Gambling Federation Malware

**jmildstone** · 16th February 2005, 10:28 PM

5 days ago my wife installed Pinklady Casino (GFED sister casino),following night,
I felt like playing some black jack at www.theblackjacktable.com, I just couldn't access their page,
I thought they where having down time so called it for that night, Next day same thing happened so I contacted support ,
they told me that their casino was running fine and that were not doing maintenance of any kind to their site.

They advised me to clean up my cache, cookies and temporaries files which I did and guess what....

I was having the same problem.

Next day I called them again and one of the supervisors said that the problem may be was on the ISP end, funny thing is that at my office we use the same ISP and theblackjacktable.com site works fine from work.

So I took my home computer and plugged it at work - I still had problems accessing their site .

At this point I felt like throwing my home computer off the window,so tried again with my friends laptop and then with my computer at work,
we both had access to theblackjacktable.com.

The tech guy took my Home PC to IT Department and this is what he found out

-----------------------------------------------------------------------------------------------------------------

The installation process from G-FED Casinos modifies 7 files,one of this files is

called "hosts" located in the following path

C:\windows\system32\drivers\etc\hosts

GFED casino software has altered this file and add a spyware on it.

Regularly a computer use a host file to resolve dns names when their is a software
installed on the computer.This Spyware denies access to other casino sites.

Before installing the GFED -PINKLADY casino hosts file is about 2 Kbytes, after
software installation almost doubled its size to 4.40 k bytes,

Now you may think what makes this file so big??

First of all the original file is about 19 lines, GFED insert 1175 blank lines and in the

last line they add the following line 255.255.255.255 www.theblackjacktable.com

----------------------------------------------------------------------------------------------------------------------------

Now i can play theblackjacktable.com., because the tech guy flushed my computer....

**GrandMaster** · 16th February 2005, 10:40 PM

This would be a trojan, not spyware, but very nasty indeed, and it would justify rogueing the casino involved.

**jmildstone** · 16th February 2005, 10:57 PM

i call it unloyal competition....

**bagofmaggots** · 16th February 2005, 11:07 PM

I'm an IT guy myself and for any software to modify that host file is a cause for concern. That's much more than spyware that's "hacking". If Gambling Federation indeed did that, they owe an explanation.

**caruso** · 17th February 2005, 12:01 AM

...but of course, cheating software is OK.

Too funny.

http://mb.winneronline.com/showthread.html?t=14596

**dominique** · 17th February 2005, 12:38 AM

Thats all we need! Casinos trying to eliminate the competition right on our computers!

BTW I love the card symbols on the message buttons, nice touch!

**LatrellDG** · 17th February 2005, 02:11 AM

Thank you for the advice, I finally found the problem I was getting in my computer around a month ago.

What really concerns me is if they do not care in hacking their customers computers, what can they do to their games???

Absolutely!! They have fixed games. I am blocking them now!!!

**555YY** · 17th February 2005, 02:37 AM

i'm a network administrator as well, if anyone can pm a copy of said malware i can ask around to see if anything can be done against this kind of despicable violation of privacy from a legal standpoint

**mucullus** · 17th February 2005, 03:02 AM

this is unbelievable, i tried it and installed pink lady casino.
indeed, after starting the casino for the first time it wrote the entry "www.royaldutchcasino" pointing to the IP 255.255.255.255 in my host file. this means you can't access this homepage anymore as every time you enter the web address you'll be redirected to the wrong IP. this is the behaviour of annoying malware, and I believe every gfed casino will behave in that way because all gfed affiliated casinos are downloaded from subdomains of gfed's main site. Boycott them!