Etenco.com.br

[Evilcry]

Hi,

Code: [Select]

http://www.enteco.com.br/pornotube/index1.htm
Which contains:

Code: [Select]

video1439654.exe
video54582.exe
video76566.exe
video8657786.exe

Regards,
Giuseppe 'Evilcry' Bonfa'

[Kayrac]

drops a file in system32, starts it as a service, and POSTS this

Code: [Select]

74.50.109.2/ldr/client01/ldrctl.php

[JohnC]

Thank you.