SpywareRemover 2009

[Malekal_morte]

SpywareRemover 2009 est un rogue (faux anti-spyware) qui s'installe sans permission, le malware affiche de fausses alertes vous indiquant que vous êtes infecté par un spyware et vous recommande d'acheter ce faux anti-spyware pour soit disant désinfecter votre ordinateur.

[Malekal_morte]

www.spywareremover2009pro.com partage la même IP que le site du rogue PCPrivacyCleaner (89.18.181.13)

Domain Name: SPYWAREREMOVER2009PRO.COM
Registrar: ESTDOMAINS, INC.
Whois Server: whois.estdomains.com
Referral URL: http://www.estdomains.com
Name Server: NS1.SPYWAREREMOVER2009PRO.COM
Name Server: NS2.SPYWAREREMOVER2009PRO.COM
Name Server: NS3.SPYWAREREMOVER2009PRO.COM
Name Server: NS4.SPYWAREREMOVER2009PRO.COM
Status: clientTransferProhibited
Updated Date: 27-oct-2008
Creation Date: 22-oct-2008
Expiration Date: 22-oct-2009


Domain Name: SPYWAREREMOVER2009PRO.COM

Registrant:
Peersoft INC
Joshua Pearman ([email protected])
2432 Charter Street, 66214
Lenexa
Kansas,66220
US
Tel. +7.9137450640

Creation Date: 22-Oct-2008
Expiration Date: 22-Oct-2009

Domain servers in listed order:
ns4.spywareremover2009pro.com
ns3.spywareremover2009pro.com
ns2.spywareremover2009pro.com
ns1.spywareremover2009pro.com


Administrative Contact:
Peersoft INC
Joshua Pearman ([email protected])
2432 Charter Street, 66214
Lenexa
Kansas,66220
US
Tel. +7.9137450640

Technical Contact:
Peersoft INC
Joshua Pearman ([email protected])
2432 Charter Street, 66214
Lenexa
Kansas,66220
US
Tel. +7.9137450640

Billing Contact:
Peersoft INC
Joshua Pearman ([email protected])
2432 Charter Street, 66214
Lenexa
Kansas,66220
US
Tel. +7.9137450640

[Malekal_morte]

Code : Tout sélectionner

1237644445.445    699 192.168.1.25 TCP_MISS/200 10767 GET http://removespywarethreats.com/scns/1/?a=-en&l=srm_1&prodabbr=USRM - DIRECT/94.102.51.15 text/html
1237644458.193   5104 192.168.1.25 TCP_MISS/200 1501988 GET http://downl.removespywarethreats.com/secure/1b6a1b9733f5a7e5c31c8b6b84ecfffd/49c4d33d/SpywareRemover2009.com/SpywareRemover2009_Installer_Dual_Rezer_en.exe -

Domain Name: REMOVESPYWARETHREATS.COM
Registrar: YESNIC CO. LTD.
Whois Server: whois.yesnic.com
Referral URL: http://www.yesnic.com
Name Server: NS1.COMONDNS.COM
Name Server: NS2.COMONDNS.COM
Name Server: NS3.COMONDNS.COM
Name Server: NS4.COMONDNS.COM
Status: clientTransferProhibited
Updated Date: 02-mar-2009
Creation Date: 24-feb-2009
Expiration Date: 24-feb-2010

::Registrant::
Name : Preston Wasson
Email : [email protected]
Address : 4532 Dancing Dove Lane
Zipcode : 10011
Nation : US
Tel : 347-526-4950
Fax :

[Malekal_morte]

Code : Tout sélectionner

1237644423.856    147 192.168.1.25 TCP_MISS/200 9433 GET http://advancesoftwaretool.com/2009/download/ex.html?a=cspamg-sst&l=30&f=cs_5846519023&ex=1&ed=2&h=&sub=csp&prodabbr=3P_UVSM&p=14 - DIRECT/78.46.93.77 text/html
1237644423.886    136 192.168.1.25 TCP_MISS/200 5727 GET http://desktoprepairpackage.com/js/settings.js - DIRECT/94.102.51.15 application/x-javascript
1237644424.050    164 192.168.1.25 TCP_MISS/200 1627 GET http://desktoprepairpackage.com/etc/secure_installers.js - DIRECT/94.102.51.15 application/x-javascript
1237644424.138     88 192.168.1.25 TCP_MISS/200 5557 GET http://desktoprepairpackage.com/js/params.js - DIRECT/94.102.51.15 application/x-javascript
1237644424.294    155 192.168.1.25 TCP_MISS/200 10696 GET http://desktoprepairpackage.com/js/managers.js - DIRECT/94.102.51.15 application/x-javascript
1237644424.382     87 192.168.1.25 TCP_MISS/200 9890 GET http://desktoprepairpackage.com/js/index.js - DIRECT/94.102.51.15 application/x-javascript
1237644424.528    114 192.168.1.25 TCP_MISS/302 532 GET http://advancesoftwaretool.com/secure/457aa1faf33f32ad3cc21d43497c1d07/49c4d33e/bestvirusremover2009.com/virusremover2009_setup_free_rezer_en.exe - DIRECT/78.46.93.77 text/html
1237644427.663   3099 192.168.1.25 TCP_MISS/200 280452 GET http://download.advancesoftwaretool.com/secure/457aa1faf33f32ad3cc21d43497c1d07/49c4d33e/bestvirusremover2009.com/virusremover2009_setup_free_rezer_en.exe - DIRECT/38.103.173.97 application/x-msdos-program

Domain Name: DESKTOPREPAIRPACKAGE.COM
Registrar: YESNIC CO. LTD.
Whois Server: whois.yesnic.com
Referral URL: http://www.yesnic.com
Name Server: NS1.COMONDNS.COM
Name Server: NS2.COMONDNS.COM
Name Server: NS3.COMONDNS.COM
Name Server: NS4.COMONDNS.COM
Status: clientTransferProhibited
Updated Date: 02-mar-2009
Creation Date: 24-feb-2009
Expiration Date: 24-feb-2010

::Registrant::
Name : Preston Wasson
Email : [email protected]
Address : 4532 Dancing Dove Lane
Zipcode : 10011
Nation : US
Tel : 347-526-4950
Fax :

Domain Name: ADVANCESOFTWARETOOL.COM
Registrar: DIRECTI INTERNET SOLUTIONS PVT. LTD. D/B/A PUBLICDOMAINREGISTRY.COM
Whois Server: whois.PublicDomainRegistry.com
Referral URL: http://www.PublicDomainRegistry.com
Name Server: NS1.GONSSET.COM
Name Server: NS2.GONSSET.COM
Status: clientTransferProhibited
Updated Date: 04-mar-2009
Creation Date: 04-mar-2009
Expiration Date: 04-mar-2010