A recent tour of scareware IV

As usual, new variants of known scareware (rogue) are emerging every day using the usual methods of deception (false alerts, domain names alluding, false scans, etc.)..

Some of the latest malware of this style are:

XpyBurner *
MD5: eb8f9f40c563250f53b404b61dbfb491
IP: 72.232.186.20
United States Las Vegas Dwd Technologies Llc
Platform: Windows
Associated domains:
Xpyburner. Com
Xpyburnerpro. Com
VT Report: 19/ 38 (50.00%)

Security System *
MD5: 45bcdb17659fc0f6f6277e9e027441cc
IP: 72.232.186.18
United States Las Vegas Dwd Technologies Llc
Platform: Windows
Associated domains:
System-tuner. Com
Systemsecurityse. Com

VT Report: 19/ 39 (48.72%)

HDrive Sweeper *
MD5: c1fc9887457353607062fd8df689fde0
IP: 72.232.186.21
United States Las Vegas Dwd Technologies Llc
Platform: Windows
Associated domains:
Hdrivesweeper. Com
Hdrivesweeperpro. Com
VT Report: 21/ 39 (53.85%)

System Tuner *
MD5: fa36c3b1d61b6e9d7b2f6b0ee645806d
IP: 72.232.186.18
United States Las Vegas Dwd Technologies Llc
Platform: Windows
Associated domains:
System-tuner. Com
Systemsecurityse. Com
VT Report: 22/ 35 (62.86%)

* Encunetran is on the same IP range.

AntiSpyware 3000
MD5: 945725b374fad6a35e24e2e8543a5d85
IP: 210.51.37.113
Shanghai China-stock-ltd Xindongli
Platform: Windows
Associated domains:
antispyware3000. net
duocw. com
VT Report: 38/ 39 (97.44%)

Virus Doctor
MD5: 82e6594e1d241f23eb2c524beecc9963
IP: 64.86.17.9
Teleglobe Inc. Montreal Canada
Platform: Windows
Associated domains:
mysupervisor. net
virus-doctor. com
pay-virusdoctor. com
trdatasft. com
Online virusdoctor. com
VT report: 21/ 39 (53.85%)

Total Virus Protection
MD5: 84e782738fcef71a8701da221fed94c5
IP: 83,133,123,166 / 92,241,176,220
Wuppertal Germany LNC-dsl-discounter
Russian Federation Wahome Colocation
Platform: Windows
Associated domains:
t61.1paket. com
totalmalwareprotection. com
xpvirusprotection. com
xpvirusprotection2009. com
VT Report: 3/ 39 (7.69%)

MalwareDoc
MD5: af5f63cdaed1e619b65d7bf506e40e3a
IP: 193.138.172.5
Moscow Russian Federation New Communication Technologies
Platform: Windows
Associated domains:
antispyknight. biz
474.metago. Cn beforethehost. Com, bobthejoker. Info atingloves. Ru, farmhut. Net, femoffice. Net, foxtrot1. Biz, friendis. Us, gaysagays. Com, gogogogogogogogogogogo. Cn google-analutuk. Com, iframestat. org, intellpoint. org, avascript. bz, kva-kva. net, Lencom. com, live69. ru, matchwow. us, mycashnew. ru, mynewcards. ru, odnoklassniki-newyear2009. ru, ownroom. org, oy4b-oykb. ru, piontor. com, Pompova. ru, pop.yandex2. cn pornuha. cc, smsgogo. cn topsale. us
VT Report: 7/ 38 (18.42%)

Antivirus 1
MD5: 27a882668aeda52450ef78a0d6e42a30

IP: 70.38.19.201
- Ontario - Toronto - Alexandre Lussier
Platform: Windows
Associated domains:
2010.info anti-virus, antivirus-2010.info, av1-download.info, av1-site.info, downloads.anti-virus-2010.info, tagsdirect.winfamilyholiday.com, Anti-virus1-installs.info
VT Report: 5/ 39 (12.82%)

Related information
A recent tour of scareware III
A recent tour of scareware II
A recent tour of scareware

Jorge Mieres