> ls -l 941.pdfSure looks fishy.
-rw-r--r-- 1 uid gid 14720 2009-06-22 20:14 941.pdf
> file 941.pdf
941.pdf: PDF document, version 1.1
> evince 941.pdf
Error: PDF file is damaged - attempting to reconstruct xref table...
> host w.eaaxra.infoSearching on adv-basesrv.net didn't turn up much, but a search on advert-base.net led to this blog from April 9th, Another virus infection, courtesy of Yahoo News which opens:
w.eaaxra.info has address 18.104.22.168
w.eaaxra.info has address 22.214.171.124
w.eaaxra.info has address 126.96.36.199
> host 188.8.131.52
184.108.40.206.in-addr.arpa domain name pointer sever3.adv-basesrv.net.
> host 220.127.116.11
18.104.22.168.in-addr.arpa domain name pointer server2.advert-base.net.
> host 22.214.171.124
126.96.36.199.in-addr.arpa domain name pointer server1.advert-base.net.
Major web sites like Yahoo.com and Boston.com are infecting thousands, if not hundred thousands of computers with trojans, back doors, and other viruses, through some of their ad service providers. When will the people in charge of these web sites wake up and start screening the ads that they are serving?Apparently the blogger over there was infected, and after cleaning up he traced his infection back to good old advert-base.net.
So after two and a half months, this advertising outfit is still spreading exploits in addition to the ads. Why is such an irresponsible company still in business?