Author Topic: Trojan Ransom  (Read 348012 times)

0 Members and 1 Guest are viewing this topic.

July 19, 2011, 06:18:43 pm
Reply #30

EP_X0FF

  • Special Members
  • Hero Member

  • Offline
  • *

  • 254
    • KernelMode.info
Any chance you can drop me the samples you've got of these so far please? (can't seem to get any of the redirs to work)

Sure, I sent you PM with link to archive with two today samples, pass "malware" without quotes.
Please lets me know if something is wrong.

July 19, 2011, 09:23:21 pm
Reply #31

MysteryFCM

  • Administrator
  • Hero Member

  • Offline
  • *****

  • 1693
  • Personal Text
    Phishing Phanatic
    • I.T. Mate
Much appreciated, cheers :)
Regards

Steven Burn
I.T. Mate / hpHosts
it-mate.co.uk / hosts-file.net

July 20, 2011, 01:45:51 am
Reply #32

EP_X0FF

  • Special Members
  • Hero Member

  • Offline
  • *

  • 254
    • KernelMode.info
Amazon ransom

full trace below including redirector (pornomamaebet.com, registar PUBLICDOMAINREGISTRY.COM)

Quote
hxxp://s3.amazonaws.com/freepornx/index.html (72.21.194.15) -> hxxp://s3.amazonaws.com/freepornx/video.htm (72.21.194.15) -> hxxp://pornomamaebet.com/in.cgi?2 (95.211.111.86) -> hxxp://1qporka.s3.amazonaws.com/index.htm (72.21.194.23) -> hxxp://1qporka.s3.amazonaws.com/xxx_video.exe (72.21.194.23)

update, now redirects to
Quote
hxxp://hnyporka.s3.amazonaws.com/xxx_video.exe
, however previous location also working.

MBRLocker (active locations)

Quote
hxxp://avipornoonline.ru/xxxvideo.avi.exe
hxxp://megasyperxxx.ru/xxxvideo.avi.exe
hxxp://PORNYXAAVI.ru/xxxvideo.avi.exe

Below is list of domains which are reserved by ransom guys for future use (some of them already working, some just sleeping)
I'm sorry it's unfiltered, maybe some of them already listed here. This list is courtesy of mc0blck :)

Quote
hxxp://AVIPORNOONLINE.ru/
hxxp://AVIPORNOONLINE.ru/xxxvideo.avi.exe
hxxp://CAMSHOTPORNO.ru/
hxxp://CAMSHOTPORNO.ru/xxxvideo.avi.exe
hxxp://CLUBTRAXTELOKSUPER.ru/
hxxp://CLUBTRAXTELOKSUPER.ru/video/porno-rolik.avi.exe
hxxp://CLUBTRAXTELOKSUPER.ru/1/video/porno-rolik1.avi.exe
hxxp://CLUBTRAXTELOKSUPER.ru/2/video/porno-rolik2.avi.exe
hxxp://CLUBTRAXTELOKSUPER.ru/3/video/porno-rolik3.avi.exe
hxxp://CLUBTRAXTELOKSUPER.ru/4/video/porno-rolik4.avi.exe
hxxp://CLUBTRAXTELOKSUPER.ru/5/video/porno-rolik5.avi.exe
hxxp://CLUBTRAXTELOKSUPER.ru/6/video/porno-rolik6.avi.exe
hxxp://CLUBTRAXTELOKSUPER.ru/7/video/porno-rolik7.avi.exe
hxxp://CLUBTRAXTELOKSUPER.ru/8/video/porno-rolik8.avi.exe
hxxp://CLUBTRAXTELOKSUPER.ru/9/video/porno-rolik9.avi.exe
hxxp://CLUBTRAXTELOKSUPER.ru/10/video/porno-rolik10.avi.exe
hxxp://DADNMOMSPORNO.ru/
hxxp://DADNMOMSPORNO.ru/xxxvideo.avi.exe
hxxp://GIGABAYTSTUDENTPORNO.ru/
hxxp://GIGABAYTSTUDENTPORNO.ru/video/porno-rolik.avi.exe
hxxp://GIGABAYTSTUDENTPORNO.ru/1/video/porno-rolik1.avi.exe
hxxp://GIGABAYTSTUDENTPORNO.ru/2/video/porno-rolik2.avi.exe
hxxp://GIGABAYTSTUDENTPORNO.ru/3/video/porno-rolik3.avi.exe
hxxp://GIGABAYTSTUDENTPORNO.ru/4/video/porno-rolik4.avi.exe
hxxp://GIGABAYTSTUDENTPORNO.ru/5/video/porno-rolik5.avi.exe
hxxp://GIGABAYTSTUDENTPORNO.ru/6/video/porno-rolik6.avi.exe
hxxp://GIGABAYTSTUDENTPORNO.ru/7/video/porno-rolik7.avi.exe
hxxp://GIGABAYTSTUDENTPORNO.ru/8/video/porno-rolik8.avi.exe
hxxp://GIGABAYTSTUDENTPORNO.ru/9/video/porno-rolik9.avi.exe
hxxp://GIGABAYTSTUDENTPORNO.ru/10/video/porno-rolik10.avi.exe
hxxp://MALOLETKIINSCHOOLPORNO.ru/
hxxp://MALOLETKIINSCHOOLPORNO.ru/video/porno-rolik.avi.exe
hxxp://MALOLETKIINSCHOOLPORNO.ru/1/video/porno-rolik1.avi.exe
hxxp://MALOLETKIINSCHOOLPORNO.ru/2/video/porno-rolik2.avi.exe
hxxp://MALOLETKIINSCHOOLPORNO.ru/3/video/porno-rolik3.avi.exe
hxxp://MALOLETKIINSCHOOLPORNO.ru/4/video/porno-rolik4.avi.exe
hxxp://MALOLETKIINSCHOOLPORNO.ru/5/video/porno-rolik5.avi.exe
hxxp://MALOLETKIINSCHOOLPORNO.ru/6/video/porno-rolik6.avi.exe
hxxp://MALOLETKIINSCHOOLPORNO.ru/7/video/porno-rolik7.avi.exe
hxxp://MALOLETKIINSCHOOLPORNO.ru/8/video/porno-rolik8.avi.exe
hxxp://MALOLETKIINSCHOOLPORNO.ru/9/video/porno-rolik9.avi.exe
hxxp://MALOLETKIINSCHOOLPORNO.ru/10/video/porno-rolik10.avi.exe
hxxp://MEGAARCHIVETRAX.ru/
hxxp://MEGAARCHIVETRAX.ru/video/porno-rolik.avi.exe
hxxp://MEGAARCHIVETRAX.ru/1/video/porno-rolik1.avi.exe
hxxp://MEGAARCHIVETRAX.ru/2/video/porno-rolik2.avi.exe
hxxp://MEGAARCHIVETRAX.ru/3/video/porno-rolik3.avi.exe
hxxp://MEGAARCHIVETRAX.ru/4/video/porno-rolik4.avi.exe
hxxp://MEGAARCHIVETRAX.ru/5/video/porno-rolik5.avi.exe
hxxp://MEGAARCHIVETRAX.ru/6/video/porno-rolik6.avi.exe
hxxp://MEGAARCHIVETRAX.ru/7/video/porno-rolik7.avi.exe
hxxp://MEGAARCHIVETRAX.ru/8/video/porno-rolik8.avi.exe
hxxp://MEGAARCHIVETRAX.ru/9/video/porno-rolik9.avi.exe
hxxp://MEGAARCHIVETRAX.ru/10/video/porno-rolik10.avi.exe
hxxp://MEGAARCHIVSCHOOLPORNO.ru/
hxxp://MEGAARCHIVSCHOOLPORNO.ru/video/porno-rolik.avi.exe
hxxp://MEGAARCHIVSCHOOLPORNO.ru/1/video/porno-rolik1.avi.exe
hxxp://MEGAARCHIVSCHOOLPORNO.ru/2/video/porno-rolik2.avi.exe
hxxp://MEGAARCHIVSCHOOLPORNO.ru/3/video/porno-rolik3.avi.exe
hxxp://MEGAARCHIVSCHOOLPORNO.ru/4/video/porno-rolik4.avi.exe
hxxp://MEGAARCHIVSCHOOLPORNO.ru/5/video/porno-rolik5.avi.exe
hxxp://MEGAARCHIVSCHOOLPORNO.ru/6/video/porno-rolik6.avi.exe
hxxp://MEGAARCHIVSCHOOLPORNO.ru/7/video/porno-rolik7.avi.exe
hxxp://MEGAARCHIVSCHOOLPORNO.ru/8/video/porno-rolik8.avi.exe
hxxp://MEGAARCHIVSCHOOLPORNO.ru/9/video/porno-rolik9.avi.exe
hxxp://MEGAARCHIVSCHOOLPORNO.ru/10/video/porno-rolik10.avi.exe
hxxp://MEGASYPERXXX.ru/
hxxp://MEGASYPERXXX.ru/xxxvideo.avi.exe
hxxp://OOOPSMYPUSY.ru/
hxxp://OOOPSMYPUSY.ru/xxxvideo.avi.exe
hxxp://PORNOAGENTX.ru/
hxxp://PORNOAGENTX.ru/xxxvideo.avi.exe
hxxp://PORNOBESPLATNOXX.ru/
hxxp://PORNOBESPLATNOXX.ru/video/porno-rolik.avi.exe
hxxp://PORNOBESPLATNOXX.ru/1/video/porno-rolik1.avi.exe
hxxp://PORNOBESPLATNOXX.ru/2/video/porno-rolik2.avi.exe
hxxp://PORNOBESPLATNOXX.ru/3/video/porno-rolik3.avi.exe
hxxp://PORNOBESPLATNOXX.ru/4/video/porno-rolik4.avi.exe
hxxp://PORNOBESPLATNOXX.ru/5/video/porno-rolik5.avi.exe
hxxp://PORNOBESPLATNOXX.ru/6/video/porno-rolik6.avi.exe
hxxp://PORNOBESPLATNOXX.ru/7/video/porno-rolik7.avi.exe
hxxp://PORNOBESPLATNOXX.ru/8/video/porno-rolik8.avi.exe
hxxp://PORNOBESPLATNOXX.ru/9/video/porno-rolik9.avi.exe
hxxp://PORNOBESPLATNOXX.ru/10/video/porno-rolik10.avi.exe
hxxp://PORNOCLUBSMOTRIONLINE.ru/
hxxp://PORNOCLUBSMOTRIONLINE.ru/video/porno-rolik.avi.exe
hxxp://PORNOCLUBSMOTRIONLINE.ru/1/video/porno-rolik1.avi.exe
hxxp://PORNOCLUBSMOTRIONLINE.ru/2/video/porno-rolik2.avi.exe
hxxp://PORNOCLUBSMOTRIONLINE.ru/3/video/porno-rolik3.avi.exe
hxxp://PORNOCLUBSMOTRIONLINE.ru/4/video/porno-rolik4.avi.exe
hxxp://PORNOCLUBSMOTRIONLINE.ru/5/video/porno-rolik5.avi.exe
hxxp://PORNOCLUBSMOTRIONLINE.ru/6/video/porno-rolik6.avi.exe
hxxp://PORNOCLUBSMOTRIONLINE.ru/7/video/porno-rolik7.avi.exe
hxxp://PORNOCLUBSMOTRIONLINE.ru/8/video/porno-rolik8.avi.exe
hxxp://PORNOCLUBSMOTRIONLINE.ru/9/video/porno-rolik9.avi.exe
hxxp://PORNOCLUBSMOTRIONLINE.ru/10/video/porno-rolik10.avi.exe
hxxp://PORNOSEKSAS.ru/
hxxp://PORNOSEKSAS.ru/xxxvideo.avi.exe
hxxp://PORNOSITEFORFREE.ru/
hxxp://PORNOSITEFORFREE.ru/video/porno-rolik.avi.exe
hxxp://PORNOSITEFORFREE.ru/1/video/porno-rolik1.avi.exe
hxxp://PORNOSITEFORFREE.ru/2/video/porno-rolik2.avi.exe
hxxp://PORNOSITEFORFREE.ru/3/video/porno-rolik3.avi.exe
hxxp://PORNOSITEFORFREE.ru/4/video/porno-rolik4.avi.exe
hxxp://PORNOSITEFORFREE.ru/5/video/porno-rolik5.avi.exe
hxxp://PORNOSITEFORFREE.ru/6/video/porno-rolik6.avi.exe
hxxp://PORNOSITEFORFREE.ru/7/video/porno-rolik7.avi.exe
hxxp://PORNOSITEFORFREE.ru/8/video/porno-rolik8.avi.exe
hxxp://PORNOSITEFORFREE.ru/9/video/porno-rolik9.avi.exe
hxxp://PORNOSITEFORFREE.ru/10/video/porno-rolik10.avi.exe
hxxp://PORNYXAAVI.ru/
hxxp://PORNYXAAVI.ru/xxxvideo.avi.exe
hxxp://PORVALIZELKUMALOLETKI.ru/
hxxp://PORVALIZELKUMALOLETKI.ru/video/porno-rolik.avi.exe
hxxp://PORVALIZELKUMALOLETKI.ru/1/video/porno-rolik1.avi.exe
hxxp://PORVALIZELKUMALOLETKI.ru/2/video/porno-rolik2.avi.exe
hxxp://PORVALIZELKUMALOLETKI.ru/3/video/porno-rolik3.avi.exe
hxxp://PORVALIZELKUMALOLETKI.ru/4/video/porno-rolik4.avi.exe
hxxp://PORVALIZELKUMALOLETKI.ru/5/video/porno-rolik5.avi.exe
hxxp://PORVALIZELKUMALOLETKI.ru/6/video/porno-rolik6.avi.exe
hxxp://PORVALIZELKUMALOLETKI.ru/7/video/porno-rolik7.avi.exe
hxxp://PORVALIZELKUMALOLETKI.ru/8/video/porno-rolik8.avi.exe
hxxp://PORVALIZELKUMALOLETKI.ru/9/video/porno-rolik9.avi.exe
hxxp://PORVALIZELKUMALOLETKI.ru/10/video/porno-rolik10.avi.exe
hxxp://REDPUSSYX.ru/
hxxp://REDPUSSYX.ru/xxxvideo.avi.exe
hxxp://SEXPOREVOTERRAARCHIV.ru/
hxxp://SEXPOREVOTERRAARCHIV.ru/video/porno-rolik.avi.exe
hxxp://SEXPOREVOTERRAARCHIV.ru/1/video/porno-rolik1.avi.exe
hxxp://SEXPOREVOTERRAARCHIV.ru/2/video/porno-rolik2.avi.exe
hxxp://SEXPOREVOTERRAARCHIV.ru/3/video/porno-rolik3.avi.exe
hxxp://SEXPOREVOTERRAARCHIV.ru/4/video/porno-rolik4.avi.exe
hxxp://SEXPOREVOTERRAARCHIV.ru/5/video/porno-rolik5.avi.exe
hxxp://SEXPOREVOTERRAARCHIV.ru/6/video/porno-rolik6.avi.exe
hxxp://SEXPOREVOTERRAARCHIV.ru/7/video/porno-rolik7.avi.exe
hxxp://SEXPOREVOTERRAARCHIV.ru/8/video/porno-rolik8.avi.exe
hxxp://SEXPOREVOTERRAARCHIV.ru/9/video/porno-rolik9.avi.exe
hxxp://SEXPOREVOTERRAARCHIV.ru/10/video/porno-rolik10.avi.exe
hxxp://STUDENTDOMATRAX.ru/
hxxp://STUDENTDOMATRAX.ru/video/porno-rolik.avi.exe
hxxp://STUDENTDOMATRAX.ru/1/video/porno-rolik1.avi.exe
hxxp://STUDENTDOMATRAX.ru/2/video/porno-rolik2.avi.exe
hxxp://STUDENTDOMATRAX.ru/3/video/porno-rolik3.avi.exe
hxxp://STUDENTDOMATRAX.ru/4/video/porno-rolik4.avi.exe
hxxp://STUDENTDOMATRAX.ru/5/video/porno-rolik5.avi.exe
hxxp://STUDENTDOMATRAX.ru/6/video/porno-rolik6.avi.exe
hxxp://STUDENTDOMATRAX.ru/7/video/porno-rolik7.avi.exe
hxxp://STUDENTDOMATRAX.ru/8/video/porno-rolik8.avi.exe
hxxp://STUDENTDOMATRAX.ru/9/video/porno-rolik9.avi.exe
hxxp://STUDENTDOMATRAX.ru/10/video/porno-rolik10.avi.exe
hxxp://SUPERMEGAARCHIVAVIPORNOSEXXXX.ru/
hxxp://SUPERMEGAARCHIVAVIPORNOSEXXXX.ru/video/porno-rolik.avi.exe
hxxp://SUPERMEGAARCHIVAVIPORNOSEXXXX.ru/1/video/porno-rolik1.avi.exe
hxxp://SUPERMEGAARCHIVAVIPORNOSEXXXX.ru/2/video/porno-rolik2.avi.exe
hxxp://SUPERMEGAARCHIVAVIPORNOSEXXXX.ru/3/video/porno-rolik3.avi.exe
hxxp://SUPERMEGAARCHIVAVIPORNOSEXXXX.ru/4/video/porno-rolik4.avi.exe
hxxp://SUPERMEGAARCHIVAVIPORNOSEXXXX.ru/5/video/porno-rolik5.avi.exe
hxxp://SUPERMEGAARCHIVAVIPORNOSEXXXX.ru/6/video/porno-rolik6.avi.exe
hxxp://SUPERMEGAARCHIVAVIPORNOSEXXXX.ru/7/video/porno-rolik7.avi.exe
hxxp://SUPERMEGAARCHIVAVIPORNOSEXXXX.ru/8/video/porno-rolik8.avi.exe
hxxp://SUPERMEGAARCHIVAVIPORNOSEXXXX.ru/9/video/porno-rolik9.avi.exe
hxxp://SUPERMEGAARCHIVAVIPORNOSEXXXX.ru/10/video/porno-rolik10.avi.exe
hxxp://VIDEOPORNOCAM.ru/
hxxp://VIDEOPORNOCAM.ru/xxxvideo.avi.exe
hxxp://YOUNGPORNOSEKS.ru/
hxxp://YOUNGPORNOSEKS.ru/xxxvideo.avi.exe
hxxp://mnogomolodihtelokokporno.ru/
hxxp://mnogomolodihtelokokporno.ru/1/video/porno-rolik1.avi.exe
hxxp://mnogomolodihtelokokporno.ru/2/video/porno-rolik2.avi.exe
hxxp://mnogomolodihtelokokporno.ru/3/video/porno-rolik3.avi.exe
hxxp://mnogomolodihtelokokporno.ru/4/video/porno-rolik4.avi.exe
hxxp://mnogomolodihtelokokporno.ru/6/video/porno-rolik6.avi.exe
hxxp://mnogomolodihtelokokporno.ru/7/video/porno-rolik7.avi.exe
hxxp://mnogomolodihtelokokporno.ru/8/video/porno-rolik8.avi.exe
hxxp://mnogomolodihtelokokporno.ru/9/video/porno-rolik9.avi.exe
hxxp://mnogomolodihtelokokporno.ru/10/video/porno-rolik10.avi.exe

July 20, 2011, 10:30:06 am
Reply #33

EP_X0FF

  • Special Members
  • Hero Member

  • Offline
  • *

  • 254
    • KernelMode.info
Amazon

Quote
hxxp://llkzporn.s3.amazonaws.com/xxx_video.exe

MBRLocker (new build)

Quote
hxxp://pornoagentx.ru/xxxvideo.avi.exe

Regarding to EXETEL.DE who hosts all pornorolik malware. As far as I know it ignored all abuses we sent in a last two weeks. If anyone knows a way how to make it answer please tell.

July 20, 2011, 12:49:13 pm
Reply #34

mc0blck

  • Jr. Member

  • Offline
  • **

  • 14
Blocker: hxxp://sdomankor.info/gierqwwn.cgi?11 (88.208.33.155) -> hxxp://pornositexxx.ru/1/ (46.251.237.240) -> hxxp://pornositexxx.ru/1/video/porno-rolik1.avi.exe (46.251.237.240)
Blocker: hxxp://pornositexxx.ru/2/ (46.251.237.240) -> hxxp://pornositexxx.ru/2/video/porno-rolik2.avi.exe (46.251.237.240)
Blocker: hxxp://pornositexxx.ru/3/ (46.251.237.240) -> hxxp://pornositexxx.ru/3/video/porno-rolik3.avi.exe (46.251.237.240)
Blocker: hxxp://pornositexxx.ru/4/ (46.251.237.240) -> hxxp://pornositexxx.ru/4/video/porno-rolik4.avi.exe (46.251.237.240)
Blocker: hxxp://pornositexxx.ru/6/ (46.251.237.240) -> hxxp://pornositexxx.ru/6/video/porno-rolik6.avi.exe (46.251.237.240)

July 20, 2011, 04:35:51 pm
Reply #35

EP_X0FF

  • Special Members
  • Hero Member

  • Offline
  • *

  • 254
    • KernelMode.info
New redirector for Amazon ransom

hxxp://ebiporka.com/in.cgi?2

full path

Quote
hxxp://freepornx.s3.amazonaws.com/index.html -> hxxp://freepornx.s3.amazonaws.com/video.htm -> hxxp://ebiporka.com/in.cgi?2 -> hxxp://4tporl.s3.amazonaws.com/index.htm -> hxxp://4tporl.s3.amazonaws.com/xxx_video.exe

July 20, 2011, 04:56:49 pm
Reply #36

MysteryFCM

  • Administrator
  • Hero Member

  • Offline
  • *****

  • 1693
  • Personal Text
    Phishing Phanatic
    • I.T. Mate
Regarding to EXETEL.DE who hosts all pornorolik malware. As far as I know it ignored all abuses we sent in a last two weeks. If anyone knows a way how to make it answer please tell.

Working on it ;)
Regards

Steven Burn
I.T. Mate / hpHosts
it-mate.co.uk / hosts-file.net


July 20, 2011, 06:41:23 pm
Reply #38

cleanmx

  • Special Members
  • Hero Member

  • Offline
  • *

  • 3405
    • Spam-Filter Anti-Spam Virenschutz - CLEAN MX Managed Anti-Spam Service ist die Lösung für Ihr Spam-Problem
Regarding to EXETEL.DE who hosts all pornorolik malware. As far as I know it ignored all abuses we sent in a last two weeks. If anyone knows a way how to make it answer please tell.

Working on it ;)

I contacted their upstream provider, ripe -tel-nr of them is not allocated ....
update: I reached optimate-server.de on their cell phone, they promised to shut down this server
-- gerhard

Code: [Select]
|2011-07-18 14:53:00 CEST |913511 |TR/Crypt.ZPACK.Gen |46.251.237.240 |besplatnomegaporno.ru |http://besplatnomegaporno.ru/video/porno-rolik.avi.exe
|2011-07-18 14:53:00 CEST |913512 |TR/Crypt.ZPACK.Gen |46.251.237.240 |besplatnomegaporno.ru |http://besplatnomegaporno.ru/1/video/porno-rolik1.avi.exe
|2011-07-18 14:53:00 CEST |913513 |TR/Crypt.ZPACK.Gen |46.251.237.240 |besplatnomegaporno.ru |http://besplatnomegaporno.ru/2/video/porno-rolik2.avi.exe
|2011-07-18 14:53:00 CEST |913514 |TR/Crypt.ZPACK.Gen |46.251.237.240 |besplatnomegaporno.ru |http://besplatnomegaporno.ru/3/video/porno-rolik3.avi.exe
|2011-07-18 14:53:00 CEST |913515 |TR/Ransom.DN.18 |46.251.237.240 |besplatnomegaporno.ru |http://besplatnomegaporno.ru/4/video/porno-rolik4.avi.exe
|2011-07-18 14:53:00 CEST |913516 |TR/Crypt.ZPACK.Gen |46.251.237.240 |besplatnomegaporno.ru |http://besplatnomegaporno.ru/6/video/porno-rolik6.avi.exe
|2011-07-18 14:53:00 CEST |913517 |TR/Crypt.ZPACK.Gen |46.251.237.240 |besplatnomegaporno.ru |http://besplatnomegaporno.ru/7/video/porno-rolik7.avi.exe
|2011-07-18 14:53:00 CEST |913518 |TR/Crypt.ZPACK.Gen |46.251.237.240 |besplatnomegaporno.ru |http://besplatnomegaporno.ru/8/video/porno-rolik8.avi.exe
|2011-07-18 14:53:00 CEST |913519 |TR/Ransom.DN.14 |46.251.237.240 |besplatnomegaporno.ru |http://besplatnomegaporno.ru/9/video/porno-rolik9.avi.exe
|2011-07-18 14:53:00 CEST |913520 |TR/Crypt.ZPACK.Gen |46.251.237.240 |besplatnomegaporno.ru |http://besplatnomegaporno.ru/10/video/porno-rolik10.avi.exe
|2011-07-18 23:08:10 CEST |916246 |TR/Crypt.ZPACK.Gen |46.251.237.240 |megaarchivschoolporno.ru |http://megaarchivschoolporno.ru/video/porno-rolik.avi.exe
|2011-07-19 01:00:26 CEST |916526 |TR/Ransom.DN.14 |46.251.237.240 |gigabaytstudentporno.ru |http://gigabaytstudentporno.ru/9/video/porno-rolik9.avi.exe
|2011-07-19 01:00:26 CEST |916529 |TR/Crypt.ZPACK.Gen |46.251.237.240 |gigabaytstudentporno.ru |http://gigabaytstudentporno.ru/2/video/porno-rolik2.avi.exe
|2011-07-19 01:00:26 CEST |916530 |TR/Crypt.ZPACK.Gen |46.251.237.240 |gigabaytstudentporno.ru |http://gigabaytstudentporno.ru/1/video/porno-rolik1.avi.exe
|2011-07-19 03:08:13 CEST |916577 |TR/Crypt.ZPACK.Gen |46.251.237.240 |supermegaarchivavipornosexxxx.ru |http://supermegaarchivavipornosexxxx.ru/2/video/porno-rolik2.avi.exe
|2011-07-19 03:08:14 CEST |916578 |TR/Crypt.ZPACK.Gen |46.251.237.240 |sexporevoterraarchiv.ru |http://sexporevoterraarchiv.ru/1/video/porno-rolik1.avi.exe
|2011-07-19 07:00:22 CEST |916653 |TR/Crypt.ZPACK.Gen |46.251.237.240 |pornositeforfree.ru |http://pornositeforfree.ru/3/video/porno-rolik3.avi.exe
|2011-07-19 09:00:23 CEST |916706 |TR/Crypt.ZPACK.Gen |46.251.237.240 |clubtraxteloksuper.ru |http://clubtraxteloksuper.ru/3/video/porno-rolik3.avi.exe
|2011-07-19 09:00:23 CEST |916707 |TR/Crypt.ZPACK.Gen |46.251.237.240 |supermegaarchivavipornosexxxx.ru |http://supermegaarchivavipornosexxxx.ru/video/porno-rolik.avi.exe
|2011-07-19 09:00:24 CEST |916708 |TR/Crypt.ZPACK.Gen |46.251.237.240 |supermegaarchivavipornosexxxx.ru |http://supermegaarchivavipornosexxxx.ru/1/video/porno-rolik1.avi.exe
|2011-07-19 09:00:24 CEST |916709 |TR/Ransom.DN.14 |46.251.237.240 |supermegaarchivavipornosexxxx.ru |http://supermegaarchivavipornosexxxx.ru/9/video/porno-rolik9.avi.exe
|2011-07-19 09:00:24 CEST |916710 |TR/Crypt.ZPACK.Gen |46.251.237.240 |supermegaarchivavipornosexxxx.ru |http://supermegaarchivavipornosexxxx.ru/10/video/porno-rolik10.avi.exe
|2011-07-19 09:00:24 CEST |916714 |TR/Crypt.ZPACK.Gen |46.251.237.240 |supermegaarchivavipornosexxxx.ru |http://supermegaarchivavipornosexxxx.ru/8/video/porno-rolik8.avi.exe
|2011-07-19 09:00:24 CEST |916715 |TR/Crypt.ZPACK.Gen |46.251.237.240 |supermegaarchivavipornosexxxx.ru |http://supermegaarchivavipornosexxxx.ru/7/video/porno-rolik7.avi.exe
|2011-07-19 10:00:32 CEST |916779 |TR/Crypt.ZPACK.Gen |46.251.237.240 |clubtraxteloksuper.ru |http://clubtraxteloksuper.ru/video/porno-rolik.avi.exe
|2011-07-19 10:00:32 CEST |916780 |TR/Crypt.ZPACK.Gen |46.251.237.240 |clubtraxteloksuper.ru |http://clubtraxteloksuper.ru/1/video/porno-rolik1.avi.exe
|2011-07-19 10:00:32 CEST |916781 |TR/Ransom.DN.14 |46.251.237.240 |clubtraxteloksuper.ru |http://clubtraxteloksuper.ru/9/video/porno-rolik9.avi.exe
|2011-07-19 10:00:32 CEST |916782 |TR/Crypt.ZPACK.Gen |46.251.237.240 |clubtraxteloksuper.ru |http://clubtraxteloksuper.ru/8/video/porno-rolik8.avi.exe
|2011-07-19 10:00:32 CEST |916783 |TR/Crypt.ZPACK.Gen |46.251.237.240 |clubtraxteloksuper.ru |http://clubtraxteloksuper.ru/10/video/porno-rolik10.avi.exe
|2011-07-19 10:00:32 CEST |916784 |TR/Ransom.DN.18 |46.251.237.240 |clubtraxteloksuper.ru |http://clubtraxteloksuper.ru/4/video/porno-rolik4.avi.exe
|2011-07-19 10:00:32 CEST |916785 |TR/Crypt.ZPACK.Gen |46.251.237.240 |clubtraxteloksuper.ru |http://clubtraxteloksuper.ru/6/video/porno-rolik6.avi.exe
|2011-07-19 10:00:32 CEST |916786 |TR/Crypt.ZPACK.Gen |46.251.237.240 |clubtraxteloksuper.ru |http://clubtraxteloksuper.ru/2/video/porno-rolik2.avi.exe
|2011-07-19 14:00:25 CEST |916947 |TR/Crypt.ZPACK.Gen |46.251.237.240 |maloletkiinschoolporno.ru |http://maloletkiinschoolporno.ru/3/video/porno-rolik3.avi.exe
|2011-07-19 13:11:00 CEST |917039 |TR/Crypt.ZPACK.Gen |46.251.237.240 |megaavivideoporevo.ru |http://megaavivideoporevo.ru/1/video/porno-rolik1.avi.exe
|2011-07-19 13:11:00 CEST |917040 |TR/Crypt.ZPACK.Gen |46.251.237.240 |megaavivideoporevo.ru |http://megaavivideoporevo.ru/2/video/porno-rolik2.avi.exe
|2011-07-19 13:11:00 CEST |917041 |TR/Crypt.ZPACK.Gen |46.251.237.240 |megaavivideoporevo.ru |http://megaavivideoporevo.ru/6/video/porno-rolik6.avi.exe
|2011-07-19 13:11:00 CEST |917042 |TR/Crypt.ZPACK.Gen |46.251.237.240 |megaavivideoporevo.ru |http://megaavivideoporevo.ru/7/video/porno-rolik7.avi.exe
|2011-07-19 13:11:00 CEST |917043 |TR/Crypt.ZPACK.Gen |46.251.237.240 |megaavivideoporevo.ru |http://megaavivideoporevo.ru/10/video/porno-rolik10.avi.exe
|2011-07-19 22:15:24 CEST |917435 |TR/Crypt.ZPACK.Gen |46.251.237.240 |megaavivideoporevo.ru |http://megaavivideoporevo.ru/video/porno-rolik.avi.exe
|2011-07-19 22:15:24 CEST |917436 |TR/Ransom.DN.14 |46.251.237.240 |megaavivideoporevo.ru |http://megaavivideoporevo.ru/9/video/porno-rolik9.avi.exe
|2011-07-19 22:15:24 CEST |917437 |TR/Crypt.ZPACK.Gen |46.251.237.240 |megaavivideoporevo.ru |http://megaavivideoporevo.ru/8/video/porno-rolik8.avi.exe
|2011-07-19 22:15:24 CEST |917438 |TR/Ransom.DN.18 |46.251.237.240 |megaavivideoporevo.ru |http://megaavivideoporevo.ru/4/video/porno-rolik4.avi.exe
|2011-07-20 00:15:22 CEST |917559 |TR/Crypt.ZPACK.Gen |46.251.237.240 |pornoclubsmotrionline.ru |http://pornoclubsmotrionline.ru/10/video/porno-rolik10.avi.exe
|2011-07-20 00:15:23 CEST |917562 |TR/Ransom.DN.14 |46.251.237.240 |pornoclubsmotrionline.ru |http://pornoclubsmotrionline.ru/9/video/porno-rolik9.avi.exe
|2011-07-20 00:15:23 CEST |917564 |TR/Crypt.ZPACK.Gen |46.251.237.240 |pornoclubsmotrionline.ru |http://pornoclubsmotrionline.ru/video/porno-rolik.avi.exe
|2011-07-20 00:15:23 CEST |917565 |TR/Ransom.DN.18 |46.251.237.240 |pornoclubsmotrionline.ru |http://pornoclubsmotrionline.ru/4/video/porno-rolik4.avi.exe
|2011-07-20 00:15:23 CEST |917566 |TR/Crypt.ZPACK.Gen |46.251.237.240 |pornoclubsmotrionline.ru |http://pornoclubsmotrionline.ru/8/video/porno-rolik8.avi.exe
|2011-07-20 00:15:23 CEST |917567 |TR/Crypt.ZPACK.Gen |46.251.237.240 |pornoclubsmotrionline.ru |http://pornoclubsmotrionline.ru/7/video/porno-rolik7.avi.exe
|2011-07-20 00:15:23 CEST |917568 |TR/Crypt.ZPACK.Gen |46.251.237.240 |pornoclubsmotrionline.ru |http://pornoclubsmotrionline.ru/6/video/porno-rolik6.avi.exe
|2011-07-20 00:15:23 CEST |917569 |TR/Crypt.ZPACK.Gen |46.251.237.240 |pornoclubsmotrionline.ru |http://pornoclubsmotrionline.ru/3/video/porno-rolik3.avi.exe
|2011-07-20 00:15:23 CEST |917571 |TR/Crypt.ZPACK.Gen |46.251.237.240 |pornoclubsmotrionline.ru |http://pornoclubsmotrionline.ru/1/video/porno-rolik1.avi.exe
|2011-07-20 01:00:35 CEST |917581 |TR/Crypt.ZPACK.Gen |46.251.237.240 |sexfornightfreeporno.ru |http://sexfornightfreeporno.ru/8/video/porno-rolik8.avi.exe
|2011-07-20 01:00:36 CEST |917582 |TR/Crypt.ZPACK.Gen |46.251.237.240 |sexfornightfreeporno.ru |http://sexfornightfreeporno.ru/3/video/porno-rolik3.avi.exe
|2011-07-20 01:00:36 CEST |917583 |TR/Crypt.ZPACK.Gen |46.251.237.240 |sexfornightfreeporno.ru |http://sexfornightfreeporno.ru/7/video/porno-rolik7.avi.exe
|2011-07-20 01:00:36 CEST |917584 |TR/Ransom.DN.18 |46.251.237.240 |sexfornightfreeporno.ru |http://sexfornightfreeporno.ru/4/video/porno-rolik4.avi.exe
|2011-07-20 01:00:36 CEST |917585 |TR/Crypt.ZPACK.Gen |46.251.237.240 |sexfornightfreeporno.ru |http://sexfornightfreeporno.ru/6/video/porno-rolik6.avi.exe
|2011-07-20 02:00:40 CEST |917605 |TR/Crypt.ZPACK.Gen |46.251.237.240 |sexfornightfreeporno.ru |http://sexfornightfreeporno.ru/video/porno-rolik.avi.exe
|2011-07-20 02:00:40 CEST |917606 |TR/Crypt.ZPACK.Gen |46.251.237.240 |sexfornightfreeporno.ru |http://sexfornightfreeporno.ru/10/video/porno-rolik10.avi.exe
|2011-07-20 02:00:40 CEST |917607 |TR/Ransom.DN.14 |46.251.237.240 |sexfornightfreeporno.ru |http://sexfornightfreeporno.ru/9/video/porno-rolik9.avi.exe
|2011-07-20 09:00:49 CEST |917714 |TR/Crypt.ZPACK.Gen |46.251.237.240 |traxnochyustudent.ru |http://traxnochyustudent.ru/6/video/porno-rolik6.avi.exe
|2011-07-20 09:00:49 CEST |917715 |TR/Crypt.ZPACK.Gen |46.251.237.240 |traxnochyustudent.ru |http://traxnochyustudent.ru/3/video/porno-rolik3.avi.exe
|2011-07-20 09:00:49 CEST |917716 |TR/Crypt.ZPACK.Gen |46.251.237.240 |traxnochyustudent.ru |http://traxnochyustudent.ru/2/video/porno-rolik2.avi.exe
|2011-07-20 09:00:49 CEST |917717 |TR/Crypt.ZPACK.Gen |46.251.237.240 |traxnochyustudent.ru |http://traxnochyustudent.ru/1/video/porno-rolik1.avi.exe
|2011-07-20 10:00:07 CEST |917726 |TR/Ransom.DN.18 |46.251.237.240 |traxnochyustudent.ru |http://traxnochyustudent.ru/4/video/porno-rolik4.avi.exe
|2011-07-20 08:39:00 CEST |917819 |TR/Crypt.ZPACK.Gen |46.251.237.240 |clubtraxteloksuper.ru |http://clubtraxteloksuper.ru/7/video/porno-rolik7.avi.exe
|2011-07-20 08:39:00 CEST |917820 |TR/Crypt.ZPACK.Gen |46.251.237.240 |gigabaytstudentporno.ru |http://gigabaytstudentporno.ru/video/porno-rolik.avi.exe
|2011-07-20 08:39:00 CEST |917821 |TR/Crypt.ZPACK.Gen |46.251.237.240 |gigabaytstudentporno.ru |http://gigabaytstudentporno.ru/3/video/porno-rolik3.avi.exe
|2011-07-20 08:39:00 CEST |917822 |TR/Ransom.DN.18 |46.251.237.240 |gigabaytstudentporno.ru |http://gigabaytstudentporno.ru/4/video/porno-rolik4.avi.exe
|2011-07-20 08:39:00 CEST |917824 |TR/Crypt.ZPACK.Gen |46.251.237.240 |gigabaytstudentporno.ru |http://gigabaytstudentporno.ru/6/video/porno-rolik6.avi.exe
|2011-07-20 08:39:00 CEST |917825 |TR/Crypt.ZPACK.Gen |46.251.237.240 |gigabaytstudentporno.ru |http://gigabaytstudentporno.ru/7/video/porno-rolik7.avi.exe
|2011-07-20 08:39:00 CEST |917826 |TR/Crypt.ZPACK.Gen |46.251.237.240 |gigabaytstudentporno.ru |http://gigabaytstudentporno.ru/8/video/porno-rolik8.avi.exe
|2011-07-20 08:39:00 CEST |917827 |TR/Crypt.ZPACK.Gen |46.251.237.240 |gigabaytstudentporno.ru |http://gigabaytstudentporno.ru/10/video/porno-rolik10.avi.exe
|2011-07-20 08:39:00 CEST |917828 |TR/Crypt.ZPACK.Gen |46.251.237.240 |maloletkiinschoolporno.ru |http://maloletkiinschoolporno.ru/video/porno-rolik.avi.exe
|2011-07-20 08:39:00 CEST |917829 |TR/Crypt.ZPACK.Gen |46.251.237.240 |maloletkiinschoolporno.ru |http://maloletkiinschoolporno.ru/1/video/porno-rolik1.avi.exe
|2011-07-20 08:39:00 CEST |917830 |TR/Crypt.ZPACK.Gen |46.251.237.240 |maloletkiinschoolporno.ru |http://maloletkiinschoolporno.ru/2/video/porno-rolik2.avi.exe
|2011-07-20 08:39:00 CEST |917831 |TR/Ransom.DN.18 |46.251.237.240 |maloletkiinschoolporno.ru |http://maloletkiinschoolporno.ru/4/video/porno-rolik4.avi.exe
|2011-07-20 08:39:00 CEST |917833 |TR/Crypt.ZPACK.Gen |46.251.237.240 |maloletkiinschoolporno.ru |http://maloletkiinschoolporno.ru/6/video/porno-rolik6.avi.exe
|2011-07-20 08:39:00 CEST |917834 |TR/Crypt.ZPACK.Gen |46.251.237.240 |maloletkiinschoolporno.ru |http://maloletkiinschoolporno.ru/7/video/porno-rolik7.avi.exe
|2011-07-20 08:39:00 CEST |917835 |TR/Crypt.ZPACK.Gen |46.251.237.240 |maloletkiinschoolporno.ru |http://maloletkiinschoolporno.ru/8/video/porno-rolik8.avi.exe
|2011-07-20 08:39:00 CEST |917836 |TR/Ransom.DN.14 |46.251.237.240 |maloletkiinschoolporno.ru |http://maloletkiinschoolporno.ru/9/video/porno-rolik9.avi.exe
|2011-07-20 08:39:00 CEST |917837 |TR/Crypt.ZPACK.Gen |46.251.237.240 |maloletkiinschoolporno.ru |http://maloletkiinschoolporno.ru/10/video/porno-rolik10.avi.exe
|2011-07-20 08:39:00 CEST |917838 |TR/Crypt.ZPACK.Gen |46.251.237.240 |megaarchivetrax.ru |http://megaarchivetrax.ru/video/porno-rolik.avi.exe
|2011-07-20 08:39:00 CEST |917839 |TR/Crypt.ZPACK.Gen |46.251.237.240 |megaarchivetrax.ru |http://megaarchivetrax.ru/1/video/porno-rolik1.avi.exe
|2011-07-20 08:39:00 CEST |917840 |TR/Crypt.ZPACK.Gen |46.251.237.240 |megaarchivetrax.ru |http://megaarchivetrax.ru/2/video/porno-rolik2.avi.exe
|2011-07-20 08:39:00 CEST |917841 |TR/Crypt.ZPACK.Gen |46.251.237.240 |megaarchivetrax.ru |http://megaarchivetrax.ru/3/video/porno-rolik3.avi.exe
|2011-07-20 08:39:00 CEST |917842 |TR/Ransom.DN.18 |46.251.237.240 |megaarchivetrax.ru |http://megaarchivetrax.ru/4/video/porno-rolik4.avi.exe
|2011-07-20 08:39:00 CEST |917844 |TR/Crypt.ZPACK.Gen |46.251.237.240 |megaarchivetrax.ru |http://megaarchivetrax.ru/6/video/porno-rolik6.avi.exe
|2011-07-20 08:39:00 CEST |917845 |TR/Crypt.ZPACK.Gen |46.251.237.240 |megaarchivetrax.ru |http://megaarchivetrax.ru/7/video/porno-rolik7.avi.exe
|2011-07-20 08:39:00 CEST |917846 |TR/Crypt.ZPACK.Gen |46.251.237.240 |megaarchivetrax.ru |http://megaarchivetrax.ru/8/video/porno-rolik8.avi.exe
|2011-07-20 08:39:00 CEST |917847 |TR/Ransom.DN.14 |46.251.237.240 |megaarchivetrax.ru |http://megaarchivetrax.ru/9/video/porno-rolik9.avi.exe
|2011-07-20 08:39:00 CEST |917848 |TR/Crypt.ZPACK.Gen |46.251.237.240 |megaarchivetrax.ru |http://megaarchivetrax.ru/10/video/porno-rolik10.avi.exe
|2011-07-20 08:39:00 CEST |917849 |TR/Crypt.ZPACK.Gen |46.251.237.240 |megaarchivschoolporno.ru |http://megaarchivschoolporno.ru/1/video/porno-rolik1.avi.exe
|2011-07-20 08:39:00 CEST |917850 |TR/Crypt.ZPACK.Gen |46.251.237.240 |megaarchivschoolporno.ru |http://megaarchivschoolporno.ru/2/video/porno-rolik2.avi.exe
|2011-07-20 08:39:00 CEST |917851 |TR/Crypt.ZPACK.Gen |46.251.237.240 |megaarchivschoolporno.ru |http://megaarchivschoolporno.ru/3/video/porno-rolik3.avi.exe
|2011-07-20 08:39:00 CEST |917852 |TR/Ransom.DN.18 |46.251.237.240 |megaarchivschoolporno.ru |http://megaarchivschoolporno.ru/4/video/porno-rolik4.avi.exe
|2011-07-20 08:39:00 CEST |917854 |TR/Crypt.ZPACK.Gen |46.251.237.240 |megaarchivschoolporno.ru |http://megaarchivschoolporno.ru/6/video/porno-rolik6.avi.exe
|2011-07-20 08:39:00 CEST |917855 |TR/Crypt.ZPACK.Gen |46.251.237.240 |megaarchivschoolporno.ru |http://megaarchivschoolporno.ru/7/video/porno-rolik7.avi.exe
|2011-07-20 08:39:00 CEST |917856 |TR/Crypt.ZPACK.Gen |46.251.237.240 |megaarchivschoolporno.ru |http://megaarchivschoolporno.ru/8/video/porno-rolik8.avi.exe
|2011-07-20 08:39:00 CEST |917857 |TR/Ransom.DN.14 |46.251.237.240 |megaarchivschoolporno.ru |http://megaarchivschoolporno.ru/9/video/porno-rolik9.avi.exe
|2011-07-20 08:39:00 CEST |917858 |TR/Crypt.ZPACK.Gen |46.251.237.240 |megaarchivschoolporno.ru |http://megaarchivschoolporno.ru/10/video/porno-rolik10.avi.exe
|2011-07-20 08:39:00 CEST |917859 |TR/Crypt.ZPACK.Gen |46.251.237.240 |pornobesplatnoxx.ru |http://pornobesplatnoxx.ru/video/porno-rolik.avi.exe
|2011-07-20 08:39:00 CEST |917860 |TR/Crypt.ZPACK.Gen |46.251.237.240 |pornobesplatnoxx.ru |http://pornobesplatnoxx.ru/1/video/porno-rolik1.avi.exe
|2011-07-20 08:39:00 CEST |917861 |TR/Crypt.ZPACK.Gen |46.251.237.240 |pornobesplatnoxx.ru |http://pornobesplatnoxx.ru/2/video/porno-rolik2.avi.exe
|2011-07-20 08:39:00 CEST |917862 |TR/Crypt.ZPACK.Gen |46.251.237.240 |pornobesplatnoxx.ru |http://pornobesplatnoxx.ru/3/video/porno-rolik3.avi.exe
|2011-07-20 08:39:00 CEST |917863 |TR/Ransom.DN.18 |46.251.237.240 |pornobesplatnoxx.ru |http://pornobesplatnoxx.ru/4/video/porno-rolik4.avi.exe
|2011-07-20 08:39:00 CEST |917865 |TR/Crypt.ZPACK.Gen |46.251.237.240 |pornobesplatnoxx.ru |http://pornobesplatnoxx.ru/6/video/porno-rolik6.avi.exe
|2011-07-20 08:39:00 CEST |917866 |TR/Crypt.ZPACK.Gen |46.251.237.240 |pornobesplatnoxx.ru |http://pornobesplatnoxx.ru/7/video/porno-rolik7.avi.exe
|2011-07-20 08:39:00 CEST |917868 |TR/Ransom.DN.14 |46.251.237.240 |pornobesplatnoxx.ru |http://pornobesplatnoxx.ru/9/video/porno-rolik9.avi.exe
|2011-07-20 08:39:00 CEST |917869 |TR/Crypt.ZPACK.Gen |46.251.237.240 |pornobesplatnoxx.ru |http://pornobesplatnoxx.ru/10/video/porno-rolik10.avi.exe
|2011-07-20 08:39:00 CEST |917870 |TR/Crypt.ZPACK.Gen |46.251.237.240 |pornositeforfree.ru |http://pornositeforfree.ru/video/porno-rolik.avi.exe
|2011-07-20 08:39:00 CEST |917871 |TR/Crypt.ZPACK.Gen |46.251.237.240 |pornositeforfree.ru |http://pornositeforfree.ru/1/video/porno-rolik1.avi.exe
|2011-07-20 08:39:00 CEST |917872 |TR/Crypt.ZPACK.Gen |46.251.237.240 |pornositeforfree.ru |http://pornositeforfree.ru/2/video/porno-rolik2.avi.exe
|2011-07-20 08:39:00 CEST |917873 |TR/Ransom.DN.18 |46.251.237.240 |pornositeforfree.ru |http://pornositeforfree.ru/4/video/porno-rolik4.avi.exe
|2011-07-20 08:39:00 CEST |917875 |TR/Crypt.ZPACK.Gen |46.251.237.240 |pornositeforfree.ru |http://pornositeforfree.ru/6/video/porno-rolik6.avi.exe
|2011-07-20 08:39:00 CEST |917876 |TR/Crypt.ZPACK.Gen |46.251.237.240 |pornositeforfree.ru |http://pornositeforfree.ru/7/video/porno-rolik7.avi.exe
|2011-07-20 08:39:00 CEST |917877 |TR/Crypt.ZPACK.Gen |46.251.237.240 |pornositeforfree.ru |http://pornositeforfree.ru/8/video/porno-rolik8.avi.exe
|2011-07-20 08:39:00 CEST |917878 |TR/Ransom.DN.14 |46.251.237.240 |pornositeforfree.ru |http://pornositeforfree.ru/9/video/porno-rolik9.avi.exe
|2011-07-20 08:39:00 CEST |917879 |TR/Crypt.ZPACK.Gen |46.251.237.240 |pornositeforfree.ru |http://pornositeforfree.ru/10/video/porno-rolik10.avi.exe
|2011-07-20 08:39:00 CEST |917880 |TR/Crypt.ZPACK.Gen |46.251.237.240 |porvalizelkumaloletki.ru |http://porvalizelkumaloletki.ru/video/porno-rolik.avi.exe
|2011-07-20 08:39:00 CEST |917881 |TR/Crypt.ZPACK.Gen |46.251.237.240 |porvalizelkumaloletki.ru |http://porvalizelkumaloletki.ru/1/video/porno-rolik1.avi.exe
|2011-07-20 08:39:00 CEST |917882 |TR/Crypt.ZPACK.Gen |46.251.237.240 |porvalizelkumaloletki.ru |http://porvalizelkumaloletki.ru/2/video/porno-rolik2.avi.exe
|2011-07-20 08:39:00 CEST |917883 |TR/Crypt.ZPACK.Gen |46.251.237.240 |porvalizelkumaloletki.ru |http://porvalizelkumaloletki.ru/3/video/porno-rolik3.avi.exe
|2011-07-20 08:39:00 CEST |917884 |TR/Ransom.DN.18 |46.251.237.240 |porvalizelkumaloletki.ru |http://porvalizelkumaloletki.ru/4/video/porno-rolik4.avi.exe
|2011-07-20 08:39:00 CEST |917886 |TR/Crypt.ZPACK.Gen |46.251.237.240 |porvalizelkumaloletki.ru |http://porvalizelkumaloletki.ru/6/video/porno-rolik6.avi.exe
|2011-07-20 08:39:00 CEST |917887 |TR/Crypt.ZPACK.Gen |46.251.237.240 |porvalizelkumaloletki.ru |http://porvalizelkumaloletki.ru/7/video/porno-rolik7.avi.exe
|2011-07-20 08:39:00 CEST |917888 |TR/Crypt.ZPACK.Gen |46.251.237.240 |porvalizelkumaloletki.ru |http://porvalizelkumaloletki.ru/8/video/porno-rolik8.avi.exe
|2011-07-20 08:39:00 CEST |917889 |TR/Ransom.DN.14 |46.251.237.240 |porvalizelkumaloletki.ru |http://porvalizelkumaloletki.ru/9/video/porno-rolik9.avi.exe
|2011-07-20 08:39:00 CEST |917890 |TR/Crypt.ZPACK.Gen |46.251.237.240 |porvalizelkumaloletki.ru |http://porvalizelkumaloletki.ru/10/video/porno-rolik10.avi.exe
|2011-07-20 08:39:00 CEST |917891 |TR/Crypt.ZPACK.Gen |46.251.237.240 |sexporevoterraarchiv.ru |http://sexporevoterraarchiv.ru/video/porno-rolik.avi.exe
|2011-07-20 08:39:00 CEST |917892 |TR/Crypt.ZPACK.Gen |46.251.237.240 |sexporevoterraarchiv.ru |http://sexporevoterraarchiv.ru/2/video/porno-rolik2.avi.exe
|2011-07-20 08:39:00 CEST |917893 |TR/Crypt.ZPACK.Gen |46.251.237.240 |sexporevoterraarchiv.ru |http://sexporevoterraarchiv.ru/3/video/porno-rolik3.avi.exe
|2011-07-20 08:39:00 CEST |917894 |TR/Ransom.DN.18 |46.251.237.240 |sexporevoterraarchiv.ru |http://sexporevoterraarchiv.ru/4/video/porno-rolik4.avi.exe
|2011-07-20 08:39:00 CEST |917896 |TR/Crypt.ZPACK.Gen |46.251.237.240 |sexporevoterraarchiv.ru |http://sexporevoterraarchiv.ru/6/video/porno-rolik6.avi.exe
|2011-07-20 08:39:00 CEST |917897 |TR/Crypt.ZPACK.Gen |46.251.237.240 |sexporevoterraarchiv.ru |http://sexporevoterraarchiv.ru/7/video/porno-rolik7.avi.exe
|2011-07-20 08:39:00 CEST |917898 |TR/Crypt.ZPACK.Gen |46.251.237.240 |sexporevoterraarchiv.ru |http://sexporevoterraarchiv.ru/8/video/porno-rolik8.avi.exe
|2011-07-20 08:39:00 CEST |917899 |TR/Ransom.DN.14 |46.251.237.240 |sexporevoterraarchiv.ru |http://sexporevoterraarchiv.ru/9/video/porno-rolik9.avi.exe
|2011-07-20 08:39:00 CEST |917900 |TR/Crypt.ZPACK.Gen |46.251.237.240 |sexporevoterraarchiv.ru |http://sexporevoterraarchiv.ru/10/video/porno-rolik10.avi.exe
|2011-07-20 08:39:00 CEST |917901 |TR/Crypt.ZPACK.Gen |46.251.237.240 |studentdomatrax.ru |http://studentdomatrax.ru/video/porno-rolik.avi.exe
|2011-07-20 08:39:00 CEST |917902 |TR/Crypt.ZPACK.Gen |46.251.237.240 |studentdomatrax.ru |http://studentdomatrax.ru/1/video/porno-rolik1.avi.exe
|2011-07-20 08:39:00 CEST |917903 |TR/Crypt.ZPACK.Gen |46.251.237.240 |studentdomatrax.ru |http://studentdomatrax.ru/2/video/porno-rolik2.avi.exe
|2011-07-20 08:39:00 CEST |917904 |TR/Crypt.ZPACK.Gen |46.251.237.240 |studentdomatrax.ru |http://studentdomatrax.ru/3/video/porno-rolik3.avi.exe
|2011-07-20 08:39:00 CEST |917905 |TR/Ransom.DN.18 |46.251.237.240 |studentdomatrax.ru |http://studentdomatrax.ru/4/video/porno-rolik4.avi.exe
|2011-07-20 08:39:00 CEST |917907 |TR/Crypt.ZPACK.Gen |46.251.237.240 |studentdomatrax.ru |http://studentdomatrax.ru/6/video/porno-rolik6.avi.exe
|2011-07-20 08:39:00 CEST |917908 |TR/Crypt.ZPACK.Gen |46.251.237.240 |studentdomatrax.ru |http://studentdomatrax.ru/7/video/porno-rolik7.avi.exe
|2011-07-20 08:39:00 CEST |917909 |TR/Crypt.ZPACK.Gen |46.251.237.240 |studentdomatrax.ru |http://studentdomatrax.ru/8/video/porno-rolik8.avi.exe
|2011-07-20 08:39:00 CEST |917910 |TR/Ransom.DN.14 |46.251.237.240 |studentdomatrax.ru |http://studentdomatrax.ru/9/video/porno-rolik9.avi.exe
|2011-07-20 08:39:00 CEST |917911 |TR/Crypt.ZPACK.Gen |46.251.237.240 |studentdomatrax.ru |http://studentdomatrax.ru/10/video/porno-rolik10.avi.exe
|2011-07-20 08:39:00 CEST |917912 |TR/Crypt.ZPACK.Gen |46.251.237.240 |supermegaarchivavipornosexxxx.ru |http://supermegaarchivavipornosexxxx.ru/3/video/porno-rolik3.avi.exe
|2011-07-20 08:39:00 CEST |917913 |TR/Ransom.DN.18 |46.251.237.240 |supermegaarchivavipornosexxxx.ru |http://supermegaarchivavipornosexxxx.ru/4/video/porno-rolik4.avi.exe
|2011-07-20 08:39:00 CEST |917915 |TR/Crypt.ZPACK.Gen |46.251.237.240 |supermegaarchivavipornosexxxx.ru |http://supermegaarchivavipornosexxxx.ru/6/video/porno-rolik6.avi.exe
|2011-07-20 08:39:00 CEST |917916 |TR/Crypt.ZPACK.Gen |46.251.237.240 |mnogomolodihtelokokporno.ru |http://mnogomolodihtelokokporno.ru/video/porno-rolik.avi.exe
|2011-07-20 08:39:00 CEST |917917 |TR/Crypt.ZPACK.Gen |46.251.237.240 |mnogomolodihtelokokporno.ru |http://mnogomolodihtelokokporno.ru/1/video/porno-rolik1.avi.exe
|2011-07-20 08:39:00 CEST |917918 |TR/Crypt.ZPACK.Gen |46.251.237.240 |mnogomolodihtelokokporno.ru |http://mnogomolodihtelokokporno.ru/2/video/porno-rolik2.avi.exe
|2011-07-20 08:39:00 CEST |917919 |TR/Crypt.ZPACK.Gen |46.251.237.240 |mnogomolodihtelokokporno.ru |http://mnogomolodihtelokokporno.ru/3/video/porno-rolik3.avi.exe
|2011-07-20 08:39:00 CEST |917920 |TR/Ransom.DN.18 |46.251.237.240 |mnogomolodihtelokokporno.ru |http://mnogomolodihtelokokporno.ru/4/video/porno-rolik4.avi.exe
|2011-07-20 08:39:00 CEST |917921 |TR/Crypt.ZPACK.Gen |46.251.237.240 |mnogomolodihtelokokporno.ru |http://mnogomolodihtelokokporno.ru/6/video/porno-rolik6.avi.exe
|2011-07-20 08:39:00 CEST |917922 |TR/Crypt.ZPACK.Gen |46.251.237.240 |mnogomolodihtelokokporno.ru |http://mnogomolodihtelokokporno.ru/7/video/porno-rolik7.avi.exe
|2011-07-20 08:39:00 CEST |917923 |TR/Crypt.ZPACK.Gen |46.251.237.240 |mnogomolodihtelokokporno.ru |http://mnogomolodihtelokokporno.ru/8/video/porno-rolik8.avi.exe
|2011-07-20 08:39:00 CEST |917924 |TR/Ransom.DN.14 |46.251.237.240 |mnogomolodihtelokokporno.ru |http://mnogomolodihtelokokporno.ru/9/video/porno-rolik9.avi.exe
|2011-07-20 08:39:00 CEST |917925 |TR/Crypt.ZPACK.Gen |46.251.237.240 |mnogomolodihtelokokporno.ru |http://mnogomolodihtelokokporno.ru/10/video/porno-rolik10.avi.exe
|2011-07-20 11:38:00 CEST |918154 |TR/Crypt.ZPACK.Gen |46.251.237.240 |sexfornightfreeporno.ru |http://sexfornightfreeporno.ru/1/video/porno-rolik1.avi.exe
|2011-07-20 11:38:00 CEST |918155 |TR/Crypt.ZPACK.Gen |46.251.237.240 |sexfornightfreeporno.ru |http://sexfornightfreeporno.ru/2/video/porno-rolik2.avi.exe
|2011-07-20 11:38:00 CEST |918157 |TR/Crypt.ZPACK.Gen |46.251.237.240 |traxnochyustudent.ru |http://traxnochyustudent.ru/video/porno-rolik.avi.exe
|2011-07-20 11:38:00 CEST |918159 |TR/Crypt.ZPACK.Gen |46.251.237.240 |traxnochyustudent.ru |http://traxnochyustudent.ru/7/video/porno-rolik7.avi.exe
|2011-07-20 11:38:00 CEST |918160 |TR/Crypt.ZPACK.Gen |46.251.237.240 |traxnochyustudent.ru |http://traxnochyustudent.ru/8/video/porno-rolik8.avi.exe
|2011-07-20 11:38:00 CEST |918161 |TR/Ransom.DN.14 |46.251.237.240 |traxnochyustudent.ru |http://traxnochyustudent.ru/9/video/porno-rolik9.avi.exe
|2011-07-20 11:38:00 CEST |918162 |TR/Crypt.ZPACK.Gen |46.251.237.240 |traxnochyustudent.ru |http://traxnochyustudent.ru/10/video/porno-rolik10.avi.exe
|2011-07-20 12:54:00 CEST |918221 |TR/Crypt.ZPACK.Gen |46.251.237.240 |pornositexxx.ru |http://pornositexxx.ru/video/porno-rolik.avi.exe
|2011-07-20 12:54:00 CEST |918222 |TR/Crypt.ZPACK.Gen |46.251.237.240 |pornositexxx.ru |http://pornositexxx.ru/1/video/porno-rolik1.avi.exe
|2011-07-20 12:54:00 CEST |918223 |TR/Crypt.ZPACK.Gen |46.251.237.240 |pornositexxx.ru |http://pornositexxx.ru/2/video/porno-rolik2.avi.exe
|2011-07-20 12:54:00 CEST |918224 |TR/Crypt.ZPACK.Gen |46.251.237.240 |pornositexxx.ru |http://pornositexxx.ru/3/video/porno-rolik3.avi.exe
|2011-07-20 12:54:00 CEST |918225 |TR/Ransom.DN.18 |46.251.237.240 |pornositexxx.ru |http://pornositexxx.ru/4/video/porno-rolik4.avi.exe
|2011-07-20 12:54:00 CEST |918227 |TR/Crypt.ZPACK.Gen |46.251.237.240 |pornositexxx.ru |http://pornositexxx.ru/6/video/porno-rolik6.avi.exe
|2011-07-20 12:54:00 CEST |918228 |TR/Crypt.ZPACK.Gen |46.251.237.240 |pornositexxx.ru |http://pornositexxx.ru/7/video/porno-rolik7.avi.exe
|2011-07-20 12:54:00 CEST |918229 |TR/Crypt.ZPACK.Gen |46.251.237.240 |pornositexxx.ru |http://pornositexxx.ru/8/video/porno-rolik8.avi.exe
|2011-07-20 12:54:00 CEST |918230 |TR/Ransom.DN.14 |46.251.237.240 |pornositexxx.ru |http://pornositexxx.ru/9/video/porno-rolik9.avi.exe
|2011-07-20 12:54:00 CEST |918231 |TR/Crypt.ZPACK.Gen |46.251.237.240 |pornositexxx.ru |http://pornositexxx.ru/10/video/porno-rolik10.avi.exe
|2011-07-20 19:00:48 CEST |918324 |TR/Ransom.DN.18 |46.251.237.240 |pornoeblyadlyatebya.ru |http://pornoeblyadlyatebya.ru/4/video/porno-rolik4.avi.exe
|2011-07-20 19:00:48 CEST |918325 |TR/Crypt.ZPACK.Gen |46.251.237.240 |pornoeblyadlyatebya.ru |http://pornoeblyadlyatebya.ru/2/video/porno-rolik2.avi.exe
|2011-07-20 19:00:48 CEST |918326 |TR/Crypt.ZPACK.Gen |46.251.237.240 |pornoeblyadlyatebya.ru |http://pornoeblyadlyatebya.ru/1/video/porno-rolik1.avi.exe
|2011-07-20 19:00:48 CEST |918327 |TR/Crypt.ZPACK.Gen |46.251.237.240 |pornoeblyadlyatebya.ru |http://pornoeblyadlyatebya.ru/3/video/porno-rolik3.avi.exe
|2011-07-20 20:00:51 CEST |918356 |TR/Crypt.ZPACK.Gen |46.251.237.240 |pornoeblyadlyatebya.ru |http://pornoeblyadlyatebya.ru/7/video/porno-rolik7.avi.exe
|2011-07-20 20:00:51 CEST |918357 |TR/Crypt.ZPACK.Gen |46.251.237.240 |pornoeblyadlyatebya.ru |http://pornoeblyadlyatebya.ru/6/video/porno-rolik6.avi.exe
/usr/sbin/gwrsigmail.pl abuse@clean-mx.de abuse@exetel.de /tmp/viruses_complain_913511.1311187554.mail
/usr/sbin/gwrsigmail.pl abuse@clean-mx.de certbund@bsi.bund.de /tmp/viruses_complain_913511.1311187554.mail
/usr/sbin/gwrsigmail.pl abuse@clean-mx.de abuse@optimate-server.de /tmp/viruses_complain_913511.1311187554.mail

July 20, 2011, 08:38:36 pm
Reply #39

mc0blck

  • Jr. Member

  • Offline
  • **

  • 14
Code: [Select]
Blocker: http://comruporn.s3.amazonaws.com/index.html (72.21.214.42) -> http://livepornohd.ru/in.cgi?2 (95.211.111.80) -> http://5uporn.s3.amazonaws.com/index.htm (72.21.214.42) -> http://5uporn.s3.amazonaws.com/xxx_video.exe (72.21.214.42)

July 20, 2011, 08:40:01 pm
Reply #40

Amishrabbit

  • Jr. Member

  • Offline
  • **

  • 10

I contacted their upstream provider, ripe -tel-nr of them is not allocated ....
update: I reached optimate-server.de on their cell phone, they promised to shut down this server
-- gerhard

A number of the domains from this thread/attack that were formerly hosted on 46.251.237.240 appear to be moving over to 91.220.0.35 / AS51630, which is another Latvian network.

avipornoonline.ru
camshotporno.ru
dadnmomsporno.ru
megasyperxxx.ru
ooopsmypusy.ru
pornoagentx.ru
pornoseksas.ru
pornyxaavi.ru
redpussyx.ru
ssssaniedirki.ru
utubexxxvideo.ru
videopornocam.ru
youngpornoseks.ru

They are all still active.

aut-num:         AS51630
as-name:         SIABAS-AS
descr:           SIA BUSINESS AVIATION SERVICES
org:             ORG-BASL1-RIPE
import:          from AS24589 action pref=120; accept ANY
import:          from AS8285 action pref=120; accept ANY
import:          from AS21156 action pref=120; accept ANY
export:          to AS24589 announce AS51630
export:          to AS8285 announce AS51630
export:          to AS21156 announce AS51630
admin-c:         VLAS1-RIPE
tech-c:          VLAS1-RIPE
mnt-by:          RIPE-NCC-END-MNT
mnt-by:          SIABAS-MNT
mnt-routes:      SIABAS-MNT
source:          RIPE # Filtered

organisation:    ORG-BASL1-RIPE
org-name:        SIA BUSINESS AVIATION SERVICES
org-type:        OTHER
address:         Graudu str. 48A, Riga, LV-1058, Latvia
mnt-ref:         SIABAS-MNT
mnt-by:          SIABAS-MNT
source:          RIPE # Filtered

person:          Vadims Vlasovs
address:         Graudu str. 48A, Riga, LV-1058, Latvia
phone:           +371 29528757
nic-hdl:         VLAS1-RIPE
mnt-by:          SIABAS-MNT
source:          RIPE # Filtered
-=A

July 20, 2011, 09:18:08 pm
Reply #41

mc0blck

  • Jr. Member

  • Offline
  • **

  • 14
Porno-rolik
Quote
Blocker: hxxp://sosutstudentxxx.ru/1/ (46.251.237.240) -> hxxp://sosutstudentxxx.ru/1/video/porno-rolik1.avi.exe (46.251.237.240)
Blocker: hxxp://sosutstudentxxx.ru/2/ (46.251.237.240) -> hxxp://sosutstudentxxx.ru/2/video/porno-rolik2.avi.exe (46.251.237.240)
Blocker: hxxp://sosutstudentxxx.ru/4/ (46.251.237.240) -> hxxp://sosutstudentxxx.ru/4/video/porno-rolik4.avi.exe (46.251.237.240)
Blocker: hxxp://sosutstudentxxx.ru/6/ (46.251.237.240) -> hxxp://sosutstudentxxx.ru/6/video/porno-rolik6.avi.exe (46.251.237.240)
Blocker: hxxp://sosutstudentxxx.ru/3/video/porno-rolik3.avi.exe (46.251.237.240)

Amazon
Quote
hxxp://comruporn.s3.amazonaws.com/index.html (72.21.211.200) -> hxxp://comruporn.s3.amazonaws.com/video.htm (72.21.211.200) -> hxxp://livepornohd.ru/in.cgi?2 (95.211.111.80) -> hxxp://ebpoino.s3.amazonaws.com/index.htm (72.21.211.200) -> hxxp://ebpoino.s3.amazonaws.com/xxx_video.exe (72.21.211.200)

July 21, 2011, 03:39:52 am
Reply #42

EP_X0FF

  • Special Members
  • Hero Member

  • Offline
  • *

  • 254
    • KernelMode.info
MBRLocker (new binary and updated unlock code)

Quote
hxxp://redpussyx.ru/xxxvideo.avi.exe

Regarding to EXETEL.DE who hosts all pornorolik malware. As far as I know it ignored all abuses we sent in a last two weeks. If anyone knows a way how to make it answer please tell.

Working on it ;)

I contacted their upstream provider, ripe -tel-nr of them is not allocated ....
update: I reached optimate-server.de on their cell phone, they promised to shut down this server
-- gerhard

Thank you both, really appreciate that :)

A number of the domains from this thread/attack that were formerly hosted on 46.251.237.240 appear to be moving over to 91.220.0.35 / AS51630, which is another Latvian network.

Yes. Pornorolik (this is reincarnation of Ransom formerly known as WinAD) and MBRLocker seems coming from one gang and Amazon WS hosted ransom (formerly known as Lock'Em'All, named because of specific strings found in the previous version of this locker) from other group. First uses EXETEL.DE to host their malware and SIA BUSINESS AVIATION SERVICES. Second group migrating from one free service to another.

In the end of June, beginning of July LockEmAll were hosted on Yandex's narod.ru hosting (it's completely free). We successfully wiped it from there. After this Lock'Em'All moved to hosting located in Japan (also free) ninja.co.jp, we kicked it from there (ninja response was very quick :)) and they finally moved to Amazon Web Services (starting from 11 July).

The pity thing in Amazon WS - their abuse system seems not working at all (or we don't know *how* to use it), because all abuse requests we done have been returned with the following response:

Quote
Dear Abuse Reporter,

Thank you for submitting your abuse report. Unfortunately, we're unable to identify an Amazon EC2 customer using the source IP address(es) at the time you provided. This can happen when Amazon EC2 does not own the IP address(es) or when the date, time, or time zone that you provided is incorrect. If you feel you have mistyped the IP address or the abuse time, please re-submit the Amazon EC2 Abuse Report Form with updated information so we may proceed with processing your report:

http://aws-portal.amazon.com/gp/aws/html-forms-controller/contactus/AWSAbuse
 
Source IP address(es): 72.21.211.173
Abuse time: Tue Jul 19 14:11:00 UTC 2011

July 21, 2011, 06:00:27 am
Reply #43

mc0blck

  • Jr. Member

  • Offline
  • **

  • 14
Quote
The pity thing in Amazon WS - their abuse system seems not working at all (or we don't know *how* to use it), because all abuse requests we done have been returned with the following response:
It is really strange - just check the provided link in the abuse form and you will get all proofs - IP, date, time.

July 21, 2011, 09:31:50 am
Reply #44

EP_X0FF

  • Special Members
  • Hero Member

  • Offline
  • *

  • 254
    • KernelMode.info
Quote
The pity thing in Amazon WS - their abuse system seems not working at all (or we don't know *how* to use it), because all abuse requests we done have been returned with the following response:
It is really strange - just check the provided link in the abuse form and you will get all proofs - IP, date, time.

I think this is because this system is automatic. I've send abuse regarding hxxp://ebpoino.s3.amazonaws.com few minutes ago, if it will again not work I will do what MysteryFCM suggested :)