On 21 April 2010 22:07, Matthew Hunt <m...@pobox.com> wrote: > On Wed, Apr 21, 2010 at 9:18 PM, William Robb <war...@gmail.com> wrote: > >> I just got redirected to monaprotectguard06td.xorg.pl, which according to my >> WOT plug in, has a very poor reputation. > > I downloaded http://EnticingTheLight.com using fetch(1) on FreeBSD > running in a virtual machine. > > Manual inspection of the HTML reveals this near the bottom (in angle > brackets where I have square): > > [script src="http://61.4.82.212/js.php"][/script] > > Googling for that IP finds lots of malware references.
Thanks Matthew, that's very, very useful. Now I have to go find the PHP file where that's hidden. Cheers, --M. -- \/\/o/\/\ --> http://WorldOfMiserere.com http://EnticingTheLight.com A Quest for Photographic Enlightenment -- PDML Pentax-Discuss Mail List PDML@pdml.net http://pdml.net/mailman/listinfo/pdml_pdml.net to UNSUBSCRIBE from the PDML, please visit the link directly above and follow the directions.