Best Blackhat Forum

Is this the infected or clean version?

Can someone BAN this user? Doesn't search, posts double threads, uses monetized links...

BAAANNNN!!!

Oh... and by the way:
Wack0 cleaned the infected code on this thread here:
http://bestblackhatforum.com/Thread-WARN...s-Infected

Cheers, Johnny63

yes i agree to Hangman its better not to use this

Isn't this marina_hot part of the group who all joined this month and shared infected files on purpose resulting in multiple bans? Could an admin please check this user out please? Thanks

Here's the thread with the banned members and marina_hot is right in there with them although not banned. http://bestblackhatforum.com/Thread-Get-...ro-edition

Same F****** Plugin...
Same F****** Script!
Same F****** File!
Ban This Mother F*****!
PLUS! Posted It Twice!

WHAT ARE YOUR TALKING ABOUT?

I have NOT HAD ANY PROBLEMS on any of the websites that I put this on!

I even had a NEW Domain (Jan 26) NEW Website come up #2 on the 1st page of Google using this download the last three days, NO Backlinks.


I just did another Virus scan NOW Tues Jan 29:

https://www.virustotal.com/file/ef2db1c2396394c76a1feae74edfdac4d3563f56fde5d47e59fe7b5b75417231/analysis/1359503709/

(01-29-2013 02:53 PM)flowknight Wrote: [ -> ]DON'T DOWNLOAD THIS. AFTER UPLOADING THIS PLUGIN, I FOUND SOME SPAMMY LINKS WERE ADDED IN MY FOOTER. THIS IS HARMFUL FOR SEO.

WHAT ARE YOUR TALKING ABOUT?

I have put this on 8 of my websites and I just checked 4 of them NOW and I DO NOT SEE ANY SPAMMY LINKS In The footer.

I have NOT HAD ANY PROBLEMS on any of the websites that I put this on!

I even had a NEW Domain (Jan 26) NEW Website come up #2 on the 1st page of Google using this download the last three days, NO Backlinks.

(01-30-2013 03:03 AM)kirstie Wrote: [ -> ]WARNING! THIS FILE IS INFECTED. THE INFECTION IS IN THE CLASSES/CENTRAL.CLASS.PHP FILE, WHICH HAS BEEN ENCRYPTED WITH BASE64.

IF YOU USE THIS PLUGIN, A BACKDOOR WILL BE CREATED INTO YOUR SITE. YOUR AMAZON AND ADSENSE AFFILIATE CODES CAN BE REPLACED BY THE ATTACKERS. MALWARE AND SPAM LINKS CAN BE PUT ON YOUR SITE.

DO NOT USE!

Kirstie, YOU ARE RIGHT! I do see it now! The Base64 in the CLASSES/CENTRAL.CLASS.PHP FILE. I need to contact everyone that downloaded it.

The VirusTool Read 0/45:

https://www.virustotal.com/file/ef2db1c2...359503709/

Hi Un4gettable,

I know that it isn't down to you - it was contaminated on the site you originally got it from.

The classes/central.class.php contains a very clever exploit which was heavily encrypted. This is why it didn't trigger any virus alerts.

In the warning thread I started (which has mysteriously been removed for some reason?) wack0 kindly decoded the file and explained how the exploit works. Basically, when you activate the plugin it automatically emails your site details to the hacker.

At a later date, the hacker can visit your site and login via a secret backdoor. The hacker can then access your site with his own username and password as an admin and take over your site.

In my other (now gone) thread, wack0 kindly provided a clean version of the file. If you use that one on your site, the plugin will be clean and work perfectly.

HTH :)

(01-30-2013 11:07 AM)kirstie Wrote: [ -> ]Hi Un4gettable,

I know that it isn't down to you - it was contaminated on the site you originally got it from.

The classes/central.class.php contains a very clever exploit which was heavily encrypted. This is why it didn't trigger any virus alerts.

In the warning thread I started (which has mysteriously been removed for some reason?) wack0 kindly decoded the file and explained how the exploit works. Basically, when you activate the plugin it automatically emails your site details to the hacker.

At a later date, the hacker can visit your site and login via a secret backdoor. The hacker can then access your site with his own username and password as an admin and take over your site.

In my other (now gone) thread, wack0 kindly provided a clean version of the file. If you use that one on your site, the plugin will be clean and work perfectly.

HTH :)

How do I WARN All of the people who downloaded it?

I will check with support,