hs.2-215.zlkon.lv -(94.247.2.215)

[SysAdMini]

Fake AV

Code: [Select]

ascertaindiseasepro.cn/?wm=70100
ascertaindiseasepro.cn/installer_70100.exehttp://www.virustotal.com/analisis/6a7fa1578f1a8374220f0366f10a98e7 19/40

[Malware-Web-Threats]

Fake error page:

Code: [Select]

hxxp://countedantiviruspro.com

Trojan Fake AV:

Code: [Select]

hxxp://addedantivirusonline.com/setup.exe
hxxp://addedantivirusonline.com/se.exe (InternetAntivirusPro.exe)
hxxp://addedantivirusonline.com/install/AntivirusPlus_ba.exe
hxxp://addedantivirusonline.com/install/AntivirusPlus.exe

VirusTotal: Trojan - 10/40 (25%)
VirusTotal: Trojan - 18/40 (45%)
VirusTotal: Trojan - 10/40 (25%)
VirusTotal: Trojan - 9/40 (22.5%)

Anubis Report
Anubis Report
Anubis Report
Anubis Report

Anubis Report for se.exe (InternetAntivirusPro.exe)

From ANUBIS:1037 to 94.247.2.216:80 - [searchopt7.com] 
Request: GET /cmd.php 
Response: 200 "OK" 

Anubis Report for AntivirusPlus.exe

TCP Connection Attempts:   
from ANUBIS:1740 to 220.175.36.102:139 

TCP Scans:   
50 IPs on Port 445
220.175.0.0/16

[Malware-Web-Threats]

Fake error page:

Code: [Select]

hxxp://bestcountedantivirus.com

[CkreM]

fake AV:

Code: [Select]

freecoveronline.cn
freedefense2u.cn
and the fake payment site:
https://secure-plus-payments.com/cgi-bin/nph-pr/pandora/softcore/buy_soft.php?productid=avplus3&advert=1