hs.2-215.zlkon.lv -(94.247.2.215)

[CkreM]

AV Fraud,all on the same IP: 94.247.2.215

Code: [Select]

http://downloadantivirusplus.com/setup.exe
http://av-plus-support.com/registration.html
http://Bestinternetexamine.com
http://safeyouthnet.com
http://theantivirusplus.com/setup.exe
http://downloadantivirusplus.com/setup.exe
http://linkcanpro.com
http://yournetascertain.com
http://websmartcheck.com
http://websportscheck.com
http://websecurecheck.com
http://internethomecheck.com
http://easywebscanlive.com
http://yourwebscanlive.com
http://linkcanlive.com
http://myinternetexamine.com
http://yourinternetexamine.com
http://easywebexamine.com
http://bestwebexamine.com
http://yourwebexamine.com
http://easynetcheckonline.com
http://bestnetcheckonline.com
http://yournetcheckonline.com

[SysAdMini]

Code: [Select]

myantivirusplus.com

[SysAdMini]

Code: [Select]

hxxp://yourguardpro.cn/installer_90001.exe
http://www.virustotal.com/analisis/0ca99080d7252f55aac81c78f032ee5f
http://www.threatexpert.com/report.aspx?md5=23cb553ce604959f3d39575813d8d48b

Code: [Select]

easyaddedantivirus.com/setup.exehttp://www.virustotal.com/analisis/6c71656d9fd1682e3a34704e403a06e4

[SysAdMini]

AV Fraud,all on the same IP: 94.247.2.215

Code: [Select]

http://downloadantivirusplus.com/setup.exe
http://av-plus-support.com/registration.html
http://Bestinternetexamine.com
http://safeyouthnet.com
http://theantivirusplus.com/setup.exe
http://downloadantivirusplus.com/setup.exe
http://linkcanpro.com
http://yournetascertain.com
http://websmartcheck.com
http://websportscheck.com
http://websecurecheck.com
http://internethomecheck.com
http://easywebscanlive.com
http://yourwebscanlive.com
http://linkcanlive.com
http://myinternetexamine.com
http://yourinternetexamine.com
http://easywebexamine.com
http://bestwebexamine.com
http://yourwebexamine.com
http://easynetcheckonline.com
http://bestnetcheckonline.com
http://yournetcheckonline.com

All dead.

[MysteryFCM]

Got 156

http://hosts-file.net/pest.asp?show=94.247.2.

Another 159 at;

http://hosts-file.net/pest.asp?show=94.247.3.

[SysAdMini]

Code: [Select]

easypersonalprotection.cn
freedefenseforyou.cn
mycheckdiseasepro.cn
mycheckdiseasestore.cn
mydefense4u.cn
mydefense4you.cn
myguardforyou.cn
newguard4u.cn
newguard4you.cn
refugepro.cn
yourguard4you.cn
yourguardforyou.cn
yourguardonline.cn
yourguardpro.cn

easyincomeprotection.cn/installer_90001.exe
easyaddedantivirus.com/setup.exe
yourcountedantivirus.com/setup.exe


[SysAdMini]

more Fake AV

Code: [Select]

addedantiviruslive.com/redirect.php
addedantiviruslive.com/se.exe
addedantiviruslive.com/setup.exe
addedantiviruslive.com/install/AntivirusPlus.exe
addedantiviruslive.com/install/InternetExplorer.dll
bigprotectionlive.cn/installer.exe
easybestprotection.cn/installer.exe

[GmG]

Code: [Select]

http://myascertainpoison.cn/?wm=70101
http://myascertainpoison.cn/installer_70101.exe


[SysAdMini]

redirects to Fake AV

Code: [Select]

examineillnesslive.cnFake AV

Code: [Select]

easycheckpoisonpro.cn/?
easydefenseonline.cn
bigdefense2u.cn

[Malware-Web-Threats]

FakeAV AntivirusPlus

Code: [Select]

hxxp://addedantivirusstore.com/setup.exe
hxxp://addedantivirusstore.com/se.exe
hxxp://myplusantiviruspro.com/setup.exe
hxxp://myplusantiviruspro.com/se.exe
hxxp://realantivirusplus.com/setup.exe
hxxp://realantivirusplus.com/se.exe
hxxp://yourguardstore.cn/setup.exe
hxxp://yourguardstore.cn/se.exe

setup.exe - VirusTotal: AntivirusPlus 23/40 (57.5%)
se.exe - VirusTotal 23/40 (57.5%)
se.exe - Anubis

Second download - setup.exe Anubis

Code: [Select]

hxxp://addedantiviruslive.com/install/AntivirusPlus_ba.exe
hxxp://addedantivirusstore.com/install/AntivirusPlus_ba.exe
hxxp://myplusantiviruspro.com/install/AntivirusPlus_ba.exe
hxxp://realantivirusplus.com/install/AntivirusPlus_ba.exe
hxxp://yourguardstore.cn/AntivirusPlus_ba.exe

AntivirusPlus_ba.exe VirusTotal: AntivirusPlus 20/40 (50%) - Anubis

Fake Error Page (redirect to hxxp://addedantiviruslive.com/buy.php?id=)

Code: [Select]

hxxp://myplusantiviruslive.com


[MysteryFCM]

Redirs if you've got Javascript enabled, from nickad.selfip.com (IP: 82.197.130.134) to;

http://yourfriskviruspro.cn/?wm=70127&l=1
IP: 94.247.2.215

Which downloads;

http://yourfriskviruspro.cn/installer_70127.exe

SWF (not checked it yet) at;

yourfriskviruspro.cn/6/images/errsnd.swf

/edit

Wepawet analysis of the SWF;

http://wepawet.cs.ucsb.edu/view.php?hash=4db493ad19020803168e4cd15c30dd23&type=swf

/edit 2

Results for the original wm= URL;

http://wepawet.cs.ucsb.edu/view.php?hash=16b84598f9b75c0657dbf4cd5a564aa5&t=1239501884&type=js

/edit 3

NOD detected the installer as Win32/Statik when I tried downloading it ..... gonna get a smoke and coffee and snag it with NOD disabled so I can VT it.

[Malware-Web-Threats]

Trojan downloader for AntivirusPlus

Code: [Select]

hxxp://bigcoverlive.cn/installer_1.exe
VirusTotal: Trojan FakePlus 20/39 (51.29%)

htaccess trick?

Code: [Select]

hxxp://bigcoverlive.cn/what_ever_you_want.exe
hxxp://bigcoverlive.cn/what/ever/you/want.exe

Anubis Analysis - installer_1.exe

From ANUBIS:1032 to 94.247.2.215:80 - [addedantiviruslive.com] 
Request: GET /cb/real.php?id= 
Response: 200 "OK" 
Request: GET /install/AntivirusPlus.exe 
Response: 200 "OK" 
Request: GET /cfg/dmns.cfg 
Response: 200 "OK" 
Request: GET /install/InternetExplorer.dll 
Response: 200 "OK" 

[Mr Clean]

Code: [Select]

http://bestfriskviruslive.cn/installer_90001.exe

$ dig bestfriskviruslive.cn +short
94.247.2.215

http://www.virustotal.com/analisis/8a32a4491b9f853e0ccdba6d3fb665e7  10/39


http://www.bfk.de/bfk_dnslogger.html?query=94.247.2.215#result

Code: [Select]

ns1.pubilcnameserver7.com A 94.247.2.215
addedantiviruslive.com A 94.247.2.215
searchrizotto.com A 94.247.2.215
easyaddedantivirus.com A 94.247.2.215
yourcountedantivirus.com A 94.247.2.215
av-plus-support.com A 94.247.2.215
yourguardonline.cn A 94.247.2.215
easydefenseonline.cn A 94.247.2.215
bestprotectiononline.cn A 94.247.2.215
yourguardstore.cn A 94.247.2.215
examinepoisonstore.cn A 94.247.2.215
freecoverstore.cn A 94.247.2.215
myexaminevirusstore.cn A 94.247.2.215
bestexaminedisease.cn A 94.247.2.215
yourfriskdisease.cn A 94.247.2.215
friskdiseaselive.cn A 94.247.2.215
bestdefenselive.cn A 94.247.2.215
bigprotectionlive.cn A 94.247.2.215
bigcoverlive.cn A 94.247.2.215
easyserviceprotection.cn A 94.247.2.215
easypersonalprotection.cn A 94.247.2.215
myascertainpoison.cn A 94.247.2.215
yourguardpro.cn A 94.247.2.215
refugepro.cn A 94.247.2.215
mycheckdiseasepro.cn A 94.247.2.215
yourcheckpoisonpro.cn A 94.247.2.215
bigdefense2u.cn A 94.247.2.215
newguard4u.cn A 94.247.2.215
mydefense4u.cn A 94.247.2.215
bestcover4u.cn A 94.247.2.215
freedefenseforyou.cn A 94.247.2.215
topfeed.biz A 94.247.2.215


http://www.threatexpert.com/report.aspx?md5=d3d76dd609947235df31c92881ada188

Code: [Select]

* The data identified by the following URLs was then requested from the remote web server:
http://addedantiviruspro.com/cb/real.php?id=1
http://addedantiviruspro.com/cb/installs.php?id=1

recommend adding ->    addedantiviruspro.com

[Malware-Web-Threats]

Code: [Select]

hxxp://addedantiviruspro.com/setup.exe
hxxp://addedantiviruspro.com/se.exe

VirusTotal: Fake Antivirus 12/40 (30%)
VirusTotal: Trojan 10/40 (25%)

[Malware-Web-Threats]

Following the Anubis report for setup.exe on addedantiviruspro.com

second download:

Code: [Select]

hxxp://addedantiviruspro.com/install/AntivirusPlus_ba.exe

Anubis Report

VirusTotal: Fake Antivirus 5/40 (12.83%)