[Win32:Virut]

Hi, interesting FakeAV scanner, it's blocking browser, but it don't block Opera with Presto :)

Chrome and Firefox are blocked.

Code: Select all

hxxp://200.63.97.55/~miltonm/language/images/
PHISHING

hxxp://200.63.97.55/~miltonm/language/
REDIRECTS to FAKEAV SCANNER

http://www.youtube.com/watch?v=ToE2rXJYWt8

[Xylitol]

Code: Select all

hxxp://200.63.97.55/~miltonm/footer.php

WSO ;)

[bantempmail]

Why would they put WSO (I assume, it's a webshell http://packetstormsecurity.com/files/11 ... 2.5.1.html) on to 200.63.97.55, considering they could just root it since it seems to run nginx 0.7.67? Ease-of-use? Incompetence? Don't care?