XyliBox: rogue

Showing posts with label rogue. Show all posts

Sunday, 12 February 2012

Monday, 6 February 2012

AV Security Essentials is a fake Antivirus. This rogue displays fake alerts to scare users. It replaces Smart Anti-Malware Protection, Antivirus Smart Protection, Malware Protection Center, Internet Security Guard, Home Security Solutions, Home Safety Essentials, Anti-Malware Lab, System Smart Security, PC Security Guardian, Best Malware Protection, Internet Security Essentials, Smart Internet Protection 2011, Personal Internet Security 2011, Personal Security Sentinel, Internet Antivirus 2011, Internet Security Suite, Smart Security, My Security Shield, Security Master AV, My Security Engine, Security Guard, CleanUp Antivirus and Security Antivirus

To register (and help removal), enter this serial code: K7LY-R5GU-SI9D-EVFB or U2FD-S2LA-H4KA-UEPB

The following urls were found

http://secure1.personalsuiteydpz.com

http://secure2.saveantivirlqdi.com

http://secure1.personalsuiteydpz.com

http://www5.av-security-essentials.com/?uid=7&mid=54d478139f9a9764baead4fbf8f84bd7&StrWinOS=wvXP&bid=b_Unknown&sid=11111&ls=1&errors=0&nid=0&abbr=AVSE&pid=3

Thanks to Remixed for the sample :)

Sunday, 25 December 2011

Home Security Solutions

Not yet my last post for this year finally... wild fakeAV appeared !

Home Security Solutions is a fake Antivirus. This rogue displays fake alerts to scare users. It replaces Home Safety Essentials, Anti-Malware Lab, System Smart Security, PC Security Guardian, Best Malware Protection, Internet Security Essentials, Smart Internet Protection 2011, Personal Internet Security 2011, Personal Security Sentinel, Internet Antivirus 2011, Internet Security Suite, Smart Security, My Security Shield, Security Master AV, My Security Engine, Security Guard, CleanUp Antivirus and Security Antivirus

Loader:

Payload:

To register (and help removal), use one of these codes: K7LY-R5GU-SI9D-EVFB
K7LY-H4KA-SI9D-U2FD
U2FD-S2LA-H4KA-UEPB
Click on the Help icon, Register Now.
Enter the Serial code and click on Activate Product Key.

---

• dns: 1 ›› ip: 76.73.19.180 - adresse: WWW5.THEBEST-AV-FORYOU.COM

• dns: 1 ›› ip: 76.73.19.178 - adresse: SECURE1.SMARTWASUITE.COM

• dns: 1 ›› ip: 76.73.19.180 - adresse: SECURE1.THEBEST-ARMYFYA.COM

The following url was found:

• dns: 1 ›› ip: 76.73.19.180 - adresse: WWW5.THEBEST-AV-FORYOU.COM

• dns: 1 ›› ip: 76.73.19.178 - adresse: SECURE1.SMARTWASUITE.COM

• dns: 0 ›› ip: - adresse: SECURE2BESTIQI-GUARD.COM

• dns: 1 ›› ip: 76.73.19.180 - adresse: SECURE1.THEBEST-ARMYFYA.COM

• dns: 0 ›› ip: - adresse: REPORT2.OGPERTQEYTAGAHERT.COM

GET /?unbpahwn=kuTK4N7k6G%2BB3s3kuNfm587c2bPM0dfX5pqkyOHW4%2BKfp5GYnePbya2mmOuoa%2BbdyLWY5tbV6ObV%0D%0ApJGflamkXpShnaiekqCRmJ3P1MfirLrHhVTf0NSipZrezt2xkYs%3D HTTP/1.1

Host: report2.ogpertqeytagahert.com

GET /?gbifvbt=mOTK4N7k6G%2BP0tvZ29Po1ovu3cWkmI7c6LGl2ce9jc7SydvQ59eiu6a%2BzV%2BApK7FksW9qqmmubet%0D%0Ao47S29hrmKPRm5mhl6mb2qvGqaaoqJSP1MjUmdjW153frJXJxZ%2BLxb1yoKCemJOZjLiruK%2FHz8Tg%0D%0A36Cd5tWW0eWxoova1sPZnrC4xZqEyOG21damnaaSmtTO3NuvpFY%3D HTTP/1.1

Host: report2.ogpertqeytagahert.com

Thanks to Remixed for the sample.

PS: All your BH are belong to us.

btw, check your mail dude

Wednesday, 14 December 2011

Security Monitor 2012

According to S!Ri, Security Monitor 2012 is a fake security software (rogue). It is from the same family as: Security Solution 2011, Antivirus Antispyware 2011, AntiVirus System 2011, Security Inspector 2010, AntiVirus Studio 2010, Desktop Security 2010, Total PC Defender 2010, Desktop Defender 2010, Contraviro, UnVirex.

To register (and help removal), enter this serial code: LIC2-00A6-234C-B6A9-38F8-F6E2-0838-F084-E235-6051-18B3

The following urls was found:

Site:

• dns: 1 ›› ip: 46.21.148.212 - adresse: SECURITYMONITOR2012.COM

http://securitymonitor2012.com/0/

http://securitymonitor2012.com/buy/do

http://securitymonitor2012.com/themes/securityMonitor2012/js/ajax.js

http://securitymonitor2012.com/support/send

Landing/Malware download:

• dns: 1 ›› ip: 85.17.141.69 - adresse: NET-TESTNEWHARD.US

http://net-testnewhard.us/security/

http://net-testnewhard.us/site/

http://net-testnewhard.us/assets/

http://net-testnewhard.us/soft/

http://net-testnewhard.us/status/

http://net-testnewhard.us/work/

http://net-testnewhard.us/go/

http://net-testnewhard.us/scanner/

http://net-testnewhard.us/logs/

http://net-testnewhard.us/patch/

http://net-testnewhard.us/exe/

http://net-testnewhard.us/ldpatch/ 

http://net-testnewhard.us/sis/

Fraudulent payment processor:

• dns: 1 ›› ip: 31.214.133.99 - adresse: SECURE.ONLINESTARPAYMENT.COM

https://secure.onlinestarpayment.com/payment/?sku_name=SMONTR12_EN,SMONTR12_EN_00,SMONTR12_EN_01,ACTF_EN_01&aid=test&lid=therelid&affid=1&sku_checked={sku_checked}

Thanks to Malekal_morte for the sample ;)

Tuesday, 15 November 2011

System Fix

According to S!Ri (and thanks for the sample)
System Fix is a fake Defragmenter tool (rogue) from the same family as: System Restore, Data Restore, Data Recovery, Master Utilities, HDD Repair, System Repair, Windows XP Recovery, Windows Fix Disk, Windows Restore, Windows Repair, Windows Recovery, Windows Diagnostic, Windows Tool, WinScan, Disk Recovery, WinDisk, Windows Disk, Windows Scan, Memory Optimizer, Disk Optimizer, Good Memory, Fast Disk, Disk OK, My Disk, Memory Fixer, HDD Fix, HDD Low, Scanner, Disk Repair, Defragmenter, HDD Tools, Smart HDD, HDD Rescue, HDD Plus, HDDDiagnostic, Hard Drive Diagnostic, HDD Scan, Win Defragmenter, Win Defrag, Win HDD, Check Disk, Ultra Defragger, Quick Defragmenter, HDD Defragmenter, System Defragmenter

To register (and help removal), copy paste this code: 1203978628012489708290478989147
If your PC is infected with System Fix follow bleepingcomputer's removal guide.

The following urls was identified:

http://wiki-722866.com/up.php?0Q9oBPXEN0uECUgzEJ95RQsaiTvvq1aG3F/2q5oNowaH1WY=

http://leriverolfunt.com/up.php?0Q9oBPXWIF6ZDA8mH5Z+B1dJ3GOt5RbXhB247slCrknCijOH2Xr3T8jzCzQSupnV+MLLQYxn7xtAKGkjlPDWiEa3HBeIa2zlQTCZYmcOBul+G8jZpxTa5n4o1OVN3bFNoprYcHtcDRcVi63XA9oZTRL/fzJUhqAaPFPFXFXgP/s=

http://debcapluesub.com/up.php?0Q9oBPXWIF6ZDA8mH5Z+B1dJ3GOt5RbXhB247slCrknCijOH2Xr3T8jzCzQSupnV+MLLQYxn7xtAKGkjlPDWiEa3HBeIa2zlQTCZYmcOBul+G8jZpxTa5n4o1OVN3bFNoprYcHtcDRcVi63XA9oZTRL/fzJUhqAaPFPFXFXgP/s=

http://wiki-722866.com/britix/a

http://wiki-722866.com/cgi-bin/

http://wiki-722866.com/icons/

http://wiki-722866.com/customers/

http://wiki-722866.com/cat/

http://wiki-722866.com/usage/

http://wiki-722866.com/error/

http://leriverolfunt.com/new

http://leriverolfunt.com/customers/

http://leriverolfunt.com/test/

http://leriverolfunt.com/xp/

http://leriverolfunt.com/binaries/

http://leriverolfunt.com/test1/

http://debcapluesub.com/images/

http://debcapluesub.com/index/

http://debcapluesub.com/new/

http://debcapluesub.com/img/

http://debcapluesub.com/default/

http://debcapluesub.com/faq/

http://debcapluesub.com/icons/

http://debcapluesub.com/0/

http://debcapluesub.com/library/

http://debcapluesub.com/scripts/

http://debcapluesub.com/n/

http://debcapluesub.com/css/

http://debcapluesub.com/customers/

http://debcapluesub.com/application/

http://debcapluesub.com/styles/

http://debcapluesub.com/tickets/

http://debcapluesub.com/auth/

http://debcapluesub.com/sale/

http://debcapluesub.com/tmp/

http://debcapluesub.com/var/

Thursday, 10 November 2011

AV Security 2012

According to S!Ri (and thanks for the sample)
AV Security 2012 is a fake Antivirus. It is a clone of System Security 2011, AV Protection Online, Cloud Protection, Guard Online, AV Guard Online, Security Guard 2012, OpenCloud Security, OpenCloud Antivirus, BlueFlare Antivirus, Milestone Antivirus, Wireshark Antivirus, Sysinternals Antivirus, XJR Antivirus, AKM Antivirus 2010 Pro, Your PC Protector.

AV Security 2012 prevents legit softwares execution, displays fake alerts and blocks random Web pages.

If you need to clean your computer and AV Security 2012 is blocking legit cleaners execution, enter one of these serial to register:
1148762586
1171249582
1186796371
1196121858
1225242171
1354156739
1579859198
1789847197
1835437232
1837663686
1961232582
2285876582
2294654156
2343258649
2356258973
2619969432
2621948916
2676258959
2698736776
2819969298
2833525916
2838763789
2961332892
3541567625
3554156516
3619747186
3766368952
3787625649
3787693326
3798826765
3899836863
3924394865
3945638233
3961218556
4146739331
4159763697
4179195823
4235528916
4261328365
4261996943
4268761565
4281328365
4414895278
4439154958
4655834325
4723274453
5267873675
5268174898
5379885698
5688289871
5898714538
5919825316
5932169186
5956636198
6315563723
6376736918
6378962334
6526765122
6593439566
6613528235
6637321723
6641354156
6874821958
6899692327
7246526785
7414541691
7592174565
7614643697
7659421734
7715438456
7852676282
7885832169
8132856849
8135259195
8196345414
8196375436
8355259195
8355289195
8356392329
8367636975
8525752718
8558121691
8567493449
8593214778
8838996945
8857988267
8861321723
8874598414
9217234169
9217457527
9221581871
9285678582
9376471437
9378969331
9691962564
9859198478
9882676258
9972439689
9972665267

Kill code: 9992665263

If your PC is infected with Privacy Protection follow bleepingcomputer's removal guide.

Sunday, 6 November 2011

Privacy Protection

Privacy Protection is a fake Antivirus tool. It is from the same rogue family as Malware Protection, Spyware Protection, Advanced Security Tool 2010, Security Central, Home Personal Antivirus, XP Deluxe Protector, Win PC Antivirus, Win PC Defender, XP Police Antivirus, IE-Security, WinDefender 2009 and Total Secure 2009.

The rogue detects fake infections and prevents legit softwares execution, displaying alert messages to scare users.

To register (and help removal) enter the following serial with any email: Y76REW-T65FD5-U7VBF5A
If your PC is infected with Privacy Protection follow bleepingcomputer's removal guide.

Thursday, 27 October 2011

Security Defender

Since some days, this *old* FakeAV Html based seem make more noise than usual on VT.
Fake scanner pages/installer dies after hours and respawn to new locs.

To register (and help removal), copy paste this code: D13F-3B7D-B3C5-BD84

Network activity:

scan81.beatok.in/index.php?Q/Dhb9RBbZ1GTnqIM+VN0STaBd676GNVrWL+4hBE54uCmiABiN8+/AO54gjstFigswyk3iIAH4E07JmQo8TLaVryOyWM0+C3PrVRPRcxu7kPZRqGRULnM61f4F6Hhma5yRkmrPGCmjPhTvSVnqtuKfsBii3ftxW4RuHDIksADjjtN9Y9iBDtQUr0DAEeMX8/qw6hAJ/6k8s= 

http://94.199.49.61/jPhnBSWoCa0qt12dsD5SPN25RN66jx4pZXooc095hwhTyJR6ljVFVnzEi0NhHEbaaa2+9zhz9h1GtWo2Htzgm/7rz5OgdAG/E95vrYHh2vLAsG2K7txRoUOMQgF27FO9yNJR24fc1phuGe65uK2D0/ELfY/7wr4Iwuhi3JSBD92tjD72ChY7VmwOthlS/bfZZkASuqJWxBg=

http://94.199.49.61/l.php?aff_id=211&u={5129F7AA-8EAF-F8FD-3532-B0D0287A637B}&log_id=12

http://94.199.49.61/sw/211/1/{5129F7AA-8EAF-F8FD-3532-B0D0287A637B}/6be8ee50-2fc8-44c3-aab3-0d5998f4270a/b.dat

http://94.199.49.61/aRuPRgeys/SnfD9qA6Q+RWlrADDs/pXLtzLuvt2P77N+Zz2DwNt2GmUfJAH9orLy1oqgPW6u8yiMiivq3+aW4rsmfZ7a1sCY2Y7OioeCTfkgdA==

(Sample found yesterday) Security Defender.dll 1/43: >> 2.3%
https://www.virustotal.com/file-scan/report.html?id=2e7141d6a7e94b7c97aa69a9f0283f5c474b70b82a31fa097ecf005071359be7-1319709080

(Sample found today) Security Defender2.dll: 0/43 >> 0.0%
https://www.virustotal.com/file-scan/report.html?id=3748c5d7e866e1ff37b2c5b9b502a6f36f2524e3047fd2fb22553e1f858148f9-1319710208

Sunday, 23 October 2011

System Security 2011

System Security 2011 is a fake Antivirus. It is a clone of AV Protection Online, Cloud Protection, Guard Online, AV Guard Online, Security Guard 2012, OpenCloud Security, OpenCloud Antivirus, BlueFlare Antivirus, Milestone Antivirus, Wireshark Antivirus, Sysinternals Antivirus, XJR Antivirus, AKM Antivirus 2010 Pro, Your PC Protector.

System Security 2011 prevents legit softwares execution, displays fake alerts and blocks random Web pages.

If you need to clean your computer and System Security 2011 is blocking legit cleaners execution, enter one of these serial to register:
1148762586
1171249582
1186796371
1196121858
1225242171
1354156739
1579859198
1789847197
1835437232
1837663686
1961232582
2285876582
2294654156
2343258649
2356258973
2619969432
2621948916
2676258959
2698736776
2819969298
2833525916
2838763789
2961332892
3541567625
3554156516
3619747186
3766368952
3787625649
3787693326
3798826765
3899836863
3924394865
3945638233
3961218556
4146739331
4159763697
4179195823
4235528916
4261328365
4261996943
4268761565
4281328365
4414895278
4439154958
4655834325
4723274453
5267873675
5268174898
5379885698
5688289871
5898714538
5919825316
5932169186
5956636198
6315563723
6376736918
6378962334
6526765122
6593439566
6613528235
6637321723
6641354156
6874821958
6899692327
7246526785
7414541691
7592174565
7614643697
7659421734
7715438456
7852676282
7885832169
8132856849
8135259195
8196345414
8196375436
8355259195
8355289195
8356392329
8367636975
8525752718
8558121691
8567493449
8593214778
8838996945
8857988267
8861321723
8874598414
9217234169
9217457527
9221581871
9285678582
9376471437
9378969331
9691962564
9859198478
9882676258
9972439689
9972665267

Kill code: 9992665263

Network activity:

http://ourdatatransfers.com/gate.php

http://pickviewonline.com/sp.php?adv=6575&who=S

http://storeordersonline.com/sig/?id=6575&system=6.0.2900|5.1.3|1036&mx=11&hwid=000C29EBC45369B9499E&n=tuI02D4tbXiA%2BDLeMjQ0C8Wpd51qB6%2BfknYtNas%3D

Thanks to remixed for the sample :)

Wednesday, 19 October 2011

AV Protection Online

AV Protection Online is a fake Antivirus. It is a clone of Cloud Protection, Guard Online, AV Guard Online, Security Guard 2012, OpenCloud Security, OpenCloud Antivirus, BlueFlare Antivirus, Milestone Antivirus, Wireshark Antivirus, Sysinternals Antivirus, XJR Antivirus, AKM Antivirus 2010 Pro, Your PC Protector.

AV Protection Online prevents legit softwares execution, displays fake alerts and blocks random Web pages.

If you need to clean your computer and AV Protection Online is blocking legit cleaners execution, enter one of these serial to register:
1148762586
1171249582
1186796371
1196121858
1225242171
1354156739
1579859198
1789847197
1835437232
1837663686
1961232582
2285876582
2294654156
2343258649
2356258973
2619969432
2621948916
2676258959
2698736776
2819969298
2833525916
2838763789
2961332892
3541567625
3554156516
3619747186
3766368952
3787625649
3787693326
3798826765
3899836863
3924394865
3945638233
3961218556
4146739331
4159763697
4179195823
4235528916
4261328365
4261996943
4268761565
4281328365
4414895278
4439154958
4655834325
4723274453
5267873675
5268174898
5379885698
5688289871
5898714538
5919825316
5932169186
5956636198
6315563723
6376736918
6378962334
6526765122
6593439566
6613528235
6637321723
6641354156
6874821958
6899692327
7246526785
7414541691
7592174565
7614643697
7659421734
7715438456
7852676282
7885832169
8132856849
8135259195
8196345414
8196375436
8355259195
8355289195
8356392329
8367636975
8525752718
8558121691
8567493449
8593214778
8838996945
8857988267
8861321723
8874598414
9217234169
9217457527
9221581871
9285678582
9376471437
9378969331
9691962564
9859198478
9882676258
9972439689
9972665267

Kill code: 9992665263

Network activity:
http://storeordersonline.com/sig/?id=8779&system=6.0.2900|5.1.3|1036&mx=11&hwid=000C29EBC45369B9499E&n=GFclHqmH4X46dWwhtcjadTVoaysOJBvnXAnrIQ%3D%3D

Thanks to remixed for the sample :)

Tuesday, 11 October 2011

Cloud Protection

Cloud Protection is a fake Antivirus. It is a clone of Guard Online, AV Guard Online, Security Guard 2012, OpenCloud Security, OpenCloud Antivirus, BlueFlare Antivirus, Milestone Antivirus, Wireshark Antivirus, Sysinternals Antivirus, XJR Antivirus, AKM Antivirus 2010 Pro, Your PC Protector.

Cloud Protection prevents legit softwares execution, displays fake alerts and blocks random Web pages.

If you need to clean your computer and Cloud Protection is blocking legit cleaners execution, enter one of these serial to register:
1148762586
1171249582
1186796371
1196121858
1225242171
1354156739
1579859198
1789847197
1835437232
1837663686
1961232582
2285876582
2294654156
2343258649
2356258973
2619969432
2621948916
2676258959
2698736776
2819969298
2833525916
2838763789
2961332892
3541567625
3554156516
3619747186
3766368952
3787625649
3787693326
3798826765
3899836863
3924394865
3945638233
3961218556
4146739331
4159763697
4179195823
4235528916
4261328365
4261996943
4268761565
4281328365
4414895278
4439154958
4655834325
4723274453
5267873675
5268174898
5379885698
5688289871
5898714538
5919825316
5932169186
5956636198
6315563723
6376736918
6378962334
6526765122
6593439566
6613528235
6637321723
6641354156
6874821958
6899692327
7246526785
7414541691
7592174565
7614643697
7659421734
7715438456
7852676282
7885832169
8132856849
8135259195
8196345414
8196375436
8355259195
8355289195
8356392329
8367636975
8525752718
8558121691
8567493449
8593214778
8838996945
8857988267
8861321723
8874598414
9217234169
9217457527
9221581871
9285678582
9376471437
9378969331
9691962564
9859198478
9882676258
9972439689
9972665267

Kill code: 9992665263

If your PC is infected with Cloud Protection, follow Bleeping Computer's removal guide.

Thanks to S!Ri for the sample ;)

Saturday, 8 October 2011

Guard Online

Guard Online is a fake Antivirus. It is a clone of AV Guard Online, Security Guard 2012, OpenCloud Security, OpenCloud Antivirus, BlueFlare Antivirus, Milestone Antivirus, Wireshark Antivirus, Sysinternals Antivirus, XJR Antivirus, AKM Antivirus 2010 Pro, Your PC Protector.

Guard Online prevents legit softwares execution, displays fake alerts and blocks random Web pages.

If you need to clean your computer and Guard Online is blocking legit cleaners execution, enter one of these serial to register:
1148762586
1171249582
1186796371
1196121858
1225242171
1354156739
1579859198
1789847197
1835437232
1837663686
1961232582
2285876582
2294654156
2343258649
2356258973
2619969432
2621948916
2676258959
2698736776
2819969298
2833525916
2838763789
2961332892
3541567625
3554156516
3619747186
3766368952
3787625649
3787693326
3798826765
3899836863
3924394865
3945638233
3961218556
4146739331
4159763697
4179195823
4235528916
4261328365
4261996943
4268761565
4281328365
4414895278
4439154958
4655834325
4723274453
5267873675
5268174898
5379885698
5688289871
5898714538
5919825316
5932169186
5956636198
6315563723
6376736918
6378962334
6526765122
6593439566
6613528235
6637321723
6641354156
6874821958
6899692327
7246526785
7414541691
7592174565
7614643697
7659421734
7715438456
7852676282
7885832169
8132856849
8135259195
8196345414
8196375436
8355259195
8355289195
8356392329
8367636975
8525752718
8558121691
8567493449
8593214778
8838996945
8857988267
8861321723
8874598414
9217234169
9217457527
9221581871
9285678582
9376471437
9378969331
9691962564
9859198478
9882676258
9972439689
9972665267

Kill code: 9992665263

If your PC is infected with Guard Online, follow Bleeping Computer's removal guide.

The following urls was identified:

http://ourbigbooklibrarry.com/r.php?vx=17&os=xp&id=6575&hwid=000C29EBC45369B9499E&ver=15&p=2&av=none&wd=0&ad=1 

http://ourbigbooklibrarry.com/r.php?vx=17&os=na&id=6575&hwid=000C29EBC45369B9499E&ver=15&p=3&key=5267873675 

http://storeordersonline.com/sig/?id=6575&system=6.0.2900|5.1.3|1036&mx=11&hwid=000C29EBC45369B9499E&n=kn5G%2Fmy%2B9g25Y

http://storeordersonline.com/sig/successed

Thanks to Grinler for the sample ;)

Thursday, 6 October 2011

AV Guard Online

AV Guard Online is a fake Antivirus. It is a clone of Security Guard 2012, OpenCloud Security, OpenCloud Antivirus, BlueFlare Antivirus, Milestone Antivirus, Wireshark Antivirus, Sysinternals Antivirus, XJR Antivirus, AKM Antivirus 2010 Pro, Your PC Protector.

AV Guard Online prevents legit softwares execution, displays fake alerts and blocks random Web pages.

If you need to clean your computer and AV Guard Online is blocking legit cleaners execution, enter one of these serial to register:
1148762586
1171249582
1186796371
1196121858
1225242171
1354156739
1579859198
1789847197
1835437232
1837663686
1961232582
2285876582
2294654156
2343258649
2356258973
2619969432
2621948916
2676258959
2698736776
2819969298
2833525916
2838763789
2961332892
3541567625
3554156516
3619747186
3766368952
3787625649
3787693326
3798826765
3899836863
3924394865
3945638233
3961218556
4146739331
4159763697
4179195823
4235528916
4261328365
4261996943
4268761565
4281328365
4414895278
4439154958
4655834325
4723274453
5267873675
5268174898
5379885698
5688289871
5898714538
5919825316
5932169186
5956636198
6315563723
6376736918
6378962334
6526765122
6593439566
6613528235
6637321723
6641354156
6874821958
6899692327
7246526785
7414541691
7592174565
7614643697
7659421734
7715438456
7852676282
7885832169
8132856849
8135259195
8196345414
8196375436
8355259195
8355289195
8356392329
8367636975
8525752718
8558121691
8567493449
8593214778
8838996945
8857988267
8861321723
8874598414
9217234169
9217457527
9221581871
9285678582
9376471437
9378969331
9691962564
9859198478
9882676258
9972439689
9972665267

Kill code: 9992665263

The following urls was identified:

http://ourbigbooklibrarry.com/r.php?mx=7&id=6575&ver=14&hwid=000C29EBC45369B9499E&p=2&os=xp&av=none&wd=0&ad=1 

http://storeordersonline.com

/sig/?id=6575&system=6.0.2900|5.1.3|1036&mx=11&hwid=000C29EBC45369B9499E&n=GFdU6S2F42V5ThrCMYr0DlWdg90H9Hg%3D

http://ourbigbooklibrarry.com/r.php?mx=7&id=6575&ver=14&hwid=000C29EBC45369B9499E&p=3&os=na&key=9859198478

Thanks to Remixed for the sample ;)