Transponder Gang Chronicles By Webhelper

Apologies for neglecting this thread

Major CWS Sites Update

CWS List Sorted By IP Address In Text Format
(IP and Domains ) Updated 11 Sept 2005

CWS Alpha Sort In Text Format
(Only Domains listed) Updated 11 Sept 2005

Full Read\More Info
====================================================================

In late August 2005, I was given a link by my friend Suzi of Spywarewarrior that was an IP address [removed] that ran a massive CWS infestations similar to that of the infamous vxiframe.biz infestations. Upon further research I found that this IP was also being used by two well known CWS porn sites along with an IP of Esthost/Estdomains as an 404 error page that calls a page called waite.html which also contains 195.225.177.33 in an IFRAME to load the IP automatically thus infesting users.
The waite.html page is an old scare scam for RazeSpyware. See Spywarewarrior Rogue Anti-Spyware listing for details. This waite.html page will only be seen about a second and then will close and the CWS infestations will begin. Below is what the page looks like without the live CWS link.

Full Read @ Webhelper
======================================================================
Webhelper's CWS Diaries

"One must know the past in order to understand the future, if one is to change the future"

Home |CWS Lists Main Index |
Updated: 27 November, 2005 10:46 AM

I. About The CWS Diaries
A. What The Dairies Are
B. Webhelper Definition of Cool Web Search or CWS for Short
C. Criteria I Use For My Investigative Research
II. Historical Overview of the CWS
CWS Groups Historical Overview From 2003 To Nov 2005
III. The Webhelper CWS Diaries
A. November 2005
IV. The CWS Groups and Their Histories (These will be added very soon)
A. Feel Media Group: from Datanotary.com to today's Martfinder.com
B. 008k.com - Petro-line Gang (looking-for.cc, lookfor.cc, searchv.com,)
C. AliBaba & 40 Loop Back Gang ( Hijacks to Searchadv.com as of 2005)
D. J Cactus Dimpy Gang (Most Dangerous of all Gangs)
E. VladZone (Slemshield, Slimfind, adslim.com)
F. Asher Nahmais (i–search.com, iexplorer.reg ) uses *.reg files to hijack with
G. Esthost,Estdomains,est-corp - Estonia group
H. Henry Bison (find4u.com) Finish/Estonia gang
I. Security Scam Hijackers
J. Coolwebsearch.com
K. Umaxsearch - searchadv.com (Russian affiliate program like Coolwebsearch.com
L. Wallace Sandford Defualt-Homepage-Networks Hijacker and Scare Scams for spydeleter till FTC closed down in 2004
V. CWS Sites Lists
A. CWS Sites Sorted By IP Address
B. CWS Sites Sorted By Domains
C. Specialisted CWS Lists By Groups
VI. Index Of Past CWS Writings

VII. Support Forums and Other Help Resources
A. CastleCops (Also provide support in other languages)
B. Spywarewarrior.com
C. Freedomlist.com
D. Carma Blog and Forum
E. Landzdown.com Adaware and Hijackthis Specialists
F. Bluetack (BISS) (Internet Security Solutions)
G. MVPS.org Host file
H. IE-Spyad - Eric Howes Blocking lists
I. Maddoktor2 (Spyware Beware)
VII. Additional Readings and Resources
A. Merijn's Cool Web Search Chronicles May 27, 2003 to April 17, 2004
B. The CLSID / BHO List / Toolbar Master List
This is the Master BHO and Toolbar list by Tony Klein and CastleCops
C. HijackThis log tutorial
D. ActiveX Objects (Downloaded Program Files) aka O16
E. Startup Programs List

Direct Link To Webhelper's CWS Diaries
=====================================================================


As of January 2, 2006, I now have all my CWS lists including the master in excel format online:


Sorted by IP Address (Text format) http://webhelper4u.com/CWS2/cwslists/cwsbyip.txt


Sorted by Domains (Text Format) http://webhelper4u.com/CWS2/cwslists/cwsalpha.txt


MS Office Excel format contains more indepth information on the sites listed.

http://webhelper4u.com/CWS2/cwslists/cwsmasterlist.xls

I have links to the excel viewer if needed:

http://webhelper4u.com/CWS/index.html

webhelper
============================================================================
The CWS Groups and Their Histories

Update: Jan 7

A: Feel Media Group: from Datanotary.com to today's Martfinder.com
B: 008k.com - Petro-line Gang
=====================================================
Jan 19

Razespyware and its whois CWS owner Pantier Co
Razespyware has been on the rise via CWS infestations and many are looking for information about them. razespyware.net which has the razespyware whois now shows a one Painter Co or aka Pant co who have been a known linked to the CWS world for a long time with its many porn sites.

In August 2005, I did a write up about a scare ad page for Razespyware that redirected to a major (vxiframe.biz- cactus @ asdbiz.biz) CWS infester and hijacker. Today Razespyware is being
used by many of the major CWS hijackers but it is their whois owner that I have made a PDF document about for today. Later I will be talking about the Nelroy Ltd. that is shown in the Company info page at their site.

August 2005 write up:

The CWS hackers look like they are starting to spread to what was once thought to be the safe part of the Internet!

http://webhelper4u.com/CWS/Research/screen…iteexploit.html

Jan 19, 2006 PDF on the Painter Co infestaions and Rzespyware installs:

http://webhelper4u.com/CWSDiaries/painter_…razespyware.pdf

Reprinted with permission by Webhelper
=================================================
CWS Sites Lists Updates Jan 22, 2006

Text format sorted by Domains (0 -Z)

http://webhelper4u.com/CWS2/cwslists/cwsalpha.txt

Text format sorted by IP addresses:


http://webhelper4u.com/CWS2/cwslists/cwsbyip.txt

Also the Master CWS list in Excel Spreadsheet format has been updated

http://webhelper4u.com/CWS2/cwslists/cwsmasterlist.xls

For all above an others see the CWS Main Index:
CWS Main Index

==============================================================


JAN 27
VladZone Sites Now in My Site - pass the word to block

These are linked to the CWS desktop take overs and scare ads for anti-spyware scams, so because of their history and their sites that are part of the desktop scare scams with CWS they are now going to all be listed at my site.

SMART-SECURITY.INFO, adslim.com, SLEMSHIELD.COM

Listing
http://webhelper4u.com/CWS/cws_vladzones.html

Screenshots of various scare scams that happen after you are infested.
****
http://www.webhelper4u.com/CWS/greg-search…screenshot.html
securityiguard
http://www.webhelper4u.com/CWS/Research/sc…ktopsearch.html
isrvs isearch

http://webhelper4u.com/CWS/Research/screen…pywarescam.html
slimshield scam - topantispywares

http://webhelper4u.com/CWS/Research/screen…re_tactics_.htm
trojan-spy.HTML.smitfraud.c and w32.hllp.spreda.b.spy

http://webhelper4u.com/CWS/Research/screen…idinfected.html
stealthSWs114.h!dll hoax

March 20 2006

Lots of Updates and More to come

Sites Listing Updates

http://webhelper4u.com/CWS2/cwslists/cwsalpha.txt

NOTE: As I have over 3500 sites listed,
sometimes a duplicate entry may be found which I am correcting but it will be slow

All sites listed here are either linked to sites that run exploits,
are found in the code of CWS files that have been infested on computers,
or their whois with their mostly faked owners and or emails are
registered to other domains that run the CWS exploits.

http://webhelper4u.com/CWS2/cwslists/cwsbyip.txt

NOTE: As I have over 1400 sites listed,
sometimes a duplicate entry may be found.

All sites listed here are either linked to sites that run exploits,
are found in the code of CWS files that have been infested on computers,
or their whois with their mostly faked owners and or emails are
registered to other domains that run the CWS exploits.

http://webhelper4u.com/CWS2/cwslists/cwsmasterlist.xls

http://webhelper4u.com/CWS2/cwslists/groupssites.xls

(Group spreadsheet contains the worst of the worst)
Anything in red indicates a zero day exploit


Whois History Time Line of the Klik Gang and Rogues
Anti Spyware Apps
http://webhelper4u.com/CWSDiaries/Rogues_and_Klik_gang1.pdf

Rogues covered are:
Adwarebazooka.com
adwaredelete.com
Adwarepunisher.com
antivirus-gold.com
antivirus-gold.com
Hitvirus.com
razespyware.net
Remedyantispy.com
spydemolisher.com
Spyiblock.com
spysheriff.com
spytrooper.com
spywareno.com
thespyguard.com

All call:
traffweb.biz/dl/error.php

First zero day exploit:
traffweb.biz/dl/adv799/fillmemadv799.htm
traffweb.biz/dl/adv799/bag.htm

Second zero day exploit
traffweb.biz/dl/xpladv799.wmf

CHM exploit
traffweb.biz/dl/adv799/x.chm

ByteVerify Java Exploit
traffweb.biz/dl/adv799/loaderadv799.jar

Main Trojan Installer
traffweb.biz/dl/adv799/win32.exe

All these sites belong with the above traffweb and all call the traffweb.biz


85.249.19.122
wwise.biz
jason coffman
Philadelphia PA US
admin @ iframecash.biz

[removed]
8-extreme.biz
Gaylen Goldston
Belle Plaine KS US
admin @ toolbarweb.biz

[removed]
Gaylen Goldston
Belle Plaine KS US
abuse @ 8-extreme.biz

5-extreme.biz
4-extreme.biz
7-extreme.biz
6-extreme.biz
3-extreme.biz
2-extreme.biz
1-extreme.biz

[removed]
extrememoney.biz
Henry Nery
Henderson NV US
darkgt @ mail.ru


traffbest.biz
traffbucks.biz
traffcool.biz
traffdollars.biz
traffmoney.biz
traffnew.biz
traffsale1.biz
traffweb.biz

/progs/
ms1.txt
kl.txt
secure32.html
hosts.txt
toolbar.txt
de.txt
au.txt
us.txt
it.txt
paytime.txt
tool1.txt
tool2.txt
tool3.txt
tool4.txt
tool5.txt


Replacement for game4all.biz
217.107.217.184
traff4all.biz
D B kog
omsk RU
test @ test.ua

[external image: Posted Image] Webhelper