A recent tour of scareware XV

New wave of scareware that runs on the Internet. As I clarify in each of the entries in this series, the list comprising these URL's and IP addresses represents only a small percentage, very small, the impressive body of IP's and domains that daily spread this type of malware.

MicroVaccine
MD5: 96a2cfdb534b547518a446a48150624e
IP: 218.38.15.85
Korea, Republic Of Seoul Hanaro Telecom Inc
Associated Domains
clear-pc.net
microvaccine.net
vaccine2009.com
virusbye.net

Result: 24/41 (58.54%)

Omega AntiVir = Windows System Suite
IP: 64.86.16.161
Canada Brampton Velcom
Associated Domains
omegaantivir.com
trustshields.cn
update1.omegaantivir.com

Contraviro
MD5: 8b1555ab8de5f4884e95e72d1755c984
IP: 195.2.253.44
Russian Federation Madet Ltd
Associated Domains
antiviruscontraviro.com
contraviro.com
securedpaymentprocessor.com


Result: 7/41 (17.07%)

Soft Safeness = Save Defender = Trust Warrior
IP: 83.233.30.66, 91.212.127.131
Sweden Stockholm Serverconnect I Norrland
United Kingdom Telos Solutions Ltd
Associated Domains
mail.safetykeeper.com, mail.savekeeper.com, mail.softsafeness.com, ns1.safetykeeper.com, ns1.savekeeper.com, ns1.softsafeness.com, ns2.mitrokili.com, ns2.mredkizerut.com, ns2.ofcilamed.com, ns2.propinutrek.com, ns2.sdrukap.com, ns2.vcerukam.com, ns2.vderuwerol.com, ns2.vredupotre.com, ns2.vtromik.com, softsafeness.com, www.safetykeeper.com, www.softsafeness.com

MicroV3
MD5: 783385a90259131a89da62d10df67fa6
IP: 220.73.161.54
Korea, Republic Of Seoul Thrunet Co. Ltd
Associated Domains
cocoda.co.kr, dvccode.com
i-viewtec.com, microv3.com
newocn.net, phoneboja.com
rich09.com, samsung77.com
www.cocoda.co.kr
Result: 22/41 (53.66%)

malwareurlirblock.com/1/ (83.133.125.116) - Germany Lncde-greatnet-newmedia
windows-protectionsuite.com (206.53.61.75) - Canada Thornhill Rcp.net
antivirus-plus09.com/install/avplus.exe (195.95.151.176) - Ukraine Kiev Limited Corp
windows-shield.com, adware-finder.com, av-safety.com, avidentify.com, avir-guardian.com
avir-protect.com
aviraplatinum.com
aviremover.com
aviremover2009.com
avirguardian.com
avremoverpro.com
awareprotect.com
awareremover.com
epcsecurity.com
esysprotect.com
intsecurepro.com
intsecureprof.com
oemantivir.com
osadwarekill.com
osawarepro.com
scanforspywarenow.com
virusermoverpro.com
viruskill2009.com
wins-guard.com
www.avir-guardian.com
www.avir-protect.com
www.esysprotector.com (91.206.201.8) - Ukraine Pe Sergey Demin
scareware-killer.com (213.155.22.193) - Ukraine Tehnologii Budushego Llc
windowsprotection-suite.net (64.213.140.68) - United States Global Crossing
smogcatalog.info/scan/vds.php (64.27.5.63) - United States Yucca Valley Airlinereservations.com Inc
weragumasekasuke.com/10580532 (204.12.219.133), vuilerdomegase.com/10580532 (204.12.219.132), vulertagulermos.com/10580532 (204.12.219.131), scukonherproger.com (204.12.219.149) - United States Kansas City Wholesale Internet Inc
luxmediacodec.com/av-scanner.0.exe (64.191.53.230) - United States Scranton Network Operations Center Inc
easynettest.com/install/ws.exe (62.90.136.237) - Israel Haifa Barak I.t.c
ynoubfa.cn/?uid=186&pid=3&ttl=41a4951046e (64.86.25.201), trustsystem-protect.com, online-scanandsecure.net - (64.86.16.119) - Canada Brampton Velcom
winfixscanner1.com/download/Soft_21.exe, delete-all-virus09.com (213.163.89.60) - Netherlands Rotterdam Telos Solutions Ltd
lakrapi.com/1/antivirus_pro_2009_v3.18.exe (87.118.118.246) - Germany Erfurt Keyweb Ag Ip Network
yourcomp.us/antivirus_setup.exe (91.212.198.152) - Russian Federation Individual Retailer Nevedomskiy A A

Proof Defender 2009
IP: 76.76.101.85
United States Portland Donald Wildes
Associated Domains
defender-2009.com
ns1.pdefzone.com
ns2.pdefzone.com
proofdefender.com
proofdefender2009.com
www.pdefender2009.com
www.proofdefender.com

System Cleaner
IP: 69.64.33.242
United States Lancaster Hosting Solutions International Inc
Associated Domains
brand-supplier.net, brands-house.com, brands-house.net, brands-sales.com, brands-vendor.com, brands-vendors.com, brands-vendors.net, discounts-shop.net, discounts-store.com, doctroshield2009.com, fashion-vendors.com, fashion-vendors.net, firstantivir2009.com, firstprotection2009.com, kicks-buy.com, kicks-buy.net, kicks-discount.com, kicks-discount.net, kicks-discounts.com, kicks-discounts.net. kicks-mall.com, kicks-shop.com, kicks-stock.com, kicks-supplier.com, kicks-vendors.com, kicks-vendors.net, liveantivir.com, liveprotectpro.com, luxury-mall.com, luxury-stock.com, myantivirus2009.com, mypharmshop.com, myprotectsuite.com, onguardsoft.com, onlineantivirpro.com, own-shoes.com, own-shoes.net, psp-shop.com, sneakers-buy.com, sneakers-sale.com, sneakers-sales.com, sneakers-stock.com, watches-supplier.com, www.luxury-mall.com

Privacy Center
MD5: 3731bde3c476993cbec9e849e4922c87
IP: 83.233.165.149
Sweden Stockholm Serverconnect I Norrland
Associated Domains
crusade-new.com
privacy-software.info

Result: 6/41 (14.63%)

The goal is to take this information as a resource to block harmful directions.

Related information
Una recorrida por los últimos scareware XIV
Una recorrida por los últimos scareware XIII
Una recorrida por los últimos scareware XII
Una recorrida por los últimos scareware XI
Una recorrida por los últimos scareware X
Una recorrida por los últimos scareware IX
Una recorrida por los últimos scareware VIII
Una recorrida por los últimos scareware VII
Una recorrida por los últimos scareware VI
Una recorrida por los últimos scareware V
Una recorrida por los últimos scareware IV
Una recorrida por los últimos scareware III
Una recorrida por los últimos scareware II
Una recorrida por los últimos scareware I

Jorge Mieres