Puppy Linux Discussion Forum

alienjeff · Joined: 08 Jul 2006 Posts: 2291 Location: Winsted, CT - USA

From http://malwaredomains.com/?tag=fake-codecs

DNS Blocklist Update 12/29
Posted on December 29th, 2007 in New Domains, Storm Worm, fake codecs by dglosser

Added: storm worm domains, rogue antivirus, fake codecs

e-learningcenter.ru flashupdate.net
googl.name health-hack.com
home-xxx.com jkh-novgorod.ru
juhost.ru l0calh0st.jino-net.ru
natural-amber.com newyearwithlove.com
orentraff.cn qarchive.net
s0s1.net taktomi.ru
traffurl.ru trffc.org
vip-ddos.org x5x.ru
xll-g.com milk0soft.com
xmaturelife.com

updates are located at http://www.malwaredomains.com/updates
The full files are located at: http://www.malwaredomains.com/files

BOOT file is in MS DNS format
spywaredomains.zones file is in BIND Server format
domains.txt file is the complete list along with original reference

Caneri · Joined: 04 Sep 2007 Posts: 1569 Location: Canada

Hey thanks AJ,

I've been getting a huge spike in traffic out of .ru

It says it's from puppyrus but I will definitely look much closer at this.

Eric

wingruntled · Joined: 20 Feb 2007 Posts: 287 Location: Great Lakes

Where is Barry?
The manual page is still infected.

alienjeff · Joined: 08 Jul 2006 Posts: 2291 Location: Winsted, CT - USA

purple_ghost · Joined: 09 Nov 2005 Posts: 417

For the ordinary users. Have we been left with a Trojan in Puppy Linux iitself? Did I download a working Trojan with the manual? Should I rebuild by pup_save file?

Caneri · Joined: 04 Sep 2007 Posts: 1569 Location: Canada

I don't know who runs puppyrus but they should be informed also about this.

Eric

wingruntled · Joined: 20 Feb 2007 Posts: 287 Location: Great Lakes

alienjeff · Joined: 08 Jul 2006 Posts: 2291 Location: Winsted, CT - USA

It has been just shy of 22-hours since biting my tongue regarding this matter. Though The Tongue is now unleashed, I'll measure my words - all in the interest of deliberately attempting to be constructive.

Any word back from Barry? It's Sunday morning, east coast USA time, and several pages on puppylinux.com still carry and propagate this IFRAME exploit.

I've just sent a PM to both LobsterEd and Barry regarding this, and a backup email to LobsterEd.

FYI, Barry's last post on this forum was date/time stamped Mon Feb 25, 2008 9:34 pm (east coast USA), though I seem to remember seeing him listed on-line since then. LobsterEd was logged on this forum when I was commenting here.

wingruntled · Joined: 20 Feb 2007 Posts: 287 Location: Great Lakes

alienjeff · Joined: 08 Jul 2006 Posts: 2291 Location: Winsted, CT - USA

To date, this is the only official public response I've been able find:

prehistoric · Joined: 23 Oct 2007 Posts: 1472

With apologies to Lobster. Laughing

Wolf Pup · Joined: 27 Apr 2006 Posts: 637

AJ, where those once real monkeys? Question

BTW, until Barry comes back and fixes the web page, anyone using Internet explorer should disable the IFRAME by:

Starting Internet Explorer then go to -
Tools - Internet Options - Security Tab - Click "Custom Level"

Scroll down till you see:
Launching programs and files in a IFrame = Disable

Then press OK to all, and restart. That IFRAME exploit should stop redirecting after this.

trapster · Joined: 28 Nov 2005 Posts: 2071 Location: Maine, USA

Internet Explorer?????

Wassat?

wingruntled · Joined: 20 Feb 2007 Posts: 287 Location: Great Lakes

Wolf Pup
Barry was here in the forums yesterday. The pages on his domain were fixed directly after. I imagine he had quite a few PM's about the problem. He took his blog down and put up a temporary explaining what part of the problem was.

alienjeff · Joined: 08 Jul 2006 Posts: 2291 Location: Winsted, CT - USA