bliket im calling you OUT you trojan installing peice of shit - GoFuckYourself.com

Myst · 11-27-2006, 11:50 PM

So I go on yahoo chat yesterday.. what do I see..

The place is absolutely flooded with some guy and his 10000s of chatbots. Clicking on profilehome.com took me to http://xnet4.ipwn.com/. Interesting, a 'yahoo webcam viewer' application. So I download it, and check it out with olly debug to see what its doing. Seemed safe enough, so I ran it (with my trusty packet sniffer running in the background). The file xsphinx.exe goes and 'initializes installation', downloading the file xmain.exe from the server, putting it in the windows\system32 directory, and launching it (also loading it on startup).

I run xmain.exe, and it turns out the program requests http://xnet4.ipwn.com/ys/dat/mylink.txt for the link it will be spamming, then grabs some accounts/passwords (jesus learn to encrypt you idiot) from http://xnet4.ipwn.com/(removed) ie jennifer_xv2161, logs the accounts loaded on the computer at http://xnet4.ipwn.com/log.php, and finally gets a list of chatrooms from http://xnet4.ipwn.com/ys/dat/mychats.txt.

So anyone that downloads this exe will have a trojan that runs in the background, and on startup, that connects several yahoo bots into chat to spam the channels. The bots will spam the profilehome.com url.

Now profilehome.com will sometimes redirect you to the trojan page, and sometimes to Imlive (http://imlive.com/wmaster.asp?WID=12...0000000_00000). The dns for profilehome.com points to some free dns server, which eventually leads to https://www.theplanet.com/ where it is hosted.

As I am looking through my cache, I find the URL to the image http://ipwn.com/pcstats.jpg

Looks like this was probably saved to my cache from GFY!. Searching ipwn.com to see who is retarded enough to post his stats from his trojaned computers, there are several matches to one 'bliket'.

Now heres some fun stuff.
Here he is complaining how mtree has not payed him yet http://www.gofuckyourself.com/showthread.php?t=677741
And here he is being stupid enough to post pictures of himself showing off how studly he is http://www.gofuckyourself.com/showthread.php?t=676492

Im sure ImLive will have no problem dealing with this guy
And heres a nice article to what happens to people who get caught running botnets http://www.techweb.com/wire/security/173500033

L-Pink · 11-27-2006, 11:52 PM

Alky · 11-27-2006, 11:53 PM

pretty idiotic to trojan people in this day and age.

*knock knock*

who's there?

FBI OPEN UP.

lol good luck in the future blikit!

munki · 11-27-2006, 11:54 PM

Oh shit...

StickyGreen · 11-27-2006, 11:56 PM

lol...owned...

Myst · 11-27-2006, 11:56 PM

He promotes mtree/aac/pussycash/realitycash/datinggold from his post at http://www.gofuckyourself.com/showthread.php?t=677741
and he also runs http://www.StartProfile.com (according to links on his bots' profiles)

Just a matter of time before hes done

jacked · 11-27-2006, 11:57 PM

rut roh

that doesn't look good at all

CaptainHowdy · 11-27-2006, 11:59 PM

The pic with Lars is priceless...

aaron · 11-28-2006, 12:01 AM

what a dumb ass

Myst · 11-28-2006, 12:02 AM

Quote:

Originally Posted by CaptainHowdy

The pic with Lars is priceless...

quite fitting to see em together

aaron · 11-28-2006, 12:03 AM

oops sorry

DatingGold · 11-28-2006, 12:30 AM

Quote:

Originally Posted by Myst

He promotes mtree/aac/pussycash/realitycash/datinggold from his post at http://www.gofuckyourself.com/showthread.php?t=677741
and he also runs http://www.StartProfile.com (according to links on his bots' profiles)

Just a matter of time before hes done

Actually we terminated him a while ago.

rounders · 11-28-2006, 12:33 AM

wow straight busted!

heywood · 11-28-2006, 12:35 AM

Fucked up, illegal, and stupid. Watch this one unfold.

And yeah, the pic with lars is great.

one eight · 11-28-2006, 12:42 AM

And THAT, webmaster of gfy, is how to properly own someone.

mikeyddddd · 11-28-2006, 12:50 AM

Quote:

Originally Posted by Myst

bliket im calling you OUT you trojan installing peice of shit

Good work

I remembered the "Lensman" pic.

woj · 11-28-2006, 12:57 AM

sig spot...

sicone · 11-28-2006, 01:00 AM

damn... would like to hear a response/excuse

OzMan · 11-28-2006, 01:05 AM

That's some crazy shit. I hope he is practising his ability to hold wet soap

Awesome detective work Myst

martinsc · 11-28-2006, 01:19 AM

busted.!!!

Masterchief · 11-28-2006, 01:27 AM

I'm sure it's some misunderstanding, I shook his hands at a show and he seemed like a well rounded stand-up guy.

Furious_Female · 11-28-2006, 01:27 AM

What a fuckin idiot. He should kill himself.

Martin3 · 11-28-2006, 01:33 AM

That Lars pic is great

JD · 11-28-2006, 01:34 AM

holy ass rocket to the moon batman.

Ownage factor.... OFF THE SCALE!

Tullian Zombie · 11-28-2006, 01:55 AM

Don't you just want to kick the shit out of punks like that in front of their mamas?

I'm chasing a plagiarizer of mine right now so I have a hard-on (so to speak) for cheating douchebag ball sniffers.

Theo · 11-28-2006, 02:02 AM

lol now that is ownage

Stevie · 11-28-2006, 02:08 AM

Quote:

Originally Posted by Myst

quite fitting to see em together

lol, my thoughts exactly....

Kimo · 11-28-2006, 02:23 AM

i sale trojan horse

dollar five

get them while they iz

King of Queens · 11-28-2006, 02:26 AM

Quote:

Originally Posted by CaptainHowdy

The pic with Lars is priceless...

They say birds of the same feather flock together

starpimps · 11-28-2006, 02:27 AM

that sucks...but then again it sucks to look at him
he looks like a goof

Jace · 11-28-2006, 02:30 AM

i have to say without a doubt, this is one of the best outings on GFY in a long fucking time

emthree · 11-28-2006, 02:31 AM

Early signature spot.

martinsc · 11-28-2006, 02:32 AM

Quote:

Originally Posted by Jace

i have to say without a doubt, this is one of the best outings on GFY in a long fucking time

i second that.

Why · 11-28-2006, 04:19 AM

what a moron

Lazonby · 11-28-2006, 04:31 AM

Quote:

Originally Posted by Myst

Who's the ugly woman he is with?

mikeyddddd · 11-28-2006, 06:09 AM

polle54 · 11-28-2006, 06:27 AM

LOL he is going down

and the stupid fuck didn't even know how to encrypt his files

good work busting his ass.

Alky · 11-28-2006, 08:19 AM

Quote:

Originally Posted by mikeyddddd

StarkReality · 11-28-2006, 08:25 AM

xclusive · 11-28-2006, 08:31 AM

I love this thread lol

Antonio · 11-28-2006, 08:33 AM

he should fly to South America FAST !!!!!!

jacklaidlaw · 11-28-2006, 08:35 AM

lmao OwNeD

Tempest · 11-28-2006, 08:42 AM

How about reporting him to the FBI as well so they can get all his info from the programs and go get his ass.

BVF · 11-28-2006, 09:09 AM

Good one

Kimo · 11-28-2006, 09:33 AM

did you get him

Chris · 11-28-2006, 09:39 AM

hahahah nice

well done

Myst · 11-28-2006, 10:31 AM

Quote:

Originally Posted by mikeyddddd

OzMan · 11-28-2006, 10:37 AM

I think bliket picked the wrong week to go on vacation to spend all his bling.

Last Activity: 11-24-2006 02:36 AM

and apparently Pussycash picked the wrong morning to not check the boards.

crockett · 11-28-2006, 10:41 AM

Quote:

Originally Posted by mikeyddddd

lol sad but probably true. Yet people still do business with Lars and I'm sure programs will still take this guy's traffic.

btw is this the same "bike" guy that runs the big tgp's?

Alky · 11-28-2006, 12:00 PM

bump for blikit to answer!

11-27-2006, 11:50 PM	#1
Myst Confirmed User Join Date: Feb 2004 Location: Alberta, Canada Posts: 4,707	bliket im calling you OUT you trojan installing peice of shit So I go on yahoo chat yesterday.. what do I see.. The place is absolutely flooded with some guy and his 10000s of chatbots. Clicking on profilehome.com took me to http://xnet4.ipwn.com/. Interesting, a 'yahoo webcam viewer' application. So I download it, and check it out with olly debug to see what its doing. Seemed safe enough, so I ran it (with my trusty packet sniffer running in the background). The file xsphinx.exe goes and 'initializes installation', downloading the file xmain.exe from the server, putting it in the windows\system32 directory, and launching it (also loading it on startup). I run xmain.exe, and it turns out the program requests http://xnet4.ipwn.com/ys/dat/mylink.txt for the link it will be spamming, then grabs some accounts/passwords (jesus learn to encrypt you idiot) from http://xnet4.ipwn.com/(removed) ie jennifer_xv2161, logs the accounts loaded on the computer at http://xnet4.ipwn.com/log.php, and finally gets a list of chatrooms from http://xnet4.ipwn.com/ys/dat/mychats.txt. So anyone that downloads this exe will have a trojan that runs in the background, and on startup, that connects several yahoo bots into chat to spam the channels. The bots will spam the profilehome.com url. Now profilehome.com will sometimes redirect you to the trojan page, and sometimes to Imlive (http://imlive.com/wmaster.asp?WID=12...0000000_00000). The dns for profilehome.com points to some free dns server, which eventually leads to https://www.theplanet.com/ where it is hosted. As I am looking through my cache, I find the URL to the image http://ipwn.com/pcstats.jpg Looks like this was probably saved to my cache from GFY!. Searching ipwn.com to see who is retarded enough to post his stats from his trojaned computers, there are several matches to one 'bliket'. Now heres some fun stuff. Here he is complaining how mtree has not payed him yet http://www.gofuckyourself.com/showthread.php?t=677741 And here he is being stupid enough to post pictures of himself showing off how studly he is http://www.gofuckyourself.com/showthread.php?t=676492 Im sure ImLive will have no problem dealing with this guy And heres a nice article to what happens to people who get caught running botnets http://www.techweb.com/wire/security/173500033 Last edited by Myst; 11-27-2006 at 11:53 PM..

11-27-2006, 11:54 PM	#4
munki Do Fun Shit. Industry Role: Join Date: Dec 2004 Location: OC Posts: 13,393	Oh shit... __________________ “I have the simplest tastes. I am always satisfied with the best.” -Oscar Wilde

11-27-2006, 11:56 PM	#5
StickyGreen . Industry Role: Join Date: Oct 2003 Posts: 13,076	lol...owned... __________________ Refer Cam Girls and Take Home 10% of Everything They Make For Life

11-27-2006, 11:56 PM	#6
Myst Confirmed User Join Date: Feb 2004 Location: Alberta, Canada Posts: 4,707	He promotes mtree/aac/pussycash/realitycash/datinggold from his post at http://www.gofuckyourself.com/showthread.php?t=677741 and he also runs http://www.StartProfile.com (according to links on his bots' profiles) Just a matter of time before hes done Last edited by Myst; 11-27-2006 at 11:59 PM..

11-27-2006, 11:57 PM	#7
jacked sperm tail Industry Role: Join Date: May 2004 Location: nj Posts: 11,019	rut roh that doesn't look good at all __________________ Got Cam Models? icq: 361-607-616

11-27-2006, 11:52 PM	#2
L-Pink working on my tan Industry Role: Join Date: Mar 2005 Location: Florida/Kentucky Posts: 39,151

11-27-2006, 11:53 PM	#3
Alky Confirmed User Join Date: Apr 2002 Location: Houston Posts: 5,651	pretty idiotic to trojan people in this day and age. knock knock who's there? FBI OPEN UP. lol good luck in the future blikit!

11-27-2006, 11:59 PM	#8
CaptainHowdy Too lazy to set a custom title Industry Role: Join Date: Dec 2004 Location: Happy in the dark. Posts: 93,284	The pic with Lars is priceless... __________________ FLASH SALE INSANITY! deal with a 100% Trusted Seller Buy Traffic Spots on a High-Quality Network 1 Year or Lifetime — That’s Right, Until the Internet Explodes!

11-28-2006, 12:01 AM	#9
aaron Confirmed User Industry Role: Join Date: Mar 2003 Location: USA Posts: 4,452	what a dumb ass Last edited by aaron; 11-28-2006 at 12:03 AM..

11-28-2006, 12:03 AM	#11
aaron Confirmed User Industry Role: Join Date: Mar 2003 Location: USA Posts: 4,452	oops sorry

11-28-2006, 12:33 AM	#13
rounders Confirmed User Join Date: Sep 2003 Location: p0rn0stars & h0es Posts: 2,931	wow straight busted! __________________ ICQ#: 153923840

11-28-2006, 12:35 AM	#14
heywood So Fucking Banned Join Date: Jun 2003 Location: Wilsonville, Oregon Posts: 468	Fucked up, illegal, and stupid. Watch this one unfold. And yeah, the pic with lars is great.

11-28-2006, 12:42 AM	#15
one eight Confirmed User Join Date: Mar 2005 Location: Costa Rica & San Francisco Posts: 1,933	And THAT, webmaster of gfy, is how to properly own someone. __________________ -more than a number 308 760 278

11-28-2006, 12:57 AM	#17
woj <&(©¿©)&> Industry Role: Join Date: Jul 2002 Location: Chicago Posts: 47,882	sig spot... __________________ Custom Software Development, email: woj#at#wojfun#.#com to discuss details or skype: wojl2000 or gchat: wojfun or telegram: wojl2000 Affiliate program tools: Hosted Galleries Manager Banner Manager Video Manager Wordpress Affiliate Plugin Pic/Movie of the Day Fansign Generator Zip Manager

11-28-2006, 01:00 AM	#18
sicone Retired Industry Role: Join Date: Jan 2004 Location: Sac Posts: 18,453	damn... would like to hear a response/excuse __________________

11-28-2006, 01:05 AM	#19
OzMan Confirmed User Join Date: Sep 2003 Location: Los Begas Posts: 9,162	That's some crazy shit. I hope he is practising his ability to hold wet soap Awesome detective work Myst __________________

11-28-2006, 01:19 AM	#20
martinsc Too lazy to set a custom title Industry Role: Join Date: Jun 2005 Location: 127.0.0.1 Posts: 27,047	busted.!!! __________________ Make Money

11-28-2006, 01:27 AM	#21
Masterchief Confirmed User Join Date: Jun 2006 Posts: 530	I'm sure it's some misunderstanding, I shook his hands at a show and he seemed like a well rounded stand-up guy.

11-28-2006, 01:27 AM	#22
Furious_Female Confirmed User Industry Role: Join Date: Oct 2002 Location: Upstate, New York Posts: 8,187	What a fuckin idiot. He should kill himself. __________________ Skype: j3nn.com ICQ 160370494 My current favorite high-converting sponsor: CrakRevenue

11-28-2006, 01:33 AM	#23
Martin3 Confirmed User Join Date: Oct 2005 Location: Houston Posts: 1,529	That Lars pic is great __________________ 264-543-302

11-28-2006, 01:34 AM	#24
JD Too lazy to set a custom title Industry Role: Join Date: Sep 2003 Posts: 22,651	holy ass rocket to the moon batman. Ownage factor.... OFF THE SCALE!

11-28-2006, 01:55 AM	#25
Tullian Zombie Confirmed User Join Date: May 2006 Location: Next door to Oz or ICQ 339-835-888 Posts: 302	Don't you just want to kick the shit out of punks like that in front of their mamas? I'm chasing a plagiarizer of mine right now so I have a hard-on (so to speak) for cheating douchebag ball sniffers. __________________ The Smut Lady Women's erotica blog Slutty Devils Goth Hub

11-28-2006, 02:02 AM	#26
Theo HAL 9000 Industry Role: Join Date: May 2001 Posts: 34,515	lol now that is ownage

11-28-2006, 02:23 AM	#28
Kimo ... Join Date: Jan 2006 Location: Maryland ICQ:87038677 Posts: 11,542	i sale trojan horse dollar five get them while they iz __________________ ...

11-28-2006, 02:27 AM	#30
starpimps Confirmed User Join Date: Sep 2006 Location: internets Posts: 6,954	that sucks...but then again it sucks to look at him he looks like a goof __________________ Teen Porn Models / Solo Girls

11-28-2006, 02:30 AM	#31
Jace FBOP Class Of 2013 Industry Role: Join Date: Jan 2004 Location: bumfuck, ky Posts: 35,562	i have to say without a doubt, this is one of the best outings on GFY in a long fucking time

11-28-2006, 02:31 AM	#32
emthree Dialer Kingpin Join Date: Jun 2003 Location: New York Posts: 10,816	Early signature spot. __________________ • Sell Patches & Pills •

11-28-2006, 04:19 AM	#34
Why MFBA Industry Role: Join Date: Mar 2003 Location: PNW Posts: 7,230	what a moron

11-28-2006, 06:09 AM	#36
mikeyddddd Viva la vulva! Join Date: Mar 2003 Location: you can't please everyone, so you got to please yourself Posts: 16,557	__________________ AdultStarProfits AmbyaCash AnilosCash AzianiGold ColdHardCash FlashTheMoney IdolBucks MediumPimpin NSCash Nubiles PussyCash ScoreCash Sextronix SpunkyCash TubeTitans Twistys

11-28-2006, 06:27 AM	#37
polle54 Confirmed User Join Date: Jul 2004 Location: The Beach Posts: 4,626	LOL he is going down and the stupid fuck didn't even know how to encrypt his files good work busting his ass. __________________ ICQ# 143561781

11-28-2006, 08:25 AM	#39
StarkReality Confirmed User Join Date: May 2004 Location: 4 8 15 16 23 42 Posts: 4,444

11-28-2006, 08:31 AM	#40
xclusive Too lazy to set a custom title Join Date: Apr 2004 Location: Buffalo, NY Posts: 35,218	I love this thread lol __________________ I support MediumPimpin.com / Shemp's Outlawtgp.com /

11-28-2006, 08:33 AM	#41
Antonio Too lazy to set a custom title Join Date: Oct 2001 Location: Spartaaaaaaaaa Posts: 14,136	he should fly to South America FAST !!!!!!

11-28-2006, 08:35 AM	#42
jacklaidlaw Confirmed User Join Date: Sep 2006 Posts: 728	lmao OwNeD __________________

11-28-2006, 08:42 AM	#43
Tempest Too lazy to set a custom title Industry Role: Join Date: May 2004 Location: West Coast, Canada. Posts: 10,217	How about reporting him to the FBI as well so they can get all his info from the programs and go get his ass.