Thread about Exchanger sites

[sursmurf]

Code: [Select]

http://moje-php.xf.cz/cnnvid.html
http://rihaweb.wz.cz/cnnvid.html
http://www.pappschik.de/cnnvid.html
http://acrpolska.pl/cnnvid.html
http://tonysproductreviews.com/cnnvid.html
http://joscarorganics.co.uk/cnnvid.html

they all end up downloading adobe_flash.exe


http://www.virustotal.com/analisis/e243b5b6a0c77c8f25f0e9f193163b5f

[philipp]

Code: [Select]

http://stageeventos.com.br/_images/video-nude-anjelia.avi.exe
http://artmx.com.br/imagens/imagens_content/video-anjelina.avi.exe
http://196.32.220.3/video-nude-anjelina.avi.exe
http://www.orca.com.tr/images/paris-nude-video.avi.exe
http://kam3-l3on.ifrance.com/phpBB2/images/smiles/video-nude-anjelia.avi.exe
http://stoppatologii.za.pl/imagenes/.../video-anjelina.avi.exe
http://toleventours.iespana.es/images/Paris-nude-video.avi.exe
http://www.shsoluzioni.it/images/Paris-nude-video.avi.exe
http://lipt0n.freehost.pl/images/Paris-nude-video.avi.exe
http://www.frankiemunozmanagement.com/videos/Paris-nude-video.avi.exe


[sursmurf]

Code: [Select]

http://62.129.131.197/install.exe
http://acrpolska.pl/install.exe
http://dominostalkforums.org/install.exe
http://frmkaynak.com/install.exe
http://efmpentathlon.org/install.exe
http://www.matbroome.com/install.exe

http://mgmvalet.com/index1.php
http://havermexicana.com.mx/index1.php



[JohnC]

Thank you.

[blender]

http://www.saulogomes.com.br/msvid32.exe <-- exchanger

Droppings:

79.135.167.18/20scan1.exe
79.135.167.18/21scan.exe
79.135.167.18/ftpgd.exe
avxp-2008.net/images/1219303511/ee92fb91e4e687490ecb8c7404afbdba/8efbe1be-570d-4b91-80d8-f535d5b47182.gif

Ends up installing XPAntivirus, FakeAlert/Renos with the fake BSOD screensaver & hijacked desktop pic/restrictions, Infostealer.

[CM_MWR]

Careful dragging those binaries outa vm now. 

[blender]

Wouldn't be my 1st format!

[CM_MWR]

lol@fufi!

This avp2008 and bravix installers are everywhere. 

[blender]

FUFI! is Fun!

few more exchangers.
No clue if still live atm.

Code: [Select]

http://fmsudamericana.com/index_1.html
http://gerp.com.br/homme/homme.php
http://nsoares.eu1net.org/index1.php
http://pension-aupoil.fr/index1.php
http://pop40.com.br/index_1.html
http://roboto.com.ar/index1.php
http://semneartemis.ro/index_1.html
http://studio.metouia.net/index1.php
http://thegreencrusade.com/index1.php
http://upac.com.au/index_1.html
http://www.blue-monday.org/index_1.html
http://www.hotelshelton.com.br/homme/homme.php

http://68.178.197.15/msvid32.exe
http://89.187.49.18/madonna.avi.exe
http://aventurastour.com/play.exe
http://burons.cantalpassion.com/play.exe
http://christosgroup.com/msvid32.exe
http://commune-siran.cantalpassion.com/play.exe
http://construtoraleal.com.br/play.exe
http://crosmedia.ro/play.exe
http://fmsudamericana.com/codecpack.exe
http://incibaharat.com/msvid32.exe
http://iou.org/msvid32.exe
http://itarareonline.com/msvid32.exe
http://multiphonie.cantalpassion.com/play.exe
http://www.barryhutchison.com/msvid32.exe
http://www.black10.home.pl/play.exe
http://www.calfsoft.com/play.exe
http://www.capembalagens.com.br/msvid32.exe
http://www.dcd-trade.ch/play.exe
http://www.fmpasion.com.ar/msvid32.exe
http://www.g4god.in/play.exe
http://www.gkv.in/play.exe
http://www.noticiasmisioneras.com/msvid32.exe
http://www.ribeiraopretoeregiao.com.br/msvid32.exe
http://www.traquejo.com.br/msvid32.exe


[blender]

Sommore:

hxxp://1000millasargentina.com.ar/play.exe
hxxp://3kman.com.ar/play.exe
hxxp://89.187.49.18/madonna.avi.exe
hxxp://89.187.49.18/setup.exe
hxxp://acrediteofilme.com.br/play.exe
hxxp://agmerparana.com.ar/play.exe
hxxp://aicsolucoes.com/play.exe
hxxp://angelina.cantalpassion.com/play.exe
hxxp://aventurastour.com/play.exe
hxxp://bandaantidoto.com/play.exe
hxxp://bcm.org.my/play.exe
hxxp://beta.theindustryresource.com/play.exe
hxxp://burons.cantalpassion.com/play.exe
hxxp://cantal-arts.cantalpassion.com/play.exe
hxxp://cantalcheval.cantalpassion.com/play.exe
hxxp://cesium-chloride.com/play.exe
hxxp://commune-siran.cantalpassion.com/play.exe
hxxp://construtoraleal.com.br/play.exe
hxxp://conveying.com/play.exe
hxxp://coulon.cantalpassion.com/play.exe
hxxp://crosmedia.ro/play.exe
hxxp://cyberstart.com.ar/msvid32.exe
hxxp://deathbyrose.hanagasumi.net/play.exe
hxxp://edr.co.in/play.exe
hxxp://elexor.com/play.exe
hxxp://elportal.info/play.exe
hxxp://evergreen-studio.com/play.exe
hxxp://exectr.net/index.php
hxxp://exectr.net/privacy-policy.php
hxxp://fakecrucifixion.kurushiunai.jp/play.exe
hxxp://fencefactory.com.au/play.exe
hxxp://fetraelec.com.ve/play.exe
hxxp://fouracesstags.com/msvid32.exe
hxxp://francarros.com.br/play.exe
hxxp://freddygarcia.com.ve/play.exe
hxxp://ftp-fr.eservglobal.com/play.exe
hxxp://garbati.com.uy/play.exe
hxxp://gdbdev.com/play.exe
hxxp://gfportfolio.com.ar/play.exe
hxxp://gite.seccaud.albepierre.cantalpassion.com/play.exe
hxxp://glycerine.servebeer.com/play.exe
hxxp://handofset.com/play.exe
hxxp://ieo15.cantalpassion.com/play.exe
hxxp://intranetcivica.com.ar/play.exe
hxxp://jet-multimedia.de/play.exe
hxxp://jordannefm.cantalpassion.com/play.exe
hxxp://jotna.com/play.exe
hxxp://lpo.cantal.cantalpassion.com/play.exe
hxxp://madurezcero.com/play.exe
hxxp://marketah.mysteria.cz/play.exe
hxxp://meyers.com/play.exe
hxxp://multiphonie.cantalpassion.com/play.exe
hxxp://ostal.del.libre.cantalpassion.com/play.exe
hxxp://ostaloisa.cantalpassion.com/play.exe
hxxp://portaldoctordj.com/play.exe
hxxp://roskiman.com/play.exe
hxxp://rugby.arpajon15.cantalpassion.com/play.exe
hxxp://rugby.cantalpassion.com/play.exe
hxxp://sadsystems.com.ar.elserver.com/play.exe
hxxp://scoutik.mysteria.cz/play.exe
hxxp://septfons.cantalpassion.com/play.exe
hxxp://shopathomecafe.com/play.exe
hxxp://tagsag.bringapont.hu/play.exe
hxxp://thomasregisterofnj.com/play.exe
hxxp://tirtaji.com/play.exe
hxxp://toaqsa.com/play.exe
hxxp://tokotor.cg.yu/play.exe
hxxp://tolhuin.gov.ar/play.exe
hxxp://voceacontece.com/play.exe
hxxp://wiki.cantalpassion.com/play.exe
hxxp://www.arminseemann.ch/play.exe
hxxp://www.bajajinternational.com/play.exe
hxxp://www.black10.home.pl/play.exe
hxxp://www.bodegasadan.com/play.exe
hxxp://www.bwlapdance.com/play.exe
hxxp://www.calfsoft.com/play.exe
hxxp://www.dcd-trade.ch/play.exe
hxxp://www.divesociety.ch/play.exe
hxxp://www.emrbpo.com/play.exe
hxxp://www.fencefactory.com.au/play.exe
hxxp://www.fridayfilmworks.com/play.exe
hxxp://www.g4god.in/play.exe
hxxp://www.gkv.in/play.exe
hxxp://www.grutly.com/play.exe
hxxp://www.lenapiel.com/play.exe
hxxp://www.pcperfect.ch/play.exe
hxxp://www.professionalinweb.in/play.exe
hxxp://www.programasergiorocha.com/msvid32.exe
hxxp://www.punniya.com.sg/play.exe
hxxp://www.sail-on.cn/play.exe
hxxp://www.technohub.co.th/play.exe
hxxp://www.thejonwebgroup.com/play.exe
hxxp://www.valuespace.de/play.exe
hxxp://yvon.momboisse.cantalpassion.com/play.exe

Dunno whats live or dead. -- didnt check.
Didn't check for dupes either

[pcaccent]

hxxp://7yascokgec.com/player.exe
hxxp://1000millasargentina.com.ar/player.exe
hxxp://agmerparana.com.ar/player.exe
hxxp://www.black10.home.pl/player.exe
hxxp://evergreen-studio.com/player.exe
hxxp://fencefactory.com.au/player.exe
hxxp://www.fridayfilmworks.com/player.exe
hxxp://www.g4god.in/player.exe
hxxp://fakecrucifixion.kurushiunai.jp/player.exe
hxxp://meyers.com/player.exe
hxxp://tirtaji.com/player.exe
hxxp://www.valuespace.de/player.exe

[JohnC]

Thank you.