daily something......

[SysAdMini]

"XP Protection Center"

braviax/brastk advertised rogue

Thanks. Added.

[SysAdMini]

I have added many zeus/zbot/wsnpoem urls to list in the last days.

http://www.malwaredomainlist.com/mdl.php?search=zeus%2F&colsearch=All&quantity=50&sort=Date

[SysAdMini]

Some pdf exploits

Code: [Select]

hardmoviesporno.com/rf/exp/update1.pdfAnalysis:
http://wepawet.cs.ucsb.edu/view.php?hash=6e2a9dc53394e4d4f844a91c6e430783&t=1232726861&type=js
http://www.virustotal.com/analisis/ff4c30c4e7bf97019e2595c659191103

Code: [Select]

hardmoviesporno.com/rf/exp/update2.pdf
Analysis:

http://wepawet.cs.ucsb.edu/view.php?hash=0d64591f2075368ff912ecc5ec7f9cb7&t=1232726875&type=js
http://www.virustotal.com/analisis/6c0c223baa85f44b0342072a51dc3877

[sparsha]

Rogue pushed through Vxgame Trojan infection

Code: [Select]

hXXp://antivirusxppro2009.com/cgi-bin/download.pl?code=0000049
antivirusxppro2008.com


[SysAdMini]

Rotators

Code: [Select]

http://diettopseek.cn/in.cgi?cocacola
http://yourliteseek.cn/in.cgi?cocacola
http://litetoplocatesite.cn/in.cgi?cocacola2
http://litepremiumlist.cn/in.cgi?cocacola
http://nanotopfind.cn/in.cgi?cocacola
rotate to

Code: [Select]

http://murom-hotel.com/system/index.php
http://326g.com/forums/includes/hooks/system/index.php
http://parsrabota.reg36.ru/includes/system/index.php
http://alink.belstom.ru/partners/system/index.php
http://daiwa-cormoran.ru/mods/catalog/acr/system/index.php
http://taraxacum.ru/templates/siteground95/images/system/index.php
http://love-sad.ru/img/system/index.php
http://avtonchik.ru/images/stories/fruit/system/index.php
http://sunucum2.kaliteweb.net/~burctnet/system/index.php
http://ecogroup-vrn.ru/site/i/css/system/index.php
http://demokoksander.nl/recepten/system/index.php
http://2vb.ru/tetisgal/images/system/index.php

exploits from all sites lead to the same file :

http://www.virustotal.com/analisis/1a10833084a81f73b84c2a40f64d6302 2/35 !!!!


Rogue

Code: [Select]

http://imunizator.net/
best-online-antivirus-scanner.info/scan.php
best-antivirus-2010-scanner.info/scan.php
best-antivirus-2010-download.info/install.php
antivirus-scanner-online.com/scan.php

[sparsha]

Rogues

Code: [Select]

http://antispyknight.biz/files/antispyknight.msi
http://antispyknight.info/files/antispyknight.msi
http://total-defender.com/download/total-defender-setup.exe


[SysAdMini]

Rogue Winiguard

Code: [Select]

94.247.2.173/.dif/go.php?sid=1
Redirectors to LuckySploit

Code: [Select]

94.247.2.50/.dif/go.php?sid=1
94.247.2.52/.dif/go.php?sid=1
94.247.2.157/.dif/go.php?sid=1

[aaudi]

already posted ... <modified>

hxxp://www.hoho-3.cn/ gr.exe - Downloader

[sparsha]

IE Security new rogue from IEDefender family.

Code: [Select]

http://ie-security.com/_download.aspx
http://216.240.151.112/ie.exe
https://secured-software-order.com/iesa2/


[aaudi]

Related to popups

Code: [Select]

hxxp://ifengw.com/TT.exe

[sparsha]

XP Police Antivirus rogue sites: courtesy S!R!

Code: [Select]

xp-police.com
http://xp-police.com/installed.php?id=dress
http://xp-download-center.com/exe3/dress.exe


[sparsha]

Sites related to SysAntivirus 2009 rogue application.

Code: [Select]

sysantivirus2009.com
http://files.sysav-download.com/load/setup_1_1_.exe
http://int.sysreport1.com/stat.php?func=installrun&id=1&landing=1&lang=EN&sub=0
http://dl.sysav-storage.com/get/?type=main&pin=1&lnd=1
http://int.sysreport2.com/stat.php?func=ok
http://int.sysreport1.com/dom1.php
http://sales.buysysantivirus2009.com/pay/MQ==_MA==_RTA5MDUwNzk=/1/


[sparsha]

Sites related to  System Guard 2009 rogue application.

Code: [Select]

dlsg09.com
dlsgd3.com
getsysgd09.com
sg12scanner.com
sg9scanner.com
systemguard2009.com
systemguard2009m.com


[sparsha]

Scam sites involved in distributing "Antivirus 2009" Rogue security application

Code: [Select]

http://internetinterestingplaces.cn/soft.php?aid=0479&d=1&refer=9d9cbe78e
http://pleaseclickhere.cn/soft.php?aid=0182&d=1&refer=289ce6417
http://anti-malware-scanner.com/promo/1/freescan.php?nu=880479
http://antimalware-scanner.com/promo/1/freescan.php?nu=880182


[SysAdMini]

Code: [Select]

hxxp://elkonline.pl/images/eventlist/venues/small/systemhttp://wepawet.cs.ucsb.edu/view.php?hash=b6f6603d951fdcdf047cc3815498ac94&t=1233950001&type=js