YNOT.COM Trojan - Day 4 - GoFuckYourself.com

Rik Lear · 06-16-2014, 03:02 PM

Hey all,
4 days ago at approx. 3PM PST, Kaspersky alerted us to a trojan on ynot.com. We attempted to email, but they were spit back to us, (including emailing @abuse), as well as us then contacting the news dept. over at xbiz but no answer/confirm from them either.

If you run Kaspersky you'll notice that there is a server wide trojan alert (not even letting the visitor into the site), as well as the same infection is trying to leach its way through our desktop RSS feed readers.

Just a heads up. And if anyone knows how, please get in touch with ynot.

Thanks,
Rik

Rik Lear · 06-16-2014, 07:03 PM

Just a bump for the night crowd.

But also this.

We have 4 systems using RSS feed readers across our monitors 24-7. With that said, out of all of the scrolling feeds, we were alerted to YNOT at around the time mentioned above. I then personally went to the splashpage, and bam. alerts went off. Our anti-virus (Kaspersky) went off literally 10 seconds ago as I type this.

This means that anyone visiting the site in just over the last 96 hours ago [up until 10 seconds ago] would obviously be infected. Our company only uses this software, having gone through the gamut of all anti-virus softwares in this industry for over a decade.

If any of you are getting alerts from Norton, McAfee, etc., let everyone know please. Otherwise, I'd personally do a full system scan, empty cache files, check for loc files, etc. You know the routine.

It's a shame, IMO, to see this BS happen to YNOT, just as it pissed me off to see moneycult's 'hosted' sub-directory be infected too for fucking 5 solid months.

Either way, check your shit if you've been to YNOT in the last 4 days. We are behind our systems literally 12-14 hours a day here at the offices, live, so this is something that I've been witnessing every fucking day since it started....

Nomarh · 06-16-2014, 07:27 PM

Get it here too , Google Chrome has blocked access to this page on www.ynot.com.
Content from hq-youporn.com, a known malware distributor, has been inserted into this web page. Visiting this page now is very likely to infect your computer with malware.
Malware is malicious software that causes things like identity theft, financial loss, and permanent file deletion. Learn more

AsianDivaGirlsWebDude · 06-16-2014, 07:36 PM

Quote:

Originally Posted by Nomarh

Get it here too , Google Chrome has blocked access to this page on ynot.com.
Content from hq-youporn.com, a known malware distributor, has been inserted into this web page. Visiting this page now is very likely to infect your computer with malware.
Malware is malicious software that causes things like identity theft, financial loss, and permanent file deletion. Learn more

Why would you post a link to a virus?

ADG

Rik Lear · 06-16-2014, 07:36 PM

Quote:

Originally Posted by Nomarh

Get it here too , Google Chrome has blocked access to this page on ynot. com.
Content from hq-youporn .com, a known malware distributor, has been inserted into this web page. Visiting this page now is very likely to infect your computer with malware.
Malware is malicious software that causes things like identity theft, financial loss, and permanent file deletion. Learn more

Yeah, so you're the Chris Butler that apparently is the scam fuck-all from everywhere. It's too bad you had to be the 1st poster here. Maybe you should've gotten infected.

Bummer.

At least you contributed to the thread, and I don't know you or your history here. But it seems you're fucking famous for being a fucking scammer.

Anyone else with other anti-virus software, please post(!)

Nomarh · 06-16-2014, 07:41 PM

Quote:

Originally Posted by Rik Lear

Yeah, so you're the Chris Butler that apparently is the scam fuck-all from everywhere. It's too bad you had to be the 1st poster here. Maybe you should've gotten infected.

Bummer.

At least you contributed to the thread, and I don't know you or your history here. But it seems you're fucking famous for being a fucking scammer.

Anyone else with other anti-virus software, please post(!)

Ok Jodete

Rik Lear · 06-16-2014, 07:50 PM

Quote:

Originally Posted by Nomarh

Ok Jodete

Like I said, I don't know you, nor do I know what a Jodete is. Either way, this is a thread about a large site being hacked and taken over by a trojan. So in essence, what you're doing is bumping a very serious thread, so at least thanks for that. What if this was GFY that was a victim?

IMO, this deserves a sticky until YNOT takes care of this. It's fucking bullshit that idiot noob webmasters are being infected as we speak.

And my reply to you is yet another bump so that someone from the North American night crowd can contact these mofos asap and clean their servers.

Rik Lear · 06-16-2014, 10:17 PM

This is a final *bump* for my friends across the pond who are just waking up now....

I just got an email from a long time friend who posts here at GFY regarding this thread and the YNOT hack, that of which his name will remain secret, and I'll answer it now...

"Why didn't you post this sooner? Like on day 1?"

Answer: Simply because I'm busy running 147 sites. It was on my mind, but after so many hourly desktop alerts on day 4, it was time to go public...

"What about the Moneycult thing wtf!?"

Answer: I was pissed off about 5-6 months ago when my secretary told me about this. I then investigated and found that their sub-directory named, "hosted," was severely infected, but that their root was still fine. So I personally emailed them twice, along with my secretary but we got no replies whatsoever - even with ICQ - and in that sense I put it on the back burner and was going to openly say something here when I felt like it.

---------------------------

With all of this said, here's an update: It's been quiet with virus alerts since my last post, so I'll assume that this thread got into the right hands. It's not my intention to bring ill-will towards any of the popular boards. On the contrary, this is truly about one thing only.

And that is: Identity fraud. If ANY OF YOU have had your identity stolen, then we are in the same boat. Identity fraud crosses the line because it's not about the adult industry, it's about your personal space, your bank account and, not-to-mention the PAIN in the fucking ass it is to take care of it. (!)

ANYONE who truly knows about trojans, malware, etc. knows the harm that they can do. This is about internet security, and the trojan that hit YNOT isn't about YNOT, it's about our fight against motherfuckers who get off stealing our bank accounts, our 'life' and our souls. Until it happens to you (for me twice last year alone) then you just don't get it. Plain & simple...

Whether you like, love or hate the competition in the adult industry, it doesn't matter. We are still internet entrepreneurs and this kind of shit doesn't just hit our industry, it hits the entire online population.

Being online since 1994 I've seen the exponential growth of all kinds of warez since the beginning of the 'web,' and it's truly turned into a terrible thing that can destroy families literally overnight when you wake up to check your online bank accounts.

With that said, we are really not enemies in the adult industry. Things have changed. It's 2014 now and things aren't what they were just a few short years ago. When it all comes down to brass tacks, no matter who or what site you hate or support, TIMES ARE DIFFERENT NOW. If one of our compatriot sites goes down, it's up to US to help.

This/my thread was not meant to hurt YNOT, it was meant to reach out and help other webmasters/companies in the sense that no-matter-what we are all in this together. Pulling together to help each other in a time when this industry or that industry might be in trouble. And, with identity theft the number one increasing problem in this world, it's up to us to stop malwarez from reaching people who just don't get it. Because, in the end, it'll hit you and I in some form or another. Moreover, we *have* to respect the legitimate and other successful ones who give this industry an edge.

In my humble opinion, it's sad to see all the fighting that goes on. All the bullshit that is 'this' industry, but so be it. It is what it is. And it probably will remain so. But, at the end of the day, when my ex-wife slow poisoned me and put me into coma for 3 days all because of porn, money and lies, it dawned on me... What's it all worth? When your spouse of over a decade decides she's going to slow poison you with anti-freeze for 2 years all because of the half-million in the bank you have to ask yourself...

Is fighting in this industry really worth it? Did you make some really cool friends that you can trust? Are you happy with your life if you were to die tomorrow? Is your family taken care of if you do?

Just some thoughts.

GFY, YNOT et. al. have been around forever. Keep it true. Keep it simple. And don't get so anal the next time you feel dissed on the boards.

Rik.

Rik Lear · 06-16-2014, 10:57 PM

I take it back. Kaspersky just alerted us now [11:06 PM PST]

The trojan is still active.

Rik Lear · 06-17-2014, 12:04 AM

*Bump* for Europe.

Rik Lear · 06-17-2014, 12:15 AM

Now I'm expecting some sorry-ass IT to get fired tomorrow.

Hope his IT security job isn't like the GM recall oversight.

Any site that has one week of malware infection has a mole inside.

Imagine if that happened here?

Rik.

06-16-2014, 03:02 PM	#1
Rik Lear Confirmed User Industry Role: Join Date: Oct 2013 Location: Jacuzzi Posts: 112	YNOT.COM Trojan - Day 4 Hey all, 4 days ago at approx. 3PM PST, Kaspersky alerted us to a trojan on ynot.com. We attempted to email, but they were spit back to us, (including emailing @abuse), as well as us then contacting the news dept. over at xbiz but no answer/confirm from them either. If you run Kaspersky you'll notice that there is a server wide trojan alert (not even letting the visitor into the site), as well as the same infection is trying to leach its way through our desktop RSS feed readers. Just a heads up. And if anyone knows how, please get in touch with ynot. Thanks, Rik __________________ 52 185 317 I listen to Korn and Enya on random repeat.

06-16-2014, 07:03 PM	#2
Rik Lear Confirmed User Industry Role: Join Date: Oct 2013 Location: Jacuzzi Posts: 112	Just a bump for the night crowd. But also this. We have 4 systems using RSS feed readers across our monitors 24-7. With that said, out of all of the scrolling feeds, we were alerted to YNOT at around the time mentioned above. I then personally went to the splashpage, and bam. alerts went off. Our anti-virus (Kaspersky) went off literally 10 seconds ago as I type this. This means that anyone visiting the site in just over the last 96 hours ago [up until 10 seconds ago] would obviously be infected. Our company only uses this software, having gone through the gamut of all anti-virus softwares in this industry for over a decade. If any of you are getting alerts from Norton, McAfee, etc., let everyone know please. Otherwise, I'd personally do a full system scan, empty cache files, check for loc files, etc. You know the routine. It's a shame, IMO, to see this BS happen to YNOT, just as it pissed me off to see moneycult's 'hosted' sub-directory be infected too for fucking 5 solid months. Either way, check your shit if you've been to YNOT in the last 4 days. We are behind our systems literally 12-14 hours a day here at the offices, live, so this is something that I've been witnessing every fucking day since it started.... __________________ 52 185 317 I listen to Korn and Enya on random repeat.

06-16-2014, 10:17 PM	#8
Rik Lear Confirmed User Industry Role: Join Date: Oct 2013 Location: Jacuzzi Posts: 112	This is a final bump for my friends across the pond who are just waking up now.... I just got an email from a long time friend who posts here at GFY regarding this thread and the YNOT hack, that of which his name will remain secret, and I'll answer it now... "Why didn't you post this sooner? Like on day 1?" Answer: Simply because I'm busy running 147 sites. It was on my mind, but after so many hourly desktop alerts on day 4, it was time to go public... "What about the Moneycult thing wtf!?" Answer: I was pissed off about 5-6 months ago when my secretary told me about this. I then investigated and found that their sub-directory named, "hosted," was severely infected, but that their root was still fine. So I personally emailed them twice, along with my secretary but we got no replies whatsoever - even with ICQ - and in that sense I put it on the back burner and was going to openly say something here when I felt like it. --------------------------- With all of this said, here's an update: It's been quiet with virus alerts since my last post, so I'll assume that this thread got into the right hands. It's not my intention to bring ill-will towards any of the popular boards. On the contrary, this is truly about one thing only. And that is: Identity fraud. If ANY OF YOU have had your identity stolen, then we are in the same boat. Identity fraud crosses the line because it's not about the adult industry, it's about your personal space, your bank account and, not-to-mention the PAIN in the fucking ass it is to take care of it. (!) ANYONE who truly knows about trojans, malware, etc. knows the harm that they can do. This is about internet security, and the trojan that hit YNOT isn't about YNOT, it's about our fight against motherfuckers who get off stealing our bank accounts, our 'life' and our souls. Until it happens to you (for me twice last year alone) then you just don't get it. Plain & simple... Whether you like, love or hate the competition in the adult industry, it doesn't matter. We are still internet entrepreneurs and this kind of shit doesn't just hit our industry, it hits the entire online population. Being online since 1994 I've seen the exponential growth of all kinds of warez since the beginning of the 'web,' and it's truly turned into a terrible thing that can destroy families literally overnight when you wake up to check your online bank accounts. With that said, we are really not enemies in the adult industry. Things have changed. It's 2014 now and things aren't what they were just a few short years ago. When it all comes down to brass tacks, no matter who or what site you hate or support, TIMES ARE DIFFERENT NOW. If one of our compatriot sites goes down, it's up to US to help. This/my thread was not meant to hurt YNOT, it was meant to reach out and help other webmasters/companies in the sense that no-matter-what we are all in this together. Pulling together to help each other in a time when this industry or that industry might be in trouble. And, with identity theft the number one increasing problem in this world, it's up to us to stop malwarez from reaching people who just don't get it. Because, in the end, it'll hit you and I in some form or another. Moreover, we have to respect the legitimate and other successful ones who give this industry an edge. In my humble opinion, it's sad to see all the fighting that goes on. All the bullshit that is 'this' industry, but so be it. It is what it is. And it probably will remain so. But, at the end of the day, when my ex-wife slow poisoned me and put me into coma for 3 days all because of porn, money and lies, it dawned on me... What's it all worth? When your spouse of over a decade decides she's going to slow poison you with anti-freeze for 2 years all because of the half-million in the bank you have to ask yourself... Is fighting in this industry really worth it? Did you make some really cool friends that you can trust? Are you happy with your life if you were to die tomorrow? Is your family taken care of if you do? Just some thoughts. GFY, YNOT et. al. have been around forever. Keep it true. Keep it simple. And don't get so anal the next time you feel dissed on the boards. Rik. __________________ 52 185 317 I listen to Korn and Enya on random repeat.

06-16-2014, 10:57 PM	#9
Rik Lear Confirmed User Industry Role: Join Date: Oct 2013 Location: Jacuzzi Posts: 112	I take it back. Kaspersky just alerted us now [11:06 PM PST] The trojan is still active. __________________ 52 185 317 I listen to Korn and Enya on random repeat.

06-17-2014, 12:04 AM	#10
Rik Lear Confirmed User Industry Role: Join Date: Oct 2013 Location: Jacuzzi Posts: 112	Bump for Europe. __________________ 52 185 317 I listen to Korn and Enya on random repeat.

06-16-2014, 07:27 PM	#3
Nomarh So fucking Banned Industry Role: Join Date: Apr 2014 Location: West Coast Posts: 192	Get it here too , Google Chrome has blocked access to this page on www.ynot.com. Content from hq-youporn.com, a known malware distributor, has been inserted into this web page. Visiting this page now is very likely to infect your computer with malware. Malware is malicious software that causes things like identity theft, financial loss, and permanent file deletion. Learn more

06-17-2014, 12:15 AM	#11
Rik Lear Confirmed User Industry Role: Join Date: Oct 2013 Location: Jacuzzi Posts: 112	Now I'm expecting some sorry-ass IT to get fired tomorrow. Hope his IT security job isn't like the GM recall oversight. Any site that has one week of malware infection has a mole inside. Imagine if that happened here? Rik. __________________ 52 185 317 I listen to Korn and Enya on random repeat.