Malware? - - Was: State of local self defense

G. Morgan

unread,

Jan 23, 2012, 10:06:46 AM1/23/12

to

A.P.S. --> Does anyone detect anything malicious on the URL below? I
can't find anything.
http://chicagohandgun.org/2011/08/lawson-v-chicago-victory/

Thread here:
Message-ID: <jfh9h7$iu2$1...@dont-email.me>

Snag wrote:

> Apparently not , it was caught and deleted by that "shit software" before
>it could deliver it's payload . SM suggested it might have been one of the
>popup ads . Could be , I don't know or care , it got caught .

/What/ got caught?

Do a 'wget' on it, there is no malware there:

Requesting .. Ok
Reply received (reply time: 1688 ms)
------------------------------------
HTTP/1.1 200 OK
Date: Mon, 23 Jan 2012 14:33:49 GMT
Server: Apache
X-Pingback: http://chicagohandgun.org/xmlrpc.php
Link: <http://chicagohandgun.org/?p=59>; rel=shortlink
Set-Cookie: bp-message=deleted; expires=Sun, 23-Jan-2011 14:33:48 GMT;
path=/
Set-Cookie: bp-message-type=deleted; expires=Sun, 23-Jan-2011 14:33:48
GMT; path=/
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" lang="en-US">

<head profile="http://gmpg.org/xfn/11">

<meta http-equiv="Content-Type" content="text/html;
charset=UTF-8" />

<title>Chicago Handgun Rights | Blog | Lawson
v Chicago - VICTORY!</title>

<meta name="generator" content="WordPress 3.1" /> 

<link rel="stylesheet"
href="http://chicagohandgun.org/wp-content/plugins/buddypress/bp-themes/bp-default/style.css"
type="text/css" media="screen" />

<link rel="alternate"
type="application/rss+xml" title="Chicago Handgun Rights | Site Wide
Activity RSS Feed" href="http://chicagohandgun.org/activity/feed/" />

<link rel="alternate" type="application/rss+xml"
title="Chicago Handgun Rights Blog Posts RSS Feed"
href="http://chicagohandgun.org/feed/" />
<link rel="alternate" type="application/atom+xml"
title="Chicago Handgun Rights Blog Posts Atom Feed"
href="http://chicagohandgun.org/feed/atom/" />

<link rel="pingback"
href="http://chicagohandgun.org/xmlrpc.php" />

<link rel="alternate" type="application/rss+xml"
title="Chicago Handgun Rights » Lawson v Chicago – VICTORY!
Comments Feed"
href="http://chicagohandgun.org/2011/08/lawson-v-chicago-victory/feed/"
/>
<script type='text/javascript'
src='http://chicagohandgun.org/wp-includes/js/l10n.js?ver=20101110'></script>
<script type='text/javascript'
src='http://chicagohandgun.org/wp-includes/js/jquery/jquery.js?ver=1.4.4'></script>
<script type='text/javascript'>
/* <![CDATA[ */
var BP_DTheme = {
my_favs: "My Favorites",
accepted: "Accepted",
rejected: "Rejected",
show_all_comments: "Show all comments for this thread",
show_all: "Show all",
comments: "comments",
close: "Close",
mention_explain: "@ is a unique identifier for that you can
type into any message on this site. will be sent a notification and a
link to your message any time you use it."
};
/* ]]> */
</script>
<script type='text/javascript'
src='http://chicagohandgun.org/wp-content/plugins/buddypress/bp-themes/bp-default/_inc/global.js?ver=3.1'></script>
<script type='text/javascript'
src='http://chicagohandgun.org/wp-includes/js/comment-reply.js?ver=20090102'></script>
<script type='text/javascript'
src='http://chicagohandgun.org/wp-content/plugins/buddypress-mobile/themes/default/theme.js?ver=3.1'></script>
<link rel="EditURI" type="application/rsd+xml" title="RSD"
href="http://chicagohandgun.org/xmlrpc.php?rsd" />
<link rel="wlwmanifest" type="application/wlwmanifest+xml"
href="http://chicagohandgun.org/wp-includes/wlwmanifest.xml" />
<link rel='index' title='Chicago Handgun Rights'
href='http://chicagohandgun.org/' />
<link rel='start' title='I’m back!'
href='http://chicagohandgun.org/2010/11/im-back/' />
<link rel='prev' title='Lawson v. Chicago – Mayhem Denied!'
href='http://chicagohandgun.org/2011/08/lawson-v-chicago-mayhem-denied/'
/>
<meta name="generator" content="WordPress 3.1" />
<link rel='canonical'
href='http://chicagohandgun.org/2011/08/lawson-v-chicago-victory/' />
<link rel='shortlink' href='http://chicagohandgun.org/?p=59' />

<script type="text/javascript">var ajaxurl =
"http://chicagohandgun.org/wp-load.php";</script>

<style type="text/css">
#aka,#aka:link,#aka:hover,#aka:visited,#aka:active{color:#fff;text-decoration:none}
#aka:hover{border:none;text-decoration:none}
#aka:hover #akismet1{display:none}
#aka:hover #akismet2,#akismet1{display:block}
#akismet2{display:none;padding-top:2px}
#akismeta{font-size:16px;font-weight:bold;line-height:18px;text-decoration:none}
#akismetcount{display:block;font:15px
Verdana,Arial,Sans-Serif;font-weight:bold;text-decoration:none}
#akismetwrap
#akismetstats{background:url(http://chicagohandgun.org/wp-content/plugins/akismet/akismet.gif)
no-repeat top left;border:none;color:#fff;font:11px 'Trebuchet
MS','Myriad
Pro',sans-serif;height:40px;line-height:100%;overflow:hidden;padding:8px
0 0;text-align:center;width:120px}
</style>
<style type="text/css">
#header { background-image:
url(http://chicagohandgun.org/wp-content/plugins/buddypress/bp-themes/bp-default/_inc/images/default_header.jpg);
}
#header h1 a, #desc {
color:#FFFFFF; }
</style>

<script type="text/javascript"> jQuery(document).ready(
function() { jQuery("a.confirm").click( function() { if ( confirm( 'Are
you sure?' ) ) return true; else return false; }); });</script>

</head>

<body class="single single-post postid-59
single-format-standard" id="bp-default">

<div id="header">

<h1 id="logo"><a
href="http://chicagohandgun.org" title="Home">Chicago Handgun
Rights</a></h1>

<ul id="nav">
<li>
<a
href="http://chicagohandgun.org" title="Home">Home</a>
</li>

<li>
<a
href="http://chicagohandgun.org/activity/" title="Activity">Activity</a>
</li>

<li>
<a
href="http://chicagohandgun.org/members/" title="Members">Members</a>
</li>

<li>
<a
href="http://chicagohandgun.org/groups/" title="Groups">Groups</a>
</li>

<li class="page_item page-item-2"><a
href="http://chicagohandgun.org/about/" title="About">About</a></li>
<li class="page_item page-item-13"><a
href="http://chicagohandgun.org/gun-laws/" title="Gun Laws">Gun
Laws</a></li>

</ul>

<div id="search-bar">
<div class="padder">

<form
action="http://chicagohandgun.org/search" method="post"
id="search-form">
<input type="text"
id="search-terms" name="search-terms" value="" />
<select
name="search-which" id="search-which" style="width: auto"><option
value="members">Members</option><option
value="groups">Groups</option><option
value="forums">Forums</option></select>
<input type="submit"
name="search-submit" id="search-submit" value="Search" />
<input type="hidden"
id="_wpnonce" name="_wpnonce" value="85dee0b8df" /><input type="hidden"
name="_wp_http_referer" value="/2011/08/lawson-v-chicago-victory/" />
</form>

</div>
</div>

</div>

<div id="container">
<div id="content">
<div class="padder">

<div class="page" id="blog-single">

<div class="item-options">

<div class="alignleft"></div>
<div class="alignright"></div>

</div>

<div class="post" id="post-59">

<div class="author-box">
<img
src="http://chicagohandgun.org/wp-content/uploads/avatars/2/b4699390e8510ed6cdc742e13bdf03e6-bpthumb.jpg"
alt="" class="avatar user-2-avatar" width='50' height='50' /> <p>by <a
href="http://chicagohandgun.org/members/dwlawson/"
title="dwlawson">dwlawson</a></p>
</div>

<div class="post-content">
<h2 class="posttitle"><a
href="http://chicagohandgun.org/2011/08/lawson-v-chicago-victory/"
rel="bookmark" title="Permanent Link to Lawson v Chicago –
VICTORY!">Lawson v Chicago – VICTORY!</a></h2>

<p class="date">3:07 pm
<em>in <a href="http://chicagohandgun.org/category/chicago/" title="View
all posts in Chicago" rel="category tag">Chicago</a> by <a
href="http://chicagohandgun.org/members/dwlawson/"
title="dwlawson">dwlawson</a></em> </p>

<div class="entry">
<p>I have to
hand it to my lawyer, <a href="http://www.joelbrodskylaw.com/"
target="_blank">Joel Brodsky</a>, he did a great job. Kudos also to my
expert witness, Andre Queen of <a
href="http://www.securitytrainingconcepts.us/" target="_blank">Fidelity
Investigative Training Academy</a>.</p>
<p>Big thanks also go to Christopher Conte and Todd Vandermyde, of the
<a href="http://nra.org" target="_blank">NRA</a>, who supported me in
this lawsuit.</p>
<p>And of course, I couldn’t have done this without the moral
support I get from the good folks in the gun rights community,
especially <a href="http://www.illinoiscarry.com"
target="_blank">IllinoisCarry.com</a>.</p>
<p><a
href="http://chicagohandgun.org/wp-content/uploads/2011/08/Order-of-Administrative-Hearing-Officer-On-Remand-8-5-2011.pdf">Order
of Administrative Hearing Officer On Remand 8-5-2011</a></p>
<p>Here is the text of the decision:</p>
<blockquote><p><strong>Decision</strong></p>
<p><strong></strong><br />
This matter having been heard on the remand order of Judge Patrick T.
Rogers, entered on June 24, 2011, in the Circuit Court of Cook County,
Illinois, Municipal Department-First District. All parties having been
heard by the Administrative Law Judge concerning the denial of firearms
registration certifications under the Municipal Code of Chicago,
Chapters 2-84, et. Seq. and 8-20, et seq.. It is the findings of this
Court:</p>
<ol>
<li>On June 24, 2011, Judge Patrick T. Rogers remanded this matter to
the City of Chicago Department of Administrative Hearings and ordered
“for both the plaintiff and the City to provide additional
evidence as to whether the four firearms are prohibited under the City
ordinance. The Court further orders that plaintiff be permitted to
bring the four firearms to the hearing for the purpose of providing
evidence”.</li>
<li>On August 2, 2011, a full hearing was conducted and the City of
Chicago presented testimony from Sergeant Stanley Petraitis and Police
Officer Biggins from the Chicago Police Department Gun Registration
Division. Applicant, David Lawson, presented evidence testimony from
Andre Queen, Fidelity Investigative Training Academy.</li>
<li>The subject rifles: SKS Rifle serial # 1703531, SKS Rifle serial #
2203167, SKS Rifle serial # 3H1539 and SKS Rifle FE1596-1958 were
presented in open court and available to the parties witnesses for
inspection and examination. The City objected to the presence of the
rifles and the City witnesses declined to examine the subject rifles.
City’s objection was overruled.</li>
<li>Sgt. Petraitis testified for the City that based upon his review of
the Application for Firearm Registration filed by David Lawson on or
about August 31, 2010, there was no indication that the subject rifles
were modified from the fixed magazine position. David Lawson’s
testimony is unrebbuted that the weapons, and the fixed magazine
platform, are in the same condition as when he purchased the rifles,
when he applied for the registration and at the time of the
hearing.</li>
<li>The undisputed fact is the subject rifles are over seventy years old
and there have been no alteration or modifications from the original
design. David W. Lawson is licensed by the Department of Treasury,
Bureau of Alcohol, Tobacco and Firearms as a Collector of Curios and
Relics.</li>
<li>The City witness, Officer Biggins, contends that the subject rifles
have the capability of accepting a detachable magazine with a flick of a
sharp object or a bullet without structural changes to the weapon.
Officer Biggins testified that “the process” does not
allow him to demonstrate this potential alteration to the subject
weapons.</li>
<li>Sections 8-20-190 and 8-20-205 of the Municipal Code of Chicago,
provides for the procedures for denials and revocation, inter alia,
“A registration certificate shall be revoked (1) when the firearm
becomes an unregisterable firearm;” or “if, in the
determination of the superintendent, a CFP or registration certificate
should be revoked,”. That is the City’s recourse in the
event there was a modification or alteration to the subject
weapons.</li>
<li>It is the finding of this Administrative Law Judge, based upon the
testimony of all the witness’ and the examination of the subject
rifles by the applicant, David Lawson’s witness, Andre Queen, the
subject rifles did not have the ability to accept a detachable magazine
in the condition in which the weapons existed at the time of the
application process nor at the time of this hearing.</li>
</ol>
<p>IT IS HEREBY ORDERED:</p>
<p>The Denial by the Chicago Police Department of David Lawson’s
registration of the subject four SKS Rifles is REVERSED. The subject
rifles are not prohibited under the Municipal Code of Chicago, 8-20-170,
and therefore, registration certification shall issue accordingly.
Pursuant to Section 2-14-102 of the Chicago Municipal Code, this
decision is final and subject to review under the Illinois
Administrative Review Act.</p></blockquote>

</div>

<p
class="postmetadata"><span class="tags"></span> <span
class="comments"><a
href="http://chicagohandgun.org/2011/08/lawson-v-chicago-victory/#comments"
title="Comment on Lawson v Chicago – VICTORY!">8 Comments
»</a></span></p>
</div>

</div>

<div id="comments">

<h3 id="comments">
7 Responses to <em>Lawson v Chicago
– VICTORY!</em> </h3>

<ol class="commentlist">

<li id="comment-86">
<div class="comment-avatar-box">
<div class="avb">
<a
href="http://chicagohandgun.org/members/donmoran/" rel="nofollow">
<img
src="http://chicagohandgun.org/wp-content/uploads/avatars/8875/21e90e3806e5ddd0d725747b68f0addf-bpthumb.jpg"
alt="Avatar Image" class="avatar user-8875-avatar" width='50'
height='50' /> </a>
</div>
</div>

<div class="comment-content">

<div class="comment-meta">
<a
href="http://chicagohandgun.org/members/donmoran/"
rel="nofollow">Don</a> said: <em>On <a
href="#comment-86" title="">August 5, 2011</a></em>
</div>

<p>Congratulations on slaying the dragon once
again!</p>

<div class="comment-options">
<a class='comment-reply-link'
href='/2011/08/lawson-v-chicago-victory/?replytocom=86#respond'
onclick='return addComment.moveForm("comment-86", "86", "respond",
"59")'>Reply</a> </div>

</div>
</li>

<li id="comment-87">
<div class="comment-avatar-box">
<div class="avb">
<a href="" rel="nofollow">
<img alt=''
src='http://0.gravatar.com/avatar/8d2327c0e6fc049281cc78f8a271ad8f?s=50&d=http%3A%2F%2F0.gravatar.com%2Favatar%2Fad516503a11cd5ca435acc9bb6523536%3Fs%3D50&r=G'
class='avatar avatar-50 photo' height='50' width='50' /> </a>
</div>
</div>

<div class="comment-content">

<div class="comment-meta">
<a href="" rel="nofollow">Don Gwinn</a>
said: <em>On <a href="#comment-87"
title="">August 5, 2011</a></em>
</div>

<p>Chicago expert witness translation:
“That weapon accepts the evil kind of magazines–you can just
take these wholesome and virtuous magazines right off with a bullet or a
sharp object. What’s that? Demonstrate how it’s . . . .
oh, no, I’m afraid that’s quite impossible. But look at
this face. Would I lie to you?”</p>
<p>I’ve known some masters of no-touch knockouts, levitation,
throwing flaming chi balls and one woman who claimed to be able to
interrupt a house’s power supply by having really good sex in an
upstairs bedroom. Sadly, not one of them was able to demonstrate their
powers on request, either.</p>

<div class="comment-options">
<a class='comment-reply-link'
href='/2011/08/lawson-v-chicago-victory/?replytocom=87#respond'
onclick='return addComment.moveForm("comment-87", "87", "respond",
"59")'>Reply</a> </div>

</div>
</li>

<li id="comment-89">
<div class="comment-avatar-box">
<div class="avb">
<a
href="http://chicagohandgun.org/members/dwlawson/" rel="nofollow">
<img
src="http://chicagohandgun.org/wp-content/uploads/avatars/2/b4699390e8510ed6cdc742e13bdf03e6-bpthumb.jpg"
alt="Avatar Image" class="avatar user-2-avatar" width='50' height='50'
/> </a>
</div>
</div>

<div class="comment-content">

<div class="comment-meta">
<a
href="http://chicagohandgun.org/members/dwlawson/"
rel="nofollow">dwlawson</a> said: <em>On
<a href="#comment-89" title="">August 5, 2011</a></em>
</div>

<p>It could be they know how difficult it is to
get those trigger-guard buttons to release! LOL</p>

<div class="comment-options">
<a class='comment-reply-link'
href='/2011/08/lawson-v-chicago-victory/?replytocom=89#respond'
onclick='return addComment.moveForm("comment-89", "89", "respond",
"59")'>Reply</a> </div>

</div>
</li>

<li id="comment-90">
<div class="comment-avatar-box">
<div class="avb">
<a href="" rel="nofollow">
<img alt=''
src='http://0.gravatar.com/avatar/04010e056b40ec07816aa353a6366613?s=50&d=http%3A%2F%2F0.gravatar.com%2Favatar%2Fad516503a11cd5ca435acc9bb6523536%3Fs%3D50&r=G'
class='avatar avatar-50 photo' height='50' width='50' /> </a>
</div>
</div>

<div class="comment-content">

<div class="comment-meta">
<a href="" rel="nofollow">DB</a> said:
<em>On <a href="#comment-90" title="">August 6, 2011</a></em>
</div>

<p>How’d you like to be the cop that had
to testify for the city as part of his job? He must have felt like a
complete asshole.</p>

<div class="comment-options">
<a class='comment-reply-link'
href='/2011/08/lawson-v-chicago-victory/?replytocom=90#respond'
onclick='return addComment.moveForm("comment-90", "90", "respond",
"59")'>Reply</a> </div>

</div>
</li>

</li>

<li id="comment-94">
<div class="comment-avatar-box">
<div class="avb">
<a
href="http://smallestminority.blogspot.com" rel="nofollow">
<img alt=''
src='http://1.gravatar.com/avatar/3c1cb66ef1c28d1f147bc5bb4d5a6574?s=50&d=http%3A%2F%2F1.gravatar.com%2Favatar%2Fad516503a11cd5ca435acc9bb6523536%3Fs%3D50&r=G'
class='avatar avatar-50 photo' height='50' width='50' /> </a>
</div>
</div>

<div class="comment-content">

<div class="comment-meta">
<a
href="http://smallestminority.blogspot.com" rel="nofollow">Kevin
Baker</a> said: <em>On <a href="#comment-94"
title="">August 8, 2011</a></em>
</div>

<p>I hate to ask, but what did this cost you
monetarily? Ten times the value of the four rifles? More?</p>
<p>Kinda defines “Phyrric victory,” doesn’t it? Which,
from the City of Chicago’s position is kinda the point, I’d
imagine. Congratulations on your success, sincerely, but the mere fact
that this hearing had to occur at all . . .</p>

<div class="comment-options">
<a class='comment-reply-link'
href='/2011/08/lawson-v-chicago-victory/?replytocom=94#respond'
onclick='return addComment.moveForm("comment-94", "94", "respond",
"59")'>Reply</a> </div>

</div>
</li>

<li id="comment-97">
<div class="comment-avatar-box">
<div class="avb">
<a href="" rel="nofollow">
<img alt=''
src='http://1.gravatar.com/avatar/3fd9563e081701522cad12c1e1c378c4?s=50&d=http%3A%2F%2F1.gravatar.com%2Favatar%2Fad516503a11cd5ca435acc9bb6523536%3Fs%3D50&r=G'
class='avatar avatar-50 photo' height='50' width='50' /> </a>
</div>
</div>

<div class="comment-content">

<div class="comment-meta">
<a href="" rel="nofollow">Stan</a> said:
<em>On <a href="#comment-97" title="">August 8, 2011</a></em>
</div>

<p>Generally the winner in such a lawsuit is
able to recover legal fees.</p>

<div class="comment-options">
<a class='comment-reply-link'
href='/2011/08/lawson-v-chicago-victory/?replytocom=97#respond'
onclick='return addComment.moveForm("comment-97", "97", "respond",
"59")'>Reply</a> </div>

</div>
</li>

<li id="comment-98">
<div class="comment-avatar-box">
<div class="avb">
<a
href="http://chicagohandgun.org/members/admin/" rel="nofollow">
<img
src="http://www.gravatar.com/avatar/43fb3156188aad8215ab4a53961224dd?d=http://chicagohandgun.org/wp-content/plugins/buddypress/bp-core/images/mystery-man.jpg&s=50"
alt="Avatar Image" class="avatar user-1-avatar" width='50' height='50'
/> </a>
</div>
</div>

<div class="comment-content">

<div class="comment-meta">
<a
href="http://chicagohandgun.org/members/admin/" rel="nofollow">admin</a>
said: <em>On <a href="#comment-98"
title="">August 9, 2011</a></em>
</div>

<p>Only for civil rights lawsuits. We
didn’t make a civil rights claim.</p>

<div class="comment-options">
<a class='comment-reply-link'
href='/2011/08/lawson-v-chicago-victory/?replytocom=98#respond'
onclick='return addComment.moveForm("comment-98", "98", "respond",
"59")'>Reply</a> </div>

</div>
</li>
</ol>

</div>

<div id="respond">

<div class="comment-avatar-box">
<div class="avb">
<img alt=''
src='http://0.gravatar.com/avatar/ad516503a11cd5ca435acc9bb6523536?s=50'
class='avatar avatar-50 photo avatar-default' height='50' width='50' />
</div>
</div>

<div class="comment-content">

<h3 id="reply" class="comments-header">
Leave a Reply </h3>

<p id="cancel-comment-reply">
<a rel="nofollow"
id="cancel-comment-reply-link"
href="/2011/08/lawson-v-chicago-victory/#respond"
style="display:none;">Click here to cancel reply.</a> </p>

<form
action="http://chicagohandgun.org/wp-comments-post.php" method="post"
id="commentform" class="standard-form">

<p
class="form-author">
<label
for="author">Name <span class="required">*</span></label>
<input
type="text" class="text-input" name="author" id="author" value=""
size="40" tabindex="1" />
</p>

<p
class="form-email">
<label
for="email">Email <span class="required">*</span></label>
<input
type="text" class="text-input" name="email" id="email" value=""
size="40" tabindex="2" />
</p>

<p
class="form-url">
<label
for="url">Website</label>
<input
type="text" class="text-input" name="url" id="url" value="" size="40"
tabindex="3" />
</p>

<p
class="form-textarea">
<label
for="comment">Comment</label>
<textarea
name="comment" id="comment" cols="60" rows="10" tabindex="4"></textarea>
</p>

<p class="form-submit">
<input
class="submit-comment button" name="submit" type="submit" id="submit"
tabindex="5" value="Submit" />
<input
type='hidden' name='comment_post_ID' value='59' id='comment_post_ID' />
<input type='hidden' name='comment_parent' id='comment_parent' value='0'
/>
</p>

<div
class="comment-action">
<p
style="display: none;"><input type="hidden" id="akismet_comment_nonce"
name="akismet_comment_nonce" value="8d73d3bca8" /></p> </div>

</form>

</div>
</div>

<div id="trackbacks">

<span class="title">Lawson v Chicago
– VICTORY!</span>

<h3>1 Trackback</h3>

<ul id="trackbacklist">

<li><h5><a
href='http://www.saysuncle.com/2011/08/08/in-illinois-14/' rel='external
nofollow' class='url'>SayUncle » In Illinois</a></h5><em>on August
8, 2011</em></li>
</ul>
</div>

</div>

</div>
</div>

<div id="sidebar">
<div class="padder">

<p id="login-text">
To start connecting please log in first. You can
also <a href="http://chicagohandgun.org/register/" title="Create an
account">create an account</a>. </p>

<form name="login-form" id="sidebar-login-form"
class="standard-form" action="http://chicagohandgun.org/wp-login.php"
method="post">
<label>Username<br />
<input type="text" name="log"
id="sidebar-user-login" class="input" value="" tabindex="97" /></label>

<label>Password<br />
<input type="password" name="pwd"
id="sidebar-user-pass" class="input" value="" tabindex="98" /></label>

<p class="forgetmenot"><label><input
name="rememberme" type="checkbox" id="sidebar-rememberme"
value="forever" tabindex="99" /> Remember Me</label></p>

<input type="submit"
name="wp-submit" id="sidebar-wp-submit" value="Log In" tabindex="100" />
<input type="hidden" name="testcookie" value="1"
/>
</form>

<div id="linkcat-3" class="widget widget_links"><h3
class="widgettitle">Associations</h3>
<ul class='xoxo blogroll'>
<li><a href="http://www.illinoiscarry.com" rel="contact colleague"
title="Grassroots movement dedicated to bring Right-to-Carry to
Illinois" target="_blank">Illinois Carry</a></li>
<li><a href="http://www.isra.org" rel="contact colleague"
title="Illinois State Rifle Association" target="_blank">Illinois State
Rifle Association</a></li>

</ul>
</div>
<div id="linkcat-2" class="widget widget_links"><h3
class="widgettitle">Blogroll</h3>
<ul class='xoxo blogroll'>
<li><a href="http://armedandsafe.blogspot.com/">Armed and Safe</a></li>
<li><a href="http://onlygunsandmoney.blogspot.com/">No Lawyers –
Only Guns and Money</a></li>
<li><a href="http://pushthepulldoor.blogspot.com/">Push the Pull
Door</a></li>
<li><a href="http://secondcitycop.blogspot.com/">Second City
Cop</a></li>
<li><a href="http://www.snowflakesinhell.com" rel="acquaintance"
target="_blank">Snowflakes In Hell</a></li>
<li><a href="http://www.thebredafallacy.com/">The Breda Fallacy</a></li>
<li><a href="http://www.waronguns.blogspot.com" rel="acquaintance"
target="_blank">War On Guns</a></li>

</ul>
</div>
<div id="akismet" class="widget widget_akismet">
<h3 class="widgettitle">Spam Blocked</h3> <div
id="akismetwrap"><div id="akismetstats"><a id="aka"
href="http://akismet.com" title=""><span id="akismet1"><span
id="akismetcount">563</span> <span id="akismetsc">spam
comments</span></span> <span id="akismet2"><span id="akismetbb">blocked
by</span><br /><span id="akismeta">Akismet</span></span></a></div></div>
</div>

</div>
</div>

</div> 

<div id="footer">
<p>Chicago Handgun Rights is proudly powered by <a
href="http://wordpress.org">WordPress</a> and <a
href="http://buddypress.org">BuddyPress</a></p>

</div>

<div id="wp-admin-bar"><div class="padder"><a
href="http://chicagohandgun.org" id="admin-bar-logo">Chicago Handgun
Rights</a><ul class="main-nav"><li class="bp-login no-arrow"><a
href="http://chicagohandgun.org/wp-login.php?redirect_to=http%3A%2F%2Fchicagohandgun.org">Log
In</a></li><li class="bp-signup no-arrow"><a
href="http://chicagohandgun.org/register">Sign Up</a></li>
<li class="align-right" id="bp-adminbar-visitrandom-menu">
<a href="#">Visit</a>
<ul class="random-list">
<li><a
href="http://chicagohandgun.org/members/?random-member">Random
Member</a></li>

<li class="alt"><a
href="http://chicagohandgun.org/groups/?random-group">Random
Group</a></li>

</ul>
</li>

</ul></div></div>



</body>

</html>

Snag

unread,

Jan 23, 2012, 10:35:53 AM1/23/12

to

G. Morgan wrote:
> Snag wrote:
>
>> Apparently not , it was caught and deleted by that "shit software"
>> before it could deliver it's payload . SM suggested it might have
>> been one of the popup ads . Could be , I don't know or care , it got
>> caught .
>
> /What/ got caught?
>
> Do a 'wget' on it, there is no malware there:

I attempted to post the info from the message Avast! popped up , my OE
refused to post . Here's a clipped part of what it said :

Infection: win32:Alureon-APN [Trj]

I tried to google for more info , couldn't find much but a log (seversl ,
actually) of various AV programs catching it .
--
Snag
Learning keeps
you young !

David H. Lipman

unread,

Jan 23, 2012, 10:45:33 AM1/23/12

to

From: "G. Morgan" <seal...@osama-is-dead.net>

| A.P.S. --> Does anyone detect anything malicious on the URL below? I
| can't find anything.
| http://chicagohandgun.org/2011/08/lawson-v-chicago-victory/
|
| Thread here:
| Message-ID: <jfh9h7$iu2$1...@dont-email.me>
|
| Snag wrote:
|
>> Apparently not , it was caught and deleted by that "shit software"
>> before
>> it could deliver it's payload . SM suggested it might have been one of
>> the
>> popup ads . Could be , I don't know or care , it got caught .
|
| /What/ got caught?
|
| Do a 'wget' on it, there is no malware there:
|

Please don't post the entire HTML. There is no reason.

--
Dave
Multi-AV Scanning Tool - http://multi-av.thespykiller.co.uk
http://www.pctipp.ch/downloads/dl/35905.asp

David H. Lipman

unread,

Jan 23, 2012, 10:52:48 AM1/23/12

to

From: "Snag" <snag...@msn.com>

Aleureon is another name for the TDSS RootKit with the present bariant being
TDSS Level 4, aka; TDL4

Thta's associated with a trojan on the computer and not code on a web site
albeit a web site with malicious scripts can lead to a this kind of malware.

I don't know what Avast is flagging. If I submit the web script to Virus
Total I get...
https://www.virustotal.com/file/7609679b3f7c0f5f858b0569b115ae324b3d2d07e76414f36ca55c8b8d601bac/analysis/1327333728/

Avast doesn't flag it. Fortinet does as; JS/Obfuscus.AACB!tr

However I put the URL through a vulnerable SandBox's and nothing was seen to
be malicious.

G. Morgan

unread,

Jan 23, 2012, 10:58:43 AM1/23/12

to

David H. Lipman wrote:

>From: "G. Morgan" <seal...@osama-is-dead.net>
>
>| A.P.S. --> Does anyone detect anything malicious on the URL below? I
>| can't find anything.
>| http://chicagohandgun.org/2011/08/lawson-v-chicago-victory/
>|
>| Thread here:
>| Message-ID: <jfh9h7$iu2$1...@dont-email.me>
>|
>| Snag wrote:
>|
>>> Apparently not , it was caught and deleted by that "shit software"
>>> before
>>> it could deliver it's payload . SM suggested it might have been one of
>>> the
>>> popup ads . Could be , I don't know or care , it got caught .
>|
>| /What/ got caught?
>|
>| Do a 'wget' on it, there is no malware there:
>|
>
>Please don't post the entire HTML. There is no reason.

Did you see anything?

David H. Lipman

unread,

Jan 23, 2012, 11:09:37 AM1/23/12

to

From: "G. Morgan" <seal...@osama-is-dead.net>

>|>
>|> /What/ got caught?
>|>
>|> Do a 'wget' on it, there is no malware there:
>|>
>> Please don't post the entire HTML. There is no reason.
|
| Did you see anything?

Not in the script that I downloaded, no.

G. Morgan

unread,

Jan 23, 2012, 1:36:40 PM1/23/12

to

Thanks for looking, I didn't either.

HAND

-Graham

FromTheRafters

unread,

Jan 23, 2012, 9:32:03 PM1/23/12

to

G. Morgan wrote:

I got a blob of obfuscated javascript. While analyzing it, I
accidentally closed the program and lost it all. Going back three more
times did not give me the obfuscated javascript anymore.

The obfuscation looked very similar to some I have seen before that had
eventually led to a Fake-AV trojan.

FromTheRafters

unread,

Jan 23, 2012, 9:36:34 PM1/23/12

to

When I visited that URL, I got obfuscated Javascript just about where
the "text" appears in the html.

Yes, there was something suspicious there.

David H. Lipman

unread,

Jan 23, 2012, 9:56:38 PM1/23/12

to

From: "FromTheRafters" <err...@nomail.afraid.org>

I ran the URL under two SandBoxes and nothing abnormal was noted.

Are you talking about....
http://multi-av.thespykiller.co.uk/Image2.jpg

David H. Lipman

unread,

Jan 23, 2012, 10:16:09 PM1/23/12

to

From: "FromTheRafters" <err...@nomail.afraid.org>

Yeah. I ran it again at that JS is playing Hide & Seek. I think it is
recording IPs and checking User-Agent. I ran it again under sandBox and
although no malware and successful explotation occurred (the box is full of
exploitable software from IE6, to Adobe Reader 9 to Sun Java v5 update X)
but I did capture the following screen.

http://multi-av.thespykiller.co.uk/dump0.jpeg

It "IS" associated with Black Hole Exploit kit sites.

http://blog.dynamoo.com/2011/12/malware-bbb-complaint-from-your.html
http://urlquery.net/report.php?id=10700

FromTheRafters

unread,

Jan 23, 2012, 10:39:33 PM1/23/12

to

David H. Lipman wrote:
> From: "FromTheRafters" <err...@nomail.afraid.org>
>
> | G. Morgan wrote:
> |
> | I got a blob of obfuscated javascript. While analyzing it, I
> | accidentally closed the program and lost it all. Going back three more
> | times did not give me the obfuscated javascript anymore.
> |
> | The obfuscation looked very similar to some I have seen before that had
> | eventually led to a Fake-AV trojan.
>
> Yeah. I ran it again at that JS is playing Hide & Seek. I think it is
> recording IPs and checking User-Agent. I ran it again under sandBox and
> although no malware and successful explotation occurred (the box is full
> of exploitable software from IE6, to Adobe Reader 9 to Sun Java v5
> update X) but I did capture the following screen.
>
> http://multi-av.thespykiller.co.uk/dump0.jpeg
>
> It "IS" associated with Black Hole Exploit kit sites.
>
> http://blog.dynamoo.com/2011/12/malware-bbb-complaint-from-your.html
> http://urlquery.net/report.php?id=10700
>

Do you know what this line does?

David H. Lipman

unread,

Jan 23, 2012, 10:49:35 PM1/23/12

to

From: "FromTheRafters" <err...@nomail.afraid.org>

| Do you know what this line does?
|
| <script type="text/javascript"> jQuery(document).ready( function() {
| jQuery("a.confirm").click( function() { if ( confirm( 'Are you sure?' )
| ) return true; else return false; }); });</script>
|

No. But it is a good question for Ant.

This this script "is" playing hard to get.
http://multi-av.thespykiller.co.uk/Image2.jpg
Now you see it, now you don't. Its funny how I didn't see it this AM. Saw
it Tonight and when I go back, its gone again.

I think I have to experiment with a Proxy.

FromTheRafters

unread,

Jan 23, 2012, 11:02:01 PM1/23/12

to

David H. Lipman wrote:
> From: "FromTheRafters" <err...@nomail.afraid.org>
>
>
> | Do you know what this line does?
> |
> | <script type="text/javascript"> jQuery(document).ready( function() {
> | jQuery("a.confirm").click( function() { if ( confirm( 'Are you sure?' )
> | ) return true; else return false; }); });</script>
> |
>
> No. But it is a good question for Ant.
>
> This this script "is" playing hard to get.
> http://multi-av.thespykiller.co.uk/Image2.jpg
> Now you see it, now you don't. Its funny how I didn't see it this AM.
> Saw it Tonight and when I go back, its gone again.
>
> I think I have to experiment with a Proxy.
>

Yep, that's the booger. I simplified the decoder too much (missed out on
the h=-1) then accidentally closed the editor.

David H. Lipman

unread,

Jan 23, 2012, 11:16:03 PM1/23/12

to

From: "FromTheRafters" <err...@nomail.afraid.org>

I won't go into details in public but it looks like the server decides when
and if to host that script.

Drop me an email FTR and I'll explain.

Dustin

unread,

Jan 24, 2012, 6:27:59 PM1/24/12

to

FromTheRafters <err...@nomail.afraid.org> wrote in
news:jfl95n$f9m$1...@dont-email.me:

If you try closing the page or going "back", it comes up and asks "Are
you sure?" :) This is the routine heh, that does it.

--
Character is doing the right thing when nobody's looking. There are too
many people who think that the only thing that's right is to get by, and
the only thing that's wrong is to get caught. - J.C. Watts

Dustin

unread,

Jan 24, 2012, 6:54:57 PM1/24/12

to

Dustin <bughunte...@gmail.com> wrote in
news:Xns9FE4BD80B687CHHI2948AJD832@no:

not sure if some is missing tho. Javascript isn't my speciality.

FromTheRafters

unread,

Jan 24, 2012, 9:10:08 PM1/24/12

to

Dustin wrote:
> Dustin<bughunte...@gmail.com> wrote in
> news:Xns9FE4BD80B687CHHI2948AJD832@no:
>
>> FromTheRafters<err...@nomail.afraid.org> wrote in
>> news:jfl95n$f9m$1...@dont-email.me:
>>
>>> David H. Lipman wrote:
>>>> From: "FromTheRafters"<err...@nomail.afraid.org>
>>>>
>>>> | G. Morgan wrote:
>>>> |
>>>> | I got a blob of obfuscated javascript. While analyzing it, I
>>>> | accidentally closed the program and lost it all. Going back three
>>>> | more times did not give me the obfuscated javascript anymore.
>>>> |
>>>> | The obfuscation looked very similar to some I have seen before
>>>> | that had eventually led to a Fake-AV trojan.
>>>>

>>>> Yeah. I ran it again at that JS is playing Hide& Seek. I think it

>>>> is recording IPs and checking User-Agent. I ran it again under
>>>> sandBox and although no malware and successful explotation occurred
>>>> (the box is full of exploitable software from IE6, to Adobe Reader 9
>>>> to Sun Java v5 update X) but I did capture the following screen.
>>>>
>>>> http://multi-av.thespykiller.co.uk/dump0.jpeg
>>>>
>>>> It "IS" associated with Black Hole Exploit kit sites.
>>>>
>>>> http://blog.dynamoo.com/2011/12/malware-bbb-complaint-from-your.html
>>>> http://urlquery.net/report.php?id=10700
>>>>
>>> Do you know what this line does?
>>>
>>> <script type="text/javascript"> jQuery(document).ready( function() {
>>> jQuery("a.confirm").click( function() { if ( confirm( 'Are you sure?'
>>> ) ) return true; else return false; }); });</script>
>>>
>>>
>>
>> If you try closing the page or going "back", it comes up and asks "Are
>> you sure?" :) This is the routine heh, that does it.
>>
>>
>
> not sure if some is missing tho. Javascript isn't my speciality.

I think jquery functions for javascript like a library file does for
executables.

G. Morgan

unread,

Jan 25, 2012, 12:41:50 AM1/25/12

to

David H. Lipman wrote:

>>> I think I have to experiment with a Proxy.
>>>
>| Yep, that's the booger. I simplified the decoder too much (missed out on
>| the h=-1) then accidentally closed the editor.
>
>I won't go into details in public but it looks like the server decides when
>and if to host that script.
>
>Drop me an email FTR and I'll explain.

Would you mind copying me on that? I'd be very interested in your
findings.

My email address is real.