Category: Uncategorized

Here’s a legitimate bank, Banca Fideuram, whose real site is actively being used in phishing redirects.

You can see for yourself how poor a job that’s been done with this site: this link will generate a popup that’s certainly not from the bank.

Pretty sloppy.

And now we have congress-critters unwittingly being used in redirecting to all kinds of sites. Take a gander at this Google search [*.house.gov/exit.aspx]. See all the spam links pushing redirects, hopping off the website of our Honorable Reps? Or how about just putting in the word “intelligence” for some more fun?

This poor congress-critter is unwittingly redirecting some visitors to a hard core porn site, gipno(dot)com — www.blunt(dot)house.gov/exit.aspx?link=gipno(dot)com.

Heck, they’re not the only ones. Take, for example, Hershey’s (which, to their credit, requires user assent to redirect), or this school.

Some of these have been out for quite some time…

I’m certain there’s lots more out there. Feel free to post more of your own findings in the comments section.

Alex Eckelberry
(Credit to Francesco Benedini, sikurezza.org mailing list and Marco d’Itri for pointing out the bank redirect, and Adam Thomas for the house redirect)

Same old DNS Changer Trojans.

codecpro samples:
Windows: codecpro net/download/codecpro123.exe
Mac: codecpro net/download/codecpro123.dmg

codecviva samples:
codecviva com/download/codecviva1234.exe
codecviva com/download/codecviva1234.dmg

As always, please do not download these Trojans unless you know what you’re doing.

Patrick Jordan and Adam Thomas

Proposed banished words, by Lake Superior State University, including the terms perfect storm, webinar, surge, organic, wordsmithing, surge and random.

Alex Eckelberry
(Thanks, Andrew)

Stu Sjouwerman here does the annual prediction thing in his newsletter, Wservernews. (Note that the predictions are geared toward his audience, IT folks.)

Since I don’t do annual predictions (I hate doing these types of things), I’ve decided to post his.

I don’t agree with all the points, but some are interesting. So here it is:

Stu’s 2008 Predictions

MICROSOFT: Windows XP lives! Redmond will announce another extension until Jan 2009 for WinXP, instead of the June 30 cutoff. During 2008 they will trumpet that they broke the 200 million Vista sales, but will not report the amount of people that have downgraded to WinXP.

OPERATING SYSTEMS: Virtualization will continue strong growth as W2K8 Hyper-V is released. — Desktop virtualization will start its mainstream debut in 2008, providing intelligent provisioning of applications to desktop users. — Open Source Solutions will continue to grow, but at the same slow pace. — Linux Desktop solutions will continue to show promise, and despite Vista, will continue to fall short. — IPV6 will start becoming relevant. — Vista will get a 10% market penetration in 08, and thus will start getting attacked significantly more.

IT BUDGETS: SMB will mainly spend the money which is not sucked up by ‘keeping the lights on’ buying blades, virtualization storage and security. — If you have lots of small satellite offices, their pipes will need to be beefed up in 2008 as the Internet slowly but surely is getting gridlocked.

MALWARE: Spam will still be a problem. — Malware will use high traffic Internet sites as go-betweens to help bypass current detection and control methods. — (Spear) phishing attacks will continue to rise, and several will hijack presidential campaigns. — For SMBs servicing public companies, regulators and auditors looking downstream will knock on their doors, too. — Up to now, mobile devices and IM have been relatively malware free, but… no more in 08.

MACRO ECONOMICS: The collapsed two housing / mortgage bubbles (which were fueling each other) will be the precursor for a major 2008 correction on either the Indian or Chinese stock exchanges or both at the same time. Keep in mind that ultimately money is nothing more than an idea, and this idea is backed by confidence. If the confidence drops, the bottom falls out of bubbles. Strap yourself in for the coming year.

HARDWARE: Wireless Internet devices become a BIG deal. “I want my IP phone + music + kindle + video + Internet” Google buys 700MHz spectrum, and sells a single device that does all that with no per minute fees; free, but Adwords-based or monthly flat rate subscription. — Support for Muni Wi-Fi is going to die and will be eclipsed by Wi-Max. — 2008 will see the first mass produced plastic digital displays. — You will see the first game control hardware that used a headset reading brain waves. — 24 inch wide-screen monitors will hit the mainstream mid 2008 and thereafter will become the norm. Look for Wi-Fi-based robots emerging from small companies this year, and a new Sony AIBO doggie with the same features.

SECURITY: Electronic voting machines will be hacked in November 2008. — ‘Cloud Computing’ will penetrate as the new 2008 buzzword, but security issues with it will keep it from going mainstream. — Users will still be your weakest link in 2008. — The Payment Card Industry (PCI) standard will get teeth and very real for anyone accepting credit cards. — Bots will go peer-to-peer and harder to take down. — Criminals will start attacking virtual worlds — Virtualization opens up a new huge attack surface.

2008 TECH TRENDS: Redmond’s new SilverLight V2 technology will have a 30% market share by the end of 2008, mainly at the expense of Adobe’s Flash. — Tesla will produce 600 electric sports cars at a hundred grand each and sell them all — TV will be IP-streamed at the same time as broadcast. — Amid growing privacy concerns and intense state-level opposition, the costly Real ID Act of 2005 will collapse under its own weight in 2008. — The ‘presence’ aspect of Unified Communications (UC) which is able to track you down where ever you are, will cause major backflash in early UC deployments.

2008 CAREERS: Admins that are able to include security in their job responsibilities will do well. Add disaster recovery and business continuity and you will be doing more than fine. 2008 is the year to take ownership of your career path. Your boss will not do it for you. Try Identity Theft as a career path, it will be extremely lucrative in 2008. ;-D

WEB SECURITY: The first shots have already been fired, but a major diplomatic incident regarding hacking will erupt, allegedly involving the Chinese getting access to highly confidential data. In the mean time, the Olympic village in Beijing will be hacked from outside China. — Plan to be invaded by (or block) Social Networking site traffic.

GLOBAL CLIMATE: I predict that at least one cruise line will offer “2008 Northwest Passage” tours through the once again ice-free polar ocean. — Did you know that computers consume 14% of the energy generated in the U.S.? In 2008, Intel will start a ‘Green IT’ campaign of “ten times the performance at 10 times less the power.” — But IT departments will suffer from 2008 Eco-Fatigue as many IT vendors suddenly declare all kinds of non-proven environmental benefits.

WILD-ASS GUESSES

• Oracle Buys SalesForce.com
• Palm gets acquired by Microsoft
• Adobe gets acquired by Microsoft
• Yahoo will sell out to… Microsoft
• Presidential race Obama / Huckabee has electronic voting scandal
• Google shares will hit $900, but will see another 25% dip as well, they will get into TV and radio, and announce their own OS.
• Hi-Def Format Wars will declare peace and come out with one standard, compatible with both formats, with disks below $20.
• Microsoft launch IE8 in the Spring of 2008. The entire planet needs to be rebooted.
• Facebook is going to see the same kind of decline in popularity in 2008 that MySpace saw in 2007. The network that is actually really useful for techies like us (LinkedIn) will do extremely well.

Well, there you have it.

Alex Eckelberry

As sometimes goes in this business, misinformation slips through the cracks.

In my post earlier today, I had said that code had been published on this exploit, which makes it very serious.

However, it turns out that this is likely not the case. I was misinformed.

No source code published means a greatly reduced threat level.

I’ve updated my original blog post as well.

Alex Eckelberry

Update/Correction: I was misinformed — it appears that the code has not actually been released, which greatly reduces the threat.

This is actually serious — an unpatched RealPlayer vulnerability.

The code has been published, but we have not seen it being used. However, it could go live at any minute.

There is no known workaround. While the vulnerability has been reported for version 11 of RP, it’s unknown whether or not other versions (or alternatives) are affected.

With the current rash of malicious ad banners, one has to take extra care. The MySpace malicious banner ads were using the Neosploit exploit framework. This particular vulnerability, as far as we know, has not been released into that framework, but if it does, we have a real problem.

Heck, now is as good a time as any to get rid of that awful player.

More info:

Sans advisory (worth reading)
Secunia
FrSIRT

Alex Eckelberry
(Thanks Francesco)

We worked earlier today with Brain Krebs at the WP about malicious banner ads on Myspace.  (Malware is being delivered through exploits, but fully patched systems won’t be affected.)

Sandi Hardmeier has also been tracking ads at Excite and, now, Blick (a popular German site).  These are different than the Myspace ads (in that they don’t seem to be dumping an exploit-driven payload). 

Alex Eckelberry

My post earlier this week about STOPzilla bundling the Ask Toolbar deserves some correction.

It turns out it’s not a specially-branded version of the Ask Toolbar (unlike the case of WebRoot and ZoneLabs).

It’s their own toolbar, which uses Ask search results (Ask pays for so-called “search syndication”, deals that generate traffic to their search engine).

The STOPzilla folks argue it’s a horse of a different color (their note here). But is it a horse of that color (as Maria argued)? (Sorry for the obscure Shakespeare references, I know I’ve lost half my audience, but it makes the blog more entertaining for the other two people who read this blog.)

Here’s why it’s still a questionable decision:

• It’s a pre-checked option. Yes, this gets hazy, because it’s “their program”. But… still, it’s bothersome.
• And it is a partnership with Ask, a questionable venture on the part of a security company. Now that part is also bothersome. The Google or Yahoo Toolbars haven’t been installed through security exploits.

Ask (formerly Ask Jeeves) has had a history. Now, as far as I can tell, the company has been clean for some time now. They have made dramatic, and often impressive improvements, and I recognize their work, and the genuine hard work of Ask’s Kirk Lawrence. (Uber-spyware fighter Ben Edelman does claim that he recently got an install of an Ask toolbar without any notice or consent, but I haven’t verified this claim.)

So Ask really has made a real effort to clean things up and it shows. And the search engine itself is harmless.

I do understand STOPzilla’s point. It’s not the Ask Toolbar per se. It really is their own toolbar, and all it’s doing is using Ask search results. Fair enough. But is this a prudent move, being that they’re a security company? Does it show too much effort to monetize their customer base, rather than focus on good security? Does it show poor institutional memory, jumping in the sack with Ask? Or is it harmless and simply good business sense on their part?

I’m curious to hear your thoughts.

Alex Eckelberry
(Adrian Kingsley-Hughes at ZDNET weighs in on the bundling issue as well.)

Tina, who claims to be a DHS security screener employee, dropped a comment on my blog earlier today, and at first I was tempted to discard it as spam. Well, it is spam, but I found her site entertaining. So I’ll let it be.

Her site, screenersconfessions.com, is a crass and unabashed attempt to commercialize her experiences as a security screener. (Of course, we’re assuming that she really is a screener, but flipping through the site, it certainly seems to be the case.)

One annoying thing about the site is her use of Adbrite ads (that irritating hyperlinked text you see so much these days). Oh, and her command of the English language (which she apologizes for), and her use of curses throughout the site, which may be offensive to some.

A tidbit:

Due to the fact that is so difficult to understand that shampoos and conditioners are liquids, I had to open this bag. That bag smelled like the feet of Methuselah. Damn it! When I moved the clothes to get the liquids, four freaking giant size roaches jumped from the luggage and one went straight to my shirt. I have to admit I screamed like Casey in the movie “SCREAM”. For a minute I saw myself; stabbed in chest, stomach, and throat and gutted like the character of the movie. I am sorry but your home, if you can call it that way, has to be a trash can. Deliberately, you packed roaches and that’s disgusting. What person with a working mind will pack liquids in a stinky bag full of roaches and then bring that bag to one of the busiest airport of the nation. There is no excuse for such filth! For your information a research being conducted at the University of Florida shows that cockroaches leave chemical trails in their feces. Other cockroaches will follow these trails. So, if your clothes served as a roach’s house, the friend of your roach will follow you. I don’t want to see a caravan of roaches marching past your butt! For that, I would love you to stay home.

Obligatory tips:

• DO lay your bag on its side. The upright position is much harder to see and may trigger a re-run. If your bag is full of crap, please lay it flat on the belt. If it’s closed, don’t use a bin and remember all electronics have to come off. You don’t want to wait, and we don’t want to hear your screams.

• DO put items through the X-ray machine only when you are ready to walk through the metal detector. This minimizes the time you’re separated from your belongings. I’m tired of “MY BAG, MY BAG”. Also make sure you send all your belongings, X-Rays don’t eat your stuff, if you leave them upfront, they won’t walk, you have to send them.

• DON’T travel naked. If you see how many skin diseases walk through the checkpoint everyday, you will never wear your Daisy Dukes. Besides that we don’t need people with attention disorders deficits at the checkpoint, they create disruptions and the waiting time increase.

Not surprisingly, given her profession, she also professes an undying love for germicides:

I would love to say thanks zillions of times to three products. I can’t live, lets say I will be dead without LYSOL®, PURELL® and FEBREZE®. They don’t pay me, I am not their official sponsor or anything like that. I have over two hundreds hours of sick leave because of them. I never get sick and the checkpoint is full of germs, odors and dust. Nothing better to get rid of germs like Lysol, nothing better to have your hands clean like Purell and nothing better to eliminate the killing odors like FEBREZE®. I buy them with my own money and bring them to the checkpoint everyday. They are highly recommended, not only by me, but by the over 700 screeners that work at my airport. My life at the checkpoint is much easier and clean because of these three fabulous products.

This site does show how much frustration the security employees go through, often for reasons that make no sense. Loading these employees up with senseless, increasingly complex rules makes air travel increasingly stressful for all parties — and worse, actually reduces the airport security posture.

Alex Eckelberry

TechCrunch sees phishing on Facebook, saying “I’m not sure what the bad guys want with a bunch of Facebook user account credentials, but phishing scams seem to be hitting the site

Look at this clever phishing link TechCrunch posted:

Then, we have Fortinet seeing Zango installed through a Facebook application, “Secret Crush”.

Be careful out there.

Alex Eckelberry

Some of you might want to know where to submit virus/malware samples to security companies. This blog post might help.

First, each vendor has their own submission process. For example, Symantec has this page, McAfee has this page, Sunbelt has this page — and so on. However, email addresses are available — you can package your malware sample into a zip or RAR file, password protect it (common practice is to use the password ”infected”) and send off the sample. A full list of submission addresses is here.

Now, if you’re feeling lazy (or just plain too busy), you can always submit a sample to Virustotal. All the vendors that are part of VirusTotal receive samples, so it’s an easy way to get a sample to a lots of companies. I’m not particularly sure if it’s the fastest way to get samples out there to the security companies, but the samples do ultimately get to all of us. (Clarification — VirusTotal gets us the samples immediately. But it’s up to the vendors to get these samples into their threat signatures. For some, this takes a bit of time.)

Finally, feel free to submit the malware to our sandbox. It gives us the sample, but also, gives you a nice report as to what the malware is actually doing.

And, of course, please don’t mess with malware samples unless you really know what you’re doing. Even expert security researchers have been known to infect themselves by accident on occasion.

Alex Eckelberry

After infection by this Trojan, you’re completely locked out of the system.

You get this screen –– it takes over your entire desktop:

Click on “Click to activate new license”, you get this screen:

Turns out it’s coming from a website, which I’ve posted the same screens, below:

Different countries have different numbers. For example, here is the UK:

And here is France:

Incidentally, a search on the US 900 number shows the first link as passwordtwoenter com, which shares an IP with a number of other similar sites:

p2e com
chargemybill com
chargemyphonebill com
password2enter com
passwordtoenter com
passwordtwoenter com
phonetoenter com
pin2enter com
pintoenter com
pintwoenter com
ptwoe com

Apparently, this is a payment processor that’s now being used for malware, whether they know it or not.

Alex Eckelberry
(thanks Adam Thomas and Patrick Jordan)

Update: Pay-by-phone processor cancels account. More here.

In the “Low-Maintenance Magic” category:

Low-Maintenance Magic
The tool that requires the least amount of ongoing attention:

1. Exploit Prevention Labs’ LinkScanner Pro: Just set it and forget it.
2. Sunbelt’s Messaging Ninja: Stealthily keeps your e-mail clean and healthy.
3. Microsoft’s WSUS: Plug it in, attach clients to it and they’re patched. The best part is it’s free.

Congratulations to our Ninja development team!

Alex Eckelberry

Following on a study by the Harvard School of Public Health that “concluded there is no evidence that the [TSA’s] measures actually increase the safety of the passengers”, we now have an airline pilot delivering a salvo against the TSA in a blog post on the New York Times website (via boingboing):

Thus, what most people fail to grasp is that the nuts and bolts of keeping terrorists away from planes is not really the job of airport security at all. Rather, it’s the job of government agencies and law enforcement. It’s not very glamorous, but the grunt work of hunting down terrorists takes place far off stage, relying on the diligent work of cops, spies and intelligence officers. Air crimes need to be stopped at the planning stages. By the time a terrorist gets to the airport, chances are it’s too late.

In the end, I’m not sure which is more troubling, the inanity of the existing regulations, or the average American’s acceptance of them and willingness to be humiliated. These wasteful and tedious protocols have solidified into what appears to be indefinite policy, with little or no opposition. There ought to be a tide of protest rising up against this mania. Where is it? At its loudest, the voice of the traveling public is one of grumbled resignation. The op-ed pages are silent, the pundits have nothing meaningful to say.

(“I’m not sure which is more troubling, the inanity of the existing regulations, or the average American’s acceptance of them and willingness to be humiliated.” That’s a good point. I suspect the reason is that no one in the mainstream press wants to make an issue out of this, because of some reader responses. I’ve seen a few nasty responses when I put up these types of blog posts, that I’m advocating something like forsaking America’s Great Liberty, etc. This is nonsense, of course. I’m advocating better security, not wasteful security.)

The reality is that reason has left the table, and has been left with fear.

The illogic is plain to see everywhere:

– If these security measures are so important and life-saving, why is it that airline personnel have to go through a security check, while airport personnel don’t?

– Where is the real proof that the liquids ban do anything to prevent a binary explosive from being created in a toilet? (Not that it’s even likely that this is possible.)

– Why is it that when I was in Vienna recently, there was an army guy walking around with an Uzzi, but I didn’t have to take my shoes off? Only when I landed in the US did I need to have my shoes checked. Vienna — gateway to the Middle East, and they’re not worried about shoes?

– And what is the real number of confiscated illegal goods? It’s supposed to be “in the millions”, but how many of those were hair spray bottles and lighters?

As someone involved in security, I get the problem. But also, as someone involved in security, I am aggravated by unnecessary actions, because putting aside the hassle factor, unnecessary actions actually degrade your security posture. By focusing on confiscating perfume bottles, the TSA isn’t spending the time on doing the right things. Even something as simple as having a trained agent simply look at passengers is a powerful measure. Can’t do that if you’re worried about shampoo and removing shoes.

To the TSA folks that read this blog: Peace. I’m not attacking you. I think you’re all dealing with an enormous task, and I respect the hard work you have to do — often without any thanks. So thank you for the hard work you do — really. But I’m trying to help you here.

Let’s rethink airline security. Let’s focus on what has really worked and makes sense (good intel, locked cockpit doors, higher passenger awareness, x-raying of checked bags, etc.) and get rid of the purposeless additional cautions. Because that’s making us less secure, not more.

Alex Eckelberry

12/3/2008 Correction/Clarification: This is not technically the Ask Toolbar. It’s actually a STOPzilla toolbar that uses Ask search results. More here.

Yet another security vendor succumbs to bundling the Ask Toolbar with their product — and again, pre-selected (and when you go to uninstall the STOPzilla, you’re still left with the Ask Toolbar to uninstall).

This is getting gross.

Ask pays handsomely for these bundling arrangements, but is money ever that important that you would treat a customer this way?

It seems most people feel the same way I do — previous comment storms here (Zone Labs) and here (WebRoot). However, there are always the apologists. Feel free to post your opinion.

Alex Eckelberry
(And thank for the heads-up, Scoobie)

Most, if not all, of the pages we discussed in our post on Wednesday about Blogger sites pushing fake codecs have been removed by Google.

However, we still continue to see a good number of sites pushing fake codecs.

Example:

For the most part, these go to a site which looks like this:

(Notice the attempt to push a fake video about the Bhutto assassination. They watch for the hottest keywords and then roll those out.)

And when you click, you get this:

Very deceiving.

Here are sites we found — there are certainly more (“.” replaced with a space):

abceuropewhere blogspot com
alertsukvideo blogspot com
americacnnalerts blogspot com
ballhoneys coachesreview com
beginverymore blogspot com
blogpaperalerts blogspot com
catchabctoday blogspot com
catchredtarget blogspot com
cnnredfree blogspot com
crisiscnnbehind blogspot com
crisistodaytoday blogspot com
cueorgtag blogspot com
diglivingvideo blogspot com
directblogtour blogspot com
directeuropeget blogspot com
endblognet blogspot com
endhotget blogspot com
europegovery blogspot com
europevideomy blogspot com
fallbehindcnn blogspot com
freeonlycue blogspot com
getnewyorkpress blogspot com
gettagfall blogspot com
hereenddigg blogspot com
hotfallcatch blogspot com
livingeuropefavor blogspot com
myfallalerts blogspot com
myfreecnn blogspot com
myusahot blogspot com
newadz blogspot com
newswheremore blogspot com
nonbeginliving blogspot com
noncrisisusa blogspot com
nowtodaynow blogspot com
onepollssnap blogspot com
oneputliving blogspot com
onlinemoresupra blogspot com
orgnewshot blogspot com
orgpaperusa blogspot com
orgveryuk blogspot com
paperwhytag blogspot com
radioorgdig blogspot com
radioukradio blogspot com
redpaperdigg blogspot com
redputalerts blogspot com
sharpnewscnn blogspot com
sharpredhot blogspot com
tagabcget blogspot com
tagdigdig blogspot com
tagsuprainfo blogspot com
taguktag blogspot com
targetdiggorg blogspot com
tourfreecue blogspot com
touronlyput blogspot com
ukusaliving blogspot com
usamoreblur blogspot com
verybeginradio blogspot com
verybehindamerica blogspot com
videolivingwhy blogspot com
whyredput blogspot com
whytodayusa blogspot com

What can you do? Feel free to report these sites when you find them to Google — through this link.

And Google’s filters need to do more, such as looking for links within blogs to known malware sites — in this case, places like oyaebu, video(dot)googl(dot)name, etc.

Alex Eckelberry
(Thanks Adam Thomas)

Interesting:

Features sell. Period. Under the SaaS model, software manufacturers add features incrementally and on-demand to satisfy client requests as well as remain competitive. This sounds like a good thing to both buyers and manufacturers. It is not, at least not under the current market circumstances.

The market incentive for software manufacturers is to add as many features as possible because features are part of the beauty contest among software applications. Security is not. This means SaaS applications are guaranteed to have a continuous and relentless stream of ad-hoc features (over an above the rate at which features are added to their multi-instance cousins) each of which add more complexity to the application and the likelihood that one or more of those features contains a bug (at best) or a vulnerability (at worst).

Features then, are the distinguishing element among software manufacturers, SaaS or otherwise. So low-quality, feature-rich software tends to dominate, driving higher-quality, secure software from the market. There is really no such thing as a “final release” in SaaS, making SaaS a particularly dangerous form of software. Features, and therefore potential vulnerabilities, tend to dominate. As such, buyers will never be free from acting as crash test dummies for the manufacturer (and paying handsomely for the privilege).

Link here.

Alex Eckelberry
(Thanks, Laurie)

codecultra(dot)net

Pushes both Windows and Mac TrojanDNSChanger. Sample binaries: Mac: codecultra(dot)net/download/codecultra1123.dmg. Windows: codecultra(dot)net/download/codecultra1123.exe. And please — don’t touch these binaries unless you know what you’re doing, as they are live Trojans.

Alex Eckelberry
(Thanks Patrick Jordan)

A new rogue by the IEDefender group: files-secure from files-secure(dot)com.

As you can see, it’s a rebranded clone of IEdefender:

Patrick Jordan
Sunbelt Software Malware Research

Fake codec trojans (so-called “required” components to watch a video, but in fact are malicious trojans) are a plague on the Internet. We’ve written about them extensively.

Often, they are seen in porn sites. However, by doing a few simple searches today, we can see that they’re available to those simply doing American football pools, checking bank hours or searching for New Year’s eve clipart. All of these are taking advantage of the free Blogger service.

For example, here’s a search for “NFL playoff bracket video” on Google:

And here’s a search for a recipe for deviled eggs:

How about checking the holiday hours at B of A?

Generally, clicking on one of those links will bring up a page like this:

Which, when clicked, leads to a page pushing a fake codec (and one not very widely detected by AV engines, incidentally):

And, in another case, off of the “holiday hours” search above, we get a different fake codec being pushed:

Now, clicking on that link brings us to a website that tries to make you believe it’s a Google Video site:

(Malware researchers, just try googling “”christmas dinner prayer” site:blogspot.com” for a rash of results — or playing with other search terms in the sites.)

Here’s a list of some sites that I found on some searches — I’m sure there’s more:

zagadko(dot)blogspot(dot)com
xboxlivevidz(dot)blogspot(dot)com
xa4ubablo(dot)blogspot(dot)com
videokfda(dot)blogspot(dot)com
video-ase(dot)blogspot(dot)com
video-aa(dot)blogspot(dot)com
veryhotpaper(dot)blogspot(dot)com
theneeeez(dot)blogspot(dot)com
supekom(dot)blogspot(dot)com
sukanahi(dot)blogspot(dot)com
page47vidz(dot)blogspot(dot)com
modotvidz(dot)blogspot(dot)com
melancholyvidz(dot)blogspot(dot)com
maxjetvideoz(dot)blogspot(dot)com
lohanvideoz(dot)blogspot(dot)com
kdotvidz(dot)blogspot(dot)com
habbovideoz(dot)blogspot(dot)com
greetingsvidz(dot)blogspot(dot)com
gaizocd(dot)blogspot(dot)com
f-videoq(dot)blogspot(dot)com
europemyusa(dot)blogspot(dot)com
dubigom(dot)blogspot(dot)com
dubigom(dot)blogspot(dot)com
directusapolls(dot)blogspot(dot)com
daysprings(dot)blogspot(dot)com
daibabla(dot)blogspot(dot)com
cityscoopvidz(dot)blogspot(dot)com
chattingcom(dot)blogspot(dot)com
carrievideoz(dot)blogspot(dot)com
bjpvideoz(dot)blogspot(dot)com
babliko(dot)blogspot(dot)com
10xgoogle(dot)blogspot(dot)com

Again, these sites are pushing real trojans. Please don’t go there if unless you know what you’re doing.

(Note that I wouldn’t put this in the same league as the massive Google poisoning we saw last month. That was an epic attack, using exploits and all kinds of nasty tricks. However, this is something to be aware of, and hopefully the good folks at Google will take them down lickety-split.)

Alex Eckelberry
(Thanks to David Glosser for the heads-up on this)