Stunning Findings

ok heres the deal, i whent to get on the internet this morning and found that my home page had been set to somthing like http://%6F%64%7A%71%74%74%2E%74%2E%6...?%61%69%64=420
this sparked my curiosity. so i transilated it.
well the web address turned out to be odzqtt.t.muxa.cc with a little extetion that i believe made somthing download to my comupter....
When i WHOIS it, it came up as Muxa.cc (dhu)
i then pinged it and got the IP: 207.68.172.246
when i resolved this address it came up as mail.msn.com (what the heck???)
Furthermore i pinged odzqtt.t.muxa.cc and got the ip address
81.211.105.37
i did not get a responce from pinging so i traced it... My packets were lost at a server in Africa.(i think maybe a firewall)
i scanned the address and found a web server. i went to it but nothis is there....

Can someone Plz tell me what i am seeing????

escuss my spelling.....

i did not scan the firewalled address i scanned 81.211.105.37

Looks like you are seeing a spyware activity. I'd suggest going to look for HijackThis and CWShredder. Doing a quick google on muxa.cc got quite a few responses including this cached solution.

i got both those and i removed whatever i had... i'm mainly just wondering why it came up as Mail.msn.com

A quick google search turned up quite a few hits of this (muxa.cc) showing up in "hijackthis" logs. It looks like you have been hijacked. You might want to check out:

Hijackthis

Adware 6

Spybot-S&D

Cheers:

/EDIT
Sorry, MsM beat me to it.........as usual :D

i have highjack this and i already removed it, my question is why did it come up to Mail.msn.com

Hrmm.. Let's see:

odzqtt.t.muxa.cc

Quote:

---

Registrant:
Muxa C.C. ([email protected])

Mme Curie street, Verdun
Beirut, NONE 766
LB
+961.01351400

Domain Name: muxa.cc

Administrative, Technical, Billing Contact:
Muxa C.C. ([email protected])

Mme Curie street, Verdun
Beirut, NONE 766
LB
+961.01351400

Record created on Nov 23 2003.
Record expires on Nov 23 2006.
Domain servers:
cc.muxa.cc
xx.muxa.cc

---

http://muxa.cc has a MSN logo on it. Doing a traceroute does resolve it to a MSN address (see below). Off hand, I'd guess it's a business address perhaps?

Quote:

---

mittens@MsMittens:~$ traceroute muxa.cc
traceroute to muxa.cc (207.68.172.246), 30 hops max, 38 byte packets
1 192.168.0.1 (192.168.0.1) 1.069 ms 1.036 ms 1.109 ms
2 xx.aa.yy.zz (xx.aa.yy.zz) 25.615 ms 25.808 ms 22.926 ms
3 10.1.67.1 (10.1.67.1) 24.356 ms 51.682 ms 33.789 ms
4 msmittens.com (aa.xx.yy.zz) 19.812 ms 22.391 ms 8.273 ms
5 msmittens.com (aa.xx.yy.zz) 24.476 ms 21.083 ms 24.047 ms
6 dcr1-so-4-3-0.Chicago.cw.net (208.175.10.109) 34.042 ms 33.949 ms 30.905 ms
7 acr1-loopback.Seattle.cw.net (208.172.82.61) 70.136 ms 70.476 ms 72.288 ms
8 microsoft-hotmail-exodus.Seattle.cw.net (208.172.83.222) 147.788 ms 81.40 0 ms 82.795 ms
9 pos0-0.core2.sea2.us.msn.net (207.46.33.185) 84.180 ms 84.550 ms 83.938 ms
10 207.46.36.142 (207.46.36.142) 84.219 ms 83.839 ms 84.123 ms
11 vlan805.tuk2f-msfc-2b.us.msn.net (207.68.179.132) 84.864 ms 82.631 ms 83 .625 ms
12 * * *

---

Quote:

---

OrgName: Microsoft Corp
OrgID: MSFT
Address: One Microsoft Way
City: Redmond
StateProv: WA
PostalCode: 98052
Country: US

NetRange: 207.68.128.0 - 207.68.207.255
CIDR: 207.68.128.0/18, 207.68.192.0/20
NetName: MICROSOFT-CORP-MSN-BLK
NetHandle: NET-207-68-128-0-1
Parent: NET-207-0-0-0-0
NetType: Direct Allocation
NameServer: DNS1.CP.MSFT.NET
NameServer: DNS2.CP.MSFT.NET
NameServer: DNS1.TK.MSFT.NET
NameServer: DNS1.DC.MSFT.NET
NameServer: DNS1.SJ.MSFT.NET
Comment:
RegDate: 1996-03-26
Updated: 2003-01-15

TechHandle: ZM39-ARIN
TechName: Microsoft
TechPhone: +1-425-936-4200
TechEmail: [email protected]

OrgAbuseHandle: HOTMA-ARIN
OrgAbuseName: Hotmail Abuse
OrgAbusePhone: +1-425-882-8080
OrgAbuseEmail: [email protected]

OrgAbuseHandle: MSNAB-ARIN
OrgAbuseName: MSN ABUSE
OrgAbusePhone: +1-425-882-8080
OrgAbuseEmail: [email protected]

OrgAbuseHandle: ABUSE231-ARIN
OrgAbuseName: Abuse
OrgAbusePhone: +1-425-882-8080
OrgAbuseEmail: [email protected]

OrgNOCHandle: ZM23-ARIN
OrgNOCName: Microsoft Corporation
OrgNOCPhone: +1-425-882-8080
OrgNOCEmail: [email protected]

OrgTechHandle: MSFTP-ARIN
OrgTechName: MSFT-POC
OrgTechPhone: +1-425-882-8080
OrgTechEmail: [email protected]

# ARIN WHOIS database, last updated 2004-03-28 19:15
# Enter ? for additional hints on searching ARIN's WHOIS database.

---

another great question would be if muxa.cc has a direct link to MSN.com would that mean that msn would be funding this highjacking tool??????

Not necessarily. If the person who manages the website is paying for MSN to fund it, then MSN may not be aware of it. Perhaps you could forward this information to [email protected] and see how they respond (believe it or not, Hotmail and MSN Security are actually pretty good about responding to security emails).

Dear Abuse,
This morning I was accessing the Internet when I noticed my start page had been changed to a coded address
http://%6F%64%7A%71%74%74%2E%74%2E%...0?%61%69%64=420
to which I translated to "odzqtt.t.muxa.cc" with a directory that downloaded some spyware to my computer.
Upon further investigation I found that the IP address of Muxa.cc resolves to mail.msn.com
When I traced the address muxa.cc the last thing that came up was vlan805.tuk2f-msfc-2b.us.msn.net.

My question is "is MSN.com sponsoring a website that downloads unauthorized programs to its users PC's?"

I await your response,

Randy L. Warren

http://%6f%64%7a%71%74%74%2e%74%2e%6...?%61%69%64=420

does decode to http://odzqtt.t.muxa.cc/s.php

which resolves to 81.211.105.37

which belongs to:

inetnum: 81.211.105.0 - 81.211.105.255
netname: SOVINTEL-ICSTM2
descr: ICS TM, JSC
descr: 70 Bolshoy pr. V.O.
descr: 199002 St.-Petersburg
country: RU

using wget to avoid any kind of infection i downloaded the page (attached)

it appears to be a cool web search web page judging by the links:

<a href="http://coolpage.cc/cprv.php?aid=100038&ww=gambling">Gambling</a><br>
<a href="http://coolpage.cc/cprv.php?aid=100038&ww=casino">Casino</a><br>
<a href="http://coolpage.cc/cprv.php?aid=100038&ww=games">Games</a><br>
<a href="http://coolpage.cc/cprv.php?aid=100038&ww=movies">Movies</a><br>
<a href="http://coolpage.cc/cprv.php?aid=100038&ww=music">Music</a><br>
<a href="http://coolpage.cc/cprv.php?aid=100038&ww=sports">Sports</a><br>
<a href="http://coolpage.cc/cprv.php?aid=100038&ww=travel">Travel</a><br>

href="http://coolpage.cc/cprv.php?aid=100038&ww=betting">Betting</a><br>
<a
href="http://coolpage.cc/cprv.php?aid=100038&ww=blackjack">Blackjack</a><br>
<a
href="http://coolpage.cc/cprv.php?aid=100038&ww=casinos">Casinos</a><br>
<a
href="http://coolpage.cc/cprv.php?aid=100038&ww=gambling">Gambling</a><br>
<a
href="http://coolpage.cc/cprv.php?aid=100038&ww=horse+racing">Horse Racing</a><br>
<a
href="http://coolpage.cc/cprv.php?aid=100038&ww=poker">Poker</a>

<a href="http://coolpage.cc/cprv.php?aid=100038&ww=baseball">Baseball</a><br>
<a href="http://coolpage.cc/cprv.php?aid=100038&ww=basketball">Basketball</a><br>
<a href="http://coolpage.cc/cprv.php?aid=100038&ww=fishing">Fishing</a><br>
<a href="http://coolpage.cc/cprv.php?aid=100038&ww=football">Football</a><br>
<a href="http://coolpage.cc/cprv.php?aid=100038&ww=skiing">Skiing</a><br>
<a href="http://coolpage.cc/cprv.php?aid=100038&ww=soccer">Soccer</a>
etc., etc.

=+=+=+=+=+=+=+=+=+=+=
side note

if you omit the "/s.php" from the url odzqtt.t.muxa.cc/s.php you get re-directed to:

http://ww9.linklist.cc/index.php?aid=20037

another attempt to hide no doubt

=+=+=+=+=+=+=+=+=+=+=


there's also a ref. or two to msn search. i think microSoft might be interested in hearing about this especially with the phony dns record which points to the MS domain for the non-existant muxa.cc and the use of their "terms" page (below)

<div id=$Ci>
<span style='text-align:right;font-family:arial;font-size:7pt'><span title="Legal information for this site"><a href='http://go.msn.com/npl/terms.asp' target='_main'><!--Terms of Use--></a></span></span>
</div>


if(l!=""){
document.location="http://search.msn.com/results.asp?RS=CHECKED&Dom=en&un=doc&v=1&q="+l;
}else


so after all this....yup! looks like you been hi-jacked and their trying to hide their operation behind MicroSoft

can you let me know how you where able to download the sorce from the page???

just curious.. i think i have a good idea but i just want ot know for sure

a command line utility called wget. it's contained in unixutils which are windows versions (ports) of unix tools.

http://unxutils.sourceforge.net/UnxUtils.zip


you just do:

wget http://odzqtt.t.muxa.cc/s.php

from the command prompt. it can do much more than this. read the documentation. its a really great tool.

Gosh, Microsoft downloading spyware? Whooda Thunk! :D

considering the registrar that put through this request my guess is the Ip is hijacked and the registry info is faked...MSN has nothing to do with this beyond haveing too many unused ips that some one was able to grab.

agreed....

here is the responce from MSN.com

This is an auto-generated response designed to let you know that we have received your report, which will be investigated personally by one of our Support Representatives within 24 hours. Your report is important to us and we will treat it accordingly. You will receive no further contact from MSN about this report, unless we need further information to complete our investigation, or extenuating circumstances apply.

MSN does not provide telephone support for abuse related issues. All abuse issues must be reported to, and are addressed via email, at [email protected].

Unsolicited e-mail (or spam) is an issue challenging all ISPs and web-based e-mail services. We want you to know that MSN does not sell its membership lists, or give permission to anyone who wishes to send unsolicited e-mails. MSN does not monitor or review e-mail messages that are sent to MSN customers, but we do provide filtering systems which can be used by account holders to help them control the messages delivered to their Inbox.

Please note that we can only take action against MSN users' accounts (those which have e-mail address that ends with “@MSN.com”), and not those from any other domain. If the source of abuse in your report does not originate from an MSN account, we will be unable to assist you, and recommend that you send your report directly to the abuse department of the originating domain or service provider. You can learn how to determine where an e-mail message originated from at: http://support.msn.com/solutionartic...ncom&aid=7788.

To report e-mail abuse originating from a Hotmail account, please contact: [email protected].

When sending a report to any abuse department, please include the full, unedited content and original e-mail headers of the message, as well as a brief description of the issue. If the full, unedited content and original e-mail headers are not provided, the report cannot be investigated. For assistance on how to locate the headers, please go to http://support.msn.com/solutionartic...ncom&aid=7788. Please send this information only one time, as sending multiple reports about the same user will hamper the ability to deal with the situation in an effective and timely manner.

It’s common for unsolicited e-mail to contain a forged address on the “From:" line. This means that, while an unsolicited e-mail may appear to have been sent from an MSN account, it can just as easily have been sent from another domain. The only way to determine the original source is by investigating the e-mail header. Detailed instructions on how to do this are provided via the link above. If the message did originate from an MSN account, we will take immediate and appropriate action.

If it looks like a message was sent to you from your MSN account, the spammer has likely used software which allows your email alias to be placed into the "From" field, the same MSN ID as in the "To" field. This would not necessarily indicate the spammer has access to your MSN account, personal information, or communications.

To learn how to report non e-mail abuse issues, please visit: http://support.msn.com/solutionartic...ncom&aid=7786.

If you suspect a crime is being committed, you should report it directly to your local police authorities. MSN can only require its users to conform to its Terms of Use and Subscription Agreement. MSN reports all cases of suspected child pornography to the proper authorities.


Please do not respond to this e-mail, as any messages sent to this address by using the “Reply” button will not receive a response. We appreciate your understanding that due to our privacy policy, we will not report back to you about any action taken against MSN users. However, we want to assure you that we will take appropriate action against MSN users who have violated the MSN Terms of Use or the MSNIA Subscription Agreement.

To learn how to help keep kids safe online go to A Parent’s Guide to Online Safety at http://onlinesafetyguide.msn.com

To learn more about MSN Mail and Junk Mail Filters please visit: http://support.msn.com

well so far MSN have not done anything.... that kinda tells me that they are not conserned with issues that involve there network, or there users security............

maybe they are financing that site.......

MsM,

When I did WHOIS operation on www.networksolutions.com , for odzqtt.t.muxa.cc , it showed up ..
odzqtt.t.muxa.cc
No match for domain "ODZQTT.T.MUXA.CC".
No results showed up even if I did WHOIS on muxa.cc ..
What could be the mistake ??

Can u plz. tell me how did u get the hell lot of information about them ??

When I did traceroute.. It showed Request timed out after the 3rd router (maybe coz of a firewall) ..

I'm askin this due to high cuiosity ... How could MsM find so much info about them ?? Was it with some tool.. ??
Can anone help me. ??

Thanx in advance .

GeekTools :D

It looked like a basic whois query from a *nix box. The fact is that there are various servers for whois responses, and MsM used whois.arin.net... you had something like whois.networksolutions.com, hence the difference in response [has to do with whois database].

The 'tool' is whois in *nix. Maybe unixutils has it, if not I think something similar can be acheived with nslookup in Win XP [and I'd guess 200/2003 too].

The traceroute stop may be due to a firewall, given that your path to the server is different than MsM's. I can't test it now because of an issue with my traceroute, but that seens the reason. Simply, becasue of a different location and ISP you're signal goes through another path, and somewhere there there's a firewall.

[edit]
MsM is everywhere. Obviously she posted as I was posting. This is freaky :)
[/edit]