🚀 go-pugleaf

On 01/03/2009 07:48 AM, Doc sent:
> There's a website for a couple of famous jazz trumpeters, the late
> Candoli brothers.
> 
> http://www.candoli.com
> 
> It's a legitimate site, these guys were icons. There's a photo in
> their gallery of Pete playing wearing a Superman suit. I posted the
> direct link to it in a trumpet forum.
> 
> http://www.candoli.com/pic28.htm
> 
> Several people reported that clicking the link brought up that
> Antivirus 2009 malware bogus alert. I tried it and got the same
> thing.
> 
> How does that Antivirus 2009 page hijack attempts to go to other sites
> like that? How does it get attached to certain ones?

Their web server is infected.

> 
> How is it these people haven't been shut down?

Which people?  The web page author or maintainer?  The hosting company?
 The ISP?  Most of these folks are indemnified and will still collect
recurring fees.  I don't wish to disrespect you or your query but this
is what safe hex is about.

-- 
1PW  @?6A62?FEH9:DE=6o2@=]4@> [r4o7t]

On Jan 3, 12:55 pm, 1PW <barcrnahgjuvf...@nby.pbz> wrote:

> Which people?  The web page author or maintainer?  The hosting company?
>  The ISP?  Most of these folks are indemnified and will still collect
> recurring fees.  I don't wish to disrespect you or your query but


...but what, I should just *know*?

That's the point of asking questions. If I knew the answers I wouldn't
be asking.

On Jan 3, 12:55 pm, 1PW <barcrnahgjuvf...@nby.pbz> wrote:

> > How is it these people haven't been shut down?
>
> Which people?  The web page author or maintainer?  The hosting company?
>  The ISP?  


Whoever is creating and is on the money collecting end of the malware
site.

"Doc" <docsavage20@yahoo.com> wrote in message 
news:6a82feef-8a3a-4042-bfd0-684ce1e56ad3@l39g2000yqn.googlegroups.com...
> There's a website for a couple of famous jazz trumpeters, the late
> Candoli brothers.
>
> http://www.candoli.com
>
>

I clicked that link and my Kaspersky security suite blocked the URL
with exactly the same warning it gives with the blockyell.com scam.
It seems a number of established security vendors have listed
the links you posted as very naughty in the same way as blockyell.
But thats why you posted them isn't it, you're spreading malware. 

Doc wrote:
> There's a website for a couple of famous jazz trumpeters, the late
> Candoli brothers.
> 
> hxxp://www.candoli.com
> 
> It's a legitimate site, these guys were icons. There's a photo in
> their gallery of Pete playing wearing a Superman suit. I posted the
> direct link to it in a trumpet forum.
> 
> hxxp://www.candoli.com/pic28.htm
> 
> Several people reported that clicking the link brought up that
> Antivirus 2009 malware bogus alert. I tried it and got the same
> thing.
> 
> How does that Antivirus 2009 page hijack attempts to go to other sites
> like that? How does it get attached to certain ones?
> 
> How is it these people haven't been shut down?


Modified the links


There are really two options

1. The owners of the website are part of the group making money from 
sales of rogue software

2. Most likely the owners of the site don't know how to properly secure 
their site and it is vulnerable to exploits that allow a third party to 
modify the content.


You can find more info at <http://badwarebusters.org/>

If you put the url into http://unmaskparasites.com/ you can see that it 
is redirecting traffic to malicious sites


John

On Jan 3, 2:32 pm, "Fix it" <inva...@nothing.dil> wrote:

> It seems a number of established security vendors have listed
> the links you posted as very naughty in the same way as blockyell.
> But thats why you posted them isn't it, you're spreading malware.


Um, no. As stated I'm trying to understand the how and why.

Did I not state exactly what behavior I was observing thereby giving
you complete "click at your own risk" warning?  And you're shocked
that you found that yes, it does exactly what I said it would do
because why?

Perhaps you misunderstood the title of the thread?

Initially when I clicked the website home page it didn't do it,
several times. I only observed it when going to the direct link for
the photo. I just now got it when clicking on the home page itself.

On Jan 3, 2:44 pm, John Mason Jr <notva...@cox.net.invalid> wrote:

> If you put the url intohttp://unmaskparasites.com/you can see that it
> is redirecting traffic to malicious sites


Interesting, even though there's an initial "this site is clean"
message, it shows various redirects.

I wrote to the site admin and they contacted the site server and it's
supposed to be cured. I just clicked on the links and it doesn't seem
to be doing it now.

"Doc" <docsavage20@yahoo.com> wrote in message 
news:83d7c6f7-d0c1-41c5-a963-536d6ed033db@z6g2000pre.googlegroups.com...
>I wrote to the site admin and they contacted the site server and it's
> supposed to be cured. I just clicked on the links and it doesn't seem
> to be doing it now.
>
>
Oh yes it is still doing it. And Firefox blocks it, Kaspersky and Norton 
block it,
and you are an obvious google flop.
Anyone reading using IE and an out of date firewall, or no firewall, then do
NOT click on the links posted by the google groups flop. 

Doc wrote:
> On Jan 3, 2:44 pm, John Mason Jr <notva...@cox.net.invalid> wrote:
> 
>> If you put the url intohttp://unmaskparasites.com/you can see that it
>> is redirecting traffic to malicious sites
> 
> 
> Interesting, even though there's an initial "this site is clean"
> message, it shows various redirects.

Sent a note to developer of unmaskparasites.com to let him know, the 
site is a beta, but is still very useful.

John

Fix it wrote:
> "Doc" <docsavage20@yahoo.com> wrote in message
> news:6a82feef-8a3a-4042-bfd0-684ce1e56ad3@l39g2000yqn.googlegroups.com...
>> There's a website for a couple of famous jazz trumpeters, the late
>> Candoli brothers.
>>
>> http://www.candoli.com
>>
>>
>
> I clicked that link and my Kaspersky security suite blocked the URL
> with exactly the same warning it gives with the blockyell.com scam.
> It seems a number of established security vendors have listed
> the links you posted as very naughty in the same way as blockyell.
> But thats why you posted them isn't it, you're spreading malware.

Any _good_ firewall/anti-virus/anti-malware app will block it. The OP's 
probably using some "Free" crap like AVG. 

On Jan 3, 3:10 pm, "Fix it" <inva...@nothing.dil> wrote:

> Oh yes it is still doing it. And Firefox blocks it, Kaspersky and Norton
> block it


I just went to each link about half a dozen times, got no redirect on
either. The rest of your rambling isn't worth responding to.

From: "Doc" <docsavage20@yahoo.com>

| There's a website for a couple of famous jazz trumpeters, the late
| Candoli brothers.

| h**p://www.candoli.com

| It's a legitimate site, these guys were icons. There's a photo in
| their gallery of Pete playing wearing a Superman suit. I posted the
| direct link to it in a trumpet forum.

| h**p://www.candoli.com/pic28.htm

| Several people reported that clicking the link brought up that
| Antivirus 2009 malware bogus alert. I tried it and got the same
| thing.

| How does that Antivirus 2009 page hijack attempts to go to other sites
| like that? How does it get attached to certain ones?

| How is it these people haven't been shut down?

The site was hacked and is now compramised.  It takes you to a malicious site 
78.110.175.21

http://isc.sans.org/diary.html?storyid=5440

The malicous site will test the PC for vulneranilities in Adobe Flash, Adobe Reader and 
MDAC.

Successful exploitation will yield a EXE file.

http://www.virustotal.com/analisis/e8a650fafef32407bb729fdc63f44f78

Prevx1 V2 2009.01.03 Information Stealer
Sophos 4.37.0 2009.01.03 Troj/Daonol-Fam
TrendMicro 8.700.0.1004 2009.01.02 PAK_Generic.001

Which will drop; %windir%\system32\wdmaud.sys

All you can do it was what you did, contact the site owner to get the site fixed.

{ BTW: Thanx go to Ant ! }

-- 
Dave
http://www.claymania.com/removal-trojan-adware.html
Multi-AV - http://www.pctipp.ch/downloads/dl/35905.asp 

"Doc" <docsavage20@yahoo.com> wrote in message 
news:9757ee95-c1d6-472b-b86f-af461f331e09@s37g2000vbp.googlegroups.com...
On Jan 3, 3:10 pm, "Fix it" <inva...@nothing.dil> wrote:

> Oh yes it is still doing it. And Firefox blocks it, Kaspersky and Norton
> block it


I just went to each link about half a dozen times, got no redirect on
either. The rest of your rambling isn't worth responding to.

Which comfirms you are a google groups idiot, that link is a
listed and established phishing scam. And you x-posted it across
numerous groups.
Abuse report sent to   groups-abuse@google.com
 

On Jan 3, 5:11 pm, "Fix it" <inva...@nothing.dil> wrote:

> And you x-posted it across
> numerous groups.


Well champ, if you'll look back so did you.

Run along and take your meds.

"Doc" <docsavage20@yahoo.com> wrote in message news:9757ee95-c1d6-472b-b86f-

OK, anyone still got the link that the above thicko posted,
and if you have uptodate firewall, and use FF,
I tried it for the last time at 2209pm (UK) and got this:

Karspersky security alerted that URL redirects to Phishing site
ip identified as http://78.110.175.21/cp/?N
Security suite logged that site attempted 2 network attacks
and in the few of minutes with FF blocking but still listing the candoli's
site, the redirect phishing site - Karpersky alerting that the site 
attempted
a staggering 1251 scans!

Then I typed that IP address into google, here is the result and it's
notoriety:
http://www.google.co.uk/search?source=ig&hl=en&rlz=1G1GGLQ_ENUK288&q=http%3A%2F%2F78.110.175.21%2Fcp%2F%3FN&btnG=Google+Search&meta=lr%3D

Anyone who clicked on the link in the original post to this thread
and you didn't get an alert, you need to update your security software.
Type into google "free online anti-virus scan"
or go to Trend Micro's site or Karspersky's, and click the free scan option.
Good luck, also I suggest as many as possible post a complaint to
google about the link being x-posted to so many groups by "Doc". 

From: "Fix it" <invalid@nothing.dil>


| "Doc" <docsavage20@yahoo.com> wrote in message news:9757ee95-c1d6-472b-b86f-

| OK, anyone still got the link that the above thicko posted,
| and if you have uptodate firewall, and use FF,
| I tried it for the last time at 2209pm (UK) and got this:

| Karspersky security alerted that URL redirects to Phishing site
| ip identified as h**p://78.110.175.21/cp/?N
| Security suite logged that site attempted 2 network attacks
| and in the few of minutes with FF blocking but still listing the candoli's
| site, the redirect phishing site - Karpersky alerting that the site
| attempted
| a staggering 1251 scans!

| Then I typed that IP address into google, here is the result and it's
| notoriety:
| http://www.google.co.uk/search?source=ig&hl=en&rlz=1G1GGLQ_ENUK288&q=http%3A%2F%2F78.
| 110.175.21%2Fcp%2F%3FN&btnG=Google+Search&meta=lr%3D

| Anyone who clicked on the link in the original post to this thread
| and you didn't get an alert, you need to update your security software.
| Type into google "free online anti-virus scan"
| or go to Trend Micro's site or Karspersky's, and click the free scan option.
| Good luck, also I suggest as many as possible post a complaint to
| google about the link being x-posted to so many groups by "Doc".


Please do NOT post, live, malicious links unobfuscated !

And it is not a phishing site.  It is a vulnerability exploitation site.

http://isc.sans.org/diary.html?storyid=5440

-- 
Dave
http://www.claymania.com/removal-trojan-adware.html
Multi-AV - http://www.pctipp.ch/downloads/dl/35905.asp 

"Fix it" <invalid@nothing.dil> wrote in message 
news:ifKdnS7d356sdcLUnZ2dnUVZ8i-dnZ2d@bt.com...
>
> "Doc" <docsavage20@yahoo.com> wrote in message 
> news:9757ee95-c1d6-472b-b86f-
>
> OK, anyone still got the link that the above thicko posted,
> and if you have uptodate firewall, and use FF,
> I tried it for the last time at 2209pm (UK) and got this:
>
> Karspersky security alerted that URL redirects to Phishing site
> ip identified as http://78.110.175.21/cp/?N
> Security suite logged that site attempted 2 network attacks
> and in the few of minutes with FF blocking but still listing the candoli's
> site, the redirect phishing site - Karpersky alerting that the site 
> attempted
> a staggering 1251 scans!
>
> Then I typed that IP address into google, here is the result and it's
> notoriety:
> http://www.google.co.uk/search?source=ig&hl=en&rlz=1G1GGLQ_ENUK288&q=http%3A%2F%2F78.110.175.21%2Fcp%2F%3FN&btnG=Google+Search&meta=lr%3D
>
> Anyone who clicked on the link in the original post to this thread
> and you didn't get an alert, you need to update your security software.
> Type into google "free online anti-virus scan"
> or go to Trend Micro's site or Karspersky's, and click the free scan 
> option.
> Good luck, also I suggest as many as possible post a complaint to
> google about the link being x-posted to so many groups by "Doc".
>
>

More happy reading, it really is quite vicious what it can do!
http://seattlepi.nwsource.com/forum/boards/viewtopic.asp?topicid=130710 

On Jan 3, 5:35 pm, "Fix it" <inva...@nothing.dil> wrote:

> Good luck, also I suggest as many as possible post a complaint to
> google about the link being x-posted to so many groups by "Doc".


I assume you'll be reporting yourself since you posted the same link
to the same groups?

Do the orderlies know you've wandered out of your room?

From: "Fix it" <invalid@nothing.dil>



| More happy reading, it really is quite vicious what it can do!
| http://seattlepi.nwsource.com/forum/boards/viewtopic.asp?topicid=130710


Yes, cp/?M is the MDAC vulnerability exploit.

-- 
Dave
http://www.claymania.com/removal-trojan-adware.html
Multi-AV - http://www.pctipp.ch/downloads/dl/35905.asp 

Doc wrote:
> On Jan 3, 2:32 pm, "Fix it" <inva...@nothing.dil> wrote:
> 
>> It seems a number of established security vendors have listed
>> the links you posted as very naughty in the same way as blockyell.
>> But thats why you posted them isn't it, you're spreading malware.
> 
> 
> Um, no. As stated I'm trying to understand the how and why.
> 
> Did I not state exactly what behavior I was observing thereby giving
> you complete "click at your own risk" warning?  
<SNIP>

It's generally considered good form to obfuscate suspect links, by, for 
instance, changing the first part to hxxp://

That way nobody could accidentally click on it and end up in a bad 
place. Not everyone reads posts completely before clicking.

RB

Doc <docsavage20@yahoo.com> wrote in news:6a82feef-8a3a-4042-bfd0-
684ce1e56ad3@l39g2000yqn.googlegroups.com:

> Several people reported that clicking the link brought up that
> Antivirus 2009 malware bogus alert. I tried it and got the same
> thing.

The web server got infected...
 
> How does that Antivirus 2009 page hijack attempts to go to other sites
> like that? How does it get attached to certain ones?

By infecting vulnerable servers and computers.
 
> How is it these people haven't been shut down?

Shut down? Who would you shut down exactly?


-- 
Regards,
Dustin Cook
Malware Researcher
MalwareBytes - http://www.malwarebytes.org
  

"Damian" <nospam@rabid-dog.net> wrote in
news:gjokq3$v70$1@news.tornevall.net: 

> Fix it wrote:
>> "Doc" <docsavage20@yahoo.com> wrote in message
>> news:6a82feef-8a3a-4042-bfd0-684ce1e56ad3@l39g2000yqn.googlegroups.com
>> ... 
>>> There's a website for a couple of famous jazz trumpeters, the late
>>> Candoli brothers.
>>>
>>> http://www.candoli.com
>>>
>>>
>>
>> I clicked that link and my Kaspersky security suite blocked the URL
>> with exactly the same warning it gives with the blockyell.com scam.
>> It seems a number of established security vendors have listed
>> the links you posted as very naughty in the same way as blockyell.
>> But thats why you posted them isn't it, you're spreading malware.
> 
> Any _good_ firewall/anti-virus/anti-malware app will block it. The
> OP's probably using some "Free" crap like AVG. 

free crap? Hah. So you think a paid version of norton or mcafee is better 
do you?


-- 
Regards,
Dustin Cook
Malware Researcher
MalwareBytes - http://www.malwarebytes.org
  

Doc <docsavage20@yahoo.com> wrote in news:1428fcaa-d3af-47ae-b945-
c96c3bfcadeb@w1g2000prk.googlegroups.com:

> On Jan 3, 5:35 pm, "Fix it" <inva...@nothing.dil> wrote:
> 
>> Good luck, also I suggest as many as possible post a complaint to
>> google about the link being x-posted to so many groups by "Doc".
> 
> 
> I assume you'll be reporting yourself since you posted the same link
> to the same groups?
> 
> Do the orderlies know you've wandered out of your room?
> 

Minor Suggestion.. If you wish to be taken seriously, ignore the posters 
who outright attack you, Such as Fix. Responding in this manner only 
provokes him further and wastes even more time for those of us reading 
along.


-- 
Regards,
Dustin Cook
Malware Researcher
MalwareBytes - http://www.malwarebytes.org
  

"David H. Lipman" <DLipman~nospam~@Verizon.Net> wrote in
news:3e-dnV4iuIbifMLUnZ2dnUVZ_jqdnZ2d@giganews.com: 

> From: "Doc" <docsavage20@yahoo.com>
> 
>| There's a website for a couple of famous jazz trumpeters, the late
>| Candoli brothers.
> 
>| h**p://www.candoli.com
> 
>| It's a legitimate site, these guys were icons. There's a photo in
>| their gallery of Pete playing wearing a Superman suit. I posted the
>| direct link to it in a trumpet forum.
> 
>| h**p://www.candoli.com/pic28.htm
> 
>| Several people reported that clicking the link brought up that
>| Antivirus 2009 malware bogus alert. I tried it and got the same
>| thing.
> 
>| How does that Antivirus 2009 page hijack attempts to go to other
>| sites like that? How does it get attached to certain ones?
> 
>| How is it these people haven't been shut down?
> 
> The site was hacked and is now compramised.  It takes you to a
> malicious site 78.110.175.21
> 
> http://isc.sans.org/diary.html?storyid=5440
> 
> The malicous site will test the PC for vulneranilities in Adobe Flash,
> Adobe Reader and MDAC.
> 
> Successful exploitation will yield a EXE file.
> 
> http://www.virustotal.com/analisis/e8a650fafef32407bb729fdc63f44f78
> 
> Prevx1 V2 2009.01.03 Information Stealer
> Sophos 4.37.0 2009.01.03 Troj/Daonol-Fam
> TrendMicro 8.700.0.1004 2009.01.02 PAK_Generic.001
> 
> Which will drop; %windir%\system32\wdmaud.sys

Someone sent us 4 copies of this, all different. It's quite the morphing 
little turd.
 
> All you can do it was what you did, contact the site owner to get the
> site fixed. 

Yep.


-- 
Regards,
Dustin Cook
Malware Researcher
MalwareBytes - http://www.malwarebytes.org