dont mean to spam but i got some info on the domain name the info was being sent to:
[Only registered and activated users can see links. Click Here To Register...]
[Only registered and activated users can see links. Click Here To Register...]
and here is the name of the trojan that has been the source of 'pain in my ass' :
TROJ_GEN.0Z0313S
&
PE_CORELINK.C-1
its tried several ports incoming and outgoing, these are the favorites :
5006
1433
21
12200
80
8080
8008
8018
and now i am getting it from this ip address (before it jumped around a few random ip address, now that i have blocked all the other ports thru my router, its steady from this address):
213.218.154.210
seems to be an apache server setup, i guess trying to get thru other ports to retrieve its information
and i still see this guy posting in other threads, and avoiding this one . . .