Archive for January, 2008

How low can Zango go?

It appears there is no depth that Zango will go … following up on a recent story about “Heath Ledger fans get a dose of malware” which leads off with “The death of actor Heath Ledger has prompted cybercriminals to trick unsuspecting fans into downloading malware“ So I thought I’d Google around and see what […]

Bogus Macromedia Video ActiveX Error

These people sure are inventive … however there is no such thing as a “Macromedia Video ActiveX Error“  (Image edited for display purposes) Users that fall for this bogus prompt will get infected by “webmovies-b” (Win32/Statik) that I mentioned in a previous post.

More bogus Free Celebrities Movies

The following site advertises quite a few “Free Celebrities Movies” … but that’s not what you get …  (Image edited for display purposes) As you can see there are several culprits involved … porntubq(dot)com detected as: HTML/TrojanClicker.Agent.Fthen “64.28.183.26” loads the ActiveX to “helpticket(dot)net – you can see the VirusTotal results here. helpticket(dot)net is hosted at: […]

Another set of nasty Trojans

It appears that the “Rbusiness Network’ (aka: IFrame Dollars Group) are back in full swing … after a short lull while moving their site to new loocations due to heavy media coverage. Clicking Continue (not recommended) results in the following … Notice the detection is not the typical “codec” Zlob/DNSChanger … below is another example […]

Limelight Networks kicks WinFixer to the curb

It took a while … but it looks like Limelight finally sent the WinFixer Group packing … Back in December I wrote several posts about Limelight hosting malicious content for the WinFixer Group, after which I contacted them and only received a standard reply – “we are looking into it …”. 208.111.129.28  download.cdn.winsoftware.com208.111.129.28  sec.storageguardsoft.com208.111.129.28  software.protectdownloads.com208.111.129.28  […]

MVPS HOSTS File Update [JAN-20-2008]

The MVPS HOSTS file was recently updated [JAN-20-2008]http://www.mvps.org/winhelp2002/hosts.htm Download: hosts.zip (146 kb)http://www.mvps.org/winhelp2002/hosts.zip How To: Download and Extract the HOSTS filehttp://www.mvps.org/winhelp2002/hosts2.htm HOSTS File – Frequently Asked Questionshttp://www.mvps.org/winhelp2002/hostsfaq.htm Note: the “text” version makes a great resource for determining possible culprits … (640 kb)http://www.mvps.org/winhelp2002/hosts.txt Sign up for HOSTS file update noticeshttp://www.mvps.org/winhelp2002/updates.htm

Beware of fake PornTube sites

Seems the malware creeps are playing on the popularity of “PornTube” an adult type version of YouTube … Notice the title of the page … and there are quite a few using the same title. Which is also a “Google.Warning” site … Yikes! … accessing this site you not only get a typical (bogus) “you […]

Correction to the MVPS HOSTS file

I’ve uploaded a fresh copy of the HOSTS file due to making a correction to one of the entries … www.interactivebrands.com Corrected entry: 127.0.0.1  www.interactivebrands.com Not really that critical, but I wanted to advise anyone that happened to notice …

MVPS HOSTS File Update 01-03-08

The MVPS HOSTS file was recently updated [01-03-08]http://www.mvps.org/winhelp2002/hosts.htm Download: hosts.zip (146 kb)http://www.mvps.org/winhelp2002/hosts.zip How To: Download and Extract the HOSTS filehttp://www.mvps.org/winhelp2002/hosts2.htm HOSTS File – Frequently Asked Questionshttp://www.mvps.org/winhelp2002/hostsfaq.htm Note: the “text” version makes a great resource for determining possible culprits … (640 kb)http://www.mvps.org/winhelp2002/hosts.txt Sign up for HOSTS file update noticeshttp://www.mvps.org/winhelp2002/updates.htm