Author Topic: Suspicious Object / Zhelatin Worm  (Read 6684 times)

0 Members and 1 Guest are viewing this topic.

December 26, 2007, 05:59:07 am
Read 6684 times

M.J.Kim

  • Newbie

  • Offline
  • *

  • 3
URL :
Quote
hxxp://uhavepostcard.com/happy-2008.exe

-> Backdoor.Win32.Agent.dln (KAV)

December 26, 2007, 05:50:52 pm
Reply #1

JohnC

  • Special Members
  • Hero Member

  • Offline
  • *

  • 1964
Thank you, this will be added soon.

December 28, 2007, 03:53:38 am
Reply #2

Edgar Bangkok

  • Special Members
  • Full Member

  • Offline
  • *

  • 61
    • Edgar Internet Tools
Now blogger is full of links at storm worm page  :o   (newyeracards2008.com)
http://edetools.blogspot.com/2007/12/ora-storm-worm-attacca-blogger.html

Edgar from Bangkok




December 29, 2007, 01:09:33 am
Reply #3

sowhat-x

  • Guest
Quote
b15.3222.org
Noticed this domain in a post in your blog,and recognized it immediately...
I've seen more 3222.org sites hosting crap,seems that they prefer it for some reason...
By the way,excellent work you keep doing...


December 29, 2007, 02:45:15 am
Reply #4

sowhat-x

  • Guest
Regarding the happy-2008.exe crap,a short but nice analysis from Arbor Networks...
http://asert.arbornetworks.com/2007/12/storm-and-2008-new-campaign/

December 30, 2007, 03:40:11 pm
Reply #5

brewt

  • Special Access
  • Newbie

  • Offline
  • *

  • 8
Quote
uhavepostcard.com
happycards2008.com
newyearcards2008.com
newyearwithlove.com
familypostcards2008.com

newest:
Quote
hxxp://freshcards2008.com/sony.exe
hxxp://freshcards2008.com/happynewyear2008.exe

http://www.siteadvisor.com/sites/freshcards2008.com

http://www.google.com/search?q=freshcards2008.com
how to report a spam blog

December 31, 2007, 12:27:04 am
Reply #6

brewt

  • Special Access
  • Newbie

  • Offline
  • *

  • 8
Quote
hxxp://happy2008toyou.com
hxxp://hellosanta2008.com
hxxp://happysantacards.com
hxxp://hohoho2008.com
hxxp://newscorpalerts.com
hxxp://parentscards.com
hxxp://postcards-2008.com
hxxp://santapcards.com
hxxp://santawishes2008.com

source: http://www.spamtrackers.eu/wiki/index.php?title=Storm#December_29

December 31, 2007, 02:24:24 am
Reply #7

sowhat-x

  • Guest
Nice work  :)

Quote
hxxp://hohoho2008.com
-> He-he,yeah,ok...Santa Claus is coming to...your browser or so,twisted sense of humour...
my guess they were in a "mood" when registering this one...
He who laughs last,laughs best though...

January 02, 2008, 03:06:25 am
Reply #8

JohnC

  • Special Members
  • Hero Member

  • Offline
  • *

  • 1964
Thank you for the domains. You have to wonder how many people work on storm.