« Another Storm Worm Rootkit domain name - familypostcards2008.com
Security Flaw in Vista and XP - Rootkit exploit in the wild »

New Storm Worm Rootkit Domain happy2008toyou.com appears on the stroke of Midnight

Another Storm Worm domain as popped up on the radar,

happy2008toyou.com

The whois…

Domain name:             HAPPY2008TOYOU.COM
Name Server:             ns.happy2008toyou.com 68.251.106.142
Name Server:             ns10.happy2008toyou.com 89.35.121.187
Name Server:             ns11.happy2008toyou.com 58.9.65.61
Name Server:             ns12.happy2008toyou.com 222.209.139.28
Name Server:             ns13.happy2008toyou.com 82.59.136.43
Name Server:             ns2.happy2008toyou.com 68.36.252.81
Name Server:             ns3.happy2008toyou.com 71.230.66.163
Name Server:             ns4.happy2008toyou.com 68.61.185.117
Name Server:             ns5.happy2008toyou.com 70.232.142.1
Name Server:             ns6.happy2008toyou.com 66.75.86.71
Name Server:             ns7.happy2008toyou.com 85.29.202.180
Name Server:             ns8.happy2008toyou.com 86.139.75.35
Name Server:             ns9.happy2008toyou.com 86.130.251.39
Creation Date:           2007.12.29
Updated Date:            2007.12.29
Expiration Date:         2008.12.29
Status:                  DELEGATED
Registrant ID:           X05O1TC-RU
Registrant Name:         Larry Claus
Registrant Organization: Larry Claus
Registrant Street1:      1874 str.  office 923
Registrant City:         Los-Angeles
Registrant State:        CA
Registrant Postal Code:  320784
Registrant Country:      US
Administrative  Technical Contact
Contact ID:              X05O1TC-RU
Contact Name:            Larry Claus
Contact Organization:    Larry Claus
Contact Street1:         1874 str.  office 923
Contact City:            Los-Angeles
Contact State:           CA
Contact Postal Code:     320784
Contact Country:         US
Contact Phone:           1 320 5216723
Contact E-mail:          larryknower931@yahoo.com

Registrar:               ANO Regional Network Information Center dba RU-CENTER
Last updated on 2008.01.01 03: 36: 27 MSK/MSD

The full list of domains we currently have is:

familypostcards2008.com
freshcards2008.com
happy2008toyou.com
happycards2008.com
happysantacards.com
hellosanta2008.com
hohoho2008.com
newyearcards2008.com
newyearwithlove.com
parentscards.com
postcards-2008.com
Santapcards.com
Santawishes2008.com

The filename downloaded is happy_2008.exe

Most Virus Scanners find it,

Have a happy New Year,

Keep Safe,

regards,

Steo

This entry was posted on Tuesday, January 1st, 2008 at 12:54 am and is filed under News, Microsoft, New Rootkits, E-Cards, Rootkit Scanners, Other Malware, McAfee, wincom32, peacomm, Analysis, Nuwar, Storm Worm, Rootkit Unhooker. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.

2 Responses to “New Storm Worm Rootkit Domain happy2008toyou.com appears on the stroke of Midnight”

  1. Henry Says:
    January 3rd, 2008 at 1:45 pm

    I found you looking for info on “http://happy2008toyou.com/”
    I knew I should not go to those links they send, but I am intrigued by the mentality of these people.
    I went there and it said it would start my download right away. I of course bailed out.
    Next step is to do a virus scan.

    Anyways, thanks for the information.
    Have a Happy 2008 :)

    Henry.

  2. domain name transfers Says:
    September 20th, 2008 at 6:57 pm

    domain name transfers…

    If you use your own custom domain (like mine at Moon River Photography ) on your SmugMug site, you’ ll want to check out this thread on Dgrin for some very important changes that are happening now….

Leave a Reply