Page 1 of 2 12 LastLast
Results 1 to 20 of 27

Thread: Gammae.com Malware / Exploits

  1. November 13th, 2007, 10:26 AM #1
    Spence
    Spence is offline
    Serious Contributor
    Join Date
    May 2007
    Posts
    918
    Rep Power
    0

    Default Gammae.com Malware / Exploits

    Gammae.com runs many programs including Famedollars, Pornication, dvdbox.com, pornaccess.com,

    Vomba.com, VombaCash,

    Yoursitebar, ysbweb.com(the user side of yoursitebar and Google labels it as harmful),

    xxxtoolbar(Note that Google identifies xxxtoolbar as a threat. Visiting xxxtoolbar, and some other Gammae.com sites, will get you an autoinstall if you want to see first hand what they are doing with your future.(Although I would suggest doing it on a system you don't do your work on!)

    slotchbar(read through all the programs listed there and you will see some interesting relationships), toolbarcash.com, and many others.

    Other programs they 'use' to run are loudcash, searchbarcash, blazefind.com and probably others that they 'sold' to 180solutions. 180solutions(zango) supposedly bought out these 'rogue affiliates'. Here is an interesting write up on the loudcash.com, searchbarcash.com, and 180solutions(zango) incident.

    F-secure seems to have the impression that Gammae and Zango are 1 and the same.

    http://research.sunbelt-software.com...threatid=14816
    http://www.google.com/search?q=ysbweb

    When asked what came of this potential lawsuit on another board, they vanished..
    http://www.cippic.ca/en/news/documen...idavit-IST.pdf

    That should be plenty of information(even though it's just tip of the iceburg), and hopefully most of you understand the ramifications of what Gammae.com is doing, and if not, might take the time to research/read some of the links posted. I spend a lot of time testing trojans, exploits, etc., and I don't think it's any coincidence that Gammae.com/ISTbar/YSBweb/slotch software is in a majority of installations, especially the driveby installs.

    Domain name: GAMMAE.COM
    Registrant:
    Gamma Entertainment Inc
    3300 Cote-Vertu
    Suite 406
    Montreal, Quebec H4R 2B7
    CA

    Domain name: YSBWEB.COM
    Registrant:
    Integrated Search Technologies
    3300 Cote-Vertu
    Suite 406
    Montreal, Quebec H4R 2B7
    CA

    Domain name: XXXTOOLBAR.COM
    Registrant:
    Integrated Search Technology
    3300 Cote-Vertu
    Suite 406
    Montreal, Quebec H4R 2B7
    CA

    Domain name: ISEARCHTECH.COM
    Registrant:
    Integrated Search Technologies
    3300 Cote-Vertu
    Suite 406
    Montreal, Quebec H4R 2B7
    CA

    Domain name: TOOLBARCASH.COM
    Registrant:
    Integrated Search Technology
    3300 Cote-Vertu
    Suite 406
    Montreal, Quebec H4R 2B7
    CA

    Domain name: VOMBA.COM
    Registrant:
    Vomba Network
    3300 Cote-Vertu, Suite 406
    Montreal, QC H4R 2B7
    CA
    and so on...
    Reply With Quote Reply With Quote
  2. November 13th, 2007, 10:31 AM #2
    DamageX
    DamageX is offline
    Man, myth, legend. DamageX's Avatar
    Join Date
    Oct 2005
    Location
    Nomad
    Posts
    20,745
    Rep Power
    0

    Default

    Way overdue.
    Work Smarter At Working Smarter
    Reply With Quote Reply With Quote
  3. November 13th, 2007, 03:53 PM #3
    pbracc
    pbracc is offline
    Devil pbracc's Avatar
    Join Date
    May 2006
    Location
    4, 8, 15, 16, 23, 42
    Posts
    3,200
    Rep Power
    0

    Default

    O_O that has been my first sponsor many many years ago.. my first 25$ check came from them!
    Well, i left em just after some months.. but it's still sad..
    Trades & Quality Sponsors
    Use PAXUM as your method of payment!
    Reply With Quote Reply With Quote
  4. November 13th, 2007, 04:45 PM #4
    willwank
    willwank is offline
    D'oh!! willwank's Avatar
    Join Date
    Oct 2006
    Location
    Hamilton, ON
    Posts
    4,112
    Rep Power
    0

    Default

    Awesome work digging into this Spence
    Enough for an update to my tiny little shitlist i think.
    "If you put a thing in the center of your life, who lacks power to nourish, it will eventually destroy you, and everything you are"
    Oh btw, it's come full circle. Node/V8 - Low Level Server Side JavaScript. Benchmarked here - libs & packages here - read up here
    Other stuff:: I use PeppermintOS | Vim | Douglas Crockford | GT.M db | twitter: @willwankman | ICQ 437654594 | adult at clicksy dot org
    Reply With Quote Reply With Quote
  5. December 7th, 2007, 08:07 AM #5
    ska
    ska is offline
    Traffic Guru
    Join Date
    Feb 2007
    Location
    Berlin <-> Praha :)
    Posts
    222
    Rep Power
    0

    Default

    this thread was the first support email to gammae that i didnt got answered.
    when i was selling good for pornication they called me at home and asked me what they could do to support me... and now nothing to ease my concerns

    this is sad for me too, because in 2001 i got my first $50 check from gammacash and i had to learn the lesson about cashing a foreign check my bank at this time charged $30 for the $50 check
    Reply With Quote Reply With Quote
  6. December 9th, 2007, 04:13 PM #6
    Spence
    Spence is offline
    Serious Contributor
    Join Date
    May 2007
    Posts
    918
    Rep Power
    0

    Default

    Little more information taken from http://mvps.org/winhelp2002/hosts.txt

    Code:
     # [Integrated Search Technologies][Gamma Entertainment]
127.0.0.1  activexcash.com
127.0.0.1  www.activexcash.com
127.0.0.1  activexcash.net
127.0.0.1  www.activexcash.net
127.0.0.1  adultgameserver.com
127.0.0.1  www.adultgameserver.com
127.0.0.1  adultgameservers.com
127.0.0.1  www.adultgameservers.com
127.0.0.1  adultmoviemax.com
127.0.0.1  www.adultmoviemax.com
127.0.0.1  couldntfind.com
127.0.0.1  www.couldntfind.com
127.0.0.1  couldnotfind.com
127.0.0.1  www.couldnotfind.com #[TROJ_ISTBAR.AD]
127.0.0.1  www.ebonybymail.com
127.0.0.1  tgp.gammacash.com
127.0.0.1  maximize.gammacash.com
127.0.0.1  stats.gammacash.com
127.0.0.1  www.gammacash.com
127.0.0.1  www.gammasites.com
127.0.0.1  advertising.gammae.com
127.0.0.1  cgi.gammae.com
127.0.0.1  common.gammae.com #[AVG.Dialer.JT]
127.0.0.1  hourly.gammae.com
127.0.0.1  php.gammae.com
127.0.0.1  tracking.gammae.com
127.0.0.1  videostore.gammae.com
127.0.0.1  www.gammaentertainment.com
127.0.0.1  gaysexswap.com
127.0.0.1  cgi.gaysexswap.com
127.0.0.1  www.hardcorebymail.com
127.0.0.1  installcash.com
127.0.0.1  www.installcash.com
127.0.0.1  installdownload.com
127.0.0.1  www.installdownload.com
127.0.0.1  isearchtech.com #[SunBelt.IST.Protector]
127.0.0.1  www.isearchtech.com #[SunBelt.IST.ISTbar]
127.0.0.1  istsvcweb.com
127.0.0.1  www.istsvcweb.com
127.0.0.1  music-lookup.com
127.0.0.1  www.music-lookup.com
127.0.0.1  music-lookup.net
127.0.0.1  www.music-lookup.net
127.0.0.1  pornsearchbar.com
127.0.0.1  www.pornsearchbar.com
127.0.0.1  porntoolbar.com
127.0.0.1  www.porntoolbar.com
127.0.0.1  power-cleaner.com #[McAfee.PowerScan]
127.0.0.1  www.power-cleaner.com
127.0.0.1  www.power-scan.com #[SPYW_POWERSCAN.C]
127.0.0.1  www.safer-scan.com #[Symantec.SaferScan]
127.0.0.1  sexsearchbar.com
127.0.0.1  www.sexsearchbar.com
127.0.0.1  sextoolbar.com
127.0.0.1  www.sextoolbar.com
127.0.0.1  sexswap.com
127.0.0.1  cgi.sexswap.com
127.0.0.1  cgi.sexswap2.com
127.0.0.1  cgi.sexswap2000.com
127.0.0.1  sidefind.com #[Troj/SideFind-A][ADW_SIDEFIND.E]
127.0.0.1  cache.sidefind.com #[McAfee.Adware-ISTbar.dldr]
127.0.0.1  www.sidefind.com #[Adware.SideFind]
127.0.0.1  slidefind.net
127.0.0.1  www.slidefind.net
127.0.0.1  slidesearch.com
127.0.0.1  www.slidesearch.com
127.0.0.1  slidesearch.net
127.0.0.1  www.slidesearch.net
127.0.0.1  slotch.com #[TROJ_ISTBAR.B,K][Trojan.TrustedZones]
127.0.0.1  adult.slotch.com
127.0.0.1  www.slotch.com #[TROJ_ISTBAR.AD][Win32/Adware.Slotch]
127.0.0.1  slotchbar.com #[Troj/IstBar-N]
127.0.0.1  www.slotchbar.com
127.0.0.1  tbcode.com
127.0.0.1  cache.tbcode.com
127.0.0.1  www.tbcode.com #[HJTH.Win32.IstBar.hg]
127.0.0.1  toolbarcash.com #[Parasite.ISTbar]
127.0.0.1  www.toolbarcash.com
127.0.0.1  unlimitedsongs.net
127.0.0.1  www.unlimitedsongs.net
127.0.0.1  xxxtoolbar.com #[Adware.ClickDLoader.B]
127.0.0.1  install.xxxtoolbar.com #[TROJ_ISTBAR.D,I]
127.0.0.1  www.xxxtoolbar.com #[SunBelt.XXXToolBar.com]
127.0.0.1  yoursitebar.com #[Adware.YourSiteBar]
127.0.0.1  rewards.yoursitebar.com
127.0.0.1  stats.yoursitebar.com
127.0.0.1  www.yoursitebar.com #[SPYW_SITEBAR.A]
127.0.0.1  ysbweb.com #[Trojan.TrustedZones][ADW_ISTBAR.K]
127.0.0.1  cache.ysbweb.com #[TROJ_ISTBAR.FN]
127.0.0.1  drm.ysbweb.com #[65181.vidlock.com]
127.0.0.1  www.ysbweb.com #[Win32.Secdrop.AW][TROJ_DLOADER.AIO]
127.0.0.1  www.yyep.com #[searchtraffic.com]
# [IST via Media Traffic][Surfaccuracy][Vomba Network]
127.0.0.1  i-growth.com
127.0.0.1  igrowth.com
127.0.0.1  cpvfeed.mediatraffic.com
127.0.0.1  www.mediatraffic.com
127.0.0.1  mediatrafficagency.com
127.0.0.1  mtagrowth.com
127.0.0.1  www.accuracysurf.com
127.0.0.1  surfaccuracy.com
127.0.0.1  www.surfaccuracy.com #[Adware.SurfAccuracy]
127.0.0.1  surfingaccuracy.com
127.0.0.1  surfingtarget.com
127.0.0.1  surfingtarget.net
127.0.0.1  surfmatch.com
127.0.0.1  vomba.com #[SunBelt.Vomba][Adware.Vomba]
127.0.0.1  www.vomba.com
127.0.0.1  www.vombacash.com
127.0.0.1  www.vombasavers.com
127.0.0.1  vombashots.com #[Adware.Win32.Vomba]
127.0.0.1  www.vombashots.com
127.0.0.1  install.vombanetwork.com #[MVPS.Criteria]
127.0.0.1  services.vombanetwork.com
127.0.0.1  www.vombanetwork.com
    Last edited by Spence; December 9th, 2007 at 04:16 PM. Reason: auto links....
    Reply With Quote Reply With Quote
  7. December 9th, 2007, 09:20 PM #7
    EonBlue
    EonBlue is offline
    There are no words EonBlue's Avatar
    Join Date
    Apr 2007
    Location
    Canada
    Posts
    1,527
    Rep Power
    0

    Default

    What about Flashy Babes?

    The connection seems obvious since this is the link to the sign up page for the affiliate program:

    Code:
    http://www.gammae.com/flashybabes/
    Reply With Quote Reply With Quote
  8. December 10th, 2007, 02:26 AM #8
    MGPdevil
    MGPdevil is offline
    Serious Contributor
    Join Date
    Nov 2005
    Posts
    1,257
    Rep Power
    0

    Default

    Damn, and I just started to upload content to promote Flashy Babes.
    Reply With Quote Reply With Quote
  9. December 10th, 2007, 06:40 AM #9
    Spence
    Spence is offline
    Serious Contributor
    Join Date
    May 2007
    Posts
    918
    Rep Power
    0

    Default

    Quote Originally Posted by EonBlue
    What about Flashy Babes?

    The connection seems obvious since this is the link to the sign up page for the affiliate program:

    Code:
    http://www.gammae.com/flashybabes/
    Here is a list of programs they run/partner with, on their main ip.

    1. Bigfatcreampie.com
    2. Billfame.com
    3. Blackasswonders.com
    4. Buddy-support.com
    5. Buddylead.com
    6. Buddyprofit.com
    7. Buddyprofits.com
    8. Combatzone.net
    9. Combatzonedvdz.com
    10. Cumshotoasis.com
    11. Currycreampie.com
    12. Dailygalz.com
    13. Devilsfilm.com
    14. Famebill.com
    15. Famedigital.com
    16. Famedollars.com
    17. Famepass.com
    18. Famesupport.com
    19. Flashybabe.com
    20. Flashybabes.com
    21. Flashysupport.com
    22. Freebuddymovies.com
    23. Freepornofiles.com
    24. Gammae.com
    25. Gammaemail.com
    26. Gammajob.com
    27. Gammajobs.com
    28. Gammasites.com
    29. Gammavip.com
    30. Gogogay.com
    31. Gogonudes.com
    32. Gogopics.com
    33. Gogoporn.com
    34. Gogostuds.com
    35. Linkfame.com
    36. Majorcups.com
    37. Maledigital.com
    38. Mensolution.com
    39. Motherfuckerxxx.com
    40. Mypornplus.com
    41. Nextdoorbuddies.com
    42. Nextdoorhookups.com
    43. Nextdoormale.com
    44. Nextdoorpass.com
    45. Nextdoorstudios.com
    46. Payfame.com
    47. Peternorth.com
    48. Peternorthxxx.com
    49. Pornicationcash.com
    50. Saleschatonline.com
    51. Silverstonedvd.com
    52. Silviasaint.com 5 listings
    53. Silviasaintvip.com
    54. Squirt4real.com
    55. Squirtoholics.com
    56. Statsmonster.com
    57. Strokethatdick.com
    58. Sxx.com
    59. Terapatrick.com
    60. Tommydxxx.com
    61. Trannypros.com
    62. Virilix.com
    63. Virilix.net
    64. Whitegettho.com
    65. Whiteghetto.com
    66. Zubill.com
    Reply With Quote Reply With Quote
  10. December 10th, 2007, 01:36 PM #10
    CraK
    CraK is offline
    from accounting
    Join Date
    Oct 2005
    Location
    California
    Posts
    16,431
    Rep Power
    0

    Default

    That's some mighty fine work Spence.
    Hosting for ADX provided by Swiftwill
    Reply With Quote Reply With Quote
  11. December 10th, 2007, 02:55 PM #11
    Pornonada
    Pornonada is offline
    Serious Contributor Pornonada's Avatar
    Join Date
    Dec 2005
    Location
    Bulgaria
    Posts
    9,504
    Rep Power
    0

    Default

    Yes, lot of work great done
    who is next after ibill, paymonde ....?
    Reply With Quote Reply With Quote
  12. December 10th, 2007, 03:27 PM #12
    EonBlue
    EonBlue is offline
    There are no words EonBlue's Avatar
    Join Date
    Apr 2007
    Location
    Canada
    Posts
    1,527
    Rep Power
    0

    Default

    Spence rocks! He is a cheaters worst nightmare.
    Reply With Quote Reply With Quote
  13. December 29th, 2007, 05:00 AM #13
    reelgirlz
    reelgirlz is offline
    I need help
    Join Date
    May 2007
    Posts
    33
    Rep Power
    0

    Default

    Wow thats such a shame, gammae used to be one of the first honest progs around. I used to make good money with them years ago, they were my first sponsor and recommended by the YNOT clan.
    Bordello Web - Tips, Tricks and Trades!
    Reply With Quote Reply With Quote
  14. October 29th, 2008, 06:50 AM #14
    bracey
    bracey is offline
    the sky is falling bracey's Avatar
    Join Date
    Jun 2007
    Location
    97401 06385
    Posts
    480
    Rep Power
    0

    Default

    I was about to sign up for fame dollars until I read this. Thank you spence.
    DESKTOP STRIPPERS|LENDING CLUB|UBUNTU|EASILY BOOST BLOG AND TUBE TRAFFIC
    Reply With Quote Reply With Quote
  15. November 6th, 2008, 02:38 AM #15
    GTP
    GTP is offline
    Fuck anything that move GTP's Avatar
    Join Date
    Dec 2007
    Posts
    243
    Rep Power
    0

    Default

    Anybody asked them to read this post? I think they are really big and well known and maybe they have something to say about that...
    Fully 2257 compliant, paying twice a month
    100% hot amateur gay, str8, bi-curious and bisexual guys
    Just at Self Shot Boys . com - contact me for more info and start promoting it at Dudes Cash
    Reply With Quote Reply With Quote
  16. November 6th, 2008, 03:53 AM #16
    DamageX
    DamageX is offline
    Man, myth, legend. DamageX's Avatar
    Join Date
    Oct 2005
    Location
    Nomad
    Posts
    20,745
    Rep Power
    0

    Default

    Quote Originally Posted by GTP View Post
    Anybody asked them to read this post? I think they are really big and well known and maybe they have something to say about that...
    Do you REALLY think this post went by unnoticed by them?
    Work Smarter At Working Smarter
    Reply With Quote Reply With Quote
  17. November 6th, 2008, 07:25 AM #17
    willwank
    willwank is offline
    D'oh!! willwank's Avatar
    Join Date
    Oct 2006
    Location
    Hamilton, ON
    Posts
    4,112
    Rep Power
    0

    Default

    Quote Originally Posted by GTP View Post
    they are really big and well known
    There's also a well known fact that a lot of ppl in this biz are scum and criminals, so there you go.
    "If you put a thing in the center of your life, who lacks power to nourish, it will eventually destroy you, and everything you are"
    Oh btw, it's come full circle. Node/V8 - Low Level Server Side JavaScript. Benchmarked here - libs & packages here - read up here
    Other stuff:: I use PeppermintOS | Vim | Douglas Crockford | GT.M db | twitter: @willwankman | ICQ 437654594 | adult at clicksy dot org
    Reply With Quote Reply With Quote
  18. January 2nd, 2009, 10:02 AM #18
    DamageX
    DamageX is offline
    Man, myth, legend. DamageX's Avatar
    Join Date
    Oct 2005
    Location
    Nomad
    Posts
    20,745
    Rep Power
    0

    Default

    Quote Originally Posted by Gerrard Milford View Post
    How sure are you who is a criminal and who is not? Are all crimes equal and deserving of that treatment? What happens if you kill someone and it turns out you were wrong?
    Do you have a problem with reading comprehension?
    Work Smarter At Working Smarter
    Reply With Quote Reply With Quote
  19. January 2nd, 2009, 06:38 PM #19
    gonzo
    gonzo is offline
    On Loan from Oprano
    Join Date
    Apr 2007
    Location
    Atlanta
    Posts
    167
    Rep Power
    0

    Default

    Quote Originally Posted by DamageX View Post
    Do you REALLY think this post went by unnoticed by them?
    Free Young Karl!!!
    Reply With Quote Reply With Quote
  20. February 14th, 2009, 06:12 AM #20
    Hot Wet Hunk
    Hot Wet Hunk is offline
    Banned
    Join Date
    Feb 2009
    Location
    Land Of Dreams
    Posts
    34
    Rep Power
    0

    Default

    is gammae.com that bad ??
    Reply With Quote Reply With Quote
« Previous Thread | Next Thread »

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •  

Forum Rules