+- Hack Forums (https://hackforums.net)
+-- Forum: Marketplace (https://hackforums.net/forumdisplay.php?fid=105)
+--- Forum: Bazaar (https://hackforums.net/forumdisplay.php?fid=450)
+---- Forum: Marketplace Discussions (https://hackforums.net/forumdisplay.php?fid=163)
+---- Thread: [Community Alert] HFES domain expired, older HFES has adware now (/showthread.php?tid=5501254)
HFES domain expired, older HFES has adware now - ze-slade - Dec 22, 2016
Over the past three or four day I've been having issues with adware, but the thing being it was ONLY on hackforums, I decided to make a thread in the whitehat section to geet help. Nobody was able to fix it until today when CJOS100 said this in my thread:
(Dec 22, 2016 06:29 AM)CJOS100 Wrote: Hey I was having the exact same problem a few minutes ago, started disabling things and I narrowed it down to the tapermonkey script "HF Enhancement suite", after disabling it I haven't had any more popups.
Edit:
After looking at the script, the download URL is weird: https://i.imgur.com/ckJg6Oo.jpg
It leads to this:
PHP Code
<?php
if (typeof _popwnd == 'undefined') {
var _popwnd = -1;
function _popwnd_open(){
if (_popwnd!=-1) return;
_popwnd = window.open('http://findbetterresults.com/?dn=sublyme.net&pid=9PO755G95', '_blank', '');
_popwnd.blur();
window.focus();
}
};
window.addEventListener('click', _popwnd_open);
As soon as I disabled it, I stopped having my adware issue. Now I went on discord and luckily TheChiеf was in there and figured out that the domain was expired and somebody bought it. here's proof of expiring: https://who.is/whois/sublyme.net
This is on the older one, I'm not too sure about the current one, though.
* - Jаson - Dec 22, 2016
I suggest using the new URL
https://raw.githubusercontent.com/hashlabxyz/Userscripts/master/HackForums/HFES/HFES.user.js
* - TheChiеf - Dec 22, 2016
(Dec 22, 2016 10:06 AM)Jasоn Wrote: I suggest using the new URLIt still uses the same domain.
https://raw.githubusercontent.com/hashlabxyz/Userscripts/master/HackForums/HFES/HFES.user.js
* - Riyu - Dec 22, 2016
(Dec 22, 2016 10:06 AM)Jasоn Wrote: I suggest using the new URL
https://raw.githubusercontent.com/hashlabxyz/Userscripts/master/HackForums/HFES/HFES.user.js
Pretty sure thats the same one?
* - Jаson - Dec 22, 2016
(Dec 22, 2016 10:07 AM)TheChiеf Wrote: It still uses the same domain.
No the one he was using was from sublyme.net
This is on Github
* - Kaspah - Dec 22, 2016
This is totally irrelevant but did everything work out with the keys?
* - ze-slade - Dec 22, 2016
(Dec 22, 2016 10:07 AM)Kaspah Wrote: This is totally irrelevant but did everything work out with the keys?
You should have just pm'd me about this, no I haven't got them yet because I currently have no use for them.
* - Jаson - Dec 22, 2016
(Dec 22, 2016 10:07 AM)Riyu: Wrote: Pretty sure thats the same one?
No.
* - Cammy - Dec 22, 2016
(Dec 22, 2016 10:07 AM)TheChiеf Wrote: It still uses the same domain.
The Namespace class doesnt even connect to the domain afaik, you can even put words in it. iirc it serves as an identifier so scripts wont conflict if they have the same name or whatever
* - Jаson - Dec 22, 2016
(Dec 22, 2016 10:10 AM)Cammy Wrote: The Namespace class doesnt even connect to the domain afaik, you can even put words in it. iirc it serves as an identifier so scripts wont conflict if they have the same name or whatever
Ye. Still using HFES and having no problems with it.
* - TheChiеf - Dec 22, 2016
(Dec 22, 2016 10:14 AM)Jasоn Wrote: Ye. Still using HFES and having no problems with it.
I had no problems with it as well, but you can just Ctrl + F through the userscript, and you can clearly see more than 50 mentions of the domain.
* - ze-slade - Dec 22, 2016
(Dec 22, 2016 10:14 AM)Jasоn Wrote: Ye. Still using HFES and having no problems with it.
The newer one has no issues AFAIK, but the older one has the adware like issue.
* - Jаson - Dec 22, 2016
(Dec 22, 2016 10:15 AM)ze-slade Wrote: The newer one has no issues AFAIK, but the older one has the adware like issue.
Yea when you first alerted us of this, I had to take a closer look of the script
Newer script is perfectly fine (From Github)
* - bzrΚ - Dec 22, 2016
Surely whoever has purchased the domain was / is on HF. Kinda scummy thing to do...
* - Cammy - Dec 22, 2016
I dont even think its sublyme.net but rather http://findbetterresults.com/