Here's how the bullshit happens:
Click a link to a fortune$HITty page that doesn't exist:
Redirect to +http://www.fortunecity.com/error/errorredir.html
Redirect again to +http://157.22.32.141/js?ClickId=<some-r ... tring-here>
Which redirects to such wonderful sites as +http://www.wizardofloan.com/pages/lendi ... review.htm, +http://www.healthcareshopper.com/humana.htm, +http://www.heranswer.com/Rebal_Crms.asp, +http://www.cheapfares.com/, and +www.abcsearch.com.
These sites I've seen advertised in spam emails, and the last one has the CWS homepage hijacker.
Code of Offending page for analysis:
Code: Select all
HTTP/1.1 200 OK
Date: Sat, 06 Mar 2004 11:28:20 GMT
Server: Apache/1.3.26 (Unix)
Last-Modified: Fri, 31 Oct 2003 18:26:12 GMT
ETag: "1608a3-124-3fa2a944"
Accept-Ranges: bytes
Content-Length: 292
Connection: close
Content-Type: text/html
<html>
<head>
<script language="Javascript">
<!--
if(document.cookie.indexOf('fcid=') != -1) {
document.location = 'http://www.fortunecity.com/marketplace/404.shtml';
}
else {
document.location = 'http://error.fortunecity.com/?url=' + document.referrer;
}
// -->
</script>
</head>
</html>
if the popup blocker's turned off.Summary: Get CWShredder and STAY THE FUCK AWAY FROM FORTUNE$HITTY!
