Need help? Click here to register for free! Absolutely zero advertisements on this site!

**$9736.22 of $21422.68**

Help CastleCops serve the community on new servers, Donate Here to reach our goal.

	Donation/Premium

	Donations. Become Premium Today!

	Security Central

	· Home · PIRT/Fried Phish · MIRT · SIRT · Deutsch · Wiki · Newsletter · O16/ActiveX · CLSID List · Contest2007 · Downloads · Feedback (send) · Forums · HijackThis · Hijacktrend · LSPs · My Downloads · O18 · O20 · O21 · O22 · O23 · O9 · Premium · Private Messages · Proxomitron · Reviews · Search · StartupList · Stories Archive · Submit News · WsIRT · Your Account · Acceptable Use Policy

Survey

MIRT^(TM)

Malware Incident Reporting and Termination^(TM) Squad

A global malware termination operation launched by CastleCops, the volunteer MIRT Squad is comprised of folks who report malware, investigate malware, and actively work on malware takedown and termination. MIRT is funded by CastleCops. Become a MIRT Squad terminator by reporting malware today!

[ How-To / FAQ ]

MIRT -> Confirmed Malware | Terminated Malware

status: confirmed malware

HTTP Response 06 Jul, 2008 03:09:29	HTTP/1.1 404 Not Found
ID	11299 (termination link)
Title	Trojan
Entry	http://web52.bwx2.de/index3.php
MIRT Squad Reporter	0
Timestamp	09 May, 2008 @ 13:21:49
Topic ID	221703 - Read/respond to MIRT commentary.
Handler Note: 13 May, 2008 00:18:12	tetak: Consumed following related reports: [11477] http://web52.bwx2.de/arch.exe
Handler Note: 13 May, 2008 00:20:01	tetak: arch.exe at this location is malware known as Trojan:Win32/Tibs.gen!G (Microsoft).
Handler Note: 13 May, 2008 00:20:32	tetak: View CIDR AS24900 Report: http://www.cidr-report.org/cgi-bin/as-report?as=24900 "24900 \| DE \| ripencc \| 2002-05-14 \| IPX-SERVER IPX Server GmbH"
Handler Note: 13 May, 2008 00:20:33	tetak: Extended information for AS24900: State/Province: Country: de Responsible Domain: ip-exchange.de Abuse Email: postmaster@ip-exchange.de
Handler Note: 13 May, 2008 00:24:02	tetak: Generated and sent email malware alert to respective parties.
Slaves	11477,

Report for at 09 May, 2008 @ 13:23:14

whois

at 09 May, 2008 @ 13:23:28

CastleCops Local Cached Whois at 2008-05-09 13:03:01 
 GeekTools Whois Proxy v5.0.4 Ready.
Checking access for CastleCops MIRT... ok.

Checking server [whois.denic.de]
Results:
% Copyright (c)2006 by DENIC
% Version: 1.07.5
%
% Restricted rights.
%
%
% Terms and Conditions of Use
%
% All the domain data that is visible in the whois search is protected
% by law. It is not permitted to use it for any purpose other than
% technical or administrative requirements associated with the
% operation of the Internet or in order to contact the domain holder
% over legal problems. You are not permitted to save it electronically
% or in any other way without DENIC's express written permission. It
% is prohibited, in particular, to use it for advertising or any similar
% purpose.
%
% By maintaining the connection you assure that you have a legitimate
% interest in the data and that you will only use it for the stated
% purposes. You are aware that DENIC maintains the right to initiate
% legal proceedings against you in the event of any breach of this
% assurance and to bar you from using its whois query.

Domain:      bwx2.de
Nserver:     server1-ns1.udagdns.net
Nserver:     server1-ns2.udagdns.net
Nserver:     server1-ns3.udagdns.net
Status:      connect
Changed:     2006-11-25T11:02:48+01:00

[Holder]
Type:         PERSON
Name:         Karsten Boldt
Address:      Europastr. A63-4
Pcode:        77933
City:         Lahr
Country:      DE
Changed:      2006-11-25T11:02:48+01:00

[Admin-C]
Type:         PERSON
Name:         Karsten Boldt
Address:      Europastrasse A63-4
Pcode:        77933
City:         Lahr
Country:      DE
Changed:      2004-10-13T13:18:08+02:00

[Tech-C]
Type:         ROLE
Name:         united-domains AG
Address:      Gautinger Str. 10
Pcode:        82319
City:         Starnberg
Country:      DE
Phone:        +49 8151 36867 0
Fax:          +49 8151 36867 77
Email:        hostmaster@united-domains.de
Remarks:      Bei Problemen mit dieser Domain setzen Sie sich
Remarks:      bitte mit unserem Support in Verbindung:
Remarks:      http://www.united-domains.de/support/
Remarks:      support@united-domains.de
Remarks:      Tel.: Mo-Fr, 09.00 bis 17.00 Uhr +49 (0)8151 36867 25.
Changed:      2003-07-05T16:56:26+02:00

[Zone-C]
Type:         ROLE
Name:         united-domains AG
Address:      Gautinger Str. 10
Pcode:        82319
City:         Starnberg
Country:      DE
Phone:        +49 8151 36867 0
Fax:          +49 8151 36867 77
Email:        hostmaster@united-domains.de
Remarks:      Bei Problemen mit dieser Domain setzen Sie sich
Remarks:      bitte mit unserem Support in Verbindung:
Remarks:      http://www.united-domains.de/support/
Remarks:      support@united-domains.de
Remarks:      Tel.: Mo-Fr, 09.00 bis 17.00 Uhr +49 (0)8151 36867 25.
Changed:      2003-07-05T16:56:26+02:00

Results brought to you by the GeekTools WHOIS Proxy
Server results may be copyrighted and are used with permission.
Your host (CastleCops MIRT) has visited 134 times today.

fetched page

at 09 May, 2008 @ 13:23:17
MD5 Fingerprint: be5a1ee7385b8c7e09af4359011e690a
SHA1 Fingerprint: f3b46167b460ff389df8c4e67db0f3e42f25680e

Version 1.0


	2002-2008 � Computer Cops LLC dba CastleCops®. All rights reserved. Acceptable Use Policy. Use signifies your agreement. 153ppm 3.785s (3.167s) Making cybercriminals unhappy since 2002*

MIRT^(TM)

Malware Incident Reporting and Termination^(TM) Squad

status: confirmed malware

Report for at 09 May, 2008 @ 13:23:14

whois

dig any

host

fetched page

Corresponding BGP Origin ASN

Possible BGP peer ASNs one AS hop away from BGP Origin ASN

AS Description of a given BGP ASN

MIRT(TM)

Malware Incident Reporting and Termination(TM) Squad

status: confirmed malware

Report for at 09 May, 2008 @ 13:23:14

whois

dig any

host

fetched page

Corresponding BGP Origin ASN

Possible BGP peer ASNs one AS hop away from BGP Origin ASN

AS Description of a given BGP ASN

MIRT^(TM)

Malware Incident Reporting and Termination^(TM) Squad