« previous next »
Pages: [1]   Go Down

Author Topic: Is this redirecting to scam/scareware?  (Read 1714 times)

0 Members and 1 Guest are viewing this topic.

Offline polonus

  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 33926
  • malware fighter
Is this redirecting to scam/scareware?
« on: June 13, 2012, 04:59:15 PM »
See: htxp://zulu.zscaler.com/submission/show/2044e4aa3631584b158a7ccfcdde5b40-1339598316
See: htxp://anubis.iseclab.org/?action=result&task_id=1e0048daa7dd484748d

getfile?hash=5d72/c08c76eed47f71b0eef5f927b16a88c53979 - archive ZIP
/getfile?hash=5d72/c08c76eed47f71b0eef5f927b16a88c53979/5d72/c08c76eed47f71b0eef5f927b16a88c53979 packed by UPX
/getfile?hash=5d72/c08c76eed47f71b0eef5f927b16a88c53979/5d72/c08c76eed47f71b0eef5f927b16a88c53979 - archive BINARYRES
getfile?hash=5d72/c08c76eed47f71b0eef5f927b16a88c53979/5d72/c08c76eed47f71b0eef5f927b16a88c53979/data001 - file ?
/getfile?hash=5d72/c08c76eed47f71b0eef5f927b16a88c53979/5d72/c08c76eed47f71b0eef5f927b16a88c53979/data002 - archive JS-HTML
/getfile?hash=5d72/c08c76eed47f71b0eef5f927b16a88c53979/5d72/c08c76eed47f71b0eef5f927b16a88c53979/data002 -?
/getfile?hash=5d72/c08c76eed47f71b0eef5f927b16a88c53979/5d72/c08c76eed47f71b0eef5f927b16a88c53979 - ?
?hash=5d72/c08c76eed47f71b0eef5f927b16a88c53979 - ?

reported to virus AT avast dot com,

polonus

Logged
Cybersecurity is more of an attitude than anything else. Avast Evangelists.

Use NoScript, a limited user account and a virtual machine and be safe(r)!

Offline polonus

  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 33926
  • malware fighter
Re: Is this redirecting to scam/scareware?
« Reply #1 on: June 13, 2012, 05:19:37 PM »
Look at the IDS alerts here: http://urlquery.net/report.php?id=67915
flags: ET RBN Known Russian Business Network IP (141)

polonus
Logged
Cybersecurity is more of an attitude than anything else. Avast Evangelists.

Use NoScript, a limited user account and a virtual machine and be safe(r)!

ajhaig

  • Guest
Re: Is this redirecting to scam/scareware?
« Reply #2 on: June 14, 2012, 04:31:41 AM »
Sorry if this is off topic, but has anyone encountered this: my sister downloaded Avast (she had a lic but her computer was rebooted and stripped of apps, so she needed to reinstall it).
Many issues later, I saw that she had downloaded Avast four times (4 times, don't ask), BUT, another app downloaded 4x also (tethered?), without her help, called SpeedyPC Pro.
Then, she claims, it mysteriously installed itself, and then caused many conflicts including disabling Google and Chrome at various times and popped up all the time. Of course I uninstalled it and now the browsers seem to work ok.
What could this be?
Thanks!
Logged
Pages: [1]   Go Up
« previous next »