Another fake-av site detected..

[polonus]

Hi Pondus,

That is a rather new one with two detections, ViCheck.ca has it
It is a revival of malware last seen 2010-10-29 now at Portlane dot network
MD5 hash e5c2bcdaf4efec616469d1f307ac5c49
VT results then: http://www.virustotal.com/file-scan/report.html?id=ddd41cb48e8d132e081dcfa04d77369dfd2827d75cba6d14fd92f32aa819675f-1288376959
New detections from 193 dot 105 dot 134 dot 192  IP=on
ever so many versions, most recent : md5=1b3a4d15224fbc89b05accea481f1e7e
md5=158336212ed8607fd1b73921b8d7d8e9
md5=3e53b7a015b5be059393f38ca71216d7

They launch three new ones every day, see also: http://info.prevx.com/aboutprogramtext.asp?PX5=1DEFB0A300A1DC14AAB7034A9D84B5004CDB5185


polonus

[polonus]

Detected only by GData at VT and SOSWebScan: http://www.virustotal.com/url-scan/report.html?id=b7cc4dc35569f5f9d3f1da92bb844111-1307540248   Trojan Fake AV
See VT file scan here: http://www.virustotal.com/file-scan/report.html?id=48d1a9554f5403d27d2013f4d833b378b30d944720b70776b5e9d694dc320b9e-1307547950

polonus

[Pondus]

that is our friend Freesystemscan again...he have been very active for the last weeks


 
freesystemscan.exe - 6/43
http://www.virustotal.com/file-scan/report.html?id=8e6e3ef280e00b3cff1f5117d185407d4660c20adc2345d93d8f05ccae6d1856-1307561903

Malwarebytes detect as - Rogue.FakeMSE

[polonus]

Hi Pondus,

Here is the ThreatExpert report for the one you mentioned: http://www.threatexpert.com/report.aspx?md5=6a98f83a7b1e05af8235d9b407fce86f

polonus

[polonus]

Rogue.Agent/Gen-Nullo[EXE] (trojan dropper) not detected, see VT results:

http://www.virustotal.com/url-scan/report.html?id=ebc150c20ba3ca3827b0af0959f1129f-1308060320
&
http://www.virustotal.com/file-scan/report.html?id=8bdd8ffa4b776e26935f59e5c582ab627ed0953e8975aea918c074ce97db5801-1308067991

polonus