Rogueware AntivirusPlus - thegreatsecurity.com

Rogueware AntivirusPlus - thegreatsecurity.com, todaybestscan.com Another list of malicious domain promoting rogue software associated with "AntivirusPlus" READ THIS page if you need more information easyincomeprotection.cn (Also have 6 different template) bigdefense2u.cn easydefenseonline.cn easyincomeprotection.cn easypersonalprotection.cn examineillnesslive.cn freedefenseforyou.cn mycheckdiseasepro.cn mycheckdiseasestore.cn mydefense4u.cn mydefense4you.cn myguardforyou.cn newguard4u.cn newguard4you.cn refugepro.cn yourguard4you.cn yourguardforyou.cn yourguardonline.cn yourguardpro.cn Anubis - VirusTotal Created 30-mar-2009 Registered with "广东时代互联科技有限公司" translated into english the result beeing: "Time Internet Technology Co., Ltd. Guangdong" also cited as registrar for hosting SCAM websites here DDK-Group-Inc. EFS-Capital-Group-Inc tdk-group-inc e-innovative-inc DNS: ns1.pubilcnameserver7.com [94.247.2.215] ns2.pubilcnameserver7.com [94.247.2.216] Using the same DNS we have: easyaddedantivirus.com [94.247.2.215] yourcountedantivirus.com [94.247.2.215] Created 30-mar-2009 Registrar used: BIZCN.COM, INC. Application screenshot (Alias: FakePlus) topsoftscanner.com [209.44.126.14] Created 25-mar-2009 No whois info - PrivacyProtect.org Registrar used: DIRECTI INTERNET SOLUTIONS PVT. LTD thegreatsecurity.com [209.44.126.14] hxxp://golkis.dnip.net/online-j49/yornt.html Javascrit Analysis by Wepawet Seen on Alexa "The Google cache has been updated and the link has been removed." Created 03-apr-2009 No whois info - PrivacyProtect.org Registrar used: DIRECTI INTERNET SOLUTIONS PVT. LTD checkonlinesecurity.com [209.44.126.14] Created 05-apr-2009 No whois info - PrivacyProtect.org Registrar used: DIRECTI INTERNET SOLUTIONS PVT. LTD todaybestscan.com [209.44.126.14] Created 05-apr-2009 No whois info - PrivacyProtect.org Registrar used: DIRECTI INTERNET SOLUTIONS PVT. LTD Using these two DNS: ns1.fuckmoneycash.com [209.44.126.15] ns2.fuckmoneycash.com [209.44.126.16] Title: My computer Online Scan
Template used:

Black Hat SEO and Rogue Antivirus p.6

The silent threat: Black Hat SEO and Rogue Antivirus Analyzing the tactic READ THIS page if you need more information Yet another WinWebSecurity variant this one through crack/serial websites and ad network Fake ad: BE PROTECTED! - FREE online system scan for viruses, trojans and malware. Check it out - maybe someone have access to your PC right now! Protect yourself. Which result in a complete set of redirection Redirection 1 Redirection 2 Redirection 3 Redirection 4 then initialsecurityscan.com Retreived from google cache here VirusTotal Prevx Anubis File install.exe received on 04.03.2009 12:28:53 (CET) Result: 18/39 (46.16%) File info: File size: 108584 bytes MD5: de926b63ab0976244d752170dac7ec00 Hosted by Netelligent Hosting Services Inc on the IP 209.44.126.14 Screenshot on Friday April 3 Using NS1.FUCKMONEYCASH.COM and NS2.FUCKMONEYCASH.COM as DNS Servers No whois info - PrivacyProtect.org Registrar: DIRECTI INTERNET SOLUTIONS PVT. LTD. D/B/A PUBLICDOMAINREGISTRY.COM Dates: Created 01-apr-2009 Registration Service Provided By: DOMAIN NAMES REGISTRAR REG.RU LTD.