0
First of all, if someone sends you a dangerous link, and you're unsure whether to click it, you can always visit it in a safe way using telnet. Here's what you do:
1. Note down two parts of the URL: the hostname and the path. In the URL http://www.example.c...ex.php?test=bla the hostname is www.example.com and /index.php?test=bla is the path. If the URL is just http://www.example.com then the path is / .
2. Open a command prompt by going to Start > Run, then typing cmd.exe into the box.
3. Right click the title of the window, select Properties, then go to the Layout tab and set Height under Screen Buffer Size to 2000. This is to prevent the text from disappearing after too much of it later. If it still happens later on then you might want to set it even higher.
4. Before you continue, you must type this in somewhere for safekeeping so you can copy and paste it easily:
GET (the path you wrote down) HTTP/1.1 Host: (the hostname you wrote down)
5. Type
telnet (the hostname you wrote down) 80
Then press enter, and you'll get a blank screen. Telnet is now connected to that server.
6. You can now type text that is sent to the server you are connected to, but the text is invisible. Backspace will also not work. This is why you typed that bit out earlier, so you could copy-paste it quickly. Copy the text you wrote in step 4, then paste it in the window by right clicking the title bar of the prompt window and going to Edit > Paste.
7. Now press enter twice.
8. The server will send a reply, and this is where things get interesting. The reply will consist of a first line which contains the status code (200 means all ok, 404 means not found etc.), a few lines called 'headers', then a blank line, and finally the actual content.
You'll have to see whether the reply is proper HTML or something else. This is what I got for one virus URL I tried:
HTTP/1.1 200 OK Date: Wed, 27 Feb 2008 23:46:12 GMT Server: Apache/1.3.33 (Unix) mod_ssl/2.8.22 OpenSSL/0.9.7d SE/0.5.2 Content-Disposition: attachment; filename=PIC006.JPG-live.messenger.com; X-Powered-By: PHP/4.4.0 Connection: close Content-Type: application/octet-stream MZP☻♦ ╕@☺║►▼┤ ═!╕☺L═!ÉÉThis program must be run under Win32 $7cæ?Pcæ?PPEL↓^B*αÄü ☺☻↓Lb'►0¶↓►☻♦♦α♦☻►@►►►P$☻Ç$A╨└☺pCODEh▬►♦ `DATAp0☻∟@└BSSQ☺@▲└ etc.
Here are the danger signs of this particular case:
- Header contains Content-Type: application/octet-stream. This means that the server is trying to send a file to you rather than a webpage.
- Header contains Content-Disposition: attachment; filename=<some file name>. The server is trying to send you a file as an attachment.
- The first two letters after the blank line are 'MZ', and a bit further on it says 'This program must be run under Win32'. These denote a Windows .exe file, in other words a program. Any proper site would put those in a zip, so if you see this, you can be pretty much sure it's a virus of some kind!
-----------------------------
Now here are some dangerous links that have been discovered already. If you have any to add, post them as well. But BE CAREFUL!!
Before you post a link first put an underscore _ before every link, so that the forum does not automatically turn it into a clickable link!
You never know what kind of idiots click these links anyway and help spread the problem. Better to be safe than sorry.
Whatever you do, do NOT visit any of these links!
is this really you? :S _http://photoshare.cogia.net/?=<your email>
Downloads an .exe file to your computer. Crashed one of my friends' systems as well.
this looks alot like you :S _http://photos.hollosite.com/viewimage.php?=<your email>
Downloads an .exe file to your computer.
Edited by CodeCat, 28 February 2008 - 13:29.
