1. By continuing to use the site, you agree to the use of cookies .This website or its third-party tools use cookies, which are necessary to its functioning and required to achieve the purposes illustrated in the cookie policy.Find out more.
    Dismiss Notice
  2. Follow Casinomeister on Twitter | Facebook | YouTube | Casinomeister.us US Residents Click here! |  Svenska Svenska | 
Dismiss Notice
REGISTER NOW!! Why? Because you can't do diddly squat without having been registered!

At the moment you have limited access to view most discussions: you can't make contact with thousands of fellow players, affiliates, casino reps, and all sorts of other riff-raff.

Registration is fast, simple and absolutely free so please, join Casinomeister here!

Gambling Federation Malware

Discussion in 'Online Casino and Poker Complaints - old section' started by jmildstone, Feb 16, 2005.

    Feb 16, 2005
  1. jmildstone

    jmildstone Dormant account

    Location:
    Vermont
    5 days ago my wife installed Pinklady Casino (GFED sister casino),following night,
    I felt like playing some black jack at You must register/login in order to see the link., I just couldn't access their page,
    I thought they where having down time so called it for that night, Next day same thing happened so I contacted support ,
    they told me that their casino was running fine and that were not doing maintenance of any kind to their site.

    They advised me to clean up my cache, cookies and temporaries files which I did and guess what....

    I was having the same problem.

    Next day I called them again and one of the supervisors said that the problem may be was on the ISP end, funny thing is that at my office we use the same ISP and theblackjacktable.com site works fine from work.

    So I took my home computer and plugged it at work - I still had problems accessing their site .

    At this point I felt like throwing my home computer off the window,so tried again with my friends laptop and then with my computer at work,
    we both had access to theblackjacktable.com.

    The tech guy took my Home PC to IT Department and this is what he found out

    -----------------------------------------------------------------------------------------------------------------


    The installation process from G-FED Casinos modifies 7 files,one of this files is

    called "hosts" located in the following path

    C:\windows\system32\drivers\etc\hosts

    GFED casino software has altered this file and add a spyware on it.

    Regularly a computer use a host file to resolve dns names when their is a software
    installed on the computer.This Spyware denies access to other casino sites.

    Before installing the GFED -PINKLADY casino hosts file is about 2 Kbytes, after
    software installation almost doubled its size to 4.40 k bytes,

    Now you may think what makes this file so big??

    First of all the original file is about 19 lines, GFED insert 1175 blank lines and in the

    last line they add the following line 255.255.255.255 You must register/login in order to see the link.

    ----------------------------------------------------------------------------------------------------------------------------

    Now i can play theblackjacktable.com., because the tech guy flushed my computer....
     
  2. Feb 16, 2005
  3. GrandMaster

    GrandMaster Ueber Meister CAG

    Occupation:
    Mathematician by day, online gambler by night.
    Location:
    UK
    This would be a trojan, not spyware, but very nasty indeed, and it would justify rogueing the casino involved.
     
  4. Feb 16, 2005
  5. jmildstone

    jmildstone Dormant account

    Location:
    Vermont
    i call it unloyal competition....
     
  6. Feb 16, 2005
  7. bagofmaggots

    bagofmaggots Dormant account

    Occupation:
    Dare Devil / Grave Robber
    Location:
    Earth
    Bad bad bad

    I'm an IT guy myself and for any software to modify that host file is a cause for concern. That's much more than spyware that's "hacking". If Gambling Federation indeed did that, they owe an explanation.
     
  8. Feb 17, 2005
  9. caruso

    caruso Banned User - repetitive violations of 1.6 - troll

    Occupation:
    Casino apologist
    Location:
    England
    ...but of course, cheating software is OK.

    Too funny.

    You must register/login in order to see the link.
     
  10. Feb 17, 2005
  11. dominique

    dominique Dormant account

    Occupation:
    webmistress
    Location:
    The Boonies
    Thats all we need! Casinos trying to eliminate the competition right on our computers! :eek:


    BTW I love the card symbols on the message buttons, nice touch! :)
     
    Last edited: Feb 17, 2005
  12. Feb 17, 2005
  13. LatrellDG

    LatrellDG Dormant account

    Occupation:
    Singer
    Location:
    NY
    Thank you for the advice, I finally found the problem I was getting in my computer around a month ago.

    What really concerns me is if they do not care in hacking their customers computers, what can they do to their games???

    Absolutely!! They have fixed games. I am blocking them now!!!
     
  14. Feb 17, 2005
  15. 555YY

    555YY Dormant account

    Occupation:
    "":".."|
    Location:
    PA
    i'm a network administrator as well, if anyone can pm a copy of said malware i can ask around to see if anything can be done against this kind of despicable violation of privacy from a legal standpoint
     
  16. Feb 17, 2005
  17. mucullus

    mucullus Experienced Member

    Location:
    Germany
    this is unbelievable, i tried it and installed pink lady casino.
    indeed, after starting the casino for the first time it wrote the entry "www.royaldutchcasino" pointing to the IP 255.255.255.255 in my host file. this means you can't access this homepage anymore as every time you enter the web address you'll be redirected to the wrong IP. this is the behaviour of annoying malware, and I believe every gfed casino will behave in that way because all gfed affiliated casinos are downloaded from subdomains of gfed's main site. Boycott them!
     
  18. Feb 17, 2005
  19. jmildstone

    jmildstone Dormant account

    Location:
    Vermont
    255.255.255.255 You must register/login in order to see the link. is another site that appears to be blocked by GFED trojan
     
  20. Feb 17, 2005
  21. LatrellDG

    LatrellDG Dormant account

    Occupation:
    Singer
    Location:
    NY
    I want to know the position of Interactive Gaming Gambling and Betting Association (iggba.org.uk), Interactive Gaming Council (You must register/login in order to see the link.), Gambling Comission You must register/login in order to see the link. about this.
    They have their seals of endorsments in all Gambling Federation Sites, and this is unacceptable and go against all their fairness principles.

    Below how the hosts file looks like after they modify it:


    # Copyright (c) 1993-1999 Microsoft Corp.
    #
    # This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
    #
    # This file contains the mappings of IP addresses to host names. Each
    # entry should be kept on an individual line. The IP address should
    # be placed in the first column followed by the corresponding host name.
    # The IP address and the host name should be separated by at least one
    # space.
    #
    # Additionally, comments (such as these) may be inserted on individual
    # lines or following the machine name denoted by a '#' symbol.
    #
    # For example:
    #
    # 102.54.94.97 rhino.acme.com # source server
    # 38.25.63.10 x.acme.com # x client host

    127.0.0.1 localhost


    255.255.255.255 You must register/login in order to see the link.




    255.255.255.255 You must register/login in order to see the link.





    255.255.255.255 You must register/login in order to see the link.
     
  22. Feb 17, 2005
  23. jetset

    jetset Ueber Meister CAG

    Occupation:
    Senior Partner, InfoPowa News Service
    Location:
    Earth
    This stuff is dynamite that could introduce Gambling Federation to a world of you-know-what in several sectors, not least of which is inserting malware on players' computers and subverting other businesses.

    G-Fed is also a member of the iGGBA who might be interested in hearing about this.

    We're following up with G-FED to get their version of events, but this is going to be mighty hard to explain away.

    I wonder how many other online casinos have been *blocked* in this manner
     
  24. Feb 17, 2005
  25. spearmaster

    spearmaster RIP Ted

    Occupation:
    Devil's Advocate
    Location:
    Heaven
    *cough*

    g-fed's owner was also just named to the IGC's board of directors
     
  26. Feb 17, 2005
  27. jetset

    jetset Ueber Meister CAG

    Occupation:
    Senior Partner, InfoPowa News Service
    Location:
    Earth
    Spear is correct...from Casinomeister News quoting an IGC release earlier this year:

    QUOTE Two new directors have been elected to the IGC Board: Flaviano Fogli and Alfred E. (Freddie) Ballester. Fogli is general manager of Azur Media, an Internet marketing firm in Saint Laurent, Quebec. He is also the chief executive and a founder of the Gambling Federation, which provides services to online casino operators. A native of Italy, he moved to Canada, where he now lives, to complete his MBA.UNQUOTE
     
  28. Feb 17, 2005
  29. Casinomeister

    Casinomeister Forum Cheermeister Staff Member

    Occupation:
    Homemaker
    Location:
    Bierland
    This is not a good situation. I am in the process of contacting the right people about this.
     
  30. Feb 17, 2005
  31. Casinomeister

    Casinomeister Forum Cheermeister Staff Member

    Occupation:
    Homemaker
    Location:
    Bierland
    This is some pretty serious shit. Is this pinkladycasino specific, or have others been detected as well? I'm just wondering if the download file has been tampered with, was it done at the casino site, or does this go further.

    Also:
    Can any one of you IT guys give a step by step process to detect and remove these files or comments. I'm sure everyone will appreciate this. Not everyone has tech guys at their disposal :D
     
  32. Feb 17, 2005
  33. Casinomeister

    Casinomeister Forum Cheermeister Staff Member

    Occupation:
    Homemaker
    Location:
    Bierland
    Well I just downloaded Pinkladycasino direct from Pinkladycasino.com with no affiliate tag involved, and guess what?

    ...I can confirm this. The C:\windows\system32\drivers\etc\hosts file WAS modified - and theblackjacktable.com, You must register/login in order to see the link., and royaldutchcasino.com were all listed. I tried to access Royal Dutch Casino -- website not found error message. I went back to this "hosts" file and removed the royal dutch comments (there were two of them) and now I can access their page.

    This is a low down nasty deed. For shame Gambling Federation.
     
  34. Feb 17, 2005
  35. GrandMaster

    GrandMaster Ueber Meister CAG

    Occupation:
    Mathematician by day, online gambler by night.
    Location:
    UK
    The hosts file is at C:\windows\system32\drivers\etc\hosts on XP, you can just edit it with your favourite text editor. Make sure that you save it without any extension, notepad may save it as hosts.txt and you may have to rename it manually.

    Several viruses use the hosts file trick to stop you from accessing anti-virus sites. There may be anti-virus or anti-spyware software that monitors the hosts file and alerts the user if something is trying to modify it. You can still access a site if you know its numeric IP address.

    It would be worth submitting this to anti-virus companies. Being detected as a trojan would be very embarrassing for Pink Lady/G-FED.
     
  36. Feb 17, 2005
  37. Casinomeister

    Casinomeister Forum Cheermeister Staff Member

    Occupation:
    Homemaker
    Location:
    Bierland
    Thanks Grandmaster - I've got a handle on this.

    By the way, I've just downloaded Goldenballs - same friggin' thing. This is unbelievable.
     
  38. Feb 17, 2005
  39. Casinomeister

    Casinomeister Forum Cheermeister Staff Member

    Occupation:
    Homemaker
    Location:
    Bierland
    Commodore Casino...same thing.

    I'll be posting a warning about this by the end of the day (today is guitar day - so it may take some time).

    This is total BS.
     

Share This Page