[MPlayer-users] Android MPlayer shows artifacts while playing H264 stream

[Mike Hodson]

On Wed, Apr 8, 2015 at 5:31 PM, Harshal Patel <hpatel at signalogic.com> wrote:

> Hello,
>
> ** If you would like to see a screen cap of the artifacts, look here:
>
> http://postimg.org/image/yqn6a0a4x/
>
>
This image site seems to be harboring a nasty link to a script that claims
your Android keyboard is out of date, and then seems to have installed
something on my handset without my permission.. I saw 2 or 3 toasts as soon
as I tried to hit the back button, but did not capture what they were.  I
can try with an android emulator shortly...

The bad script in question:

wget 'http://1phads.com/notice.php?p=16779&interactive=1&pushup=1'
--user-agent 'Mozilla/5.0 (Android; Mobile; rv:26.0) Gecko/26.0
Firefox/26.0'

Obfuscated javascript with IMHO bad intent; do not visit this site...

This then loads other urls from rtbpopd.com, which is some random site at a
web hosting company "Webzilla"

# host rtbpopd.com
rtbpopd.com has address 88.85.82.147
rtbpopd.com has address 88.85.82.148
rtbpopd.com has address 88.85.82.149

# whois 88.85.82.147
% This is the RIPE Database query service.
% The objects are in RPSL format.
%
% The RIPE Database is subject to Terms and Conditions.
% See http://www.ripe.net/db/support/db-terms-conditions.pdf

% Note: this output has been filtered.
%       To receive output for a database update, use the "-B" flag.

% Information related to '88.85.82.0 - 88.85.82.255'

% Abuse contact for '88.85.82.0 - 88.85.82.255' is 'abuse at webzilla.com'

inetnum:        88.85.82.0 - 88.85.82.255
netname:        WEBAZILLA
descr:          WebaZilla
remarks:        INFRA-AW
country:        NL
admin-c:        WZNL1-RIPE
tech-c:         WZNL1-RIPE
status:         ASSIGNED PA
mnt-by:         WZNET-MNT
source:         RIPE # Filtered

role:           WebaZilla RIPE Manager
address:        WebaZilla B.V.
address:        Postbus 19115
address:        3501DC Utrecht
address:        Netherlands
phone:          +31612253464
fax-no:         +31303100299
abuse-mailbox:  abuse at webzilla.com
mnt-by:         WZNET-MNT
admin-c:        BK5536-RIPE
tech-c:         BK5536-RIPE
tech-c:         KV1670-RIPE
nic-hdl:        WZNL1-RIPE
source:         RIPE # Filtered

% Information related to '88.85.64.0/19AS35415'

route:          88.85.64.0/19
descr:          WEBAZILLA
origin:         AS35415
mnt-by:         WZNET-MNT
source:         RIPE # Filtered

% This query was served by the RIPE Database Query Service version 1.78
(DB-1)

This is similar to the ugg-boots hacks :\

Mike