Winweb Security

[Malekal_morte]

Winweb Security est un rogue (faux anti-spyware) qui s'installe sans permission, le malware affiche de fausses alertes vous indiquant que vous êtes infecté par un spyware et vous recommande d'acheter ce faux anti-spyware pour soit disant désinfecter votre ordinateur.



Quelques exemples de captures des Fausses pages de scan/alerte de sécurité

[Malekal_morte]

Code : Tout sélectionner

1227490387.164    203 192.168.1.120 TCP_MISS/200 14947 GET http://securityinternetpilot.com/ws/index.php?affid=02100 - DIRECT/85.17.92.138 text/html
1227490388.486    522 192.168.1.120 TCP_IMS_HIT/304 290 GET http://securityinternetpilot.com/ws/js/jquery.js - NONE/- application/x-javascript
1227490388.595    108 192.168.1.120 TCP_IMS_HIT/304 289 GET http://securityinternetpilot.com/ws/js/jquery-init.js - NONE/- application/x-javascript

Domain Name: SECURITYINTERNETPILOT.COM
Registrar: DIRECTI INTERNET SOLUTIONS PVT. LTD. D/B/A PUBLICDOMAINREGISTRY.COM
Whois Server: whois.PublicDomainRegistry.com
Referral URL: http://www.PublicDomainRegistry.com
Name Server: NS1.SECURITYINTERNETPILOT.COM
Name Server: NS2.SECURITYINTERNETPILOT.COM
Status: clientTransferProhibited
Updated Date: 10-oct-2008
Creation Date: 10-oct-2008
Expiration Date: 10-oct-2009

Registrant:
PrivacyProtect.org
Domain Admin ([email protected])
P.O. Box 97
Note - All Postal Mails Rejected, visit Privacyprotect.org
Moergestel
null,5066 ZH
NL
Tel. +45.36946676

Creation Date: 10-Oct-2008
Expiration Date: 10-Oct-2009

Domain servers in listed order:
ns2.securityinternetpilot.com
ns1.securityinternetpilot.com


Administrative Contact:
PrivacyProtect.org
Domain Admin ([email protected])
P.O. Box 97
Note - All Postal Mails Rejected, visit Privacyprotect.org
Moergestel
null,5066 ZH
NL
Tel. +45.36946676

Technical Contact:
PrivacyProtect.org
Domain Admin ([email protected])
P.O. Box 97
Note - All Postal Mails Rejected, visit Privacyprotect.org
Moergestel
null,5066 ZH
NL
Tel. +45.36946676

Billing Contact:
PrivacyProtect.org
Domain Admin ([email protected])
P.O. Box 97
Note - All Postal Mails Rejected, visit Privacyprotect.org
Moergestel
null,5066 ZH
NL
Tel. +45.36946676

[Malekal_morte]

Nouvelle fausse page de scan :

Code : Tout sélectionner

http://webwatchstability.com/ws/index.php?affid=02600

Domain Name: WEBWATCHSTABILITY.COM
Registrar: REGTIME LTD.
Whois Server: whois.regtime.net
Referral URL: http://www.webnames.ru
Name Server: NS1.WEBWATCHSTABILITY.COM
Name Server: NS2.WEBWATCHSTABILITY.COM
Status: ok
Updated Date: 27-nov-2008
Creation Date: 27-nov-2008
Expiration Date: 27-nov-2009

Name servers:
ns1.webwatchstability.com
ns2.webwatchstability.com

Registrar: Regtime Ltd.
Creation date: 2008-11-27
Expiration date: 2009-11-27

Registrant:
Cathy Gloeckler
Email: [email protected]
Organization: Private person
Address: 485 Illinois Avenue
City: Portland
State: OR
ZIP: 97205
Country: US
Phone: +1.5036891731
Administrative Contact:
Cathy Gloeckler
Email: [email protected]
Organization: Private person
Address: 485 Illinois Avenue
City: Portland
State: OR
ZIP: 97205
Country: US
Phone: +1.5036891731
Technical Contact:
Cathy Gloeckler
Email: [email protected]
Organization: Private person
Address: 485 Illinois Avenue
City: Portland
State: OR
ZIP: 97205
Country: US
Phone: +1.5036891731
Billing Contact:
Cathy Gloeckler
Email: [email protected]
Organization: Private person
Address: 485 Illinois Avenue
City: Portland
State: OR
ZIP: 97205
Country: US
Phone: +1.5036891731

La page de téléchargement du rogue est actuellement :

Code : Tout sélectionner

1227989099.554    356 192.168.1.63 TCP_MISS/200 60348 GET http://protectedserverdownload.com/downloadsetupws.php?affid=02600 - DIRECT/85.17.92.138 application/octet-stream

Domain Name: PROTECTEDSERVERDOWNLOAD.COM
Registrar: REGTIME LTD.
Whois Server: whois.regtime.net
Referral URL: http://www.webnames.ru
Name Server: NS1.PROTECTEDSERVERDOWNLOAD.COM
Name Server: NS2.PROTECTEDSERVERDOWNLOAD.COM
Status: ok
Updated Date: 27-nov-2008
Creation Date: 27-nov-2008
Expiration Date: 27-nov-2009

Name servers:
ns1.protectedserverdownload.com
ns2.protectedserverdownload.com

Registrar: Regtime Ltd.
Creation date: 2008-11-27
Expiration date: 2009-11-27

Registrant:
Cathy Gloeckler
Email: [email protected]
Organization: Private person
Address: 485 Illinois Avenue
City: Portland
State: OR
ZIP: 97205
Country: US
Phone: +1.5036891731
Administrative Contact:
Cathy Gloeckler
Email: [email protected]
Organization: Private person
Address: 485 Illinois Avenue
City: Portland
State: OR
ZIP: 97205
Country: US
Phone: +1.5036891731
Technical Contact:
Cathy Gloeckler
Email: [email protected]
Organization: Private person
Address: 485 Illinois Avenue
City: Portland
State: OR
ZIP: 97205
Country: US
Phone: +1.5036891731
Billing Contact:
Cathy Gloeckler
Email: [email protected]
Organization: Private person
Address: 485 Illinois Avenue
City: Portland
State: OR
ZIP: 97205
Country: US
Phone: +1.5036891731

[Malekal_morte]

Winweb Security est mis très en avant via de nombres redirections vers la fausse page de scan actuelle :

Code : Tout sélectionner

1229451781.300   3007 192.168.1.63 TCP_MISS/200 15898 GET http://websecuritydirecti.com/ws/index.php?affid=02700 - DIRECT/85.17.212.134 text/html

et le téléchargement du programme d'installation du rogue à cette adresse :

Code : Tout sélectionner

1229451149.372   7118 192.168.1.25 TCP_MISS/200 63502 GET http://securefileservices.com/downloadsetupws.php?affid=02700 - DIRECT/85.17.212.134 application/octet-stream

[Malekal_morte]

Winweb Security est mort, vive System Security !