SpyProtector

[Malekal_morte]

Thank SiRi

SpyProtector est un rogue (faux anti-spyware) qui s'installe sans permission, le malware affiche de fausses alertes vous indiquant que vous êtes infecté par un spyware et vous recommande d'acheter ce faux anti-spyware pour soit disant désinfecter votre ordinateur.



Quelques exemples de captures des Fausses pages de scan/alerte de sécurité

[Malekal_morte]

Code : Tout sélectionner

1229545597.471   6073 192.168.1.25 TCP_MISS/304 290 GET http://www.sys-scanner.org/l2/index.html?ref_id=4506 - DIRECT/64.27.15.214 -

Domain ID:D154855799-LROR
Domain Name:SYS-SCANNER.ORG
Created On:08-Dec-2008 12:27:55 UTC
Last Updated On:13-Dec-2008 16:30:53 UTC
Expiration Date:08-Dec-2009 12:27:55 UTC
Sponsoring Registrar:Bizcn.com, Inc. (R1248-LROR)
Status:CLIENT TRANSFER PROHIBITED
Status:TRANSFER PROHIBITED

Registrant ID:orgob28739271679
Registrant Name:Oleg Bajenov
Registrant Organization:Indivudual
Registrant Street1:120 Cheluskinskaya st
Registrant Street2:
Registrant Street3:
Registrant City:Moskow
Registrant State/Province:RU
Registrant Postal Code:127500
Registrant Country:RU
Registrant Phone:+86.79068601413
Registrant Phone Ext.:
Registrant FAX:+86.5925163169
Registrant FAX Ext.:
Registrant Email:[email protected]

Admin ID:orgob28739272029
Admin Name:Oleg Bajenov
Admin Organization:Indivudual
Admin Street1:120 Cheluskinskaya st
Admin Street2:
Admin Street3:
Admin City:Moskow
Admin State/Province:RU
Admin Postal Code:127500
Admin Country:RU
Admin Phone:+86.79068601413
Admin Phone Ext.:
Admin FAX:+86.5925163169
Admin FAX Ext.:
Admin Email:[email protected]

Tech ID:orgob28739272459
Tech Name:Oleg Bajenov
Tech Organization:Indivudual
Tech Street1:120 Cheluskinskaya st
Tech Street2:
Tech Street3:
Tech City:Moskow
Tech State/Province:RU
Tech Postal Code:127500
Tech Country:RU
Tech Phone:+86.79068601413
Tech Phone Ext.:
Tech FAX:+86.5925163169
Tech FAX Ext.:
Tech Email:[email protected]

Name Server:NS1.SYS-SCANNER.ORG
Name Server:NS2.SYS-SCANNER.ORG

[Malekal_morte]

Code : Tout sélectionner

1235662497.906    192 192.168.1.63 TCP_MISS/200 343 GET http://www.mybussines.biz/best/cd.php?userid=26022009_034501_131426437 - DIRECT/91.211.64.147 text/html
1235662498.046    679 192.168.1.63 TCP_MISS/200 7873 GET http://www.sys-av-lookup.org/l1/index.html?ref_id=7454 - DIRECT/78.46.152.8 text/html
1235662499.456   1432 192.168.1.63 TCP_MISS/200 30177 GET http://www.sys-av-lookup.org/scipt/jquery-1.2.3.pack.js - DIRECT/78.46.152.8 application/x-javascript