocoinshops.net

05-11-2010, 11:40 AM	#80
BIGTYMER Junior Achiever Industry Role: Join Date: Nov 2004 Location: Walled Garden Posts: 17,066	White banner and the java console popped up....

05-11-2010, 11:42 AM	#82
quantum-x Confirmed User Join Date: Feb 2002 Location: ICQ: 251425 Fr/Au/Ca Posts: 6,863	URL causing issues is coinurlredirect.com __________________ PrettyInCash.com - BoozedGFs.com - TeenGFs.com - JizzGFs.com- MilfUploads.com -

05-11-2010, 11:45 AM	#85
Zverka Confirmed User Join Date: Jun 2005 Location: EU Posts: 278	I have forgot to warning you that if you are infected and have ftp accounts stored somewhere in your computer that high chances all your sites resides in that ftp accounts are infected also. So check it out now or your sites will be flagged by google as spyware source. Good luck lads. It is such pain in the ass. When that happened to me I was in killing mood for days. __________________

05-11-2010, 11:46 AM	#86
Loki Confirmed User Industry Role: Join Date: Feb 2004 Location: Michigan Posts: 4,420	holograph: That might be true BUT all I can say is Avast will NOT load anything past part of that code, It does not load his sig, it just cut's off at the code snippit, IF it was his sig though, why are the prior posts loaded with it? What post came after Smokey's code snippit? maybe that is what Avast is blocking then? I'll make and post a shot real quick -Loki- __________________ MAKE MONEY WITH 3D TOONS! Need hosting? LokiCa$h Uses Amerinoc and love them! Skype: LokiPorn Or Email 3dloki\|at\|gmail.com

05-11-2010, 11:46 AM	#87
CIVMatt Amateur Pimpin Industry Role: Join Date: Aug 2004 Location: Orlando, FL Posts: 13,075	__________________ Make easy money with Webcams

05-11-2010, 11:47 AM	#88
CyberHustler Unregistered Abuser Industry Role: Join Date: Feb 2006 Posts: 25,269	You know what's not cool is that dudes are quick to ban people over petty shit around these parts, but we can sit here getting infected with whatever and nobody gives a shit. I guarantee if post: "Hey guys, meet me over at (insert another adult board here) since GFY is fucking up", I will be banned within minutes. If it's the banners then all somebody would have to do is remove the ad codes, fix this shit, then put them back... right? Or at least give that a try? Barefootsies... try working your mod magic, bro. Pretend somebody just broke a rule and you need to contact somebody in charge asap so you can make a banned thread.

05-11-2010, 11:48 AM	#90
tical Confirmed User Join Date: Feb 2002 Location: Las Vegas Posts: 6,504	yup got hit too, had to do a system restore... it wouldn't let me execute anything after it loaded (kept saying "whatever.exe is infected"). i updated acrobat reader, not sure if that will help future attempts... what a pain in the ass

05-11-2010, 11:50 AM	#92
Loki Confirmed User Industry Role: Join Date: Feb 2004 Location: Michigan Posts: 4,420	lol took me 5 tries to get page 1 to actually load again, Avast was blocking the entire page, BUT I finally got it to load up to the stopping point.... -Loki- __________________ MAKE MONEY WITH 3D TOONS! Need hosting? LokiCa$h Uses Amerinoc and love them! Skype: LokiPorn Or Email 3dloki\|at\|gmail.com

05-11-2010, 11:52 AM	#95
Nikki_Licks Confirmed User Join Date: May 2005 Location: Behind The Lens Posts: 6,323	It wont let me run mallwarebytes. A windows security window pops up preventing me opening mallware...WTF? __________________ Amateur Content ICQ: 292 356 077

05-11-2010, 11:54 AM	#97
Loki Confirmed User Industry Role: Join Date: Feb 2004 Location: Michigan Posts: 4,420	halfpint: this is what I have been seeing for the last two hours now: Notice the address is this thread, I tab GFY most times, so I had just opened this thread in a new tab and got that warning, and the other screenshot above (stop shot) is as far as I can get without manually coming to the 2nd page What I'm using: Avast 5.0.507 Virus Definitions version: 100511-0 All live scans are enabled (or shields) -Loki- __________________ MAKE MONEY WITH 3D TOONS! Need hosting? LokiCa$h Uses Amerinoc and love them! Skype: LokiPorn Or Email 3dloki\|at\|gmail.com Last edited by Loki; 05-11-2010 at 11:56 AM..

05-11-2010, 11:58 AM	#100
sandman! Icq: 14420613 Industry Role: Join Date: Mar 2001 Location: chicago Posts: 15,432	http://www.eset.com/download http://www.eset.com/download http://www.eset.com/download http://www.eset.com/download http://www.eset.com/download http://www.eset.com/download __________________ Need WebHosting ? Email me for some great deals [email protected]