Real AntiVirus

Real AntiVirus is a Rogue application and the Registrar of real-av.com is ESTDOMAINS

Stay away from this website.

Real AntiVirus

real-av.com

Domain Name: real-av.com
Status: clientTransferProhibited
Registrar: ESTDOMAINS, INC.
Whois Server: whois.estdomains.com
Referral URL: http://www.estdomains.com
Expiration Date: 2009-02-25
Creation Date: 2008-02-25
Last Update Date: 2008-02-25
Name Servers:
qw.cool-cool-websearch.com
wq.cool-cool-websearch.com

IP Address: 66.246.229.81
IP Location: United States
Website Status: active
Server Type: Apache/1.3.41 (Unix) mod_ssl/2.8.31 OpenSSL/0.9.8b PHP/4.4.8 mod_perl/1.29 FrontPage/5.0.2.2510
Cache Date: 2008-03-06 05:06:20 MST

AntiSpyStorm2008

AntiSpyStorm2008 is a rogue application and the Registrar of AntiSpyStorm2008.com is ESTDOMAINS.

The rogue application @ Antispystorm2008.com Is same as the rogue application @ Antispystorm.com

But the verion is Different(for now). Check the screenshot below:

Antispystorm2008.com - 1.01.0044
Antispystorm.com - 1.01.0031

AntiSpyStorm2008

AntiSpyStorm @ AntiSpyStorm2008.com

AntiSpyStorm @ AntiSpyStorm.com

AntiSpyStorm2008.com

Domain Name: antispystorm2008.com
Status: clientTransferProhibited
Registrar: ESTDOMAINS, INC.
Whois Server: whois.estdomains.com
Referral URL: http://www.estdomains.com

Expiration Date: 2009-02-07
Creation Date: 2008-02-07
Last Update Date: 2008-02-07

Name Servers:
ns1.3fn.net
ns2.3fn.net

IP Address: 216.195.54.111
IP Location: United States
Website Status: active
Server Type: Apache/2.2.4 (Unix) PHP/4.4.4 mod_ssl/2.2.4 OpenSSL/0.9.7e-p1
Cache Date: 2008-03-03 10:10:35 MST

SpyMaxX

SpyMaxX is a Rogue application and the Registrar of spymaxx.com is ESTDOMAINS.

Stay away from this website.

SpyMaxX

SpyMaxX.com

Domain Name: spymaxx.com
Status: clientTransferProhibited
Registrar: ESTDOMAINS, INC.
Whois Server: whois.estdomains.com
Referral URL: http://www.estdomains.com
Expiration Date: 2009-02-04
Creation Date: 2008-02-04
Last Update Date: 2008-02-04
Name Servers:
ns1.3fn.net
ns2.3fn.net

IP Address: 216.195.54.110
IP Location: United States
Website Status: active
Server Type: Apache/2.2.4 (Unix) PHP/4.4.4 mod_ssl/2.2.4 OpenSSL/0.9.7e-p1
Cache Date: 2008-03-03 09:30:22 MST

TheLastDefender

TheLastDefender is a Rogue application and the Registrar of TheLastDefender.com is ESTDOMAINS.

Stay away from this website.

TheLastDefender

TheLastDefender.com

Domain Name: thelastdefender.com
Status: ok
Registrar: ESTDOMAINS, INC.
Whois Server: whois.estdomains.com
Referral URL: http://www.estdomains.com

Expiration Date: 2008-12-28
Creation Date: 2007-12-28
Last Update Date: 2008-02-26
Name Servers:
ns1.thelastdefender.com
ns2.thelastdefender.com


IP Address: 78.31.211.57
Website Status: active
Server Type: Apache/2.2.6 (FreeBSD)
Alexa Trend/Rank: 1 Month: 2,207,208
Page Views per Visit: 1 Month: 3.2
Cache Date: 2008-03-03 04:00:26 MST

Mpgapplication.com

Mpgapplication.com Distributes Zlob Trojan

Make sure that you don’t install any application from this website.


Domain Name: mpgapplication.com
Status: clientTransferProhibited
Registrar: ESTDOMAINS, INC.
Whois Server: whois.estdomains.com
Referral URL: http://www.estdomains.com

Expiration Date: 2009-02-27
Creation Date: 2008-02-27
Last Update Date: 2008-02-27

Name Servers:
ns1.mpgapplication.com
ns2.mpgapplication.com

Extended Info IP Address: 85.255.118.180
IP Location: Ukraine
Website Status: active
Server Type: Apache/2.2.2 (Fedora)
Cache Date: 2008-02-28 04:43:39 MST

Wmvsolution.com

Wmvsolution.com Distributes Zlob Trojan

Make sure that you don’t install any application from this website.

Domain Name: wmvsolution.com
Status: clientTransferProhibited
Registrar: ESTDOMAINS, INC.
Whois Server: whois.estdomains.com
Referral URL: http://www.estdomains.com

Expiration Date: 2009-02-27
Creation Date: 2008-02-27
Last Update Date: 2008-02-27

Name Servers:
ns1.wmvsolution.com
ns2.wmvsolution.com

Extended Info IP Address: 85.255.120.109
IP Location: Ukraine
Website Status: active
Server Type: Apache/2.2.2 (Fedora)
Cache Date: 2008-02-28 07:48:27 MST

TheSpyBot

TheSpyBot is a Rogue application and TheSpyBot.com is regdt to ESTDOMAINS

Make sure that you don’t install any application from this website.

TheSpyBot

thespybot.com

Domain Name: thespybot.com
Status: clientTransferProhibited
Registrar: ESTDOMAINS, INC.
Whois Server: whois.estdomains.com
Referral URL: http://www.estdomains.com

Expiration Date: 2009-02-12
Creation Date: 2008-02-12
Last Update Date: 2008-02-13

Name Servers:
ns1.thespybot.com
ns2.thespybot.com

Extended Info IP Address: 78.108.183.32
Website Status: active
Server Type: nginx/0.5.33
Cache Date: 2008-02-28 10:47:53 MST

SpyWatchE

SpyWatchE is a Rogue application and spywatche.com is regdt to ESTDOMAINS

Make sure that you don’t install any application from this website.

SpyWatchE

SpyWatchE.com

Domain Name: spywatche.com
Status: clientTransferProhibited
Registrar: ESTDOMAINS, INC.
Whois Server: whois.estdomains.com
Referral URL: http://www.estdomains.com
Expiration Date: 2009-02-12
Creation Date: 2008-02-12
Last Update Date: 2008-02-13
Name Servers:
ns1.spywatche.com
ns2.spywatche.com

IP Address: 78.108.183.33
Website Status: active
Server Type: nginx/0.5.33
Cache Date: 2008-02-28 10:44:59 MST

spacecodec.com

Another Fake codec site regd to ESTDOMAINS.

This program is a DNS Changer trojan. It pretends to be a browser add-on for viewing porn which is actually a Trojan Horse program.

Stay away from this website.

spacecodec.com

Domain Name: spacecodec.com
Status: ok
Registrar: ESTDOMAINS, INC.
Whois Server: whois.estdomains.com
Referral URL: http://www.estdomains.com

Expiration Date: 2008-09-21
Creation Date: 2007-09-21
Last Update Date: 2008-02-05

Name Servers:
ns1.spacecodec.com
ns2.spacecodec.com
IP Address: 64.28.184.177
IP Location: United States
Website Status: active
Server Type: Apache/2.0.59 (FreeBSD) PHP/5.2.1 with Suhosin-Patch
Cache Date: 2008-02-07 04:32:09 MST

Lightcodec.com

What a PITY, This website is active once again producing the DNS changer trojan after more than a year.

It seams that the snake has taken a big o turn to bite its own tail, but the game is not yet over!!!!!

Stay away from this website.

lightcodec.com

Domain Name: lightcodec.com
Status: ok
Registrar: ESTDOMAINS, INC.
Whois Server: whois.estdomains.com
Referral URL: http://www.estdomains.com

Expiration Date: 2008-09-21
Creation Date: 2007-09-21
Last Update Date: 2008-02-02

Name Servers:
ns1.lightcodec.com
ns2.lightcodec.com

IP Address: 64.28.184.176
IP Location: United States
Website Status: active
Server Type: Apache/2.0.59 (FreeBSD) PHP/5.2.1 with Suhosin-Patch
Cache Date: 2008-02-04 04:38:47 MST

Firecodec.com

Another Fake Codec site Regd to ESTDOMAINS.

This program is a DNS Changer trojan. It pretends to be a browser add-on for viewing porn which is actually a Trojan Horse program.

Stay away from this website.

Firecodec.com

Domain Name: firecodec.com
Status: ok
Registrar: ESTDOMAINS, INC.
Whois Server: whois.estdomains.com
Referral URL: http://www.estdomains.com

Expiration Date: 2008-09-21
Creation Date: 2007-09-21
Last Update Date: 2008-01-29

Name Servers:
ns1.firecodec.com
ns2.firecodec.com

IP Address: 64.28.184.175
IP Location: United States
Website Status: active
Server Type: Apache/2.0.59 (FreeBSD) PHP/5.2.1 with Suhosin-Patch
Cache Date: 2008-02-01 03:10:18 MST

Some Malicious Domains

This summary is not available. Please click here to view the post.

Qazcodec.net

Another Fake Codec site Regd to ESTDOMAINS.

This program is a DNS Changer trojan. It pretends to be a browser add-on for viewing porn which is actually a Trojan Horse program.

Stay away from this website.

qazcodec.net

Domain Name: qazcodec.net
Status: ok
Registrar: ESTDOMAINS, INC.
Whois Server: whois.estdomains.com
Referral URL: http://www.estdomains.com

Expiration Date: 2008-09-21
Creation Date: 2007-09-21
Last Update Date: 2008-01-26

Name Servers:
ns1.qazcodec.net
ns2.qazcodec.net

IP Address: 64.28.184.174
IP Location: United States
Website Status: active
Server Type: Apache/2.0.59 (FreeBSD) PHP/5.2.1 with Suhosin-Patch
Cache Date: 2008-01-28 03:56:01 MST

Hqcodectime.net

Hqcodectime.net is Another Fake Codec Site regtd to ESTDOMAINS.
Following:

codecmpg.com 64.28.184.162
codecmeg.net 64.28.184.163
Codecultra.net 64.28.184.164
codecops.net 64.28.184.165
Codecpro.net 64.28.184.166
codecviva.com 64.28.184.167
Codeczang.net 64.28.184.168
codecplay.com 64.28.184.169
Codecbsplay.com 64.28.184.170
Vipcodecvip.com 64.28.184.171
Hqcodecvip.com 64.28.184.172

Do NOT download any installers from this website.Note that this program is a DNS Changer.

It pretends to be a browser add-on for viewing porn which is actually a Trojan Horse program.

Hqcodectime.net

Domain Name: hqcodectime.net
Status: ok
Registrar: ESTDOMAINS, INC.
Referral URL: http://www.estdomains.com

Expiration Date: 2008-09-21
Creation Date: 2007-09-21
Last Update Date: 2008-01-23

Name Servers:
ns1.hqcodectime.net
ns2.hqcodectime.net

IP Address: 64.28.184.173
IP Location: United States
Website Status: active
Server Type: Apache/2.0.59 (FreeBSD) PHP/5.2.1 with Suhosin-Patch
Cache Date: 2008-01-25 03:17:32 MST

STAY AWAY FROM THIS SITE!!!!!!!!

WinErrorFixer 2007

WinErrorFixer 2007 is described as potentially unwanted application by some of them, as shown in the VirusTotal Result.



VirusTotal Result: 7/32 (21.88%)

AVG -------> SHeur.KTO
eSafe -------> suspicious Trojan/Worm
FileAdvisor -------> Low threat detected
McAfee 5206 -------> potentially unwanted program Winfixer
Panda 9.0.0.4 -------> Application/WinErrorFixer
Prevx1 V2 -------> Suspicious File With Persistence
Webwasher-Gateway 6.0.1 -------> Worm.Win32.ModifiedUPX.gen!84 (suspicious)
----------------------------------------------------------------------------------------
File size: 54552 bytes
MD5: e89ee5276da753dc98571f39119f4265
SHA1: 92f9111440e85e68bc880bd03f8cb0dcf89531c5
PEiD: UPX 2.90 [LZMA] -> Markus Oberhumer, Laszlo Molnar & John Reiser
packers: UPX
Bit9 info: http://fileadvisor.bit9.com/services/extinfo.aspx?md5=e89ee5276da753dc98571f39119f4265
packers: UPX
packers: PE_Patch.UPX, UPX
Prevx info: http://info.prevx.com/aboutprogramtext.asp?PX5=123001F018A318BFD5D60079156D15002616DA17

Screenshots:

Additional information :

Domain Name: winerrorfixer.com
Status: clientDeleteProhibited, clientRenewProhibited, clientTransferProhibited, clientUpdateProhibited

Registrar: GODADDY.COM, INC.
Whois Server: whois.godaddy.com
Referral URL: http://registrar.godaddy.com
Expiration Date: 2008-12-07
Creation Date: 2005-12-07
Last Update Date: 2007-10-29

Name Servers:
ns29.domaincontrol.com
ns30.domaincontrol.com

IP Address: 64.46.38.133
IP Location: Canada
Website Status: active
Server Type: Apache/2.0.58 (Unix) mod_ssl/2.0.58 OpenSSL/0.9.7f PHP/4.4.7
Alexa Trend/Rank: 1 Month: 44,539 3 Month: 49,706
Page Views per Visit: 1 Month: 1.7 3 Month: 1.8
Cache Date: 2008-01-15 03:22:48 MST
Compare Archived Data: 2007-09-15

CodecViva.com

Another Fake Codec Site regtd to ESTDOMAINS.

Do NOT download any installers from this website.

Note that this program is a DNS Changer.It pretends to be a browser add-on for viewing porn which is actually a Trojan Horse program.

CodecViva.com

Domain Name: codecviva.com
Status: ok
Registrar: ESTDOMAINS, INC.
Whois Server: whois.estdomains.com
Referral URL: http://www.estdomains.com
Expiration Date: 2008-09-21
Creation Date: 2007-09-21
Last Update Date: 2008-01-05

Name Servers:
ns1.codecviva.com
ns2.codecviva.com

IP Address: 64.28.184.167
Website Status: active
Server Type: Apache/2.0.59 (FreeBSD) PHP/5.2.1 with Suhosin-Patch
Cache Date: 2008-01-07 05:41:20 MST

InfeStop

InfeStop is a Rogue application from ESTDOMAINS.

It displays fake report to the users, wanting them to purchase the full version to remove the malicious content.

VirusTotla result is very poor, make sure that you do not download the application.

InfeStop.com

InfeStop

Warning

VirusTotal results: 2/32 (6.25%)
NOD32v2----------> error - password-protected file
Microsoft----------> Program:Win32/Easyspywarecleaner

Domain Name: infestop.com
Status: clientTransferProhibited
Registrar: ESTDOMAINS, INC.
Whois Server: whois.estdomains.com
Referral URL: http://www.estdomains.com

Expiration Date: 2008-11-19
Creation Date: 2007-11-19
Last Update Date: 2007-11-19

Name Servers:
ns1.infestop.com
ns2.infestop.com

IP Address: 216.240.138.201
Website Status: active
Server Type: Apache
Cache Date: 2008-01-05 08:42:15 MST

Spy-Rid

 Spy-Rid is a Rogue application from ESTDOMAINS.

It displays fake report to the users, wanting them to purchase the full version to remove the malicious content.

VirusTotla result is very poor, make sure that you do not download the application

Spy-Rid.com

Spy-Rid

Warning

VirusTotal results: 2/32 (6.25%)

NOD32v2----------> error - password-protected file
Sunbelt----------> Spy-Rid

Domain Name: spy-rid.com
Status: clientTransferProhibited
Registrar: ESTDOMAINS, INC.
Whois Server: whois.estdomains.com
Referral URL: http://www.estdomains.com

Expiration Date: 2008-11-19
Creation Date: 2007-11-19
Last Update Date: 2007-11-19

Name Servers:
ns1.spy-rid.com
ns2.spy-rid.com

IP Address: 216.240.138.201
Website Status: active
Server Type: Apache
Cache Date: 2008-01-05 08:30:48 MST

EasySpywareCleaner

EasySpywareCleaner is a Rogue application from ESTDOMAINS.

It displays fake report to the users, wanting them to purchase the full version to remove the malicious content.

VirusTotla result is very poor, make sure that you do not download the application.

EasySpywareCleaner.com

EasySpywareCleaner

Warning

VirusTotal results: 2/32 (6.25%)

Microsoft ----------> Program:Win32/Easyspywarecleaner
NOD32v2 ----------> error - password-protected file

Domain Name: easyspywarecleaner.com
Status: clientTransferProhibited
Registrar: ESTDOMAINS, INC.
Whois Server: whois.estdomains.com
Referral URL: http://www.estdomains.com

Expiration Date: 2008-11-19
Creation Date: 2007-11-19
Last Update Date: 2007-11-19

Name Servers:
ns1.easyspywarecleaner.com
ns2.easyspywarecleaner.com

IP Address: 216.240.138.201
Website Status: active
Server Type: Apache
Alexa Trend/Rank: 1 Month: 831,443
Page Views per Visit: 1 Month: 1.4
Cache Date: 2008-01-05 07:34:30 MST

codecpro.net

codecpro.net is the latest Fake Codec Site from ESTDOMAINS followin

Codecops.net
Codecultra.net
Codecmeg.net
Codecmpg.com
Codecdvi.com

Do NOT download any installers from this website. Note that this program is a DNS Changer.It pretends to be a browser add-on for viewing porn which is actually a Trojan Horse program.

codecpro.net

Domain Name: codecpro.net
Status: ok
Registrar: ESTDOMAINS, INC.
Whois Server: whois.estdomains.com
Referral URL: http://www.estdomains.com

Expiration Date: 2008-09-21
Creation Date: 2007-09-21
Last Update Date: 2008-01-02

Name Servers:
ns1.codecpro.net
ns2.codecpro.net

IP Address: 64.28.184.166
Website Status: active
Server Type: Apache/2.0.59 (FreeBSD) PHP/5.2.1 with Suhosin-Patch
Cache Date: 2008-01-04 03:30:22 MST
Compare Archived Data: 2007-12-13

codecdvi.com

Another Fake Codec Site from ESTDOMAINS.

Do NOT download any installers from this website. Note that this program is a DNS Changer.

It pretends to be a browser add-on for viewing porn which is actually a Trojan Horse program.

codecdvi.com

Virustotal results: 12/32 (37.5%)

My sample is codecdvi1007.exe.

AntiVir ------> HEUR/Malware
AVG ------> Generic_c.FTY
BitDefender ------> Trojan.Zlob.BZY
CAT-QuickHeal ------> Win32.Trojan.DNSChanger.aho
ClamAV ------> Trojan.DNSChanger-2168
Fortinet ------> W32/ZLOB.ESC!tr
F-Secure ------> Trojan.Win32.DNSChanger.aii
Kaspersky ------> Trojan.Win32.DNSChanger.aii
McAfee ------> Puper.gen.d
Microsoft ------> Trojan:Win32/Alureon.gen!E
Symantec ------> Trojan.Zlob
Webwasher-Gateway ------> Heuristic.Malware


Additional information:

Domain Name: codecdvi.com
Status: ok
Registrar: ESTDOMAINS, INC.
Referral URL: http://www.estdomains.com
Expiration Date: 2008-09-21
Creation Date: 2007-09-21
Last Update Date: 2007-12-17

Name Servers:
ns1.codecdvi.com
ns2.codecdvi.com

IP Address: 64.28.184.190
Website Status: active
Server Type: Apache/2.0.59 (FreeBSD) PHP/5.2.1 with Suhosin-Patch
Cache Date: 2007-12-19 06:33:44 MST

SpySnipe

SpySnipe is a rogue application which is a clone of Sunshine Spy.

spysnipe.com is that domain that produces spysnipe.

SpySnipe displays fake allerts as shown in the screenshot below.

It appears that sunshinespy.com was previously under 88.255.94.51. Now they share the IP 77.91.229.42.

I have also included the screenshot of "Sunshine Spy". Make sure note to download these applications.

SpySnipe.com

SpySniper v 1.0

SunshineSpy 1

Domain Name: spysnipe.com
Status: clientDeleteProhibited, clientTransferProhibited
Registrar: BIZCN.COM, INC.
Referral URL: http://www.bizcn.com

Expiration Date: 2008-11-18
Creation Date: 2007-11-18
Last Update Date: 2007-11-18

Name Servers:
ns1.spysnipe.com
ns2.spysnipe.com

IP Address: 77.91.229.42
Website Status: active
Server Type: nginx/0.5.22
Cache Date: 2007-12-17 11:15:49 MSTCompare Archived Data: 2007-12-07