[bitstechs]

Hmm, a FakeAV using the winlocker method. That's a little different. Thanks for the upload.

[Win32:Virut]

Smart Guard Protection

[Win32:Virut]

Dream Scan Soft



https://www.virustotal.com/en/file/c578 ... 387303248/

[Grinler]

Any idea how its spread?

[Win32:Virut]

I have downloaded it from:

Code: Select all

hxxp://rghost.net/50995422

Payment page:

Code: Select all

hxxp://futsyscarepay.com/payment.php

"Futurro Antivirus Unlimited license" :lol: Futurro Antivirus seems to be another rogue, I found only one thread about it: http://www.malwareremoval.com/forum/vie ... 11&t=62376

https://www.virustotal.com/en/file/247b ... /analysis/ - Publisher name is Futurro Soft. I'll request it in the Malware requests.

[Xylitol]

Code: Select all

http://futsyscarepay.com/payment_process.php
> https://migs.mastercard.com.au/vpcpay (vpc_Merchant=9800000100)
>> https://www.vbv.ktb.co.th/vbvads/paWarning.aspx
• dns: 1 ›› ip: 130.185.105.68 - adresse: FUTSYSCAREPAY.COM
• dns: 1 ›› ip: 203.42.65.51 - adresse: MIGS.MASTERCARD.COM.AU *legit*
• dns: 1 ›› ip: 202.12.117.153 - adresse: WWW.VBV.KTB.CO.TH *legit*

SCAREpay.com seriously ?

[Cody Johnston]

Windows Efficiency Console



MD5 d329fd901e1b63a82ae7fea8a85bf541

VT (8/49):
https://www.virustotal.com/en/file/0b00 ... /analysis/

[Win32:Virut]

8 samples

Smart Guard Protection

[bitstechs]

Smart Guard Protection

VirusTotal 9/40: https://www.virustotal.com/en/file/9dc9 ... 387761290/

[Win32:Virut]

Windows Premium Shield