Malware Related > Eurohost LLC

91.212.65.29

(1/2) > >>

SysAdMini:
Fake AV

--- Code: ---trucount3001.com/cgi-bin/promo.pl?code=0000657
--- End code ---
http://www.virustotal.com/analisis/c14d9e4b0795e6e5b781d157d6efb60a 12/39



--- Code: ---onlinescanxpp.com/land/eurl/1.php?code=
--- End code ---
downloads

--- Code: ---antivirus-xppro-2009.com/cgi-bin/download.pl?code=00000001
--- End code ---
http://www.virustotal.com/analisis/785faaf2ff1ed2a3f5580aa7db69fcb5 7/39

SysAdMini:
Fake scanner page

--- Code: ---free-webscaners.net/disk/?code=170
--- End code ---

downloads

--- Code: ---trucount3001.com/cgi-bin/install.pl?adv=170
--- End code ---
http://www.virustotal.com/analisis/4b5312951cadde90314a58f805590155 9/40

SysAdMini:
Fake scanner page

--- Code: ---freewebscaners.org/scan3/?code=674
--- End code ---

downloads

--- Code: ---trucount3002.com/cgi-bin/install.pl?adv=674
--- End code ---
http://virscan.org/report/eb1478d8ee1d7a7b6849cbffc6dab277.html 6/38

SysAdMini:

--- Code: ---trucount3002.com/cgi-bin/promo.pl?code=0000276
--- End code ---
http://www.virustotal.com/analisis/2af7aadc41ba17e4f5889d02201671780a5e1b716f8d4b3872ae7391df847a8f-1243018061 16/38

downloads

fake av config file

--- Code: ---onlinescanxppp.com /?a=conf&code=276
--- End code ---

--- Code: ---#config#html_to_replace=http://onlinescanxppp.com/?a=html&code=276
is_html=1
html_replace_counter=10
replaces=10
html_url=http://onlinescanxppp.com/?a=html&code=276
pop_url=http://onlinescanxppp.com/?a=pop&q=%s&code=276
explorer_url=http://onlinescanxppp.com/land/eurl/?code=276
404_url=http://onlinescanxppp.com/?a=404&code=276
ruler_url=http://onlinescanxppp.com/?a=ruler&code=276
ruler_on=1
exlude_urls=antivirus-xppro2009.com
#/config#
--- End code ---

leads to Fake AV

--- Code: ---antivirus-xppro2009.com/cgi-bin/download.pl?code=276
--- End code ---
http://www.virustotal.com/analisis/a91b87215e7940297d202759fa765b1aecdf0be980f4753383744323dee030e1-1243019304
 10/35

JohnC:

--- Code: ---advanced-virusremover2009.com/cgi-bin/download.pl?code=00000000
--- End code ---

http://www.virustotal.com/analisis/4016e727a4dd4475363c17f1aaa0ef06c6c30c13836c0e26a02fe4b885fcea7c-1243632085

This site is listed on the following nameservers:
ns1.megahostname.biz    91.212.65.10
ns2.megahostname.biz    91.212.65.29

Navigation

[0] Message Index

[#] Next page