Cormac Moylan

A well known regional and extremely popular website I regulary visit seems to be in a spot of bother this morning. There is quite a bit of evidence to indicate that they are hosting a virus on their server. A thread in the computers section of their forum provides some detail into the background of this discovery:

“Last month I received spam pretending to be from Submarino (a Brazilian site similar to Amazon) with suspicious links to a jpg and php file hosted in the directory http://un-named-irish-website.com/newsletter/.htacess/ The php file redirected to an .exe in the same directory.

I let the editor know directly they were likely hosting a virus installer and a report was also sent to Hostrocket via SpamCop. I checked again several weeks later but the files were STILL accessible - seems nobody did a thing about it.

It just happened again. This time the spammer is slightly more devious and put his php redirector on another site but again it points to an exe on un-named-irish-website.com. AVG identifies http://un-named-irish-website.com/new…atorio6256.exe as the virus PSW.Banker2.TSI

To whoever runs un-named-irish-website.com: Why the fuck are you hosting viruses for Brazilian thieves and why do you do NOTHING to secure your server when informed about it? “

I checked out the links provided in the post and there is a lot of truth so far about the issue raised. When I click on the first link the Netcraft toolbar alerts me of a possible Phishing attack.

Then almost instantly my anti virus, NOD32, alerts me of a possible Trojan download in progress. The trojan name is banload.BDJ. The majority of information on this Trojan is available in Porteguese. Unfortuntely i can’t figure out what exactly the Trojan does.

This is a serious problem for this website that will need to be answered and of the course the procrastination of their host, Host Rocket, seems a bit dodgy also. There is the possibility that the website’s server has being hacked, which is why I have not named them, but if they were alerted about this serious issue then they should have taken action to resolve it.

If you're new here, you may want to subscribe to my RSS feed. Thank you for visiting! Cormac