Flash's Security Blog

Antivirus 2010

2009-01-20T11:48:00.006+05:30

Antivirus 2010

Antivirus 2010 is a Rogue application, donot download or install it on your system

These are the few sites that distribut Antivirus 2010:

Best-antivirus-2010-download.info
Best-antivirus-2010.info
Download-antivirus2010.info

Following are the screenshots related to the Rogue application:

Antivirus 2010

AntiSpywareDeluxe and AntiSpyDeluxe

2008-08-22T20:45:00.003+05:30

AntiSpywareDeluxe and AntiSpyDeluxe

Domain Name: Antispywaredeluxe.com
Status: ok
Registrar: ESTDOMAINS, INC.
Whois Server: whois.estdomains.com
Referral URL: http://www.estdomains.com/
Expiration Date: 2009-02-03
Creation Date: 2008-02-03
Last Update Date: 2008-04-04
Name Servers:
ns.antispywaredeluxe.com
ns1.us.editdns.net
ns2.us.editdns.net
ns3.us.editdns.net
Extended Info IP Address: 67.205.75.9
Website Status: active
Server Type: lighttpd/1.4.18
Alexa Trend/Rank: 1 Month: 2,303,620 3 Month: 1,579,144
Page Views per Visit: 1 Month: 1 3 Month: 1.1
Cache Date: 2008-08-22 09:18:10 MST
Compare Archived Data: 2008-03-24
------------------------------------------------------------

Domain Name: Antispydeluxe.com
Status: clientTransferProhibited
Registrar: ESTDOMAINS, INC.
Whois Server: whois.estdomains.com
Referral URL: http://www.estdomains.com/
Expiration Date: 2009-08-18
Creation Date: 2008-08-18
Last Update Date: 2008-08-18
Name Servers: ns1.antispysoftware08.com ns2.antispysoftware08.com
Extended Info IP Address: 200.63.42.145
Website Status: active
Server Type: Apache/1.3.41 (Unix) PHP/5.2.6 mod_ssl/2.8.31 OpenSSL/0.9.8b mod_perl/1.29 FrontPage/5.0.2.2510
Cache Date: 2008-08-22 09:22:24 MST
Compare Archived Data: 2008-08-19

AntiSpywareDeluxe

AntiSpyDeluxe

More new Fake Codec sites

2008-07-25T16:52:00.002+05:30

Some more new Fake codec sites distributing DNS changer Trojans.

avicodec.net
best-codec.com
cleancodec.net
demo-codec.net
democodec.net
end-codec.net
endcodec.net
hq-codec.net

Note that the the Registrars of the above sites is ESTDOMAINS.

Donot download or install any file from these sites.

New Fake codec sites

2008-07-18T16:50:00.002+05:30

New set of fake codec sites producing DNS changer Trojans.

Note that the Registrar of all these sites is ESTDOMAINS.

Stay away from them.

abc-codec.com
brakecodec.net
city-codec.com
citycodec.net
clean-codec.net
demo-codec.com
end-codec.com
firecodec.net
game-codec.com
giga-codec.com
hero-codec.com
hope-codec.com
hq-codec.com
ix-codec.com
jetcodec.net
megazcodec.com
nitrocodec.net
operacodec.com
qaz-codec.net
red-codec.net
spacecodec.net
storm-codec.com
uin-codec.net
ultracodec.net
viva-codec.com
white-codec.com
wotcodec.com
xero-codec.com
xvid-codec.org
zerocodec.net

AntiSpyware-2008

2008-07-02T15:56:00.011+05:30

AntiSpyware-2008 is a Rogue application

Following websites distribute AntiSpyware-2008:

antispyware-2008-download.com
antispyware-2008-download.net
antispyware-2008-download.info
antivirus2008pro-download.com
antivirus2008pro-download.net
antivirus2008pro-download.info
antispyware2008-download.com
antispyware2008-download.net
antispyware2008-download.info
antivirus2008-pro.com
antivirus2008-pro.net
antivirus2008-pro.info
anti-spy-ware-2008.com
antispyware2008y.com

antispyware-2008.info

Screenshots:

Installation

It usually drops the following files n folders:

Fake scanner page:

TotalAntivirus

2008-07-01T18:48:00.005+05:30

Totalantivirus is a new rogue application

Totalantivirusonline.com

TotalAntivirus

Domain Name: Totalantivirusonline.com
Status: ok
Registrar: DIRECTI INTERNET SOLUTIONS PVT. LTD. D/B/A PUBLICDOMAINREGISTRY.COM
Whois Server: whois.publicdomainregistry.com
Referral URL: http://www.publicdomainregistry.com
Expiration Date: 2009-03-31
Creation Date: 2008-03-31
Last Update Date: 2008-05-31
Name Servers:
ns1.mynick.name
ns2.mynick.name
ns3.mynick.name
ns4.mynick.name

IP Address: 72.233.81.107
IP Location: United States
Website Status: active
Server Type: Apache
Cache Date: 2008-07-01 07:05:50 MST

videopluginax.com , Porntubeguide.com

2008-04-25T16:11:00.004+05:30

Fake coedc sites:

Videopluginax.com
Porntubeguide.com

IP Address: 72.36.167.202

You will be prompted to download a codec to view the porn site, which inturn installs a Trojan on your system.

Porntubeguide.com redirects you to Videopluginax.com for the downloads.

Stay away from this site.

This is how the desktop will look after the infection:

You would also be redirected to SystemErrorFixer.com n display the following:

Clicking on the image in the center installs SystemErrorFixer, which is a Rogue application.

Real AntiVirus

2008-03-06T17:42:00.004+05:30

Real AntiVirus is a Rogue application and the Registrar of real-av.com is ESTDOMAINS

Stay away from this website.

Real AntiVirus

real-av.com

Domain Name: real-av.com
Status: clientTransferProhibited
Registrar: ESTDOMAINS, INC.
Whois Server: whois.estdomains.com
Referral URL: http://www.estdomains.com
Expiration Date: 2009-02-25
Creation Date: 2008-02-25
Last Update Date: 2008-02-25
Name Servers:
qw.cool-cool-websearch.com
wq.cool-cool-websearch.com

IP Address: 66.246.229.81
IP Location: United States
Website Status: active
Server Type: Apache/1.3.41 (Unix) mod_ssl/2.8.31 OpenSSL/0.9.8b PHP/4.4.8 mod_perl/1.29 FrontPage/5.0.2.2510
Cache Date: 2008-03-06 05:06:20 MST

AntiSpyStorm2008

2008-03-03T22:52:00.004+05:30

AntiSpyStorm2008 is a rogue application and the Registrar of AntiSpyStorm2008.com is ESTDOMAINS.

The rogue application @ Antispystorm2008.com Is same as the rogue application @ Antispystorm.com

But the verion is Different(for now). Check the screenshot below:

Antispystorm2008.com - 1.01.0044
Antispystorm.com - 1.01.0031

AntiSpyStorm2008

AntiSpyStorm @ AntiSpyStorm2008.com

AntiSpyStorm @ AntiSpyStorm.com

AntiSpyStorm2008.com

Domain Name: antispystorm2008.com
Status: clientTransferProhibited
Registrar: ESTDOMAINS, INC.
Whois Server: whois.estdomains.com
Referral URL: http://www.estdomains.com

Expiration Date: 2009-02-07
Creation Date: 2008-02-07
Last Update Date: 2008-02-07

Name Servers:
ns1.3fn.net
ns2.3fn.net

IP Address: 216.195.54.111
IP Location: United States
Website Status: active
Server Type: Apache/2.2.4 (Unix) PHP/4.4.4 mod_ssl/2.2.4 OpenSSL/0.9.7e-p1
Cache Date: 2008-03-03 10:10:35 MST

SpyMaxX

2008-03-03T22:06:00.006+05:30

SpyMaxX is a Rogue application and the Registrar of spymaxx.com is ESTDOMAINS.

Stay away from this website.

SpyMaxX

SpyMaxX.com

Domain Name: spymaxx.com
Status: clientTransferProhibited
Registrar: ESTDOMAINS, INC.
Whois Server: whois.estdomains.com
Referral URL: http://www.estdomains.com
Expiration Date: 2009-02-04
Creation Date: 2008-02-04
Last Update Date: 2008-02-04
Name Servers:
ns1.3fn.net
ns2.3fn.net

IP Address: 216.195.54.110
IP Location: United States
Website Status: active
Server Type: Apache/2.2.4 (Unix) PHP/4.4.4 mod_ssl/2.2.4 OpenSSL/0.9.7e-p1
Cache Date: 2008-03-03 09:30:22 MST

TheLastDefender

2008-03-03T16:46:00.004+05:30

TheLastDefender is a Rogue application and the Registrar of TheLastDefender.com is ESTDOMAINS.

Stay away from this website.

TheLastDefender

TheLastDefender.com

Domain Name: thelastdefender.com
Status: ok
Registrar: ESTDOMAINS, INC.
Whois Server: whois.estdomains.com
Referral URL: http://www.estdomains.com

Expiration Date: 2008-12-28
Creation Date: 2007-12-28
Last Update Date: 2008-02-26
Name Servers:
ns1.thelastdefender.com
ns2.thelastdefender.com

IP Address: 78.31.211.57
Website Status: active
Server Type: Apache/2.2.6 (FreeBSD)
Alexa Trend/Rank: 1 Month: 2,207,208
Page Views per Visit: 1 Month: 3.2
Cache Date: 2008-03-03 04:00:26 MST

Mpgapplication.com

2008-02-29T00:31:00.000+05:30

Mpgapplication.com Distributes Zlob Trojan

Make sure that you don’t install any application from this website.

Domain Name: mpgapplication.com
Status: clientTransferProhibited
Registrar: ESTDOMAINS, INC.
Whois Server: whois.estdomains.com
Referral URL: http://www.estdomains.com

Expiration Date: 2009-02-27
Creation Date: 2008-02-27
Last Update Date: 2008-02-27

Name Servers:
ns1.mpgapplication.com
ns2.mpgapplication.com

Extended Info IP Address: 85.255.118.180
IP Location: Ukraine
Website Status: active
Server Type: Apache/2.2.2 (Fedora)
Cache Date: 2008-02-28 04:43:39 MST

Wmvsolution.com

2008-02-29T00:28:00.002+05:30

Wmvsolution.com Distributes Zlob Trojan

Make sure that you don’t install any application from this website.

Domain Name: wmvsolution.com
Status: clientTransferProhibited
Registrar: ESTDOMAINS, INC.
Whois Server: whois.estdomains.com
Referral URL: http://www.estdomains.com

Expiration Date: 2009-02-27
Creation Date: 2008-02-27
Last Update Date: 2008-02-27

Name Servers:
ns1.wmvsolution.com
ns2.wmvsolution.com

Extended Info IP Address: 85.255.120.109
IP Location: Ukraine
Website Status: active
Server Type: Apache/2.2.2 (Fedora)
Cache Date: 2008-02-28 07:48:27 MST

TheSpyBot

2008-02-29T00:07:00.004+05:30

TheSpyBot is a Rogue application and TheSpyBot.com is regdt to ESTDOMAINS

Make sure that you don’t install any application from this website.

TheSpyBot

thespybot.com

Domain Name: thespybot.com
Status: clientTransferProhibited
Registrar: ESTDOMAINS, INC.
Whois Server: whois.estdomains.com
Referral URL: http://www.estdomains.com

Expiration Date: 2009-02-12
Creation Date: 2008-02-12
Last Update Date: 2008-02-13

Name Servers:
ns1.thespybot.com
ns2.thespybot.com

Extended Info IP Address: 78.108.183.32
Website Status: active
Server Type: nginx/0.5.33
Cache Date: 2008-02-28 10:47:53 MST

SpyWatchE

2008-02-29T00:00:00.003+05:30

SpyWatchE is a Rogue application and spywatche.com is regdt to ESTDOMAINS

Make sure that you don’t install any application from this website.

SpyWatchE

SpyWatchE.com

Domain Name: spywatche.com
Status: clientTransferProhibited
Registrar: ESTDOMAINS, INC.
Whois Server: whois.estdomains.com
Referral URL: http://www.estdomains.com
Expiration Date: 2009-02-12
Creation Date: 2008-02-12
Last Update Date: 2008-02-13
Name Servers:
ns1.spywatche.com
ns2.spywatche.com

IP Address: 78.108.183.33
Website Status: active
Server Type: nginx/0.5.33
Cache Date: 2008-02-28 10:44:59 MST

spacecodec.com

2008-02-07T17:57:00.000+05:30

Another Fake codec site regd to ESTDOMAINS.

This program is a DNS Changer trojan. It pretends to be a browser add-on for viewing porn which is actually a Trojan Horse program.

Stay away from this website.

spacecodec.com

Domain Name: spacecodec.com
Status: ok
Registrar: ESTDOMAINS, INC.
Whois Server: whois.estdomains.com
Referral URL: http://www.estdomains.com

Expiration Date: 2008-09-21
Creation Date: 2007-09-21
Last Update Date: 2008-02-05

Name Servers:
ns1.spacecodec.com
ns2.spacecodec.com
IP Address: 64.28.184.177
IP Location: United States
Website Status: active
Server Type: Apache/2.0.59 (FreeBSD) PHP/5.2.1 with Suhosin-Patch
Cache Date: 2008-02-07 04:32:09 MST

Lightcodec.com

2008-02-04T17:33:00.000+05:30

What a PITY, This website is active once again producing the DNS changer trojan after more than a year.

It seams that the snake has taken a big o turn to bite its own tail, but the game is not yet over!!!!!

Stay away from this website.

lightcodec.com

Domain Name: lightcodec.com
Status: ok
Registrar: ESTDOMAINS, INC.
Whois Server: whois.estdomains.com
Referral URL: http://www.estdomains.com

Expiration Date: 2008-09-21
Creation Date: 2007-09-21
Last Update Date: 2008-02-02

Name Servers:
ns1.lightcodec.com
ns2.lightcodec.com

IP Address: 64.28.184.176
IP Location: United States
Website Status: active
Server Type: Apache/2.0.59 (FreeBSD) PHP/5.2.1 with Suhosin-Patch
Cache Date: 2008-02-04 04:38:47 MST

Firecodec.com

2008-02-01T15:48:00.000+05:30

Another Fake Codec site Regd to ESTDOMAINS.

This program is a DNS Changer trojan. It pretends to be a browser add-on for viewing porn which is actually a Trojan Horse program.

Stay away from this website.

Firecodec.com

Domain Name: firecodec.com
Status: ok
Registrar: ESTDOMAINS, INC.
Whois Server: whois.estdomains.com
Referral URL: http://www.estdomains.com

Expiration Date: 2008-09-21
Creation Date: 2007-09-21
Last Update Date: 2008-01-29

Name Servers:
ns1.firecodec.com
ns2.firecodec.com

IP Address: 64.28.184.175
IP Location: United States
Website Status: active
Server Type: Apache/2.0.59 (FreeBSD) PHP/5.2.1 with Suhosin-Patch
Cache Date: 2008-02-01 03:10:18 MST

Some Malicious Domains

2008-01-31T00:06:00.000+05:30

These are some of the Malicious domains regd to ESTDOMAINS.

These sites either prompts you to download fake media codec or rogue security application or directs you to another malicious website.

dabiwa.com
uterop.com
mbaperson.com
megrep.com
cezeke.com
dumaki.com
dumaki.com
homuka.com
lopste.com
rast4u.com
semrua.com
tuffik.com
trum4u.com
uramim.com
tehuli.com
sex-fa.com
batoho.com
wefki6.com
gnusmu.com
fumuni.com
xuxeka.com
hrumst.com
no-4um.com
wupiwy.com
sapasi.com
etitv.com
typguide.com
todostosell.com
besttyp.com
livregresto.com
gredato.com
wassin.com
forperson.com
meugresto.com
arcillato.com

Stay away from these sites.

Qazcodec.net

2008-01-28T16:38:00.000+05:30

Another Fake Codec site Regd to ESTDOMAINS.

This program is a DNS Changer trojan. It pretends to be a browser add-on for viewing porn which is actually a Trojan Horse program.

Stay away from this website.

qazcodec.net

Domain Name: qazcodec.net
Status: ok
Registrar: ESTDOMAINS, INC.
Whois Server: whois.estdomains.com
Referral URL: http://www.estdomains.com

Expiration Date: 2008-09-21
Creation Date: 2007-09-21
Last Update Date: 2008-01-26

Name Servers:
ns1.qazcodec.net
ns2.qazcodec.net

IP Address: 64.28.184.174
IP Location: United States
Website Status: active
Server Type: Apache/2.0.59 (FreeBSD) PHP/5.2.1 with Suhosin-Patch
Cache Date: 2008-01-28 03:56:01 MST

Hqcodectime.net

2008-01-25T15:49:00.000+05:30

Hqcodectime.net is Another Fake Codec Site regtd to ESTDOMAINS.
Following:

codecmpg.com 64.28.184.162
codecmeg.net 64.28.184.163
Codecultra.net 64.28.184.164
codecops.net 64.28.184.165
Codecpro.net 64.28.184.166
codecviva.com 64.28.184.167
Codeczang.net 64.28.184.168
codecplay.com 64.28.184.169
Codecbsplay.com 64.28.184.170
Vipcodecvip.com 64.28.184.171
Hqcodecvip.com 64.28.184.172

Do NOT download any installers from this website.Note that this program is a DNS Changer.

It pretends to be a browser add-on for viewing porn which is actually a Trojan Horse program.

Hqcodectime.net

Domain Name: hqcodectime.net
Status: ok
Registrar: ESTDOMAINS, INC.
Referral URL: http://www.estdomains.com

Expiration Date: 2008-09-21
Creation Date: 2007-09-21
Last Update Date: 2008-01-23

Name Servers:
ns1.hqcodectime.net
ns2.hqcodectime.net

IP Address: 64.28.184.173
IP Location: United States
Website Status: active
Server Type: Apache/2.0.59 (FreeBSD) PHP/5.2.1 with Suhosin-Patch
Cache Date: 2008-01-25 03:17:32 MST

STAY AWAY FROM THIS SITE!!!!!!!!

WinErrorFixer 2007

2008-01-15T16:08:00.000+05:30

WinErrorFixer 2007 is described as potentially unwanted application by some of them, as shown in the VirusTotal Result.

VirusTotal Result: 7/32 (21.88%)

AVG -------> SHeur.KTO
eSafe -------> suspicious Trojan/Worm
FileAdvisor -------> Low threat detected
McAfee 5206 -------> potentially unwanted program Winfixer
Panda 9.0.0.4 -------> Application/WinErrorFixer
Prevx1 V2 -------> Suspicious File With Persistence
Webwasher-Gateway 6.0.1 -------> Worm.Win32.ModifiedUPX.gen!84 (suspicious)
----------------------------------------------------------------------------------------
File size: 54552 bytes
MD5: e89ee5276da753dc98571f39119f4265
SHA1: 92f9111440e85e68bc880bd03f8cb0dcf89531c5
PEiD: UPX 2.90 [LZMA] -> Markus Oberhumer, Laszlo Molnar & John Reiser
packers: UPX
Bit9 info: http://fileadvisor.bit9.com/services/extinfo.aspx?md5=e89ee5276da753dc98571f39119f4265
packers: UPX
packers: PE_Patch.UPX, UPX
Prevx info: http://info.prevx.com/aboutprogramtext.asp?PX5=123001F018A318BFD5D60079156D15002616DA17

Screenshots:

Additional information :

Domain Name: winerrorfixer.com
Status: clientDeleteProhibited, clientRenewProhibited, clientTransferProhibited, clientUpdateProhibited

Registrar: GODADDY.COM, INC.
Whois Server: whois.godaddy.com
Referral URL: http://registrar.godaddy.com
Expiration Date: 2008-12-07
Creation Date: 2005-12-07
Last Update Date: 2007-10-29

Name Servers:
ns29.domaincontrol.com
ns30.domaincontrol.com

IP Address: 64.46.38.133
IP Location: Canada
Website Status: active
Server Type: Apache/2.0.58 (Unix) mod_ssl/2.0.58 OpenSSL/0.9.7f PHP/4.4.7
Alexa Trend/Rank: 1 Month: 44,539 3 Month: 49,706
Page Views per Visit: 1 Month: 1.7 3 Month: 1.8
Cache Date: 2008-01-15 03:22:48 MST
Compare Archived Data: 2007-09-15

CodecViva.com

2008-01-07T18:58:00.000+05:30

Another Fake Codec Site regtd to ESTDOMAINS.

Do NOT download any installers from this website.

Note that this program is a DNS Changer.It pretends to be a browser add-on for viewing porn which is actually a Trojan Horse program.

CodecViva.com

Domain Name: codecviva.com
Status: ok
Registrar: ESTDOMAINS, INC.
Whois Server: whois.estdomains.com
Referral URL: http://www.estdomains.com
Expiration Date: 2008-09-21
Creation Date: 2007-09-21
Last Update Date: 2008-01-05

Name Servers:
ns1.codecviva.com
ns2.codecviva.com

IP Address: 64.28.184.167
Website Status: active
Server Type: Apache/2.0.59 (FreeBSD) PHP/5.2.1 with Suhosin-Patch
Cache Date: 2008-01-07 05:41:20 MST

InfeStop

2008-01-05T21:18:00.000+05:30

InfeStop is a Rogue application from ESTDOMAINS.

It displays fake report to the users, wanting them to purchase the full version to remove the malicious content.

VirusTotla result is very poor, make sure that you do not download the application.

InfeStop.com

InfeStop

Warning

VirusTotal results: 2/32 (6.25%)
NOD32v2----------> error - password-protected file
Microsoft----------> Program:Win32/Easyspywarecleaner

Domain Name: infestop.com
Status: clientTransferProhibited
Registrar: ESTDOMAINS, INC.
Whois Server: whois.estdomains.com
Referral URL: http://www.estdomains.com

Expiration Date: 2008-11-19
Creation Date: 2007-11-19
Last Update Date: 2007-11-19

Name Servers:
ns1.infestop.com
ns2.infestop.com

IP Address: 216.240.138.201
Website Status: active
Server Type: Apache
Cache Date: 2008-01-05 08:42:15 MST

Spy-Rid

2008-01-05T21:02:00.000+05:30

Spy-Rid is a Rogue application from ESTDOMAINS.

It displays fake report to the users, wanting them to purchase the full version to remove the malicious content.

VirusTotla result is very poor, make sure that you do not download the application

Spy-Rid.com

Spy-Rid

Warning

VirusTotal results: 2/32 (6.25%)

NOD32v2----------> error - password-protected file
Sunbelt----------> Spy-Rid

Domain Name: spy-rid.com
Status: clientTransferProhibited
Registrar: ESTDOMAINS, INC.
Whois Server: whois.estdomains.com
Referral URL: http://www.estdomains.com

Expiration Date: 2008-11-19
Creation Date: 2007-11-19
Last Update Date: 2007-11-19

Name Servers:
ns1.spy-rid.com
ns2.spy-rid.com

IP Address: 216.240.138.201
Website Status: active
Server Type: Apache
Cache Date: 2008-01-05 08:30:48 MST

EasySpywareCleaner

2008-01-05T20:26:00.000+05:30

EasySpywareCleaner is a Rogue application from ESTDOMAINS.

It displays fake report to the users, wanting them to purchase the full version to remove the malicious content.

VirusTotla result is very poor, make sure that you do not download the application.

EasySpywareCleaner.com

EasySpywareCleaner

Warning

VirusTotal results: 2/32 (6.25%)

Microsoft ----------> Program:Win32/Easyspywarecleaner
NOD32v2 ----------> error - password-protected file

Domain Name: easyspywarecleaner.com
Status: clientTransferProhibited
Registrar: ESTDOMAINS, INC.
Whois Server: whois.estdomains.com
Referral URL: http://www.estdomains.com

Expiration Date: 2008-11-19
Creation Date: 2007-11-19
Last Update Date: 2007-11-19

Name Servers:
ns1.easyspywarecleaner.com
ns2.easyspywarecleaner.com

IP Address: 216.240.138.201
Website Status: active
Server Type: Apache
Alexa Trend/Rank: 1 Month: 831,443
Page Views per Visit: 1 Month: 1.4
Cache Date: 2008-01-05 07:34:30 MST

codecpro.net

2008-01-04T16:14:00.000+05:30

codecpro.net is the latest Fake Codec Site from ESTDOMAINS followin

Codecops.net
Codecultra.net
Codecmeg.net
Codecmpg.com
Codecdvi.com

Do NOT download any installers from this website. Note that this program is a DNS Changer.It pretends to be a browser add-on for viewing porn which is actually a Trojan Horse program.

codecpro.net

Domain Name: codecpro.net
Status: ok
Registrar: ESTDOMAINS, INC.
Whois Server: whois.estdomains.com
Referral URL: http://www.estdomains.com

Expiration Date: 2008-09-21
Creation Date: 2007-09-21
Last Update Date: 2008-01-02

Name Servers:
ns1.codecpro.net
ns2.codecpro.net

IP Address: 64.28.184.166
Website Status: active
Server Type: Apache/2.0.59 (FreeBSD) PHP/5.2.1 with Suhosin-Patch
Cache Date: 2008-01-04 03:30:22 MST
Compare Archived Data: 2007-12-13

codecdvi.com

2007-12-19T19:07:00.001+05:30

Another Fake Codec Site from ESTDOMAINS.

Do NOT download any installers from this website. Note that this program is a DNS Changer.

It pretends to be a browser add-on for viewing porn which is actually a Trojan Horse program.

codecdvi.com

Virustotal results: 12/32 (37.5%)

My sample is codecdvi1007.exe.

AntiVir ------> HEUR/Malware
AVG ------> Generic_c.FTY
BitDefender ------> Trojan.Zlob.BZY
CAT-QuickHeal ------> Win32.Trojan.DNSChanger.aho
ClamAV ------> Trojan.DNSChanger-2168
Fortinet ------> W32/ZLOB.ESC!tr
F-Secure ------> Trojan.Win32.DNSChanger.aii
Kaspersky ------> Trojan.Win32.DNSChanger.aii
McAfee ------> Puper.gen.d
Microsoft ------> Trojan:Win32/Alureon.gen!E
Symantec ------> Trojan.Zlob
Webwasher-Gateway ------> Heuristic.Malware

Additional information:

Domain Name: codecdvi.com
Status: ok
Registrar: ESTDOMAINS, INC.
Referral URL: http://www.estdomains.com
Expiration Date: 2008-09-21
Creation Date: 2007-09-21
Last Update Date: 2007-12-17

Name Servers:
ns1.codecdvi.com
ns2.codecdvi.com

IP Address: 64.28.184.190
Website Status: active
Server Type: Apache/2.0.59 (FreeBSD) PHP/5.2.1 with Suhosin-Patch
Cache Date: 2007-12-19 06:33:44 MST

SpySnipe

2007-12-18T00:11:00.000+05:30

SpySnipe is a rogue application which is a clone of Sunshine Spy.

spysnipe.com is that domain that produces spysnipe.

SpySnipe displays fake allerts as shown in the screenshot below.

It appears that sunshinespy.com was previously under 88.255.94.51. Now they share the IP 77.91.229.42.

I have also included the screenshot of "Sunshine Spy". Make sure note to download these applications.

SpySnipe.com

SpySniper v 1.0

SunshineSpy 1

Domain Name: spysnipe.com
Status: clientDeleteProhibited, clientTransferProhibited
Registrar: BIZCN.COM, INC.
Referral URL: http://www.bizcn.com

Expiration Date: 2008-11-18
Creation Date: 2007-11-18
Last Update Date: 2007-11-18

Name Servers:
ns1.spysnipe.com
ns2.spysnipe.com

IP Address: 77.91.229.42
Website Status: active
Server Type: nginx/0.5.22
Cache Date: 2007-12-17 11:15:49 MSTCompare Archived Data: 2007-12-07

CodecPretty.net

2007-12-13T15:52:00.001+05:30

CodecPretty.net

Virustotal Results:14/32 (43.75%)

My sample is CodecPretty1001.exe

AntiVir ------> HEUR/Malware
AVG ------> Downloader.Zlob.KF
BitDefender ------> Trojan.Zlob.BYQ
CAT-QuickHeal ------> Win32.Trojan.DNSChanger.abj
eSafe ------> Win32.DNSChanger.abj
Fortinet ------> W32/Zlobar.ADZ!tr
F-Secure ------> Trojan.Win32.DNSChanger.acv
Kaspersky ------> Trojan.Win32.DNSChanger.adz
Microsoft ------> Trojan:Win32/Alureon.gen!E
Prevx1 ------> Generic.Dropper.xCodec
Sophos ------> Troj/Zlobar-Fam
Symantec ------> Trojan.Zlob
TheHacker ------> Trojan/Downloader.Zlob.eie
Webwasher-Gateway ------> Heuristic.Malware

Domain Name: codecpretty.net
Status: ok
Registrar: ESTDOMAINS, INC.
Referral URL: http://www.estdomains.com

Expiration Date: 2008-09-21
Creation Date: 2007-09-21
Last Update Date: 2007-12-11

Name Servers:
ns1.codecpretty.net
ns2.codecpretty.net

IP Address: 64.28.184.188
Website Status: active
Server Type: Apache/2.0.59 (FreeBSD) PHP/5.2.1 with Suhosin-Patch
Cache Date: 2007-12-13 03:17:45 MST

CodecHot.net

2007-12-10T17:47:00.000+05:30

Another Fake Codec Site from ESTDOMAINS,

Do NOT download any program from this website.

Note that this program is a DNS Changer. It pretends to be a browser add-on for viewing porn which is actually a Trojan Horse program.

CodecHot.net

Domain Name: codechot.net
Status: ok
Registrar: ESTDOMAINS, INC. Referral URL: http://www.estdomains.com
Expiration Date: 2008-09-21 Creation Date: 2007-09-21 Last Update Date: 2007-12-08
Name Servers: ns1.codechot.net ns2.codechot.net
IP Address: 64.28.184.187

SpyKillerPro

2007-12-07T21:59:00.001+05:30

SpyKillerPro - Another Rogue application from the strange website xen.name

Is seems to be a clone of RaptorDefence.

SpyKillerPro

Warning Message

Virus Total results:
AntiVir ------> DR/FraudTool.XPAntivirus.A.2
ClamAV ------> Adware.Fakealert-13
DrWeb ------> Trojan.Fakealert.373
Kaspersky ------> not-a-virus:FraudTool.Win32.XPAntivirus.a
Webwasher-Gateway ------> Trojan.Dropper.FraudTool.XPAntivirus.A.2

File size: 1402387 bytes
MD5: b2cb8c2168f279a0d62fcf7d0061e5a5
SHA1: a2fb6d6570366dda1690eafb990b331de07d859c

codechard.com

2007-12-07T15:42:00.000+05:30

Another Fake Codec Site from ESTDOMAINS,

Do NOT download any program from this website.

Note that this program is a DNS Changer.

It pretends to be a browser add-on for viewing porn which is actually a Trojan Horse program. It has the capability to install a Rootkit on to your computer to re-route your Internet searches through the bad servers to make money for them.

codechard.com

Virus Total Results: 15/32 (46.88%)

AntiVir ------> HEUR/Malware
AVG ------>Downloader.Zlob.KF
BitDefender ------>Trojan.Zlob.BYQ
CAT-QuickHeal ------>Win32.Trojan.DNSChanger.abj
Ewido ------>Downloader.Zlob.eie
Fortinet ------>W32/Zlobar.ADZ!tr
F-Secure ------>Trojan.Win32.DNSChanger.adz
Kaspersky ------>Trojan.Win32.DNSChanger.adz
Microsoft ------>Trojan:Win32/Alureon.gen!E
Panda ------>Adware/JustPorn
Prevx1 ------>Generic.Dropper.xCodec
Sophos ------>Troj/Zlobar-Fam
Symantec ------>Trojan.Zlob
TheHacker ------>Trojan/Downloader.Zlob.eie
Webwasher-Gateway ------>Heuristic.Malware

File size: 231549 bytes
MD5: d0071820c328a1985d63e86f61d5b606
SHA1: 0d92ab6bc8f25d55d9799a5c479edc751ece17b1
PEiD: -
Prevx info: http://fileinfo.prevx.com/fileinfo.asp?PX5=675A623B7D5697AB88DB03AB863BA800D8053CA9

More information:
Domain Name: codechard.com
Status: ok
Registrar: ESTDOMAINS, INC.
Referral URL: http://www.estdomains.com

Expiration Date: 2008-09-21
Creation Date: 2007-09-21
Last Update Date: 2007-12-05

Name Servers:
ns1.codechard.com
ns2.codechard.com

IP Address: 64.28.184.186
Website Status: active
Server Type: Apache/2.0.59 (FreeBSD) PHP/5.2.1 with Suhosin-Patch
Cache Date: 2007-12-07 03:09:19 MST

StopingSpy 2.1

2007-12-07T00:01:00.000+05:30

StopingSpy 2.1 is a clone of a well known Rogue application -SpySheriff.

Stopingspy.com is the domain distributing StopingSpy 2.1.

Registrar of stopingspy.com is ESTDOMAINS, well known for producing Useless websites.

DoNOT install this application and avoid this website.

Stopingspy.com

StopingSpy 2.1

Virustotal results : 6/32 (18.75%)
AhnLab-V3 ------> Win-Trojan/Spyshield.51200
CAT-QuickHeal ------> FraudTool.SpySheriff.f (Not a Virus)
Kaspersky ------> not-a-virus:FraudTool.Win32.SpySheriff.f
Microsoft ------> Program:Win32/SpySheriff
Sophos ------> Troj/DrProt-Gen
VirusBuster ------> Adware.SpySherif.Gen.2

File size: 30208 bytes
MD5: 8bc81891175a149bfef84ac0c8c556d4
SHA1: 6d76546f81dd3806a4e1b7e793237a1bc2293f30
PEiD: Armadillo v1.71

Additional information:

stopingspy.com
Status: clientTransferProhibited
Registrar: ESTDOMAINS, INC.
Referral URL: http://www.estdomains.com

Expiration Date: 2008-11-27
Creation Date: 2007-11-27
Last Update Date: 2007-11-27

Name Servers:
ns1.stopingspy.com
ns2.stopingspy.com

IP Address: 58.65.238.130
Website Status: active
Server Type: nginx/0.5.33
Cache Date: 2007-12-06 11:41:25 MST

LiveProtection 2.1

2007-12-06T23:12:00.000+05:30

LiveProtection 2.1 is a clone of a well known Rogue application -SpySheriff.

liveprotection.net is the domain distributing LiveProtection 2.1.

Registrar of liveprotection.net is ESTDOMAINS, well known for producing Useless websites.

DoNOT install this application and avoid this website.

liveprotection.net

LiveProtection 2.1

Virustotal results : 6/32 (18.75%)

AhnLab-V3 ------> Win-Trojan/Spyshield.51200
CAT-QuickHeal ------> FraudTool.SpySheriff.f (Not a Virus)
Kaspersky ------> not-a-virus:FraudTool.Win32.SpySheriff.f
Microsoft ------> Program:Win32/SpySheriff
Sophos ------> Troj/DrProt-Gen
VirusBuster ------> Adware.SpySherif.Gen.2

File size: 60928 bytes
MD5: d135860f40c86477e83f26aa49688be9
SHA1: 656feee197f0713bb15a4fd3db3f62bc545975ff
PEiD: Armadillo v1.71

Additional information:
Domain Name: liveprotection.net
Status: clientTransferProhibited

Registrar: ESTDOMAINS, INC.
Whois Server: whois.estdomains.com
Referral URL: http://www.estdomains.com

Expiration Date: 2008-11-27
Creation Date: 2007-11-27
Last Update Date: 2007-11-27

Name Servers:
ns1.liveprotection.net
ns2.liveprotection.net

IP Address: 58.65.238.130
Website Status: active
Server Type: nginx/0.5.33
Cache Date: 2007-12-06 10:45:19 MST

KillSpy 2.1

2007-12-06T22:15:00.000+05:30

KillSpy 2.1 is a clone of a well known Rogue application -SpySheriff.

killspy.org is the domain distributing KillSpy 2.1.

Registrar of killspy.org is ESTDOMAINS, well known for producing Useless websites.

DoNOT install this application and avoid this website.

killspy.org

KillSpy 2.1

Virustotal results : 6/32 (18.75%)

AhnLab-V3 ------> Win-Trojan/Spyshield.51200
CAT-QuickHeal ------> FraudTool.SpySheriff.f (Not a Virus)
Kaspersky ------> not-a-virus:FraudTool.Win32.SpySheriff.f
Microsoft ------> Program:Win32/SpySheriff
Sophos ------> Troj/DrProt-Gen
VirusBuster ------> Adware.SpySherif.Gen.2

Additional information:
Domain Name: killspy.org
Status: CLIENT TRANSFER PROHIBITED, TRANSFER PROHIBITED
Registrar: EstDomains, Inc. (R1345-LROR)

Expiration Date: 2008-11-27 15:43:30
Creation Date: 2007-11-27 15:43:30
Last Update Date: 2007-11-27 15:46:36

Name Servers:
ns1.killspy.org
ns2.killspy.org

IP Address: 58.65.238.130
Website Status: active
Server Type: nginx/0.5.33
Cache Date: 2007-12-06 06:48:49 MST

AntiSpy Pro 2.4

2007-12-06T19:05:00.000+05:30

AntiSpy Pro 2.4 -Another rogue application from ESTDOMAINS, This application is a clone of IEDefender.

I have added screenshots for both the applications, so that you can compare them.

Make sure you do not install this useless application.

AntiSpy-Pro.com

AntiSpy Pro 2.4

IEDefender.com

IE Defender 2.4.3

Additional information:

Domain Name: antispy-pro.com
Status: clientTransferProhibited
Registrar: ESTDOMAINS, INC.
Whois Server: whois.estdomains.com
Referral URL: http://www.estdomains.com

Expiration Date: 2008-11-15
Creation Date: 2007-11-15
Last Update Date: 2007-11-15

Name Servers:
ns1.antispy-pro.com
ns2.antispy-pro.com

IP Address: 85.255.121.149
Website Status: active
Server Type: Apache/2.2.3 (Debian) PHP/4.4.4-8+etch4
Cache Date: 2007-12-06 04:27:55 MST

Virustotal results: 4/32 (12.5%)

ClamAV-----> Adware.Fakealert-21
Kaspersky----->not-a-virus:FraudTool.Win32.IeDefender.j
VBA32----->suspected of Backdoor.Delf.180 (paranoid heuristics)
Symantec----->AntiSpyPro

File size: 2836949 bytes
MD5: 3e66a8d4eed567b696fd23de45f1b1ee
SHA1: 86dbd9677bfcf0bc96528bbad18b6e5e1c12e4f8
PEiD: -
packers: ASPack

Virustotal result is quiet bad, so stay away from this site.

CodecMega.net

2007-12-04T18:49:00.000+05:30

CodecMega.net

Another Fake Codec Site from ESTDOMAINS,

Do NOT download any program from this website.

Note that this program is a DNSChanger. It pretends to be a browser add-on for viewing porn which is actually a Trojan Horse program.It has the capability to install a Rootkit on to your computer to re-route your Internet searches through the bad servers to make money for them.

CodecMega.net

Virus Total Results: 16/32 (50%)
-------------------------------------------------------
AntiVir----->HEUR/Malware
AVG----->Downloader.Zlob.KF
BitDefender----->Trojan.Zlob.BYQ
CAT-QuickHeal----->Win32.Trojan.DNSChanger.abj
eSafe----->Win32.DNSChanger.abj
Ewido----->Downloader.Zlob.eie
Fortinet----->W32/Zlobar.ABJ!tr
F-Secure----->Trojan.Win32.DNSChanger.adz
Kaspersky----->Trojan.Win32.DNSChanger.adz
Microsoft----->Trojan:Win32/Alureon.gen!E
Panda----->Adware/KeyToPorn
Prevx1----->Generic.Dropper.xCodec
Sophos----->Troj/Zlobar-Fam
Symantec----->Trojan.Zlob
TheHacker----->Trojan/Downloader.Zlob.eie

Detection rate seems to be better.

More Information:
-----------------
Domain Name: codecmega.net
Status: ok
Registrar: ESTDOMAINS, INC.
Referral URL: http://www.estdomains.com

Expiration Date: 2008-09-21
Creation Date: 2007-09-21
Last Update Date: 2007-12-02

Name Servers:
ns1.codecmega.net
ns2.codecmega.net

IP Address: 64.28.184.185
Website Status: active
Server Type: Apache/2.0.59 (FreeBSD) PHP/5.2.1 with Suhosin-Patch
Cache Date: 2007-12-04 06:15:38 MST

RaptorDefence.com

2007-12-01T17:10:00.000+05:30

RaptorDefence 1.2.1 is a rogue application which displays fake detections to surprises users and make them purchase the worthless product.

Screenshots:

RaptorDefence.com

RaptorDefence 1.2.1

Domain Name: raptordefence.com
Status: ok
Registrar: DIRECT INFORMATION PVT LTD D/B/A PUBLICDOMAINREGISTRY.COM
Whois Server: whois.publicdomainregistry.com
Referral URL: http://www.publicdomainregistry.com

Expiration Date: 2008-07-20
Creation Date: 2007-07-20
Last Update Date: 2007-09-18
Name Servers: ns0.hqhost.net ns1.hqhost.net

IP Address: 88.214.198.90
Website Status: active
Server Type: Apache/1.3.37 (Unix) PHP/5.2.3
Alexa Trend/Rank: 3 Month: 1,680,653
Page Views per Visit: 3 Month: 5.0
Cache Date: 2007-12-01 04:19:35 MST

VirusTotal results: 4/32 (12.5%)

DrWeb ---> Trojan.Fakealert.373
Kaspersky ---> not-a-virus:FraudTool.Win32.XPAntivirus.a
Prevx1 ---> Heuristic: Suspicious Self Modifying File
Sunbelt ---> RaptorDefence

File size: 1578279 bytes
MD5: 4d0e16828cdd140d77221e806e535be8
SHA1: 32434e2641003f6d3b203f9214b0831ff7eb21f1
Prevx info: http://fileinfo.prevx.com/fileinfo.asp?PX5=8B98308C27FC6C0715D218E1D988C3000933526E

The detection rate is very poor. Make sure you stay away from this program.

CodecTime.com

2007-12-01T15:39:00.000+05:30

Another Fake Codec Site from ESTDOMAINS.

Do NOT download any installers from this website.

Note that this program is a DNSChanger. It pretends to be a browser add-on for viewing porn which is actually a Trojan Horse program.It has the capability to install a Rootkit on to your computer to re-route your Internet searches through the bad servers to make money for them.

Screenshot:

CodecTime.com

And this is why we call it as DNS changer:

Additional information:

Domain Name: codectime.com
Status: ok
Registrar: ESTDOMAINS, INC.
Expiration Date: 2008-09-21
Creation Date: 2007-09-21
Last Update Date: 2007-11-29

Name Servers:
ns1.codectime.com
ns2.codectime.com
--------------------------------------------------------------------------------
Extended Info IP Address: 64.28.184.184
Website Status: active
Server Type: Apache/2.0.59 (FreeBSD) PHP/5.2.1 with Suhosin-Patch
Cache Date: 2007-12-01 03:04:48 MST

VirusTotal results:

My sample is: CodecTime1090.exe

AntiVir ---> HEUR/Malware
AVG ---> Downloader.Zlob.KF
BitDefender ---> Trojan.Zlob.BYQ
CAT-QuickHeal ---> Win32.Trojan.DNSChanger.abj
eSafe ---> Win32.Zlob
Ewido ---> Downloader.Zlob.eie
Fortinet ---> W32/Zlobar.ADZ!tr
F-Secure ---> Trojan.Win32.DNSChanger.adz
Kaspersky ---> Trojan.Win32.DNSChanger.adz
Microsoft ---> Trojan:Win32/Dnschanger.AI
Prevx1 ---> Generic.Dropper.xCodec
Sophos ---> Troj/Zlobar-Fam
Symantec ---> Trojan.Zlob
TheHacker ---> Trojan/Downloader.Zlob.eie
Webwasher-Gateway ---> Heuristic.Malware

VirusProtect 3.8

2007-11-30T19:02:00.000+05:30

Registrar of Virprotect.com is ESTDOMAINS, which is well known for fake products.

If your system is infected by Virprotect through Zlob infections, it will display fake warnings in the system tray which will not vanish even if you uninstall the product, it will insist you to purchase the product.

Also the product does not uninstall completely.

Screenshots:

Virprotect.com

VirusProtect 3.8

If you note that the VirusProtectPro variants are no more active.

Virustotal results: 6/32 (18.75%)

The detection rate is very poor, make sure you stay out of this website and the application.

Avast ---> Win32:Spycrush-B
BitDefender ---> Adware.SpyLocked.C
NOD32v2 ---> Win32/Adware.VirusProtectPro
Prevx1 ---> VirusProtectPro:Spyware-All Variants
Sophos ---> Virus ProtectPro Installer
VBA32 ---> Application.Win32.Adware.VirusProtectPro

File size: 3318554 bytes
MD5: baac3692b436b982193bb7895d7405c3
SHA1: ff0de2bed0bd903de9c003e05f3767ee9e35f8f8
packers: Armadillo
Prevx info: http://fileinfo.prevx.com/fileinfo.asp?PX5=D81609571AEEC833A360320269C934002DEEC94B

Domain Name: virprotect.com
Status: clientTransferProhibited
Registrar: ESTDOMAINS, INC.
Whois Server: whois.estdomains.com
Referral URL: http://www.estdomains.com/
Expiration Date: 2008-10-23
Creation Date: 2007-10-23
Last Update Date: 2007-11-12
Name Servers:
ns1.sigmacode.biz
ns2.sigmacode.biz
ns3.sigmacode.biz
ns4.sigmacode.biz

IP Address: 85.255.119.126
Website Status: active
Server Type: nginx/0.4.13
Cache Date: 2007-11-30 06:33:49 MST
Compare Archived Data: 2007-11-13

Most of them get infected by this app. Now the question is “How to get rid of it?????”

Herez the answer!!!!!!

Juz follow the steps provided in the following link to get rid of the application using “SmitfraudFix”

http://siri.urz.free.fr/Fix/SmitfraudFix.php

The previous versions of Virprotect 3.8 are the PRO versions.

Screenshot of the previous versions are provided below (If it might help your):

VirusProtect PRO 3.3

VirusProtect PRO 3.4

VirusProtect PRO 3.5

VirusProtect PRO 3.6

VirusProtect PRO 3.7

Online-Guard.net

2007-11-29T22:21:00.000+05:30

Online-Guard 2.1

Online-Guard 2.1 is a clone of a well known Rogue application -SpySheriff.

Registrar of Online-Guard.net is ESTDOMAINS, wellknown for producing Useless websites.DoNOT install this application and avoide this website.

Online-Guard.net

Online-Guard 2.1

Virustotal results : 6/32 (18.75%)

AhnLab-V3 ---> Win-Trojan/Spyshield.51200
CAT-QuickHeal ---> FraudTool.SpySheriff.f (Not a Virus)
Ikarus ---> not-a-virus:.FraudTool.Win32.SpySheriff.f
Kaspersky ---> not-a-virus:FraudTool.Win32.SpySheriff.f
Symantec ---> OnlineGuard
VirusBuster ---> Adware.SpySherif.Gen.2

File size: 24064 bytes
MD5: 658474189f62b7a8472473357210be85
SHA1: 6beb36171279b363e88e1de21dbc74a827e7065

Additional information:

Domain Name: online-guard.net
Status: clientTransferProhibited
Registrar: ESTDOMAINS, INC.
Whois Server: whois.estdomains.com
Referral URL: http://www.estdomains.com
Expiration Date: 2008-10-25
Creation Date: 2007-10-25
Last Update Date: 2007-11-16
Name Servers: ns1.online-guard.net ns2.online-guard.ne

IP Address: 58.65.238.130
Website Status: active
Server Type: nginx/0.5.33
Cache Date: 2007-11-29 09:58:02 MST
Compare Archived Data: 2007-11-27

Guard-Center.com

2007-11-29T21:49:00.000+05:30

Guard-Center 2.1

Guard-Center 2.1 is a clone of a well known Rogue application -SpySheriff.

Registrar of Guard-Center.com is ESTDOMAINS, wellknown for producing Useless websites.

DoNOT install this application and avoide this website.

Guard-Center.com

Guard-Center 2.1

Virustotal results : 4/32 (12.5%)

AhnLab-V3 ---> Win-Trojan/Spyshield.51200
Ikarus ---> not-a-virus:.FraudTool.Win32.SpySheriff.f
Kaspersky ---> not-a-virus:FraudTool.Win32.SpySheriff.f
VirusBuster ---> Adware.SpySherif.Gen.2

File size: 60928 bytes
MD5: 3be4a29f1d5ec78c84b2d35690e7065e
SHA1: dbc320911b4460f6efcd72c0cc48a104360ac1d4

Additional information:

Domain Name: guard-center.com
Status: clientTransferProhibited
Registrar: ESTDOMAINS, INC.
Referral URL: http://www.estdomains.com

Expiration Date: 2008-10-25
Creation Date: 2007-10-25
Last Update Date: 2007-11-19

Name Servers: ns1.guard-center.com , ns2.guard-center.com

Dr-Protection.com

2007-11-29T21:05:00.000+05:30

Dr-Protection 2.1

Dr-Protection is a clone of a well known Rogue application -SpySheriff.

Registrar of Dr-Protection.com is ESTDOMAINS, wellknown for producing Useless websites.

DoNOT install this application and avoide this website.

Dr-Protection.com

Dr-Protection 2.1

Virustotal results: Result: 6/32 (18.75%)

AhnLab-V3 ---> Win-Trojan/Spyshield.51200
CAT-QuickHeal ---> FraudTool.SpySheriff.f (Not a Virus)
Ikarus ---> not-a-virus:.FraudTool.Win32.SpySheriff.f
Kaspersky ---> not-a-virus:FraudTool.Win32.SpySheriff.f
Symantec ---> Downloader.MisleadApp
VirusBuster ---> Adware.SpySherif.Gen.2

Additional Info:

Domain Name: dr-protection.com
Registrar: ESTDOMAINS, INC.
Referral URL: http://www.estdomains.com/
Expiration Date: 2008-11-15
Creation Date: 2007-11-15 Last
Update Date: 2007-11-19 Status: clientTransferProhibited
Name Servers: ns1.dr-protection.com ns2.dr-protection.com

IP Address: 58.65.238.130
Website Status: active
Server Type: nginx/0.5.33
Cache Date: 2007-11-29 08:49:47 MST
Compare Archived Data: 2007-11-27

This Website is BAD

liveantispy.com

2007-11-29T20:13:00.000+05:30

Liveantispy 2.1

Liveantispy is a clone of a well known Rogue application -SpySheriff.

Registrar of liveantispy.com is ESTDOMAINS, wellknown for producing Useless websites.

DoNOT install this application and avoide this website.

liveantispy.com

Liveantispy 2.1

Website INfo:
Domain Name: liveantispy.com
Status: clientTransferProhibited
Registrar: ESTDOMAINS, INC.
Referral URL: http://www.estdomains.com
Expiration Date: 2008-11-19 Creation
Date: 2007-11-19 Last Update Date: 2007-11-19
Name Servers: ns1.liveantispy.com ns2.liveantispy.com

Virustotal results: 4/32 (12.5%)
------------------------------------
AhnLab-V3 ---> Win-Trojan/Spyshield.51200
Ikarus ---> not-a-virus:.FraudTool.Win32.SpySheriff.f
Kaspersky ---> not-a-virus:FraudTool.Win32.SpySheriff.f
VirusBuster ---> Adware.SpySherif.Gen.2

File size: 60928 bytes
MD5: 9ae70301cd5cb35e03db73a8a1de38d3
SHA1: 75342157a0c53d2f29fb35097f476f7436c4687a

As you can see that the Virustotal results are very low, make sure to stay away from this application.

Codechq.net

2007-11-28T17:39:00.000+05:30

Codechq.net

Another Fake Codec Site from ESTDOMAINS,

Do NOT download any program from this website.

Note that this program is a DNSChanger. It pretends to be a browser add-on for viewing porn which is actually a Trojan Horse program.It has the capability to install a Rootkit on to your computer to re-route your Internet searches through the bad servers to make money for them.

Screenshot:

Following pic would give u info on the DNS it modifies:

Registrar: ESTDOMAINS, INC.

Whois Server: whois.estdomains.com

Referral URL: http://www.estdomains.com/

Expiration Date: 2008-09-21

Creation Date: 2007-09-21 Last

Update Date: 2007-11-26

Name Servers: ns1.codechq.net ns2.codechq.net

Extended Info
IP Address:
64.28.184.183
Website Status: active

Server Type: Apache/2.0.59 (FreeBSD) PHP/5.2.1 with Suhosin-Patch

Cache Date: 2007-11-28 05:10:23 MST

Virustotal Results: Result: 14/32 (43.75%)
-----------------------------------------

My sample is : Codechq1080.exe

AntiVir 7.6.0.34 2007.11.28 HEUR/Malware
Avast 4.7.1074.0 2007.11.27 Win32:Trojan-gen {Other}
AVG 7.5.0.503 2007.11.27 Downloader.Zlob.KF
BitDefender 7.2 2007.11.28 Trojan.Zlob.BYQ
CAT-QuickHeal 9.00 2007.11.27 Win32.Trojan.DNSChanger.abj
Ewido 4.0 2007.11.27 Downloader.Zlob.eie
Fortinet 3.14.0.0 2007.11.28 W32/Zlobar.ABJ!tr
F-Secure 6.70.13030.0 2007.11.28 Trojan.Win32.DNSChanger.adz
Kaspersky 7.0.0.125 2007.11.28 Trojan.Win32.DNSChanger.adz
Prevx1 V2 2007.11.28 Generic.Dropper.xCodec
Sophos 4.23.0 2007.11.28 Troj/Zlobar-Fam
Symantec 10 2007.11.28 Trojan.Zlob
TheHacker 6.2.9.144 2007.11.28 Trojan/Downloader.Zlob.eie
Webwasher-Gateway 6.6.2 2007.11.28 Heuristic.Malware

Additional information:
------------------------
File size: 231553 bytes
MD5: d57546a73be8d902fa6a574452294ee4
SHA1: d20f49022a2cebb350360e7d675ef21aee205e4e
Prevx info: http://fileinfo.prevx.com/fileinfo.asp?PX5=675A623B815697AB88DB03AB863BA800ACF0C59E

Rich Video Codec V1.6

2007-11-27T22:16:00.000+05:30

VideoAccessCodecInstall.exe

videosoftonline.com (Zlob)

Rich Video Codec Is a malicious Trojan program Which adds a toolbar to the Browser, which in turn installs application like:

1. YourPrivacyGuard.

2. ConfidentSurf.

3. ErrorFighter.

4. Adwareremover2007.

5. Securepccleaner.

6. UltimateDefender.

7. UltimateCleaner.

8. Brave-Sentry.

9. performanceoptimizer.

10. Anti-Virus-Pro

11. Trustedantivirus

U could also be taken to the following page aswell : http://www.download.neteu.eu/

If you access videosoftonline.com, you would receive the 4o3 error(as given below), but it still produces the dangerous Trojan(Zlob).

File name : VideoAccessCodecInstall.exe
MD5: 5d2d1f68229abde239fe5e160d6192f0

Virustotal Results: 10/32 (31.25%)
------------------------------------
AntiVir - DR/Zlob.Gen
AVG - Downloader.Zlob
CAT -QuickHeal TrojanDownloader.Zlob.gen
ClamAV - Trojan.Dropper-2557
F-Secure - W32/Zlob.ARDM
Norman - W32/Zlob.ARDM
Rising - Trojan.DL.Win32.Zlob.def
Sophos - Troj/Zlobar-Fam
TheHacker - Trojan/Downloader.gen
Webwasher-Gateway -Trojan.Dropper.Zlob.Gen

Website INFO:

---------------

Domain Name: videosoftonline.com

IP Address: 194.126.174.124
Server Type: ApacheCache

Status: clientTransferProhibited

Registrar: ESTDOMAINS, INC.

Referral URL: http://www.estdomains.com/

Expiration Date: 2008-11-01

Creation Date: 2007-11-01

Name Servers: ns1.videosoftonline.com ns2.videosoftonline.com

Make sure NOT to download any installers from this site.

If your system is infected by this Trojan, you need to remove them as soon as possible as it can disable the Task manager, display settings and many more. It will display all nasty websites too, which would slowdown you computer.