bliket im calling you OUT you trojan installing peice of shit
 

So I go on yahoo chat yesterday.. what do I see..
http://img157.imageshack.us/img157/2402/spamxb9.jpg

The place is absolutely flooded with some guy and his 10000s of chatbots. Clicking on profilehome.com took me to http://xnet4.ipwn.com/. Interesting, a 'yahoo webcam viewer' application. So I download it, and check it out with olly debug to see what its doing. Seemed safe enough, so I ran it (with my trusty packet sniffer running in the background). The file xsphinx.exe goes and 'initializes installation', downloading the file xmain.exe from the server, putting it in the windows\system32 directory, and launching it (also loading it on startup).

I run xmain.exe, and it turns out the program requests http://xnet4.ipwn.com/ys/dat/mylink.txt for the link it will be spamming, then grabs some accounts/passwords (jesus learn to encrypt you idiot) from http://xnet4.ipwn.com/(removed) ie jennifer_xv2161, logs the accounts loaded on the computer at http://xnet4.ipwn.com/log.php, and finally gets a list of chatrooms from http://xnet4.ipwn.com/ys/dat/mychats.txt.

So anyone that downloads this exe will have a trojan that runs in the background, and on startup, that connects several yahoo bots into chat to spam the channels. The bots will spam the profilehome.com url.

Now profilehome.com will sometimes redirect you to the trojan page, and sometimes to Imlive (http://imlive.com/wmaster.asp?WID=12...0000000_00000). The dns for profilehome.com points to some free dns server, which eventually leads to https://www.theplanet.com/ where it is hosted.

As I am looking through my cache, I find the URL to the image http://ipwn.com/pcstats.jpg
http://ipwn.com/pcstats.jpg
Looks like this was probably saved to my cache from GFY!. Searching ipwn.com to see who is retarded enough to post his stats from his trojaned computers, there are several matches to one 'bliket'.

Now heres some fun stuff.
Here he is complaining how mtree has not payed him yet http://www.gofuckyourself.com/showthread.php?t=677741
And here he is being stupid enough to post pictures of himself showing off how studly he is http://www.gofuckyourself.com/showthread.php?t=676492
http://ipwn.com/pb/Photo_111006_111.jpg
http://ipwn.com/pb/Photo_111006_057.jpg
http://ipwn.com/pb/Photo_111006_088.jpg

Im sure ImLive will have no problem dealing with this guy
And heres a nice article to what happens to people who get caught running botnets http://www.techweb.com/wire/security/173500033

:Oh crap

pretty idiotic to trojan people in this day and age.

*knock knock*

who's there?

FBI OPEN UP.




lol good luck in the future blikit!

Oh shit... :Oh crap :Oh crap

lol...owned...

He promotes mtree/aac/pussycash/realitycash/datinggold from his post at http://www.gofuckyourself.com/showthread.php?t=677741
and he also runs http://www.StartProfile.com (according to links on his bots' profiles)

Just a matter of time before hes done

rut roh :1orglaugh

that doesn't look good at all

The pic with Lars is priceless...

what a dumb ass

quite fitting to see em together :1orglaugh :1orglaugh

oops sorry

Actually we terminated him a while ago.

wow straight busted!

Fucked up, illegal, and stupid. Watch this one unfold.

And yeah, the pic with lars is great.

And THAT, webmaster of gfy, is how to properly own someone.

Good work :thumbsup

I remembered the "Lensman" pic.
:1orglaugh :1orglaugh :1orglaugh

sig spot...

damn... would like to hear a response/excuse

That's some crazy shit. I hope he is practising his ability to hold wet soap :error

Awesome detective work Myst :thumbsup

busted.!!!

I'm sure it's some misunderstanding, I shook his hands at a show and he seemed like a well rounded stand-up guy.

What a fuckin idiot. He should kill himself.

That Lars pic is great :1orglaugh

holy ass rocket to the moon batman.

Ownage factor.... OFF THE SCALE!

Don't you just want to kick the shit out of punks like that in front of their mamas?


I'm chasing a plagiarizer of mine right now so I have a hard-on (so to speak) for cheating douchebag ball sniffers.

lol now that is ownage

lol, my thoughts exactly.... :1orglaugh

i sale trojan horse


dollar five


get them while they iz

They say birds of the same feather flock together :1orglaugh

that sucks...but then again it sucks to look at him
he looks like a goof

i have to say without a doubt, this is one of the best outings on GFY in a long fucking time

Early signature spot.

i second that.

what a moron

Who's the ugly woman he is with?

LOL he is going down :)

and the stupid fuck didn't even know how to encrypt his files :)

good work busting his ass.

:1orglaugh :1orglaugh :1orglaugh

I love this thread lol

he should fly to South America FAST !!!!!!

lmao OwNeD

How about reporting him to the FBI as well so they can get all his info from the programs and go get his ass.

Good one

did you get him

hahahah nice

well done

:1orglaugh :1orglaugh :1orglaugh

I think bliket picked the wrong week to go on vacation to spend all his bling.

Last Activity: 11-24-2006 02:36 AM

and apparently Pussycash picked the wrong morning to not check the boards.

lol sad but probably true. Yet people still do business with Lars and I'm sure programs will still take this guy's traffic.

btw is this the same "bike" guy that runs the big tgp's?

bump for blikit to answer!