Trojan warning

[abe]

Hi again

Just want to let you know this.
Today somebody submitted this gallery to my tgp: http://xxxcash.404host.com/gallery001/main36.html
When you click on the link to http://www.adult-xxx-world.com/ then it tries to install a Trojan (according to Norton Antivirus).
It's hosted on a freehost ... of course. I sent an email to the freehost.
Sad things

[Surfn]

If someone had submitted it http://xxxcash.404host.com/gallery001/main36.html
to me I would have deleted it with out reviewing simply because it has 404 in the title.

[Cleo]

A lot of JavaScript on that page.

<!-- start: statistici.ro v3.7 -->

</h6>


<div align="left">
<p>
<script language="JavaScript" type="text/javascript">
<!--
uid='0A3Q';no='0';
var isr='',isc='',ir='';
var d = document;
ibn=navigator.appName;if(ibn.substring(0,9)=="Microsoft"){ibn="MSIE";}
ij=navigator.javaEnabled()==true?1:0;
if ((ir == "") || (ir == "unknown origin") || (ir == "unknown") || (ir == "undefined"))
if (d["parent"] != null)
if (parent["document"] != null)
if (parent.d["referrer"] != null)
if (typeof(parent.document) == "object"){
ir=parent.d.referrer;
}
if ((ir == "") || (ir == "unknown origin") || (ir == "unknown") || (ir == "undefined"))
if (d["referrer"] != null){
ir = d.referrer;
}
idu=escape(d.URL);idt=escape(d.title);
// -->
</script>
</p>
<p>
<script language="Javascript" type="text/javascript">
<!--
var ifi = 0;
var ifv = 0;
MSDetect = "false";
if (navigator.plugins && navigator.plugins.length){
x = navigator.plugins["Shockwave Flash"];
if (x){
ifi = 2;
if (x.description){
y = x.description;
ifv = y.charAt(y.indexOf('.')-1);
}
}
else
ifi = 1;
if (navigator.plugins["Shockwave Flash 2.0"]){
ifi = 2;
ifv = 2;
}
}
else if (navigator.mimeTypes && navigator.mimeTypes.length){
x = navigator.mimeTypes['application/x-shockwave-flash'];
if (x && x.enabledPlugin)
ifi = 2;
else
ifi = 1;
}
else
MSDetect = "true";
// -->
</script>
</p>
<p>
<script language="VBScript">
on error resume next
If MSDetect = "true" Then
For i = 2 to 5
If Not(IsObject(CreateObject("ShockwaveFlash.ShockwaveFlash." & i))) Then
Else
ifi = 2
ifv = i
End If
Next
End If
If ifi = 0 Then
ifi = 1
End If

</script>
</p>
<p>
<script language="JavaScript1.2" type="text/javascript">
<!--
s=screen;scw=s.width;sch=s.height;ibn!="Netscape"?scc=s.colorDepth:scc=s.pixelDepth;
isr=''+scw+'x'+sch;isc=scc;
// -->
</script>
</p>
<p>
<script language="JavaScript" type="text/javascript">
<!--
var d = document;wt='<a href="http://s.statistici.ro/?uid='+uid+'&no='+no+'&op=stats" target="_blank">';
wt+='<img border="0" src="http://log.statistici.ro/s/rmcounter?uid='+uid+'&no='+no+'&pu='+idu+'&pt='+idt+'&b='+ibn+'&rez='+isr+'&col='+isc;
wt+='&ref='+escape(ir)+'&j='+ij+'&f='+ifi+':'+ifv+'">';
wt+='</a>';d.writeln(wt);
//-->
</script>
</p>
<p>
<script type="text/javascript">var d = document;d.write("<");d.write("!-- ");</script>

</p>
<p><noscript><a href="http://s.statistici.ro/?uid=0A3Q&no=0&op=stats" target="_blank"><img border="0" src="http://log.statistici.ro/s/rmcounter?uid=0A3Q&no=0"></a></noscript></p>
<p><noscript></noscript>
<script type="text/javascript">var d = document;d.write(" --");d.write(">");</script>
</p>
<p>
<!-- end: statistici.ro -->
</p>
</div>
<h6>
<h6>
<h6>&nbsp;</h6>

<h6>
<h6><a HREF="http://www.top66.ro/vot.php?id=191"></a>

<br>
</h6>
</h6>
</h6>
</h6>
<p>
<!-- Cod HIT100.ro V1.0 -->
</p>
<p>
<script language="JavaScript" src="http://www.hit100.ro/imps.asp?id=3551">

</script>
</p>
<p><noscript> <a href="http://www.hit100.ro/"> HIT100.ro</a></noscript></p>
<p><noscript></noscript><noscript></noscript>
<!-- End Cod HIT100.ro -->

[abe]

Hi again.
I wonder what I should do now.
The host answer on my e-mail first was that the gallery would be removed. Immediately after that he answered that only the link to the domain that d/l the Trojan would be removed.
But bthe link is still there which I told him.
Now (the host) ask me for the country code of my browser.
I think something doesn't fit here. It looks a bit like the host himself is the guy that downloads the Trojan.
I'm not an expert in all these things. Can someone advice me what I should do please?
Thanks

[RawAlex]

Abe, if you are reviewing galleries, for a site, I would ban the host, ban the domain, and MOVE ON. Don't waste time on scammers. One less free host worth of submits won't make the world a worse place.

Alex

[GeorgeTH]

Originally posted by Cleo
A lot of JavaScript on that page.

Cleo, can you translate that, too?

[GeorgeTH]

Originally posted by RawAlex
Abe, if you are reviewing galleries, for a site, I would ban the host, ban the domain, and MOVE ON. Don't waste time on scammers. One less free host worth of submits won't make the world a worse place.

I totally agree!! Would be a different issue if you know the submitter as a long-time-reliable webmaster and the host is playing up...

[abe]

Thanks
I'll follow your advice.