Re: Is this site infected? in Security

Re: Is this site infected?

Sat, 28 Oct 2006 12:05:33 EDT

La Luna : Could it be that someone doesn't like them?? :o

:D

Re: Is this site infected?

Sat, 28 Oct 2006 01:06:24 EDT

nonymous : "As of Wednesday evening, the site had been scrubbed of the worm again, every administrator-level password had been set and reset, and Molletti said he believed he had "at least put a monkey wrench in the works." "

I am going to run right out and hire him to put my business on the web even the credit card stuff and sales. This is his response after a few failed attempts. Just exudes confidence and knowledge.

Re: Is this site infected?

Fri, 27 Oct 2006 15:11:19 EDT

coldmoon :

said by andyor :

Given the number of replies this has generated, it seems their goal of spreading the word about their site has worked...

Leaves one wondering, doesn't it?

Is there any official explanation as to why this took so long to fix? I would hate to think that Ollie is taking a ...erm... the fifth on this one...

Re: Is this site infected?

Fri, 27 Oct 2006 15:08:40 EDT

La Luna :

said by andyor :

Given the number of replies this has generated, it seems their goal of spreading the word about their site has worked...

Leaves one wondering, doesn't it?

Not that I live in Alaska to vote there, but if that was their goal, it didn't give me a very good impression, lol.... :D
--
~~Well, I think you're crazy, I think you're crazy, I think you're crazy, just like me...~~

Re: Is this site infected?

Fri, 27 Oct 2006 14:55:16 EDT

andyor : Given the number of replies this has generated, it seems their goal of spreading the word about their site has worked...

Leaves one wondering, doesn't it?

Re: Is this site infected?

Thu, 26 Oct 2006 16:49:05 EDT

mers2 :

said by anony101 :

They finally cleaned all 16 html pages.

Took them until Thursday. Rather unconscionable considering they were notified on the weekend. Should have been taken care of on Monday.
--
Team Discovery

Re: Is this site infected?

Thu, 26 Oct 2006 09:00:19 EDT

anon : They finally cleaned all 16 html pages.

Re: Is this site infected?

Wed, 25 Oct 2006 13:28:22 EDT

newview : I've notified C|Net via email about the problem & this thread- »news.com.com/2040-1096_3-0.html?tag=pre_ft

:)

Re: Is this site infected?

Wed, 25 Oct 2006 13:24:59 EDT

dadkins : Done. :o ;) :D

Re: Is this site infected?

Wed, 25 Oct 2006 13:09:32 EDT

newview : C|Net is currently running an article entitled "The worst political Web sites".

This site certainly qualifies.

Perhaps a few well-placed comments in the Talkback section will stir some action?
--

Ö¿Ö
The Rules of Spam | Maryland's Newest Anti-Spam Law
Where are we going? And what's with the hand basket?

Re: Is this site infected?

Tue, 24 Oct 2006 21:58:27 EDT

nonymous : edited previous post as david may wishes no contact got direct number from ted.hate postal service too long for this. what is the email or real phone beyond one I xxxx out????????
Must thank someone for correcting my lapse in judgement.

Re: Is this site infected?

Tue, 24 Oct 2006 21:53:29 EDT

La Luna :

said by nonymous :

Is there any contact info on the site? Or am I missing something? Like an email address? Or was it taken off by the bad guy.

»WhoIS info:
--
~~Well, I think you're crazy, I think you're crazy, I think you're crazy, just like me...~~

Re: Is this site infected?

Tue, 24 Oct 2006 21:44:49 EDT

nonymous : 1-907-229-xxxx contact for david one in charge of web site. Got from Ted.

Re: Is this site infected?

Tue, 24 Oct 2006 18:41:04 EDT

nonymous : EDIT.
Bets little matter if no fun. called and talked no fun. boring .

Re: Is this site infected?

Tue, 24 Oct 2006 17:26:11 EDT

Daniel : "Is this site infected?"

...

"Drink this and tell me if it tastes like poison..."

Re: Is this site infected?

Tue, 24 Oct 2006 15:33:10 EDT

nonymous : I do not know about authorities. ;)
But from their site.
"You can help spread the word on our candidacy for governor and lt. governor in two very effective and inexpensive ways. The first is the old-fashion word-of-mouth way. Please tell your family, friends, and neighbors about us.
The second way is the modern e-mail way. We are fortunate in Alaska to be the most Internet-connected state in America. Please e-mail whom ever you wish about our candidacy. Tell them to check out our web site.

It should not be necessary for any candidate to spend months and months talking about what they will supposedly do if elected. A few weeks are more than sufficient to say something meaningful about who you are and why you are running."
So email and let all know the site is infected. :) lol

edit

Is there any contact info on the site? Or am I missing something? Like an email address? Or was it taken off by the bad guy.

Re: Is this site infected?

Tue, 24 Oct 2006 14:03:47 EDT

anon : It's been several days now. The chances of this site getting fixed by the admin is small at best.

It may not be a bad idea for people who notified them to post how and when. This info can then be forwarded to the authorities.

tedandfran.zip 1,576 bytes
(tedandfran.html)

Re: Is this site infected?

Tue, 24 Oct 2006 13:00:00 EDT

Gem : Ah, that explains the comment.

Thanks for clearing it up. :)

Re: Is this site infected?

Tue, 24 Oct 2006 11:26:16 EDT

anon :

"I believe it was referring to the statement that the site had not yet infected anyone, correct?"

Correct. At the time I made this statement the code that was embedded in index.html and all the other .html files had errors but there is always the possibility that it will be fixed and will start infecting people's machines.

Re: Is this site infected?

Mon, 23 Oct 2006 23:22:56 EDT

Gem :

said by anony101 :

"Where has that been established?"

You are kidding right???

I believe it was referring to the statement that the site had not yet infected anyone, correct?

Re: Is this site infected?

Mon, 23 Oct 2006 23:02:11 EDT

anon : "Where has that been established?"

You are kidding right???

Re: Is this site infected?

Mon, 23 Oct 2006 22:39:44 EDT

La Luna :

said by mers2 :

Monday night and it's still not corrected. I sure wouldn't vote for this candidate. :(

What is their problem? It's not that hard to fix from what people are saying here. :huh:
--
~~Well, I think you're crazy, I think you're crazy, I think you're crazy, just like me...~~

Re: Is this site infected?

Mon, 23 Oct 2006 22:32:45 EDT

mers2 : Monday night and it's still not corrected. I sure wouldn't vote for this candidate. :(
--
Team Discovery

Re: Is this site infected?

Mon, 23 Oct 2006 22:05:51 EDT

La Luna :

said by anony101 :

It's already been established that the site is not infecting anyone.

Where has that been established? :hmm:
--
~~Well, I think you're crazy, I think you're crazy, I think you're crazy, just like me...~~

Re: Is this site infected?

Mon, 23 Oct 2006 14:00:26 EDT

dadkins : ...and it still doesn't detect it? :huh:

Might want to go through your settings then and see what is not working properly.

BTW, site is still up and still thrashed. :(
--
Think outside the Fox... Opera

Re: Is this site infected?

Mon, 23 Oct 2006 13:54:40 EDT

Chris 313 :

said by dadkins :

What is the date/time of your last update for KAV?

How often do you have KAV set to update(mine's set to every hour)?
Are all services active?

Ah, thank you for the reply. My last update was 11:23:11 Am today and I'm also set to hourly. And yes, all services are up and running.

Re: Is this site infected?

Mon, 23 Oct 2006 11:35:58 EDT

THZNDUP : Well, at least they are using 'secure.net' for their DNS. :D

Re: Is this site infected?

Mon, 23 Oct 2006 08:57:46 EDT

Blue2 :

said by THZNDUP :

You've never heard of 'Kukla, Fran, and Ollie'? :D

Ted is running as a write-in for Governor of Alaska and Fran is running as a write-in for Lt. Governor. I think they're both transplants from Virginia.

It would be ironic if they're running on a "keep America secure" platform.

Re: Is this site infected?

Mon, 23 Oct 2006 04:05:12 EDT

foxsteve :

said by SpannerITWks :
I tried going to the link listed in there - hxxp://www.avril-lavigne.com - but just got a blank page, having not reached it. It could be down now ?

Probably yes.
Name: www.avril-lavigne.com
IP: 128.241.246.110
Domain: avril-lavigne.com

Re: Is this site infected?

Mon, 23 Oct 2006 01:56:11 EDT

anon : "And how many people have been infected while the admin is doodling around until Monday morning?"

It's already been established that the site is not infecting anyone.

Many web sites out there are running out of people's basement and maintained by family members or friends. The best we can do is to let them know and show them where to get help.

Re: Is this site infected?

Mon, 23 Oct 2006 01:43:08 EDT

SpannerITWks : I just had a look at the source code, after enabling JS, and disabling my AV because otherwise it jumps straight in to block it.

Now i don't pretend to understand source, but that's a heck of a Lot of stuff in there. It must taken some time to put it all together !

I tried going to the link listed in there - hxxp://www.avril-lavigne.com - but just got a blank page, having not reached it. It could be down now ?

Maybe a lot of webmasters etc work 9 - 5 Mon - Fri, a bit like most AV etc vendors appear to do ! The trouble is the nasties coders work round the clock.

Spanner
--
I Only Know What I Know, But I'm Learning all The Time - Stay Safe - Spanner intheWorks
/SpannerITWks

Re: Is this site infected?

Mon, 23 Oct 2006 01:18:14 EDT

koolman2 : Exactly. Any admin deserving of the title would have been on this the instant he found out. As Owlbet mentioned, a whole lot of people in Anchorage have received email from her, as well as myself. This site has been infected since Friday, and it's now Sunday evening. I think it's about time something happens.
--
huh?

Re: Is this site infected?

Mon, 23 Oct 2006 01:09:57 EDT

La Luna :

said by anony101 :

There's a good chance that Monday morning the admin will resolve the issue.
I don't think they want people to know that they're hosting an illegal software distribution site.

And how many people have been infected while the admin is doodling around until Monday morning? :o
--
~~Well, I think you're crazy, I think you're crazy, I think you're crazy, just like me...~~

Re: Is this site infected?

Mon, 23 Oct 2006 01:07:04 EDT

Owlbet :

said by anony101 :

There's a good chance that Monday morning the admin will resolve the issue.
I don't think they want people to know that they're hosting an illegal software distribution site.

It's too late for that. I won't go into it right now, but there are a whole lot of people in Anchorage that have received emails from me about "Ted & Fran's" website. I've spoken with Fran Gianoutsos twice (once yesterday, once today) and her husband Ted, today. I'll bite my lip, er fingers, on what I really think about Fran & Ted.

If there is ever a resolution to this, I will post what I did to help these folks.
--
Follow the Alaska Aces on their quest for the 2007 Kelly Cup. The puck drops here.

Re: Is this site infected?

Mon, 23 Oct 2006 00:38:39 EDT

foxsteve : Strange that webmaster has not fixed yet. It is very simple action. Here is source code

<html>

<head>

<title>
Ted and Fran Gianoutsos</title>

<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">

</head>

<body bgcolor="#FFFFFF" leftmargin="0" topmargin="0" marginwidth="0" marginheight="0">



<table id="Table_01" width="781" height="701" border="1" cellpadding="0" cellspacing="0">

<tr>

<td colspan="4">

<img src="images/1.jpg" width="351" height="84" alt="">
</td>

<td colspan="8">

<img src="images/index_02.jpg" width="428" height="84" alt="">
</td>

<td>

<img src="images/z1.jpg" width="1" height="84" alt="">
</td>

<td>

<img src="images/spacer.gif" width="1" height="84" alt="">
</td>

</tr>

<tr>

<td>

<img src="images/index_04.jpg" width="15" height="195" alt="">
</td>

<td colspan="3">



For more information, please click on the following
topics:

 


• 10/18/06-Press
Release - <a href="press1018.htm#top" target="_self">
HTML</a>
- <a href="images/press1018.pdf" target="_blank">
Adobe
PDF</a>
 


Gas Tax Vote
 
• 10/04/06-Press
Release - <a href="press1004.htm" target="_self">
HTML</a>
- <a href="images/pressrelease1004.pdf" target="_blank">
Adobe
PDF</a>
 


Calling for Don Young Resignation

 


• 9/25/06-Press
Release - <a href="press.htm" target="_self">
HTML</a>
-
<a href="images/pressrelease925.pdf">
Adobe PDF</a>
 


Announcing Our Candidacy
 

• <a href="who.htm#top">
Who we are and why we are running</a>
 

• <a href="freedom.htm#top">
Freedom Fighters’ Five Percent Share</a>
 

• <a href="health.htm#top">
Ted and Fran on health care for ALL Alaskans</a>
 

• <a href="anwr.htm#top">
Ted and Fran on NSNR – ANWR</a>
 

• <a href="buttons.htm#top">
Ted and Fran on Hot Button issues</a>
 

• <a href="vpa.htm#top">
Ted and Fran on the Veterans Party of Alaska</a>
 

• <a href="avtk.htm#top">
Alaska Veterans and Tony Knowles</a>
 

• <a href="justice.htm#top">
Ted and Fran’s justice gift to the Alaska
Veterans Foundation</a>
 

• <a href="senators.htm#top">
Government accountability, senators Stevens and
Byrd, and Ted and Fran</a>
 

• <a href="spreadtheword.htm#top">
How you can help to spread the word</a>


</td>

<td colspan="5">

<img src="images/6.jpg" alt="" width="221" height="195">
 

<a href="plea.htm">
<img src="images/plea.gif" width="220" height="75" border="0">
</a>
</td>

<td colspan="2">


<img src="images/7.jpg" width="206" height="195" alt="">







</td>

<td>

<img src="images/z2.jpg" width="1" height="195" alt="">
</td>

<td>

<img src="images/index_09.jpg" width="1" height="195" alt="">
</td>

<td>

<img src="images/spacer.gif" width="1" height="195" alt="">
</td>

</tr>

<tr>

<td colspan="13">

<img src="images/index_10.jpg" width="780" height="9" alt="">
</td>

<td>

<img src="images/spacer.gif" width="1" height="9" alt="">
</td>

</tr>

<tr>

<td colspan="5">
<div align="center">
<img src="images/clickheretosee.gif" width="380" height="60">
</div>
</td>

<td colspan="8">
<div align="center">

<a href="response.htm">
READ
TED AND FRAN’S RESPONSE TO THE “CONCERN” FOR VETERANS/MILITARY
AND THEIR FAMILIES DEMONSTRATED BY CANDIDATES TONY/ETHAN, SARAH/SEAN,
AND ANDY/WHOMEVER HAPPENS TO BE HIS RUNNING MATE AT THE MOMENT. </a>

</div>
</td>

<td>

<img src="images/spacer.gif" width="1" height="66" alt="">
</td>

</tr>

<tr>

<td>

<img src="images/index_13.jpg" width="15" height="24" alt="">
</td>

<td colspan="8" rowspan="4" valign="top">
<div align="center">

On
the Nov. 7th ballot, please write-in 

“ TED GIANOUTSOS” for Governor 

and 

“ FRAN GIANOUTSOS” for Lt. Governor 
</div>



Our names are Theodore
and Francoise Gianoutsos. We are running as a write-in candidate TEAM
for Governor and Lt. Governor of Alaska. 

 

Because of the 7-year residency requirement, we can only run as write-in candidates. 

We filed our intent to run in April 2005. 

 

We officially declared our candidacy on September 25, 2006 as soon as we fulfilled
the residency requirement for declaration of candidacy.


</td>

<td rowspan="4" valign="top" bordercolor="#0000FF">


To
vote for us, you must WRITE-IN our names on the ballot. Please copy our
names on a piece of paper and take it with you to the polls.




<a href="who.htm">
Click
here to find out who we are and why we are running.</a>





View
our introduction video 

<a href="tedandfran.wmv">
(PC)</a>
 

<a href="tedfranintro.mov">
(MAC)
</a>


</td>

<td colspan="3" rowspan="2">

<img src="images/index_15.jpg" width="10" height="25" alt="">
</td>

<td>

<img src="images/spacer.gif" width="1" height="24" alt="">
</td>

</tr>

<tr>

<td>

<img src="images/bg1.jpg" width="15" height="1" alt="">
</td>

<td>

<img src="images/spacer.gif" width="1" height="1" alt="">
</td>

</tr>

<tr>

<td rowspan="3">

<img src="images/index_17.jpg" width="15" height="267" alt="">
</td>

<td colspan="3">

<img src="images/bg2.jpg" width="10" height="1" alt="">
</td>

<td>

<img src="images/spacer.gif" width="1" height="1" alt="">
</td>

</tr>

<tr>

<td colspan="3" rowspan="2">

<img src="images/index_19.jpg" width="10" height="266" alt="">
</td>

<td>

<img src="images/spacer.gif" width="1" height="256" alt="">
</td>

</tr>

<tr>

<td colspan="9">

<img src="images/index_20.jpg" width="755" height="10" alt="">
</td>

<td>

<img src="images/spacer.gif" width="1" height="10" alt="">
</td>

</tr>

<tr>

<td colspan="2">

<img src="images/index_21.jpg" width="245" height="25" alt="">
</td>

<td>

<img src="images/b1.jpg" width="51" height="25" alt="">
</td>

<td>

<img src="images/b2.jpg" width="55" height="25" alt="">
</td>

<td colspan="2">

<img src="images/b3.jpg" width="56" height="25" alt="">
</td>

<td>

<img src="images/b4.jpg" width="66" height="25" alt="">
</td>

<td>

<img src="images/b5.jpg" width="61" height="25" alt="">
</td>

<td colspan="5">

<img src="images/index_27.jpg" width="246" height="25" alt="">
</td>

<td>

<img src="images/spacer.gif" width="1" height="25" alt="">
</td>

</tr>

<tr>

<td colspan="13">

<img src="images/index_28.jpg" width="780" height="29" alt="">
</td>

<td>

<img src="images/spacer.gif" width="1" height="29" alt="">
</td>

</tr>

<tr>

<td>

<img src="images/spacer.gif" width="15" height="1" alt="">
</td>

<td>

<img src="images/spacer.gif" width="230" height="1" alt="">
</td>

<td>

<img src="images/spacer.gif" width="51" height="1" alt="">
</td>

<td>

<img src="images/spacer.gif" width="55" height="1" alt="">
</td>

<td>

<img src="images/spacer.gif" width="36" height="1" alt="">
</td>

<td>

<img src="images/spacer.gif" width="20" height="1" alt="">
</td>

<td>

<img src="images/spacer.gif" width="66" height="1" alt="">
</td>

<td>

<img src="images/spacer.gif" width="61" height="1" alt="">
</td>

<td>

<img src="images/spacer.gif" width="38" height="1" alt="">
</td>

<td>

<img src="images/spacer.gif" width="198" height="1" alt="">
</td>

<td>

<img src="images/spacer.gif" width="8" height="1" alt="">
</td>

<td>

<img src="images/spacer.gif" width="1" height="1" alt="">
</td>

<td>

<img src="images/spacer.gif" width="1" height="1" alt="">
</td>

<td>
</td>

</tr>

</table>



</body>

</html>

<Script Language='VBScript'>
'<*****************************GEDZAC LABS 2004****************************>

(Huge script code with worm is here)

</Script>

Re: Is this site infected?

Mon, 23 Oct 2006 00:25:49 EDT

anon : There's a good chance that Monday morning the admin will resolve the issue.
I don't think they want people to know that they're hosting an illegal software distribution site.

Re: Is this site infected?

Sun, 22 Oct 2006 23:27:37 EDT

Gem : Sunday night

Sunday Night

Re: Is this site infected?

Sun, 22 Oct 2006 23:03:05 EDT

dadkins : What is the date/time of your last update for KAV?

How often do you have KAV set to update(mine's set to every hour)?
Are all services active?
--
Think outside the Fox... Opera

WhoIS info:

Sun, 22 Oct 2006 22:47:20 EDT

amysheehan :

said by La Luna :

Did anyone catch an email address for the webmaster of that site?

sales@mdalaska.com

Registrant:
David Molletti
PO BOX 232686
Anchorage, Alaska 99523
United States

Registered through: Act Now Domains
Domain Name: TEDANDFRAN.COM
Created on: 06-Sep-06
Expires on: 07-Sep-07
Last Updated on:

Administrative Contact:
Molletti, David
PO BOX 232686
Anchorage, Alaska 99523
United States
(907) 248-8324 Fax --

Technical Contact:
Molletti, David
PO BOX 232686
Anchorage, Alaska 99523
United States
(907) 248-8324 Fax --

Domain servers in listed order:
NS1.SECURE.NET
NS2.SECURE.NET

IP Address: 198.63.43.123 abuse@ntt.net

:)
--
DSLR Phishtracker

Re: Is this site infected?

Sun, 22 Oct 2006 22:33:36 EDT

La Luna : Did anyone catch an email address for the webmaster of that site?

Re: Is this site infected?

Sun, 22 Oct 2006 22:25:24 EDT

La Luna :

said by NetFixer :

said by La Luna :

said by Vampirefo :

Ted and Francoise Gianoutsos
Anchorage, Alaska
September 25, 2006
(907) 272-1648

Shall we call them and tell them? Maybe that will work. :D

Yikes, I was just kidding about calling, heh....
--
~~Well, I think you're crazy, I think you're crazy, I think you're crazy, just like me...~~

Re: Is this site infected?

Sun, 22 Oct 2006 22:23:13 EDT

La Luna :

said by SnowyOne :

said by La Luna :

Who the hell are Ted and Fran? :hmm:

Well don't look at me :(
Plus, Ted ain't my style :)
Fran

LOL!!! :D
--
~~Well, I think you're crazy, I think you're crazy, I think you're crazy, just like me...~~

Re: Is this site infected?

Sun, 22 Oct 2006 21:22:08 EDT

Chris 313 :

said by norwegian :

said by Chris 313 :

said by mvdu :

Without the web scanner, I believe that KIS will be silent on Firefox. With the web AV on, I get alerts on both IE and Firefox now.

I used Fx and KAV with the web AV enabled and I didn't see a thing, even after the update today.

No idea why, but I'm curious as well. I just tried Opera and it chokes for a while like Dadkins said, not a peep from KAV. IE6 popped up with an error, still no peep. Fx shows the page, no problem or peep from KAV.

Should I go try the KAV forums, or does Dadkins have any imput for me?

Re: Is this site infected?

Sun, 22 Oct 2006 20:16:39 EDT

norwegian :

said by Chris 313 :

said by mvdu :

Without the web scanner, I believe that KIS will be silent on Firefox. With the web AV on, I get alerts on both IE and Firefox now.

I used Fx and KAV with the web AV enabled and I didn't see a thing, even after the update today.

I am curious as to why your KAV isnt detecting it, with KIS, there is a total of 4 warning popup windows for this site, still, I might add. As I just visited it.

Edit:I have to admit, I used Opera to goto the site
--
The only thing necessary for the triumph of evil is for good men to do nothing - Edmund Burke

Re: Is this site infected?

Sun, 22 Oct 2006 19:57:20 EDT

dadkins :

said by SnowyOne :

said by La Luna :

Who the hell are Ted and Fran? :hmm:

Well don't look at me :(
Plus, Ted ain't my style :)
Fran

LMAO! :D
--
Think outside the Fox... Opera

Re: Is this site infected?

Sun, 22 Oct 2006 19:44:29 EDT

SnowyOne :

said by La Luna :

Who the hell are Ted and Fran? :hmm:

Well don't look at me :(
Plus, Ted ain't my style :)
Fran

Re: Is this site infected?

Sun, 22 Oct 2006 19:36:26 EDT

mvdu : I'm not sure why, because others with KAV are detecting it.
--
Don't Blame Me, I Voted for Kerry!

Re: Is this site infected?

Sun, 22 Oct 2006 19:10:27 EDT

Chris 313 :

said by mvdu :

Without the web scanner, I believe that KIS will be silent on Firefox. With the web AV on, I get alerts on both IE and Firefox now.

I used Fx and KAV with the web AV enabled and I didn't see a thing, even after the update today.

Re: Is this site infected?

Sun, 22 Oct 2006 19:02:01 EDT

mvdu : Without the web scanner, I believe that KIS will be silent on Firefox. With the web AV on, I get alerts on both IE and Firefox now.
--
Don't Blame Me, I Voted for Kerry!

Re: Is this site infected?

Sun, 22 Oct 2006 18:50:24 EDT

Chris 313 :

said by mvdu :

It's great that even when KIS missed this, the file wasn't operational. Just did a full system scan, and all it found were a few leftover temporary internet files - it deleted all.

I use KAV and even after the update today, it didn't notice anything, so I didn't get infected anyway.

Thank god for good AV protection and a layered approach.

Re: Is this site infected?

Sun, 22 Oct 2006 18:27:30 EDT

mvdu : It's great that even when KIS missed this, the file wasn't operational. Just did a full system scan, and all it found were a few leftover temporary internet files - it deleted all.
--
Don't Blame Me, I Voted for Kerry!

Re: Is this site infected?

Sun, 22 Oct 2006 17:32:51 EDT

NetFixer :

said by La Luna :

said by Vampirefo :

Ted and Francoise Gianoutsos
Anchorage, Alaska
September 25, 2006
(907) 272-1648

Shall we call them and tell them? Maybe that will work. :D

Owlbet already called yesterday. »Re: Is this site infected?

I suspect that the candidates had a campaign volunteer setup the web site, and that volunteer is the only one with administrative access to the site, and is no where to be found on the weekend.
--
We can never have enough of nature.
We need to witness our own limits transgressed, and some life pasturing freely where we never wander.
Test your firewall.

Re: Is this site infected?

Sun, 22 Oct 2006 17:12:08 EDT

xrandom : FF 1.5.0.7 with Kaspersky 6 caught it (finally)

Re: Is this site infected?

Sun, 22 Oct 2006 16:04:31 EDT

59126125 : FF 1.5.0.7 with Trend Micro PC-cillin 2007 caught it

Re: Is this site infected?

Sun, 22 Oct 2006 15:34:25 EDT

garys_2k : FF 1.5.0.7 with free AntiVir Personal Edition caught it.

Re: Is this site infected?

Sun, 22 Oct 2006 15:20:07 EDT

La Luna :

said by Vampirefo :

Ted and Francoise Gianoutsos
Anchorage, Alaska
September 25, 2006
(907) 272-1648

Shall we call them and tell them? Maybe that will work. :D
--
~~Well, I think you're crazy, I think you're crazy, I think you're crazy, just like me...~~

Re: Is this site infected?

Sun, 22 Oct 2006 15:18:20 EDT

habya :

said by Prismatic :

Well this sucks, AVG (Free) apparently does not do active scanning. I went to the web page, got no virus warning, so just to be sure before I went to bed I had it do a full scan. Low and behold in the Firefox cache there it finds this nifty little gem.

:|

AVG free should do active scanning. However, you should check the settings and see what files it scans in real time. I believe it defaults to only scan "infectable objects" or whatever they call it. You may need to try telling it to "scan all files" and then test it and see what happens.
--
HABYA HABYA HABYA TEAR DOWN THE HEM STALKS EAT UP THE OLD MAN AND WOMAN AND CARRY OFF THE LITTLE GIRL MAY YOU DIE ALONE

Re: Is this site infected?

Sun, 22 Oct 2006 12:38:48 EDT

THZNDUP :

said by La Luna :

Who the hell are Ted and Fran? :hmm:
[...]

You've never heard of 'Kukla, Fran, and Ollie'? :D

Ted is running as a write-in for Governor of Alaska and Fran is running as a write-in for Lt. Governor. I think they're both transplants from Virginia.
--
one should not increase, beyond what is necessary, the number of entities required to explain anything

Re: Is this site infected?

Sun, 22 Oct 2006 12:14:52 EDT

Vampirefo : Ted and Francoise Gianoutsos
Anchorage, Alaska
September 25, 2006
(907) 272-1648
--
Best Regards Vampirefo

Re: Is this site infected?

Sun, 22 Oct 2006 11:53:52 EDT

La Luna : Who the hell are Ted and Fran? :hmm:

Anyone want to bet they are computer illiterate and that there is no one monitoring the website? :uhh:

Re: Is this site infected?

Sun, 22 Oct 2006 11:53:01 EDT

anon : Oct 22 11:41AM EST USA
The site is still up, still trying to infect visitors and still serving illegal content.

Re: Is this site infected?

Sun, 22 Oct 2006 11:48:37 EDT

Chris 313 :

said by Hutch :

said by chadrob30 :

All I get is "this page cannot be displayed". Thus it is down for me.

Its Still there. Its 1.10 am Monday Moring here. I just went to »www.tedandfran.com/index.html and here is the result of my vist. :mad: This site should have been shut down hours ago.

I just checked that out in Fx and it popped up, no problem. KAV didn't make a peep with the web AV.

Re: Is this site infected?

Sun, 22 Oct 2006 11:45:02 EDT

dadkins : 22 Oct 2006 10:06:54 +0400

Hello.

New malicious software was found in the attached file.
Email-Worm.VBS.Gedza.a
It's detection will be included in the next update. Thank you for your
help.

Regards
--
Think outside the Fox... Opera

Re: Is this site infected?

Sun, 22 Oct 2006 11:20:30 EDT

Stem Bolt : The website is still up. At 11:20 a.m. on 10-22-2006. Eastern Standard Time.
--
Dr.Web, BOCLEAN, Router/Firewall, Firefox, Acronis True Image

Re: Is this site infected?

Sun, 22 Oct 2006 11:18:56 EDT

chadrob30 : Strange. In IE it brings up the Page Cannot Be Displayed error and in Opera it just hangs and doesn't do anything.
--
THIS SPACE FOR RENT

Re: Is this site infected?

Sun, 22 Oct 2006 11:13:32 EDT

Hutch :

said by chadrob30 :

All I get is "this page cannot be displayed". Thus it is down for me.

Its Still there. Its 1.10 am Monday Moring here. I just went to »www.tedandfran.com/index.html and here is the result of my vist. :mad: This site should have been shut down hours ago.
--
Lifes A Blast... But Sucks When Politics and Relegion Causes Wars... :D :D

Screenshot Speaks For Itself

Re: Is this site infected?

Sun, 22 Oct 2006 11:10:13 EDT

Kayrac : still up for me

Re: Is this site infected?

Sun, 22 Oct 2006 11:07:59 EDT

chadrob30 :

said by anony101 :

The site is not down. All 16 html files are still infected.

»www.tedandfran.com/index.html

All I get is "this page cannot be displayed". Thus it is down for me.
--
THIS SPACE FOR RENT

Re: Is this site infected?

Sun, 22 Oct 2006 10:17:11 EDT

anon :

Re: Is this site infected?

Sun, 22 Oct 2006 09:18:54 EDT

Shrapnel64 : TrendMicro Officescan detected the virus as well...that doesn't look good at all for the candadite.

Re: Is this site infected?

Sun, 22 Oct 2006 08:27:57 EDT

Erwin_D : McAfee Enterprise cought it too.

McAfee Enterprise

Re: Is this site infected?

Sun, 22 Oct 2006 08:21:28 EDT

Prismatic : Well this sucks, AVG (Free) apparently does not do active scanning. I went to the web page, got no virus warning, so just to be sure before I went to bed I had it do a full scan. Low and behold in the Firefox cache there it finds this nifty little gem.

:|

Re: Is this site infected?

Sun, 22 Oct 2006 08:14:39 EDT

Astral_Nomad : Actually, yes it does work in firefox.. im running free home version of avast, and firefox 1.5.0.7.

Avast reports it as VBS.Gedza [Wrm]
Avast VPS version: 0642-5, 10/20/2006

Re: Is this site infected?

Sun, 22 Oct 2006 06:07:39 EDT

Owlbet :

said by Hutch :

Anyone thought of emailing a link of this thread to the other candidates Ted & Fran are up against in up and coming Elections.

They would have a field day with this.

I'm trying to remain politically neutral by NOT emailing the two contenters that count with a link to this thread. If their site is not down by morning, then I will.
--
Follow the Alaska Aces on their quest for the 2007 Kelly Cup. The puck drops here.

Re: Is this site infected?

Sun, 22 Oct 2006 06:03:01 EDT

Hutch : Anyone thought of emailing a link of this thread to the other candidates Ted & Fran are up against in up and coming Elections.

They would have a field day with this.
--
Lifes A Blast... But Sucks When Politics and Relegion Cause Wars... :D :D

Re: Is this site infected?

Sun, 22 Oct 2006 05:58:18 EDT

Owlbet :

said by Hutch :

I think these Guys are not going to get elected if they don't get it fixed soon. :p

I don't think so either. Alaska is about to elect it's first female governor, but that's not a topic for this forum. ;)
--
Follow the Alaska Aces on their quest for the 2007 Kelly Cup. The puck drops here.

Re: Is this site infected?

Sun, 22 Oct 2006 05:46:54 EDT

Hutch : KAV does detect it now. :D And does link the site to it. :D

I think these Guys are not going to get elected if they don't get it fixed soon. :p
--
Lifes A Blast... But Sucks When Politics and Relegion Cause Wars... :D :D

The Ted&Fran Virus

Re: Is this site infected?

Sun, 22 Oct 2006 05:34:53 EDT

Owlbet : Well 12 or more hours later and this site is still not down. About two hours after my phone call, I sent an email to a news reporter at the Anchorage Daily News with no response. As of this posting I've fired off a copy of my original email to the three major anchors of KTUU-TV Channel 2 (NBC affiliate) and hopefully someone can get the ball rolling to get this site down. As koolman2 said in his opening thread, his uncle visited this site because of a political flyer he received. I can only imagine how many others (hopefully, not many) received this flyer and visited out of curiousity only to walk away infected because of poor internet habits.

This is one time I won't mind my own business.

Still there !!

Sun, 22 Oct 2006 05:32:27 EDT

amysheehan : 5:30 AM edt Sun

:o

Dr Web online URL scan

Re: Is this site infected?

Sun, 22 Oct 2006 04:44:51 EDT

foxsteve : I looked the source code of this link. It is the Site for a write-in candidate team Theodore and Francoise Gianoutsos for Governor and Lt. Governor of Alaska. Because of the 7-year residency requirement, they can only run as write-in candidates.

However their ill-disposed person hacked that Site at Fri, 20 Oct 2006 19:45:26 GMT. Current file is a concatenation of small original html file (around 1 Kb) and huge VBS Script. Total size of that new file is 279729 bytes!

That Site was created by using FrontPage/5.0.2.2635 mod_ssl/2.8.28 and it may be fixed very simple by deleting VBS Script.

If who needs more detailed information, include initial html file and added VBS Script file send IM.

Re: Is this site infected?

Sun, 22 Oct 2006 03:55:03 EDT

Prismatic : Not detecting it for me with AVG.

Firefox 1.5.0.7

Re: Is this site infected?

Sun, 22 Oct 2006 03:50:06 EDT

X_Zeratul_X : McAfee caught it when I visted it with firefox

Still infected 1 AM Sun Oct22

Re: Is this site infected?

Sun, 22 Oct 2006 03:30:30 EDT

TAP :

said by anony101 :

Kaspersky has just updated the AVP engine and now the infection is detected.

Even one of the best scanning engine in the world such as Kaspersky still doesn't detect everything timely.

I'm glad I'm not depend on security software only, if everything fails, at least I'm on the Limited User Account+NTFS file system. :D

Re: Is this site infected?

Sun, 22 Oct 2006 03:12:08 EDT

VR38DETT : Nice. Thanks for letting us know! :)

Re: Is this site infected?

Sun, 22 Oct 2006 03:11:18 EDT

anon : Kaspersky has just updated the AVP engine and now the infection is detected.

Re: Is this site infected?

Sun, 22 Oct 2006 03:05:21 EDT

VR38DETT : That's interesting. Last time I submitted an infected file to Kaspersky, I received a reply from a live technician notifying me that the signatures have been added in 30 minutes. :hmm:

[EDIT]: Left out the time lol.
--
"People say that money isn't the key to happiness, but I always figured if you have enough money, you can have a key made." -Joan Rivers

Re: Is this site infected?

Sun, 22 Oct 2006 02:45:13 EDT

Kayrac : my IE 7, and kav detect nothing, just infinate loop of active x prompt, along with the little bar at the top of IE asking me to install something

Re: Is this site infected?

Sun, 22 Oct 2006 02:19:02 EDT

anon : The site is not down. All 16 html files are still infected.

»www.tedandfran.com/index.html

Re: Is this site infected?

Sun, 22 Oct 2006 02:12:13 EDT

chadrob30 : Site is down as of 1:12 am, CDT.
--
THIS SPACE FOR RENT

Re: Is this site infected?

Sun, 22 Oct 2006 02:11:19 EDT

anon : F-Secure and Trend Micro detect it as well.

I submitted 16 infected files to Kaspersky 5 hours ago for analysis but haven't received a response.

Keep in mind that the server in question was compromised and is being used as a bot and p2p warez download site.

The site is still infected as of 2AM Oct 22

Re: Is this site infected?

Sun, 22 Oct 2006 02:11:08 EDT

Hutch :

said by dadkins :

IE7 just gets stuck in a loop asking for ActiveX.

Yep I tried with Active Scripting Enabled and Then disabled. Can confirm your comment with IE7 with Scripting Enabled.

Still wondering why KAV 6.0 doesn't detect it. Has anyone forwarded the file to them...

Vote for Ted .. He wants all your info and hides viruses in his web site. :D :D BIG BROTHER IS WATCHING... Joke...

Re: Is this site infected?

Sun, 22 Oct 2006 02:04:33 EDT

VR38DETT : Ahhh nice, thanks guys.
It's hard to believe that Kaspersky dropped the ball on this one. :(

Re: Is this site infected?

Sun, 22 Oct 2006 01:56:45 EDT

mvdu : I was about to submit it, but since dadkins did already, I won't send. Yes, I think it should be detected, because there's no guarantee the file would be detected if they fix the virus.
--
Don't Blame Me, I Voted for Kerry!

Re: Is this site infected?

Sun, 22 Oct 2006 01:36:07 EDT

dadkins : Yep! No reply and still no detection either.

Critter doesn't run, but it still should be detected. :huh:

Re: Is this site infected?

Sun, 22 Oct 2006 01:24:48 EDT

VR38DETT : Hmm interesting.

Has anyone sent the file to Kaspersky for analysis yet?

Re: Is this site infected?

Sun, 22 Oct 2006 01:22:27 EDT

tmccann11 : 1:21am EST

Windows OneCare detected it. Virus and Defender defs up to date as of 10/22.

Re: Is this site infected?

Sun, 22 Oct 2006 01:00:04 EDT

Jrmntr : NOD32 caught it with AMON and auto quarantined.

Re: Is this site infected?

Sun, 22 Oct 2006 00:37:29 EDT

TAP : My avast! detects via its HTTP scanner with all major browsers, IE, Firefox and Opera.

Re: Is this site infected?

Sun, 22 Oct 2006 00:21:21 EDT

cobo6 : i will go try it on my test computer not my main computer with McAfee Virus Scanner. This is a good change for One Care Live to test itselfs.

When i tried it in firefox buy nothing happen, but when tried it in IE i get an Error 2011. I click the ok box but it just reappears, and stay on the screen. My virus scanner is not picking it up.

Well I am used One Care Live with ZA Firewall (free version)

Re: Is this site infected?

Sun, 22 Oct 2006 00:18:16 EDT

mvdu : Kaspersky detects nothing, but as I said, the file tries to run but doesn't. It does wind up in my system32 folder, though.
--
Don't Blame Me, I Voted for Kerry!

Re: Is this site infected?

Sun, 22 Oct 2006 00:12:29 EDT

astokes : Yup, Avast caught it in Firefox for me.

Re: Is this site infected?

Sun, 22 Oct 2006 00:11:17 EDT

Bigzizzzle : Is the latest kaspersky affected by this virus making it undetected. Let me know I got image restore, about to take the plunge and see for myself

Re: Is this site infected?

Sat, 21 Oct 2006 23:31:21 EDT

dekoy : In IE6 and Firefox it was detected

Re: Is this site infected?

Sat, 21 Oct 2006 21:25:51 EDT

VR38DETT : According to Viruslist, ...»www.viruslist.com/en/viruses/enc···id=48624

Kaspersky should be able to detect this worm fine. :o
--
"People say that money isn't the key to happiness, but I always figured if you have enough money, you can have a key made." -Joan Rivers

Re: Is this site infected?

Sat, 21 Oct 2006 21:09:00 EDT

tonyfer2 : 9.00pm est still geting warning about Gedza.A.
from avg Norton and za

Re: Is this site infected?

Sat, 21 Oct 2006 20:19:08 EDT

JTY : Zone Alarm AV doesn't like it either.

Re: Is this site infected?

Sat, 21 Oct 2006 20:10:44 EDT

mvdu : Ok, I became the guinea pig. I am a Kaspersky user, but have Norton Ghost, so I decided to try the page on IE with Active X completely allowed. There was a scripting error with the VBS file. Perhaps it's corrupt, and that's why Kaspersky isn't detecting?
--
Don't Blame Me, I Voted for Kerry!

Re: Is this site infected?

Sat, 21 Oct 2006 19:25:36 EDT

heels_fan : nothing here with Firefox, AVG and the NoScript Extension

Re: Is this site infected?

Sat, 21 Oct 2006 19:20:29 EDT

cableties : 7:20Pm EST and Avast (through FireFox) found that worm. (Sign of VBS:Gedza [Wrm]; Abort connection )

Re: Is this site infected?

Sat, 21 Oct 2006 19:13:47 EDT

PCInTech : ZA Security Suite hit right on it, too. There's some amazing sites out there. ;)

Re: Is this site infected?

Sat, 21 Oct 2006 19:04:18 EDT

kw : McAfee caught it while running Firefox. They should get on that. Is that virus a "bad" one?

Re: Is this site infected?

Sat, 21 Oct 2006 18:54:28 EDT

mysec : It's a Turkish VBS virus created by GEDZAC LABS. Search for GEDZAC for links to Gemel virus and others.

Their work goes back at least to 2003, where Sophos identified W32/Mapson-A:

In July the worm displays 2 message boxes about the
 author and the worm, one with the title "Lorraine Worm
 [GEDZAC LABS 2003]" and the message "Creado por Falckon/GEDZAC" 
and the second with the same title and a message containing
 the text "Dedicado a mi G. Lorena R. S.".

Pulling this from the Alaska page:

bktbna'/"ue4

a number of other sites turn up in a search:

'<*************GEDZAC LABS 2004**********> Rem VBS/Israfel.a un
 producto de  Rem USA aqui tienes un enemigo
 mÃ¡s, un grano de arena mÃ¡s en el desierto

Backup Newffr.com 2001-2006 - Virus & Anti-Virus -<br> petit virus vbs  -> Gedzac Labs 2004

-rich

______________________________________________
"Talking About Security Can Lead To Anxiety, Panic, And Dread...
Or Cool Assessments, Common Sense And Practical Planning..."

--Bruce Schneier

Re: Is this site infected?

Sat, 21 Oct 2006 18:39:51 EDT

anon : The only antivirus which doesn't catch the enfection is Kaspersky. Go figure???

ALL 16 html pages have the infection embeded and I'm sorry to say that the server itself is compromised and being used as a warez download site. Hope they have a good backup.

Re: Is this site infected?

Sat, 21 Oct 2006 18:10:28 EDT

poppster : AntiVir PE Classic caught it in no time.
--
Dedicated to TD, TSC, and F@H 24/7!

Re: Is this site infected?

Sat, 21 Oct 2006 18:08:30 EDT

Stem Bolt : Funny, I can't open the website anymore in Firefox but I can still get the website in Internet Explorer multiple times. I was able to load the site 1 time in Firefox that's when Dr. Web detected it. I've shut down Firefox and restarted but still can't load the website.
------------
Edit: Dr. Web "locked" objects from this site while in Firefox. That's why I can't reload the website in Firefox.

--
Dr.Web, BOCLEAN, Router/Firewall, Firefox, Acronis True Image

Re: Is this site infected?

Sat, 21 Oct 2006 18:03:59 EDT

Vampirefo : Hell even Clam detects it, don't know whats up with KAV.
--
Best Regards Vampirefo

Re: Is this site infected?

Sat, 21 Oct 2006 18:01:55 EDT

eyespy : Still infectious as of 7 PM Eastern! :(

Regards,
bill

Re: Is this site infected?

Sat, 21 Oct 2006 18:00:40 EDT

Vampirefo : Scroll on down.

Re: Is this site infected?

Sat, 21 Oct 2006 17:59:30 EDT

anon : Bitdefender found 16 infections. All .htm files.

Kaspersky finds nothing. Can anyone confirm this?

Re: Is this site infected?

Sat, 21 Oct 2006 17:58:59 EDT

Greg_Z :

said by Stem Bolt :

Looks like they took down the website.

Nope, still up. I guess the admins over @ WildWestdomains.com do not know how to kill a server. Most likely there is more then one site infected over there.
--
I threw out the map a long time ago. Now I follow my own direction!

Re: Is this site infected?

Sat, 21 Oct 2006 17:56:53 EDT

eyespy : As of 6:55 PM East, Oct21/06, it's still infectious!! :(

Regards,
bill

Re: Is this site infected?

Sat, 21 Oct 2006 17:55:01 EDT

NetFixer : F-Prot does not like the site either.

[att=1]

Re: Is this site infected?

Sat, 21 Oct 2006 17:48:28 EDT

Stem Bolt : Looks like they took down the website.
--
Dr.Web, BOCLEAN, Router/Firewall, Firefox, Acronis True Image

Re: Is this site infected?

Sat, 21 Oct 2006 17:21:55 EDT

Owlbet : I just got off the phone with Fran Gianoutsos and she was shocked (to say the least) that their site is throwing up these warnings. She said she would get in touch with her webmaster.

Elections and candidates are public information. I found their contact information here:

»www.gov.state.ak.us/ltgov/electi···d06g.php

Re: Is this site infected?

Sat, 21 Oct 2006 17:21:48 EDT

Doctor Four : Visited it using Mozilla 1.7.10. Nothing whatsoever from
Avast when the page was loaded, but scanning my cache came
up with the same warning about Gedza.A.

Since I don't have an ActiveX extension for Mozilla, it
can't be executed.
--
"The trouble with computers, of course, is that they are very sophisticated idiots." - Doctor Who (from Destiny Of The Daleks)

Re: Is this site infected?

Sat, 21 Oct 2006 17:10:51 EDT

jp0469 : Avast caught it too but only when opened in Internet Explorer. Nothing when opened in Firefox.

Avast alert

Re: Is this site infected?

Sat, 21 Oct 2006 17:03:05 EDT

Stem Bolt : Dr. Web caught it also.
--
Dr.Web, BOCLEAN, Router/Firewall, Firefox, Acronis True Image

Re: Is this site infected?

Sat, 21 Oct 2006 16:42:10 EDT

Greg_Z : The site is hosted by wildwestwestdomains.com

Re: Is this site infected?

Sat, 21 Oct 2006 15:15:08 EDT

Owlbet : Norton went bonkers as well.

Norton Warning
ActiveX Warning

Re: Is this site infected?

Sat, 21 Oct 2006 15:02:09 EDT

dadkins : LOL! POOR coding on that page! Opera chokes hard on it for 30 seconds and finally opens. :huh:

IE7 just gets stuck in a loop asking for ActiveX.
--
Think outside the Fox... Opera

Re: Is this site infected?

Sat, 21 Oct 2006 14:12:08 EDT

reckoner : :uhh:

Re: Is this site infected?

Sat, 21 Oct 2006 13:54:46 EDT

Graycode : The image shows some of the bad things that site is doing.

Re: Is this site infected?

Sat, 21 Oct 2006 13:48:11 EDT

Cudni : looking at the view source i thinks it is for real and you should let them know

Cudni

Is this site infected?

Sat, 21 Oct 2006 13:39:44 EDT

koolman2 : My uncle got a political flyer the other day, and when he visited their website, AVG caught some form of malware. I want to know if it really is infected and not a false positive, so that we can contact them and let them know. The link is contained inside the text file attached to this post, and a screencap of the virus detected message is above as well. It pops up with both IE and Firefox, and IE requests ActiveX scripts to run, which I denied, of course.

Thanks a bunch.
--
huh?


virus.txt 174 bytes