# Malware in the Pit **URL:** \ **Category:** About This Message Board\ **Created:** [January 6, 2010, 10:43am UTC](https://boards.straightdope.com/t/malware-in-the-pit/523882 "2010-01-06T10:43:20Z")\ **Posts on this page:** 15\ **Page:** 1
**Author:** ![njtt](https://avatars.discourse-cdn.com/v4/letter/n/ecd19e/32.png) [@njtt](https://boards.straightdope.com/u/njtt)\ **Post date:** [January 6, 2010, 10:43am UTC](https://boards.straightdope.com/t/malware-in-the-pit/523882/1 "2010-01-06T10:43:20Z")
I opened up The Pit a few minutes ago and, before I got to opening any threads, I saw the Firefox download manager very briefly pop up and download something. I have Firefox set to put all downloads on my desktop, and I found the file there, with a very long gibberish filename. I deleted it immediately and I think I have avoided actual infection (at any rate a quick scan with Malwarebytes did not detect anything), but I thought people ought to know. According to the download manager, the file came from [eicyxtaecun.com](http://eicyxtaecun.com). That is not a site I have ever visited, but Whois says it is registered in Florida. Is this getting in via ads? I did not see any ads on the Pit page, but I did not scroll down. I use Flashblock anyway, so I don’t think it could have been done through a flash ad. ---
**Author:** ![TubaDiva](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/tubadiva/32/507_2.png) [@TubaDiva](https://boards.straightdope.com/u/TubaDiva)\ **Post date:** [January 6, 2010, 3:09pm UTC](https://boards.straightdope.com/t/malware-in-the-pit/523882/2 "2010-01-06T15:09:12Z")
I’m going to copy what Ed asked before when people reported this problem – we need your help to weed out offenders here. At this point with just this report we can’t ascertain if this is something you picked up outside of here that got triggered by a call in the ad software on our pages or something that is hidden inside an ad. We need more information to assess the situation accurately. If it’s a rogue ad there’s usually some web traffic on it but I’m not finding anything on your mystery file here – at least not yet. Can’t discount the idea that this might be something brand new and you’re the first but again, we need more information. Ed said: We’re not sure what’s up here. The ads that led to the previous round of problems have not resumed - this is something new. If an ad on the SDMB has given you problems, please provide the following info if possible: 1. Time/date of occurrence. 2. Screenshot of the questionable ad (on PCs you can do this with Alt-Print Screen, then copy into Word, Paint, etc.), or a description of the ad. 3. Description of what happened. Did you click anything? If you were redirected, what URL were you directed to? Describe any related window or pop-up. 4. What page or thread were you on when this happened? What was the URL of the thread? Send to edzotti at [aol.com](http://aol.com). Also tubadiva at [aol.com](http://aol.com). Thanks. Sorry for any inconvenience. ---
**Author:** ![Spoons](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/spoons/32/3141_2.png) [@Spoons](https://boards.straightdope.com/u/Spoons)\ **Post date:** [January 6, 2010, 4:47pm UTC](https://boards.straightdope.com/t/malware-in-the-pit/523882/3 "2010-01-06T16:47:16Z")
I got hit with … something yesterday (Tuesday, January 5, at about 3:00 pm MST) while surfing the SDMB, using Windows IE7. Unfortunately, I didn’t collect any of the information Tuba mentioned above–I was at work and when things went wonky, I got our systems guy working on it. Anyway, FWIW, here’s what I can remember. As a member, I don’t see ads, but my computer started acting funny after I clicked a link in the [Awesome lawyer letter](http://boards.straightdope.com/sdmb/showthread.php?t=546508) thread in MPSIMS. The link was supposed to go to one of the letters that the posters were talking about. The window opened, but nothing appeared. What also happened was that a bunch of windows appeared and disappeared, so quickly as to have a strobe effect. They eventually stopped and I went back to work. Shortly after that, Google searches worked fine, but much of the time, clicking on the top search result or two redirected me to unfamiliar search sites. A few examples would be argylecomm (dot) com, zanuga (dot) com, toseeka (dot) com, freshdeals (dot) com, casearch (dot) ca, and a number of others whose names I cannot remember. One thing I have noticed is that what I click seems to be redirected through a second URL in order to get to the final one. For example, suppose I search for something I need to research (such as “canada federal acquisition regulation”) and click the top result, which purports to be a Canadian government page, and whose URL (which appears at the bottom of my browser window) is also that of a government page. Here’s what happens: – The URL at the bottom of the window changes to 9237242 (dot) cn followed by a slash then a bunch of seemingly-random numbers and letters. (No “www,” by the way.) – Then the url at the bottom changes to something innocent-sounding: like lindachapin (dot) com (some kind of business?), or kickbright (dot) com (who knows?), or irajunction (dot) com (some kind of investment page?). These pages do not appear. – Then the unwanted target page appears–this is the argylecomm, zanuga, etc. pages mentioned above. A look through the “Recent Pages” history shows that the browser may have been redirected through two to four innocent URLs before arriving at the unwanted target. Other entries in the Recent Pages state simply “redirect” or “jump.” I don’t know if any of this helps, or whether the SDMB is related to this problem; but as I said, it started occurring after the problems I had with that linked window in the Lawyer’s Letter page. And our systems guy is working on the problem here. But for what it’s worth, this is what’s been happening to me. ---
**Author:** ![Muffin](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/muffin/32/4341_2.png) [@Muffin](https://boards.straightdope.com/u/Muffin)\ **Post date:** [January 6, 2010, 8:45pm UTC](https://boards.straightdope.com/t/malware-in-the-pit/523882/4 "2010-01-06T20:45:04Z")
> [@Spoons](#): > > The window opened, but nothing appeared. My mind is like that if I wake up too early in the morning. > [@Spoons](#): > > What also happened was that a bunch of windows appeared and disappeared, so quickly as to have a strobe effect. Too much caffeine? ---
**Author:** ![njtt](https://avatars.discourse-cdn.com/v4/letter/n/ecd19e/32.png) [@njtt](https://boards.straightdope.com/u/njtt)\ **Post date:** [January 6, 2010, 8:54pm UTC](https://boards.straightdope.com/t/malware-in-the-pit/523882/5 "2010-01-06T20:54:31Z")
Like I said, I just went into the Pit and it happened. I did not click on any threads or anything else, or see any ads, but I suppose there may have been an ad there if I had scrolled down. The time was about 20 minutes before the time of my post (I am on Pacific time). I do not _think_ I actually got infected (knock on wood), perhaps because I am using Firefox. I am not blaming you guys, just trying to be helpful here. Is there not some way to check out the domain [eicyxtaecun.com](http://eicyxtaecun.com)? ---
**Author:** ![TubaDiva](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/tubadiva/32/507_2.png) [@TubaDiva](https://boards.straightdope.com/u/TubaDiva)\ **Post date:** [January 6, 2010, 10:10pm UTC](https://boards.straightdope.com/t/malware-in-the-pit/523882/6 "2010-01-06T22:10:27Z")
From now on please report all suspected incidents of malware to this address: [sdmb-tech@googlegroups.com](mailto:sdmb-tech@googlegroups.com) ---
**Author:** ![TubaDiva](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/tubadiva/32/507_2.png) [@TubaDiva](https://boards.straightdope.com/u/TubaDiva)\ **Post date:** [January 6, 2010, 10:11pm UTC](https://boards.straightdope.com/t/malware-in-the-pit/523882/7 "2010-01-06T22:11:37Z")
> [@njtt](#): > > Like I said, I just went into the Pit and it happened. I did not click on any threads or anything else, or see any ads, but I suppose there may have been an ad there if I had scrolled down. The time was about 20 minutes before the time of my post (I am on Pacific time). I do not _think_ I actually got infected (knock on wood), perhaps because I am using Firefox. > > I am not blaming you guys, just trying to be helpful here. > > Is there not some way to check out the domain [eicyxtaecun.com](http://eicyxtaecun.com)? “DNS error - cannot find server” is the message I get. We’ll continue looking into this. ---
**Author:** ![xash](https://avatars.discourse-cdn.com/v4/letter/x/c6cbf5/32.png) [@xash](https://boards.straightdope.com/u/xash)\ **Post date:** [January 6, 2010, 10:12pm UTC](https://boards.straightdope.com/t/malware-in-the-pit/523882/8 "2010-01-06T22:12:47Z")
> [@Spoons](#): > > As a member, I don’t see ads, but my computer started acting funny after I clicked a link in the [Awesome lawyer letter](http://boards.straightdope.com/sdmb/showthread.php?t=546508) thread in MPSIMS. The link was supposed to go to one of the letters that the posters were talking about. The window opened, but nothing appeared. What also happened was that a bunch of windows appeared and disappeared, so quickly as to have a strobe effect. They eventually stopped and I went back to work. I clicked on every link in that thread, and did not see any link that returned such behavior. Could you please specify the link you clicked? If it is a link in that thread, I will delete it. If not, it’s probably something you picked up from elsewhere. Thanks. - **xash** Administrator ---
**Author:** ![TubaDiva](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/tubadiva/32/507_2.png) [@TubaDiva](https://boards.straightdope.com/u/TubaDiva)\ **Post date:** [January 6, 2010, 10:19pm UTC](https://boards.straightdope.com/t/malware-in-the-pit/523882/9 "2010-01-06T22:19:53Z")
> [@TubaDiva](#): > > “DNS error - cannot find server” is the message I get. We’ll continue looking into this. But I also see: Domain Name: [EICYXTAECUN.COM](http://EICYXTAECUN.COM) Registrar: [BIZCN.COM](http://BIZCN.COM), INC. Whois Server: [whois.bizcn.com](http://whois.bizcn.com) Referral URL: [http://www.bizcn.com](http://www.bizcn.com) Name Server: [NS3.CNMSN.COM](http://NS3.CNMSN.COM) Name Server: [NS4.CNMSN.COM](http://NS4.CNMSN.COM) Status: clientDeleteProhibited Status: clientTransferProhibited Updated Date: 04-jan-2010 Creation Date: 04-jan-2010 Expiration Date: 04-jan-2011 However, when I look at “[http://www.bizcn.com](http://www.bizcn.com)” it likewise says “DNS error – cannot find server.” Doubtless this is some sort of matryoshka doll-like apparatus of bogus names and etc. Hmm . . . [http://www.aboutus.org/Bizcn.com](http://www.aboutus.org/Bizcn.com) Crap. We’ll go see what all this means and get back to you - - I think no good, though. ---
**Author:** ![Spoons](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/spoons/32/3141_2.png) [@Spoons](https://boards.straightdope.com/u/Spoons)\ **Post date:** [January 6, 2010, 10:33pm UTC](https://boards.straightdope.com/t/malware-in-the-pit/523882/10 "2010-01-06T22:33:27Z")
> [@xash](#): > > Could you please specify the link you clicked? It’s the link in post 24. Oddly, it’s working for me today, so maybe it was something picked up somewhere else. ETA: Thanks for looking into it, **xash**! I do appreciate your effort. ---
**Author:** ![njtt](https://avatars.discourse-cdn.com/v4/letter/n/ecd19e/32.png) [@njtt](https://boards.straightdope.com/u/njtt)\ **Post date:** [January 7, 2010, 7:11am UTC](https://boards.straightdope.com/t/malware-in-the-pit/523882/11 "2010-01-07T07:11:40Z")
> [@TubaDiva](#): > > But I also see: > > Domain Name: [EICYXTAECUN.COM](http://EICYXTAECUN.COM) > Registrar: [BIZCN.COM](http://BIZCN.COM), INC. > Whois Server: [whois.bizcn.com](http://whois.bizcn.com) > Referral URL: [http://www.bizcn.com](http://www.bizcn.com) > Name Server: [NS3.CNMSN.COM](http://NS3.CNMSN.COM) > Name Server: [NS4.CNMSN.COM](http://NS4.CNMSN.COM) > Status: clientDeleteProhibited > Status: clientTransferProhibited > Updated Date: 04-jan-2010 > Creation Date: 04-jan-2010 > Expiration Date: 04-jan-2011 > > However, when I look at “[http://www.bizcn.com](http://www.bizcn.com)” it likewise says “DNS error – cannot find server.” Doubtless this is some sort of matryoshka doll-like apparatus of bogus names and etc. > > Hmm . . . > > [http://www.aboutus.org/Bizcn.com](http://www.aboutus.org/Bizcn.com) > > Crap. > > We’ll go see what all this means and get back to you - - I think no good, though. Well, I found some info on [eicyxtaecun.com](http://eicyxtaecun.com) at the Whois at [DNSSTUFF.COM](http://DNSSTUFF.COM). Name, email, street address and everything (though i guess they may be fake). I guess I ought not to post those publicly here, so I will email to the address you gave above. ---
**Author:** ![njtt](https://avatars.discourse-cdn.com/v4/letter/n/ecd19e/32.png) [@njtt](https://boards.straightdope.com/u/njtt)\ **Post date:** [January 7, 2010, 7:36am UTC](https://boards.straightdope.com/t/malware-in-the-pit/523882/12 "2010-01-07T07:36:52Z")
Well, I tried to email. I got a delivery failure notification back from [sdmb-tech@googlegroups.com](mailto:sdmb-tech@googlegroups.com) 😕☹ Did you mean [gmail.com](http://gmail.com) maybe? ---
**Author:** ![TubaDiva](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/tubadiva/32/507_2.png) [@TubaDiva](https://boards.straightdope.com/u/TubaDiva)\ **Post date:** [January 7, 2010, 4:32pm UTC](https://boards.straightdope.com/t/malware-in-the-pit/523882/13 "2010-01-07T16:32:38Z")
> [@njtt](#): > > Well, I tried to email. I got a delivery failure notification back from [sdmb-tech@googlegroups.com](mailto:sdmb-tech@googlegroups.com) 😕☹ > > Did you mean [gmail.com](http://gmail.com) maybe? Yes. **[sdmbtech@gmail.com](mailto:sdmbtech@gmail.com)**, actually. :smack: ---
**Author:** ![srzss05](https://avatars.discourse-cdn.com/v4/letter/s/898d66/32.png) [@srzss05](https://boards.straightdope.com/u/srzss05)\ **Post date:** [January 7, 2010, 5:49pm UTC](https://boards.straightdope.com/t/malware-in-the-pit/523882/14 "2010-01-07T17:49:55Z")
> [@TubaDiva](#): > > However, when I look at “[http://www.bizcn.com](http://www.bizcn.com)” it likewise says “DNS error – cannot find server.” Doubtless this is some sort of matryoshka doll-like apparatus of bogus names and etc. The DNS for [bizcn.com](http://bizcn.com) is 218.5.77.28 ---
**Author:** ![MannyL](https://avatars.discourse-cdn.com/v4/letter/m/ba8739/32.png) [@MannyL](https://boards.straightdope.com/u/MannyL)\ **Post date:** [January 10, 2010, 12:44am UTC](https://boards.straightdope.com/t/malware-in-the-pit/523882/15 "2010-01-10T00:44:46Z")
OpenDNS found some trhings in a search [http://guide.opendns.com/?url="http%3A%2F%2Fwww.bizcn.com&client=ff](http://guide.opendns.com/?url=%22http%3A%2F%2Fwww.bizcn.com&client=ff) (link is safe)