what would cause this ??

Do you have a question? Post it now! No Registration Necessary.  Now with pictures!

Threaded View

PC belonging to a friend.

Friend clicks on a link to a website:


What happened next, is supposedly the
printer attached to the PC, proceeded
to print off 94 pages of random words &
gibberish sentences.

The website link above is no longer
in service.

Question is, what kind of "attack" (if
this was one), was this ?

And, what was the source of the some 94
pages of words ? (since supposedly many
of the words / sentences in the pile of
paper were contents of emails the owner
had on the machine).

Any possible explanations for this ?

How could just visiting a website cause a
printer to spew out 94 pages of stuff ???

Re: what would cause this ??

Quoting DrZaius on Tue, 16 Oct 2007 19:35:55 -0400:

Quoted text here. Click to load it

IN theory, it should be possible. Right (or wrong, depending on viewpoint)
settings in the OS and or the browser; right kind of script embedded in
the web page; just the right bug in just the right software....

I'd be more inclined to think in terms of user error - the user might have
accidentally hit the wrong button at the wrong time.

Re: what would cause this ??

"DrZaius" wrote:

Quoted text here. Click to load it

That looks like the kind of link one sees in spam. A script redirects
to another site which should display the following:

 ActiveX Object Error:
 Your browser cannot display this image file.

 You need to download new version of ActiveX
 Object to view this image file.

 To download and install ActiveX Object click Continue.

 [Continue] [Cancel] [Details...]

Choosing [Continue] will present you with a Windows executable to run
(VideoAccessCodecInstall.exe). Choosing [Cancel] will send you into a
loop of dialogs (preventing the browser window from being closed)
until 'ok' is clicked, which has the same effect as [Continue].

This is the infamous Zlob trojan, installer of adware, bogus security
software and other malware.

Quoted text here. Click to load it

It is still live.

Quoted text here. Click to load it

Social engineering.

Perhaps the data was intended to be sent back to the attacker.

Quoted text here. Click to load it

I suppose your friend installed the trojan in the hope of seeing some
pr0n. Who knows what damage it has done to the system.

Re: what would cause this ??

Quoted text here. Click to load it

supposedly, this person thinks someone they met
online, deliberately aimed the attack at one specific
machine (hers).

is there a way to find out who the site belongs to?

i tried the usual methods, but came up short. my
day job is working with aircraft, not computer

all those who responded/will respond thanks.

Re: what would cause this ??

"DrZaius" wrote:

Quoted text here. Click to load it

How so? It's just a link; there's no obligation to click it. And even
if you do, Windows won't directly run the executable but will first
ask what to do with it if subsequently, the scripted dialog on the
page was clicked.

Quoted text here. Click to load it

The standard way is to use 'whois' but Windows doesn't have that
application by default. There are several websites where you can do
a whois lookup.

In any case, that was just the first link in the chain. there are a
few domains and hosts involved before you get to the malware.

sajpj.eaqcfmc.cn (the host for the original link) -> runs a script at:
goodnserver.info -> loads a page at:
mystats.name -> redirects to:
themymoviessite.com -> loads the malware execuable from:

The domain eaqcfmc.cn is registered in China. I can't tell which
registry because the name is in Chinese. sajpj.eaqcfmc.cn has IP
address which I find belongs to netdirekt in Germany.

goodnserver.info is registered through EstDomains (Estonia) and its
IP ( also belongs to netdirekt.

mystats.name gives no useful info about the registry or registrant but
its hosted by 'Beyond The Network America' in the US at IP address

themymoviessite.com and videowebsoft.com are both registered through
EstDomains and share the IP address This is hosted by
'LLC GlobalWholesaleTrade' in Moscow, Russia.

All the EstDomains registrant (domain owner) details are unavailable.
Looking at the providers and countries here, I wouldn't count on fast
action in taking anything offline but you may be lucky.

Site Timeline