Another bunch of Zlob Trojan distributing sites

Another bunch of Zlob Trojan distributing sites

Fresh list of sites distributing Zlob Trojans

1. Gneprogram.com (85.255.118.181)

2. Ndcperformance.com (85.255.113.238)

3. Mzdsoftware.com (85.255.113.235)

4. Pkbsolution.com (85.255.118.179)

Avoid download from these sites to keep your system safe.

Bharath M N

ErrorDigger.Com

ErrorDigger.Com

Definitely this Rogue Security Application will dig up a hole in your pocket. The webpage doesn’t provide any link to download the Application. The rogue Security application is advertised through the Mediaplex(owned by ValueClick).

Screenshot of ads displayed for ErrorDigger by Mediaplex .

The site uses the IP 84.243.253.220 which is also used by many other Sellmosoft Inc Rogue Security Application.

Some of the other Rogue security applications that used/uses this IP are:

1. Performanceoptimizer.com
2. Antivirussecuritypro.com
3. Cryptdrive.com
4. Windefender.com

and many more. Detection on Virustotal is really poor.

Sunbelt CWSandbox Analysis

Avoid it at all cost...

Bharath M N

AVSystemCare crazily spreading on Internet

AVSystemCare crazily spreading on Internet

AVSystemCare a well know Rogue security application is wildly spreading on the internet. The application was first sited around May 2007.

Screenshot of AVSystemCare application

The application is aggressively advertised by Zlob Trojans. When a System gets infected by a Zlob Trojan you might receive the following warning message or a similar warning message luring /confusing/goading users to purchase any one of the many AVSystemcare clone application.

Fake security alert displayed Zlob trojan

AVSystemcare scammers are busy cloning their website. Currently they have more than 300 cloned website that shares the same IP-ddress.

Below is the complete list of sites:

http://www.flickr.com/photos/39438024@N00/1848774276/

http://www.flickr.com/photos/39438024@N00/1848776720/

[EDIT]

New Scam page of AVSystemCare

Avoid all the sites...

Bharath M N

Fresh Pack of Zlob Trojan distributing sites

Fresh Pack of Zlob Trojan distributing sites

Few new codec sites distributing Zlob trojans.

zsvcompany(dot)com

bcnproduction(dot)com

mojtechnology(dot)com

vaulimited(dot)com

Typically the download form these sites pretends as a video codec\Image codec for viewing porn on-line but instead installs Zlob trojan\DNS changer trojan on the system.

Usually some porn sites display a message stating that you need to download a special codec to view the porn on-line. Once the user accepts to install the codec the Trojan starts performing its dirty task of downloading Adware’s nagging the users with fake security warning messages.

The fake security warning message informs the user that the system is infected and is vulnerable to Trojan attacks luring the user into running a scan or downloading a security application to remove the infection. The application that the Trojan suggests will definitely be rogue security application.

The main cause of the Zlob Trojan is to goad users into purchasing Rogue security application. New rogue security application and Zlob developers deploy new installer and jump domains constantly in order to prevent the anti-spyware \malware \virus application from detecting them.

Till now the scammers are successful in winning the battle against the Security provided by the anti-malware \spyware \virus products.

Be a bit cautious about the thing you are downloading on a porn site. Always prevention is better than cure.

Bharath MN

MessengerBlocker

Messenger-blocker.com

This is a new scam that uses the windows Messenger Service to exploit the users into purchasing the rogue security application.

“The scam popup indicates that your computer is vulnarable to pop-ups, viruses, hackers, crackers, unwanted advertisement, spam, etc.”

This scam is directed to scare the users into purchasing the unwanted application to solve the problem.

CA and Symantec have a detail description about the rogue security application.

Avoid the sites and the application that it promotes.

Bharath M N

End-Ads

End-Ads.com

Funny the website is named End-ads and advertises a well documented rogue security application. So the website does the reverse of its name; After installing the application advertised on this webpage you will definitely start receiving ads stating that your system is infected blah blah...

Currently it is advertising SystemDoctor a well known rogue security application.


Site registration details:

Registrar: GODADDY.COM, INC.
Whois Server: whois.godaddy.com
Referral URL: http://registrar.godaddy.com

Expiration Date: 2008-07-13
Creation Date: 2005-07-13
Last Update Date: 2007-03-18


Different domains that share the same IP are listed below:

Blockmessengerspam.com “clone of end-ads.com”
Blockthesepopups.com
Endmessenger.com
Error-safe.org
Escapeads.com
Fightpopups.net “clone of end-ads.com”
Messenger-blocker.com
Messengerservice.info
Messengersoft.com
Messengerstopper.net “clone of end-ads.com”
Phoenixcitylights.com
Stopmessengerads.com
Stoppornads.com
Systemdoctor2008.com
Winantispyware.org
Winantivirus2007pro.com

Looking into the domain one can easily make out that all the websites are malicious. Most of the websites are actively advertising or redirecting to SystemDoctor.

Avoid all these sites and the application that it promotes.

Bharath M N

Protecthips.com! Does this Protects your System?

Protecthips.com

This is a malicious Website which promotes Rogue Security application.

Usually all the users cannot access this website, the system infected by Zlob Trojan usually come up with website mimicking the online/windows security center luring /confusing/goading users to purchase any one of the Rogue Security application advertised in this website.

The website has a test page looks like windows troubleshooting/windows help page which mimics the troubleshooting steps and then finally ask users to use of the Rogue Security application to displayed in the page to fix the issue that they are facing.

This website promotes the following Rogue Security applications:

WinAntiVirus
AntiSpyGolden
VirusHeal
Menace Rescue
Trojans Filter
Antispyware Suite
Drive Cleaner
System Doctor
AntiWorm 2008
GoldenAntiSpy

The Domain shares its IP with the following websites:

asafetyguide.com
ddgate.com
rhgate.com
safeinformations.com
securitysteps.com

All the above listed sites are phony and distribute Rogue Security application.

Avoid all these sites and the application that it promotes.

Bharath M N

Safetysettings? Are you system settings safe enough???

Safetysettings.com

A new malicious site that on the loose. If the system infected by Trojan.Win32.Puper trojan then the system homepage will be redirected to safetysettings.com

Screenshot of Safetysettings.com website

The website usually promotes four new scam software applications. All the applications advertised on this system is flagged as rogue security applications. The Trojan.Win32.Puper trojan also installs a Toolbar(Security Toolbar 7.1 which is visible in the screenshot) which has two buttons. These buttons redirect you to another malicious website apowerbar.com.

The apowerbar.com website further advertises more rogue security applications.

Avoid this phony website at all cost......


Bharath M N

MalwareMonitor.com

MalwareMonitor.com/SpywareLocker.com

Two cloned websites that are busy in distributing clones of SpySheriff application. SpySheriff is a well known Rogue security application.

Screenshot MalwareMonitor application

MalwareMonitor.com registration details:

Registrar: ESTDOMAINS, INC.

Whois Server: whois.estdomains.com

Referral URL: http://www.estdomains.com/

Expiration Date: 2008-08-13

Creation Date: 2007-08-13

Last Update Date: 2007-08-23

Screenshot Spywarelocker application

spywarelocker.com registration details:

Registrar: ESTDOMAINS, INC.

Whois Server: whois.estdomains.com

Referral URL: http://www.estdomains.com/

Expiration Date: 2008-08-13

Creation Date: 2007-08-13

Last Update Date: 2007-08-23

Avoid both the applications at all cost............

Bharath M N

Thecleanersystem.com

The installer available on the site is a suspicious looking security applciation...rogue in my list....but have to see how it distributes in future...

The site is also connected with malwarealarm.com and spy-shredder.com.

Site Registration Details:

Registrar: ESTDOMAINS, INC.
Whois Server: whois.estdomains.com
Referral URL: http://www.estdomains.com/

Expiration Date: 2008-08-07
Creation Date: 2007-08-07
Last Update Date: 2007-08-24

ScreenShot of the System Cleaner and Hardware Doctor

VirusTotal scan Result: 4/32 (12.5%)


eSafe 7.0.15.0 2007.09.17 -1891492438
Ikarus T3.1.1.12 2007.09.18 Virus.Win32.Alman.a
Sunbelt 2.2.907.0 2007.09.15 VIPRE.Suspicious
Webwasher-Gateway 6.0.1 2007.09.18 Win32.Malware.gen (suspicious)

Think before installing choice is your's......but avoid it at all cost

Bharath M N