Saturday, March 1, 2008

Week End Updates

Week End Updates




Zlob Trojan Distributing Sites:

Site Name: wmvsolution.com
IP address: 85.255.120.109

Site Name: mpgapplication.com
IP address: 85.255.118.180

The component sites associated with Zlob Trojan:

Site Name: pageforsafety.com
IP address: 85.255.116.210
This is a Scam Internet Security Page advertising Rogue security applications.

Site Name: dnserrorslist.com
IP address: 85.255.118.246
This is a fake DNS Error Page; the site also advertises Rogue Security applications. (Currently it’s advertising WinSecureAV a Rogue Security application from Winfixer family)

Here is a list of sites directly connected to SSH Family.

Site Name: Entertainaround.com
Site Name: secureinformway.com
Site Name: Gatekl.com
Site Name: Gatecs.com
All the sites shares the IP address: 85.255.118.246

Site Name: gatexv.com
IP address: 85.255.118.214

Site Name: Gatenu.com
Site Name: Onlinehelptool.com
All the sites shares the IP address: 85.255.118.214


Site Name: gateqa.com
Site Name: asafetyoffice.com
Site Name: gateqa.com
All the sites shares the IP address: 85.255.118.213

Site Name: gatews.com
Site Name: securitybrochure.com
Site Name: Gatevj.com
Site Name: Gateow.com
Site Name: Entertainallday.com
All the sites shares the IP address: 85.255.118.35

All the above mentioned sites Registrar is ESTDOMAINS, INC. The above mentioned sites which belong to SSH family are created to run scam and lure user to purchase Rogue security application.




Site Name: Websoft-c.com
IP Address: 202.71.102.101
This site pushes Trojan horse disguised as Fake codec.

New Rogue Security applications:

Site Name: TheSpyBot.com
IP Address: 78.108.183.32



ScreenShot of TheSpyBot Application


Site Name: SpyWatchE.com
IP Address: 78.108.183.32


ScreenShot of SpyWatchE Application

TheSpyBot and SpyWatchE are Rogue Security applications. These are the new Rogue Security application from the spywareNo family of rogue security application.

This Group is busy again cloning their applications and spreading it on internet.



Site Name: Mastertools.us
IP Address: 85.255.121.76

ScreenShot of SpyKillerPro Application

The site distributes SpyKillerPro a well documented rogue Security applciation. More on the Rogue Security aplication here.

Stay safe and do not visit any of these sites.

Bharath M N

blog comments powered by Disqus