hpHosts: Updated 25-11-2012

The hpHOSTS Hosts file has been updated. There is now a total of 184,913 listed hostsnames.If you are NOT using the installer, please read the included Readme.txt file for installation instructions. Enjoy! :)Latest Updated: 25/11/2012 18:00Last Verified: 24/11/2012 21:00Download hpHosts now!http://hosts-file.net/?s=DownloadEmail is now working again t...

Read More

Full Disclosure: Analysis of Fake Facebook Notification redirect to Obfuscation Blackhole(PluginDetect 0.7.9) and infecting Cridex Malware

Important Case Infector Summary:Fake Facebook Notif.(hacked WordPress)Redirector Host/IP: demarez.fr(new.htm)/ 88.190.253.248Blackhole Domain: delemiator.ruBlackhole IP: 216.24.196.66, 202.180.221.186, 203.80.16.81, 208.87.243.131Blackhole Proxy Port: 8080Cridex CNC host: 180.235.150.72 Path: /N5nmLCAAA/LxcqKAA/GLkOVCAAAA/ HTTP/1.1I was reported the below spam infection by @Hulk_Crusader,...

Read More

How, from where, by which IP you got infected w/FakeAV: System Progressive Protection; UPS Fake Spam, Spain's Front End Infector+Support Page, and Taiwan's CnC server

Today I was receiving report of another UPS spam (again, thank's to officer Pryor). Which lead users to download the FakeAV System Progressive Protection. This investigation is exposing all aspect of infection, from which spam, what downloaded trojan downloader used, which CnC used for communication and down to the support page. Infection Summary1. Drive by spam2. w/html URL to h00p://proyectosnavarra.es/CMUNFWKUWY.html...

Read More

Update 2: Domain Monster: Email server issues (again)

Happy to report, email is now working again. Now busy as hell catching up.If you've received a Relay access denied error when trying to e-mail, please re-send it. If not, don't worry, I'll get to it as soon as I c...

Read More

Update: Domain Monster: Email server issues (again)

Seems the problem is actually worse than I thought. I was aware of the issue with connecting to the incoming mail server, but found out a few hours ago from an ex, that there's also an issue with people sending me e-mail.Still no idea what the problem actually is (spoke to Domain Monster again a few moments ago, and they're still working on it, MX and A records are absolutely fine), but if...

Read More

PluginDetect 0.7.9 infector "et" Cridex Payloads of BlackHole Exploit Kit v2 (203.80.16.81) used CVE-2012-4681, CVE-2012-5076, CVE-2009-0927++

I came into PluginDetect 0.7.9 usage in the BHEK2 recently.The software PluginDetect 0.7.9 was released today in with the following details:PluginDetect Libraryversion: 0.7.9released: 10/17/2012by Eric GerdsYou can see it yourself in its website here --->>[CLICK]Or see the below capture pic of the site (click to enlarge)If you click the "Download PluginDetect" menu on the left side, you'll seea...

Read More