Lavasoft Malware Labs recently had a closer look on an IP range full of hoax sites. Reverse IP on 78.129.142.235 will reveal around 200 fraudulent domains which are hosted in United Arab Emirates. Most of the sites hosted under 78.129.142.235 will use and take advantage of already existing products from the security industry and other popular software. The examples below display their way to make illegal domains look reliable.
hxxp://7zip-2009.info
hxxp://Directx-full.info
hxxp://Icq-full.info
hxxp://Messengerplus-2009.info
hxxp://Safari-full.info
hxxp://Winrar-2009.com
hxxp://Www-kaspersky.info
XP Police Antivirus is a new rogue anti-spyware application. It will give exaggerated threat reports on the compromised computer then ask the user to purchase a registered version to remove threats which don't exist.
Win32.Worm.Waledac spreads itself using Valentine's Day "advertising" as the distribution method. It can be found on a website full of hearts with the text Guess, which one is for you? as picture 1 shows.
AntivirusTrigger is a new rogue anti-spyware application and a clone of VirusTrigger. It will give exaggerated threat reports on the compromised computer then ask the user to purchase a registered version to remove the reported threats.
- ‹‹
- 4 of 4
YOU SHOULD KNOW...
CATEGORIES
- Beta Testing (29)
- Comment (9)
- Definition File Updates (2)
- Developer Comments (15)
- Everyday Life at Lavasoft (92)
- How to (17)
- Industry and Security News (558)
- Lavasoft Products (141)
- Law Enforcement and Legal Action (49)
- News about Lavasoft (109)
- Phishing (1)
- Researcher Comments (39)
- Riff Raff (25)
- Rogues (76)
- Security Alert (93)
- Security Alerts (72)
- Security Tips (260)
- Website News (11)
