driverrobot

[cleanmx]

may someone please have a look at this ?

threatexpert says this pice phones... home and reload others,

Code: [Select]

    * There were registered attempts to establish connection with the remote hosts. The connection details are:

Remote Host Port Number
174.142.111.68 443
174.142.111.72 80
72.55.171.158 80

    * The data identified by the following URLs was then requested from the remote web server:
          o http://debug.blitware.com/signs/record_sequence/v1/
          o http://blitware.com/client/update/v1/
virustotal nothing
anubis has no network activity...

strange...

Code: [Select]

http://cdn.driverrobot.com/static/download/clickbank/1.1.0.4/DriverRobot_Setup.exe
http://www.threatexpert.com/report.aspx?md5=13700871ab4d660ad398e36bd1ce9831
http://www.virustotal.com/analisis/3a0277d0dd6143dddbd9376660967debf5db32d7331a74b6a08ac35173bcc101-1254349700
http://support.clean-mx.de/clean-mx/anubis/216998.txt

http://www.bfk.de/bfk_dnslogger.html?query=87.248.203.7

[RS-232]

...it appears to be this one?
http://www.softpedia.com/get/System/System-Miscellaneous/Driver-Robot.shtml

Here's another ThreatExpert report about it in early September...
http://www.threatexpert.com/report.aspx?md5=fe2008a89b578d3fdf368add8ec5c0a5

[Serg]

Grayware... it's really hard to prove its malicious activity
http://en.wikipedia.org/wiki/Malware#Grayware   

[RS-232]

py2exe used there,for an app that is meant for dealing with...system drivers,
that is at least what i would call a pretty weird language choice...  
Also found this post here...whatever it might mean:
http://www.complaintsboard.com/complaints/blitwaredriver-robot-c239458.html