Inhoster again..

Easier just to block 85.255.112.0 - 85.255.127.255

The full list from those servers is:

securecheck.biz
sqcontrol.biz
urgentwindowsupdate.biz
virusblast.com
yourguardonline.biz
errorsdns.com
esafetypage.com
eupdatepage.com
iewarning.com
eprotectpage.com
esecuritypage.com
Conrad Longmore | Homepage | 11.14.06 - 5:04 am | #

someone close this site http://dinet. info/
because it contains this trojan:
http:// dinet.info/ e/ us167/ e.exe
Win32:Agent-CQM [Trj]
this trojan is called by this page:
http://2. ancormimise.org / pacmaniagioco/

So please close these sites:
ancormimise.org
dinet.info

thanks

** LIVE MALWARE **
bill | 11.14.06 - 8:44 am | #

close also this site:
http://11. altraparte.com/ sfondosistemaoperativi/
bill | 11.14.06 - 8:46 am | #

Bill -- feel free to sumalware URLs
Alex Eckelberry | 11.14.06 - 12:20 pm | #

Folks -- by the way -- "Bill" here has posted clickable real live malware. I've edited the links so that you can't click it.
Alex Eckelberry | 11.14.06 - 1:05 pm | #

altraparte.com and ancormimise.org have been part of the gromozon "jump" pages and it seems that only recently they've switched exploits to install other stuff. Frankly, the domains of these "jump pages" are so many that there is almost no point in listing them all here. I'm talking THOUSANDS here (and no, not counting the subdomains, only counting the actual domains).
TNT | Homepage | 11.14.06 - 2:48 pm | #

The nice thing about the jump pages is that is can reveal any of the SSH own new porn sites and codec sites
Patrick Jordan | Homepage | 11.14.06 - 7:31 pm | #