Post by: RNKIII on March 23, 2008, 08:23:12 PM
It 'blew up' the window to fill the whole screen... and each time I responded in the 'negative' to it's request to install or download something it did the opposite.
This is what my address bar looked like [attachment=922:screenshot_03.jpg]
It has messed up the 'tabs' bar in Safari so that I can only see a small portion of the top of each tab.
I'm about to shut down Safari and restart to see if the mess continues. Am running the latest version of Safari w/'block pop-up windows' set.
Any and all reassurances and comments welcomed.
Minutes later: I can reproduce the 'problem' by going to that same new story... as I attempt to 'back out of it' to return to the main newspaper page the same thing will happen... and it does attempt to download software. [attachment=923:screenshot_06.jpg]
Bob K. rnkiii
Post by: kimmer on March 23, 2008, 08:33:45 PM
http://jfaughnan.blogspot.com/2008/03/xpon...nal-or-not.html
Post by: RNKIII on March 23, 2008, 08:38:14 PM
Have visited there several times today... not sure if I went to any stories or not but it did not happen earlier.
THANK YOU, Kimmer... Will stay away from the Star Trib for a while..
Bob K. rnkiii
Post by: Bruce_F on March 23, 2008, 09:10:16 PM
Post by: Dick Miller on March 23, 2008, 09:48:41 PM
Post by: tacit on March 23, 2008, 11:15:44 PM
XPonlinescanner.com is a Web site run by Russian organized crime. It shows you a fake, scary-looking message that warns you in dire terms that your computer is "infected" and needs to be fixed. Then it tries to trick you into downloading a file to "fix" the supposed infection.
The file that it tries to download is a Windows virus. The majority of computer viruses these days are written by Eastern European organized crime for profit. XPonlinescanner.com is known to be affiliated with one of these organized crime groups, a group known informally as Russian Business Network, or RBN.
RBN directs naive marks to virus downloaders in one of three ways. They hack into Web sites that have poor security and place redirectors on those sites, so that visitors to the sites end up being diverted to XPonlinescanner.com and other similar servers that attempt to trick gullible people into downloading viruses. They hack Web forums that have poor security and set up redirectors so that anyone who looks at certain conversation threads is redirected to the virus droppers. And they buy banner ads for fake companies,a nd place special, secret code in the banner ads so that when the poisoned banner ad is displayed, th viewer-s browser is redirected to virus dropping sites.
Most likely, the Web site you were looking at has banner ads, and the Web site owner was tricked into displaying a poisoned banner ad that redirects to XPonlinescanner.com. Drop an email to the Web site owner explaining what happened to you.
Post by: Paddy on March 24, 2008, 01:04:11 AM
And then there is the codec Trojan which does affect Macs: http://discussions.apple.com/thread.jspa?messageID=6797182
(tacit gets quoted and Texas MacMan also posts in the thread)
I'm curious, tacit - the OP (Marie) makes it sound like SHE never actually downloaded the trojan herself and as you note, it still requires positive action on the part of the user to install. So did she in fact download it at some point, not realizing that this is what she did? There are a lot of these codec trojans around and they've plagued PC users for several years now and I've certainly seen lots of them in my travels online, so I'm not convinced that the PCs on her office network are actually suffering from the same trojan.
More info on that particular nasty here: http://www.scmagazineus.com/Trojan-targets...M1001&gclid
Post by: Xairbusdriver on March 24, 2008, 10:21:48 AM
I can easily understand how a SPAMmer makes money from useless items for sale (which may never get sent, of course). I'm simply too dumb to understand how redirecting a viewer earns anything. I'm sure it must, wouldn't expect any "mod" to do much of anything for "fun!" 
Also, be careful about those "creahes!" See the wording in Bob's first screen shot. Those things can really destroy your day!
New warning: "If it walks like a duck, quacks like a duck and spells like a duck, it's probably a SCAM!" 
Don't these guys have (pirated) spell chequers?! 
Post by: Paddy on March 24, 2008, 10:56:22 AM
And yes...those sites DO make money.
Post by: Gregg on March 24, 2008, 12:04:10 PM
QUOTE(Paddy @ Mar 24 2008, 10:56 AM) <{POST_SNAPBACK}>
Jim, they often redirect to pay-for-play porn sites.
I'm glad I didn't know that. But, now I guess I do.
Post by: kimmer on March 24, 2008, 12:52:26 PM
QUOTE(Paddy @ Mar 23 2008, 11:04 PM) <{POST_SNAPBACK}>
And then there is the codec Trojan which does affect Macs: http://discussions.apple.com/thread.jspa?messageID=6797182
Nevermind, I moved over to Safari and was able to download it.
I've bumped into CODEC several times while checking out links on potential members to a book list I mod.
Post by: Xairbusdriver on March 24, 2008, 02:54:27 PM
QUOTE
they often redirect to pay-for-play porn sites.
But is that the same as "pay to visit?" I'd think there would need to be some 'registration' before anything of 'value' could be viewed. Of course, if one were already 'registered' and you had cookies allowed, you might be taken directly to the "content" and charged. Sounds fair to me! I was assuming that a site was being paid for links/visits by somebody and that somebody wasn't realizing that the views were 'forced.' The site owner thus was getting paid for probably very uninterested viewers of the ad poster or is inflating the traffic to secure high rates.
Post by: tacit on March 25, 2008, 04:12:14 PM
QUOTE(Xairbusdriver @ Mar 24 2008, 03:21 PM) <{POST_SNAPBACK}>
Remind me how these Russian sites earn money by redirecting to their sites. Or do these sites have links that they are paid for after the user gets redirected? I can easily understand how a SPAMmer makes money from useless items for sale (which may never get sent, of course). I'm simply too dumb to understand how redirecting a viewer earns anything. I'm sure it must, wouldn't expect any "mod" to do much of anything for "fun!"
I can easily understand how a SPAMmer makes money from useless items for sale (which may never get sent, of course). I'm simply too dumb to understand how redirecting a viewer earns anything. I'm sure it must, wouldn't expect any "mod" to do much of anything for "fun!" The Web site that the user is redirected to attempts to download a virus onto the user's computer, invisibly and silently, without the user knowing it. These Web sites are quite sophisticated and will use a number of different browser exploits to try to get the virus to download, one after the other. For example, they will often first try a well-known iFrame exploit in Internet Explorer. If that doesn't work, they will move on to another exploit, then another, then another.
If none of the exploits work--that is, if the user has been good and has run all the security updates and so on--the Web site will show a fake, scary-looking "Warning! You are infected with a virus! Click here to download a program to remove the virus!" message. The program that you download to "remove the virus" is, of course, a virus.
Anyway, the whole purpose of the redirection is to force or trick a virus onto the user's computer. As soon as the user is infected, the virus sends back a signal to the Russian virus writers, telling them the user's IP address. It then opens a back door on the user's computer, allowing the hackers to take over the user's computer and do anything they want.
The hackers make money in a lot of ways. They can sell lists of infected computers to spammers. The spammers then use the infected computers to send out spam. (Most spam comes from virus-infected computers. If anyone tries to trace the spam, the trace ends with the infected computer; Joe Average, who does not know his computer is infected, is actually unwittingly sending millions of spam messages without knowing it.)
The Russians will also install keyloggers on infected computers. The keyloggers will sit silently, waiting until they recognize certain words typed into a browser, such as "bank," "ebay," or "paypal." They will then kick into action, recording every button the user pushes and sending a complete transcript back to the hackers. The hackers then have the person's bank account number and password, or PayPal login and password, or whatever.
The virus-infected computers can also be used for extortion. Often, organized crime will target highly profitable sites such as porn sites or gambling sites. They will email the owner and say "Give us money or we will take down your site." If the owner does not pay, the hackers order the virus-infected computers to start accessing the Web sites, thousands of times per second. This kind of coordinated attack from tens of thousands of infected computers all at once swamps and overloads the victim's Web site, forcing it offline.
So what it all comes down to is this: Organized crime uses lots of tricks, such as hacking, poisoned banner ads, poisoned Google searches, and so on to get users to visit hostile servers. The hostile servers try to trick or force the user to download a computer virus. When the user downloads a computer virus, his computer is totally in the hands of the criminals, who use it in a variety of ways to make money--by selling access to the victim's computer to spammers, by stealing bank account information from the victim, or by using the victim's computer to attack other Web sites in order to extort money from the Web site owners.
It's very, very, very profitable. In Eastern Europe, cybercrime has pretty much replaced the normal businesses such as prostitution, loan sharking, and so on as the biggest money-maker. Russian mafia makes millions by spreading viruses.
Post by: Xairbusdriver on March 25, 2008, 09:42:57 PM
QUOTE
cybercrime has pretty much replaced the normal businesses such as prostitution, loan sharking, and so on
Well, that sounds like a plus for those countries, anyway! Fewer health problems, less expensive loans... Of course, the ones who are now hurt/damaged are more geographically spread.Thanks again for reminding me of the reasons people go into crime in the first place! I tend to forget about the value of peoples personal financial info. But, frankly, it still amazes me that SPAMmers wold pay for those lists in the first place. OTOH, if the payback is anything like junk mail, there is certainly a profit there.
Once again, profit leads these people to spend enormous amonts of study and energy to reap personal benefits rather than use those same talents for the benefit of humanity. A rather old 'tradition!'
