Gambling Federation Malware

[LatrellDG]

I want to know the position of Interactive Gaming Gambling and Betting Association (iggba.org.uk), Interactive Gaming Council (www.igcouncil.org), Gambling Comission http://www.gamblingcommission.org/ about this.
They have their seals of endorsments in all Gambling Federation Sites, and this is unacceptable and go against all their fairness principles.

Below how the hosts file looks like after they modify it:


# Copyright (c) 1993-1999 Microsoft Corp.
#
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
#
# This file contains the mappings of IP addresses to host names. Each
# entry should be kept on an individual line. The IP address should
# be placed in the first column followed by the corresponding host name.
# The IP address and the host name should be separated by at least one
# space.
#
# Additionally, comments (such as these) may be inserted on individual
# lines or following the machine name denoted by a '#' symbol.
#
# For example:
#
# 102.54.94.97 rhino.acme.com # source server
# 38.25.63.10 x.acme.com # x client host

127.0.0.1 localhost


255.255.255.255 www.theblackjacktable.com




255.255.255.255 www.casinoxo.com





255.255.255.255 www.theblackjacktable.com

[jetset]

This stuff is dynamite that could introduce Gambling Federation to a world of you-know-what in several sectors, not least of which is inserting malware on players' computers and subverting other businesses.

G-Fed is also a member of the iGGBA who might be interested in hearing about this.

We're following up with G-FED to get their version of events, but this is going to be mighty hard to explain away.

I wonder how many other online casinos have been *blocked* in this manner

[spearmaster]

*cough*

g-fed's owner was also just named to the IGC's board of directors

[jetset]

Spear is correct...from Casinomeister News quoting an IGC release earlier this year:

QUOTE Two new directors have been elected to the IGC Board: Flaviano Fogli and Alfred E. (Freddie) Ballester. Fogli is general manager of Azur Media, an Internet marketing firm in Saint Laurent, Quebec. He is also the chief executive and a founder of the Gambling Federation, which provides services to online casino operators. A native of Italy, he moved to Canada, where he now lives, to complete his MBA.UNQUOTE

[Casinomeister]

This is not a good situation. I am in the process of contacting the right people about this.

[Casinomeister]

This is some pretty serious shit. Is this pinkladycasino specific, or have others been detected as well? I'm just wondering if the download file has been tampered with, was it done at the casino site, or does this go further.

Also:

Originally Posted by jmildstone

Now i can play theblackjacktable.com., because the tech guy flushed my computer....

Can any one of you IT guys give a step by step process to detect and remove these files or comments. I'm sure everyone will appreciate this. Not everyone has tech guys at their disposal

[Casinomeister]

Well I just downloaded Pinkladycasino direct from Pinkladycasino.com with no affiliate tag involved, and guess what?

Originally Posted by jmildstone

The installation process from G-FED Casinos modifies 7 files,one of this files is

called "hosts" located in the following path

C:\windows\system32\drivers\etc\hosts

GFED casino software has altered this file and add a spyware on it.

Regularly a computer use a host file to resolve dns names when their is a software
installed on the computer.This Spyware denies access to other casino sites.

Before installing the GFED -PINKLADY casino hosts file is about 2 Kbytes, after
software installation almost doubled its size to 4.40 k bytes,

Now you may think what makes this file so big??

First of all the original file is about 19 lines, GFED insert 1175 blank lines and in the

last line they add the following line 255.255.255.255 www.theblackjacktable.com

...I can confirm this. The C:\windows\system32\drivers\etc\hosts file WAS modified - and theblackjacktable.com, www.casinoxo.com, and royaldutchcasino.com were all listed. I tried to access Royal Dutch Casino -- website not found error message. I went back to this "hosts" file and removed the royal dutch comments (there were two of them) and now I can access their page.

This is a low down nasty deed. For shame Gambling Federation.

[GrandMaster]

The hosts file is at C:\windows\system32\drivers\etc\hosts on XP, you can just edit it with your favourite text editor. Make sure that you save it without any extension, notepad may save it as hosts.txt and you may have to rename it manually.

Several viruses use the hosts file trick to stop you from accessing anti-virus sites. There may be anti-virus or anti-spyware software that monitors the hosts file and alerts the user if something is trying to modify it. You can still access a site if you know its numeric IP address.

It would be worth submitting this to anti-virus companies. Being detected as a trojan would be very embarrassing for Pink Lady/G-FED.

[Casinomeister]

Originally Posted by GrandMaster

The hosts file is at C:\windows\system32\drivers\etc\hosts on XP, you can just edit it with your favourite text editor. Make sure that you save it without any extension, notepad may save it as hosts.txt and you may have to rename it manually.

Thanks Grandmaster - I've got a handle on this.

By the way, I've just downloaded Goldenballs - same friggin' thing. This is unbelievable.

[Casinomeister]

Commodore Casino...same thing.

I'll be posting a warning about this by the end of the day (today is guitar day - so it may take some time).

This is total BS.