Author Topic: Withlove.exe come back  (Read 3461 times)

0 Members and 1 Guest are viewing this topic.

April 07, 2008, 02:58:35 am
Read 3461 times

Edgar Bangkok

  • Special Members
  • Full Member

  • Offline
  • *

  • 61
    • Edgar Internet Tools
I find over IP storm worm new page layout (love) with download files love.exe, witholve.exe and sony exe.
Names of files is same  used in Storm Worm Valentine day pages.

IP 65.78.169.170


Edgar  :)

more info : http://edetools.blogspot.com/2008/04/il-ritorno-di-withloveexe.html

April 09, 2008, 09:39:07 am
Reply #1

Edgar Bangkok

  • Special Members
  • Full Member

  • Offline
  • *

  • 61
    • Edgar Internet Tools
Now over domain  fastflux   supersameas.com   on have the new storm worm page "Storm Codec"

Edgar  :)

more info: http://edetools.blogspot.com/2008/04/storm-worm-cambia-ancora.html

April 10, 2008, 01:07:11 pm
Reply #2

Edgar Bangkok

  • Special Members
  • Full Member

  • Offline
  • *

  • 61
    • Edgar Internet Tools
Now using referer explorer (or explorer browser) make different load in domain storm worm

orthelike[DOT]com
limpodrift[DOT]cn
supersameas[dot]com

on have exploit coded and not fake video codec storm worm same on load with Firefox.

Edgar  :)