MVPS HOSTS File Update June-21-2009

The MVPS HOSTS file was recently updated [June-21-2009]
http://www.mvps.org/winhelp2002/hosts.htm

Download: hosts.zip (146 kb)
http://www.mvps.org/winhelp2002/hosts.zip

How To: Download and Extract the HOSTS file
http://www.mvps.org/winhelp2002/hosts2.htm

HOSTS File - Frequently Asked Questions
http://www.mvps.org/winhelp2002/hostsfaq.htm

Note: the "text" version makes a great resource for determining possible culprits ...
http://www.mvps.org/winhelp2002/hosts.txt (599 kb)

Posted by winhelp2002 with 11 comment(s)

A disturbing new report on your Internet Privacy

A UC Berkeley report provides an in-depth look into the Internet Privacy issue and to what amount you are really being tracked ... several media outlets have reported on this issue. Register | NyTimes | BizJournals  All with their own take on the report ... a few key excerpts from their study ...

Dominance of Google
"From our analysis, it is apparent that Google is the dominant player in the tracking market. Among the top 100 websites this project focused on, Google Analytics appeared on 81 of them. When combined with the other trackers it operates, such as DoubleClick, Google can track 92 of the top 100 websites. Furthermore, a Google-operated tracker appeared on 348,059 of 393,829 distinct domains tracked by Ghostery in March 2009 (over 88%)."

This is one of the main reasons why the majority of these "trackers" are included in the MVPS HOSTS file ...

"Among the top 100 websites" this was obtained from Quantcast ... however the "Top 100" are not really individual sites since many are owned by the same company ... so you can see how these big companies can compile quite a lot of info ...

[Example of the Big 3 - ranking]
microsoft.com (7), live.com (3), msn.com (4), windows.com (19)
Not counting their ad servers: Atlas DMT (atdmt.com) aQuantive (adbureau.net)

google.com (1), youtube.com (6), blogspot.com (14), blogger.com (40)
Not counting DoubleClick which ranks #37 at Alexa

yahoo.com (2), flickr.com (30), geocities.com (47)
Not counting their ad servers: Overture, RightMedia, BlueLithium
---------------------------------------------------------

SHARING
"Websites make distinctions between sharing with affiliates, contractors, and third parties. Of the top 50 sites, 29 stated that they do NOT share user data with unrelated third parties. However, 45 affirmatively state that they share data with affiliates, and 36 affirmatively state that they allow third-party tracking. The average consumer might assume an affiliate or tracker to be a third party, but given the actual usage of these terms in privacy policies, that assumption would be mistaken.  Of the top 50 sites, 43 state affirmatively that they share data with third-party contractors, including all 29 of the sites who state that they do not share with unrelated parties."

This is why I recommend turning off Cookies and "whitelist" (allow) only those that are needed ...

NO ACCOUNTABILITY FOR THIRD-PARTY TRACKING
"In our analysis of privacy policies, 36 of the websites affirmatively acknowledged the presence of third-party tracking. However, each of these policies also stated that the data collection practices of these third parties were outside the coverage of the privacy policy. This appears to be a critical loophole in privacy protection."

"This appears to be a critical loophole" ... and they sure do word their Privacy Policy pages to take advantage of this loophole.

In the Register article they state: "Omniture and Quantcast cookies appeared on 57 per cent of the top 100 and less than 6 per cent of the 400,000" ... I would offer that this figure is actually much higher, since Omniture (112.2o7.net) also makes extensive use of clones to disguise their 3rd party trackers ...
[Example]
om.symantec.com is actually symanteccom.112.2o7.net
std.o.webmd.com is actually webmdglobal.122.2o7.net
stats.adobe.com is actually adobe.com.112.2o7.net

Using the Register as an example you can see the extent of tracking from third parties that goes on ...

All the entries in red above are blocked by the HOSTS file ... but the above is just from visiting one page on that site. However I must give them kudos for the Privacy Policy ... which they explain in very plain language of what they are doing and from who. Compare that to the BizJournal's statement:

"Adobe’s privacy policy, for example, when analyzed for readability, was written at an equivalent grade level of 17.29. The average privacy policy in the study was written at a grade level of 13.83."

I'm not sure what grade level 17.29 is ... but I'm sure I didn't go to school that long! ...

Posted by winhelp2002 with 1 comment(s)

More fake PornTube sites

I see plenty of these fake PornTube sites everyday ... however several sites are trying to trick visitors (nothing unusual) into thinking they need to update their (Adobe) Flash Player ... by first displaying an image then it blurs out and the bogus message appears ... same type as I spotted here 

The "Load Now" button redirects to "update-flash. com" and serves up "FlashPlayer.v9.014.exe" which my Antivirus (NOD32 v4) detects as "Win32/Kryptik.QY" or visiting a similar site (see below) you get just a blank area with a clickable link ...

 (image edited for display)

Do you see the common denominator in all these type sites? ... Look at the page title "PornTube: best movies collection." Usually about once a week I use the page title as a search term and find about 10-20 new sites ...

Google: 1 - 20 of about 6,080 for "PornTube: best movies collection.".

Yahoo: 1 - 10 of 10,100 for "PornTube: best movies collection."

Microsoft Live/Bing: 1-10 of 325 results - With "SafeSearch" turned off: 1-30 of 565 results

Yes Microsoft's Live search in your (Internet Explorer 8) browser now redirects to their new search service Bing ... as with Google and Yahoo (with Cookies enabled) you can define/tweak the results page as well as enable/disable SafeSearch which will filter adult images, text and videos ... I would suggest users that share an account with underage children that you enable SafeSearch in all three search engines (or any others that you may use) ...

What I noticed new in Bing - Video was the ability to play the video right from the results page without actually visiting the site ... kids are not stupid ... once they figure this out (with SafeSearch disabled) they can view most anything they want and leave no trace that they were there ... (see example below)

Posted by winhelp2002 with no comments

Oh Comodo here we go again!

Visiting the following Fraudware Antispyware site ... I always check the "Buy now" (purchase) section to see where this will lead. Sadly it leads to yet another Comodo issued certificate ...

You can see from the Microsoft Fiddler output where the site leads ... I pasted the certificate info into the output ...

Comodo states: "To get a DV cert all you need is a domain name and $15..and no background check about your identity is required." As I stated in a previous post ... perhaps you should at least check the domain name ... duh! that would be a good first clue ... but I guess the $15 is more important?

These culprits were first reported on Thursday, April 16, 2009 - A Diverse Portfolio of Fake Security Software - Part Nineteen and later by the SunBelt blog where both these domains reside on the same IP (iSystem Inc.)

Seems iSystem Inc also controls several other (malicious) domains ... including "malwarecatcher. net" which is associated with "updvms. net" and this is where it get interesting ...

 
(Image edited for display purposes)

Well look at that! directories for (left column) several malicious domains ... and the typical files found in each (right column)
Extraantivirus, Fastantivirus09, Malwarecatcher, Prestotuneup, and on and on ... so you can see there is no doubt all these domains are malicious as well as the files ... when I attempted to download "EXAVR/BankSetupRelease.exe" my AV (NOD32) detected this as a variant of Win32/Kryptik.JQ trojan

I mentioned in my last post a malicious domain (secure.xsoftstore.com) which Comodo stated they revoked the certificate ... what gets me is I suggested that they at least should check the domain names ... well it seems they didn't look into this either ...

== Server Certificate ==========
[Subject]
  CN=secure.xsoftstore.com, OU=Free SSL, OU=Hosted by LiderTelecom LTD, OU=Domain Control Validated
[Issuer]
  CN=EssentialSSL CA, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB
[Serial Number]
  00C2ECCD1FEFB7508CA5D7ADB6E405E192
[Not Before]
  4/29/2009 8:00:00 PM
[Not After]
  7/29/2009 7:59:59 PM

If Comodo had bothered to check ... they would have found all these domains are related ... [Whois link here]

All this for $15 ... my things must be really bad? ...

Posted by winhelp2002 with no comments

Follow-up to the Comodo Controversy

It seems that after my last post concerning Comodo it has caused quite a stir ... so I'd like to clear up a few points made on several other Forums.
[DSL Reports] [Security Garden] [Wilders Security] [Calendar of Updates]

Over at Comodo's Forum "Melih" who describes himself as: Comodo's Hero Administrator

"You say we responded to MVP Mike before and he gave us kudos. So why would we not respond to him this time if he sent us an email? Your logic doesn't make sense. If we responded before then we would respond again. And we did respond as soon as we were alerted but did NOT receive any emails from MVP Mike as far as I know."

Well as I stated in my previous post I sent an email on 04-21-09 alerting Comodo and never received a reply ... so why would I bother sending another when I find more of the same (Malware sites using Comodo certificates) ... however after "going public" it sure didn't take long for these certificates to be revoked. Imagine that ... I got a reply today ... "your email got buried" = buried? ... if you notice I sent it to both the address I was given and "CC'd" to the person I dealt with previously ...

I just feel sorry for the amount of people that were duped into thinking they were at a legit site and actually purchased this malicious software, after I notified Comodo ... only to be "buried" ... then why did you bother to set up a specific address to report these sites?

And this comment ... "Its a weak certificate, but its something that many many Certification Authorities are selling so I don't really see why Donna and similar should make a thread bashing solely comodo for it..Verisign and Godaddy is the major pushers and sellers for this junk, yet they get no critic whatsoever for that.."

First I very rarely see a certificate issued by GoDaddy to these type malware pushers ... now here is a tip ... perhaps the first clue would be to Google the domain name that wants to purchase a certificate ...

In some cases the domain name itself should be a red flag! = secure.spywareprotector-2009.com

== Server Certificate ==========
[Subject]
  CN=secure.spywareprotector-2009.com, OU=Free SSL, OU=Hosted by
 LiderTelecom LTD, OU=Domain Control Validated

 [Issuer]
  CN=EssentialSSL CA, O=COMODO CA Limited, L=Salford, S=Greater
 Manchester, C=GB

 [Serial Number]
  2AEB99837575BE971E4EEB2329CD3507

Yet "Iam Monkey_boy=) from the comodo forums" states:
"Comodo can't really be blamed if a site that has a certificate hosts malware"

Let me put a little perspective on this ... "Conficker systems being updated with SpywareProtect2009"
Conficker is now believed to be the largest computer worm infection since the 2003 ... and Comodo issued the certificate to "SpywareProtector-2009" ... now you can't tell me that this domain name isn't a cause for concern? It gives me chills to think how many people were duped into purchasing this product.

Now if it was my company and I found out we were involved (even remotely) in the largest infection since 2003 ... I'd certainly want to make some changes in our policy as to how these certificates are issued ... but that's just me ...

And I'll finish up with this little gem ... "So the question should be the ethics of publishing these kind of material without informing the security vendors in the first place."

You question my ethics? ... it wasn't my intent to get into a pi**ing contest with these people but who's ethics are in question here? ... mine for publicly reporting this or Comodo's for a continuing practice of issuing/selling certificates to questionable characters ...

Posted by winhelp2002 with no comments

Comodo continues to issue certificates to known Malware

I was following up on a list of malware sites posted on Dancho Danchev's Blog and yet again I find Comodo issuing certificates to these Malware writers. The reason I say again is I was given a "secret" email address at Comodo a while back to report these culprits ... however I was asked to keep it quiet.

As you can see my Antivirus detects the download as malicious and breaks the connection ... however when I click the "Buy" button what do I find? You guessed it ... a certificate issued by Comodo ... don't these people check out anyone?

Several other sites mentioned in the list are using (76.76.103.163)  secure.a5bill. com
[Issuer]
  CN=PositiveSSL CA, O=Comodo CA Limited, L=Salford, S=Greater Manchester, C=GB

[Serial Number]
  00B33E45471F5FDF745564B85336A50AA3
------------------------------------------------

"secure.a5bill.com" is hosted on the same IP as the following and all the downloads are detected as Win32/Adware.CoreguardAntivirus
coreguard-antivirus. com
guardlab2009. biz
guardlab2009. net
guardlab2009. com (Google Diagnostic report)

Some of the others on the above list are using:
fullguardlab. com
== Server Certificate ==========
[Subject]
  CN=fullguardlab. com, OU=Free SSL, OU=Hosted by LiderTelecom LTD, OU=Domain Control Validated
[Issuer]
  CN=EssentialSSL CA, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB
[Serial Number]
  00912B6C954BB5BEA83000C4599B9A5C13

bitcoreguard. com
== Server Certificate ==========
[Subject]
  CN=fullguardlab. com, OU=Free SSL, OU=Hosted by LiderTelecom LTD, OU=Domain Control Validated
[Issuer]
  CN=EssentialSSL CA, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB
[Serial Number]
  00912B6C954BB5BEA83000C4599B9A5C13
-------------------------------------------------

So this got me to thinking ... a while back (04-21-09) I reported to Comodo via their secret address a list of sites distributing malicious software ... although I never received a reply as I did when I reported "Conficker systems being updated with SpywareProtect2009" which Comodo had issued a certificate to.

Anyway ... I went back and checked the sites I last reported and it seems Comodo has decided to ignore my report ...

rapid-antivir-2009. com
rapid-antivir2009. com
rapid-antivirus2009. com = all redirect to:

secure.xsoftstore. com

== Server Certificate ==========
[Subject]
  CN=secure.xsoftstore.com, OU=Free SSL, OU=Hosted by LiderTelecom LTD, OU=Domain Control Validated
[Issuer]
  CN=EssentialSSL CA, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB
[Serial Number]
  00C6AC84946462C7F3EADC5565AE3156A4
[Not Before]
  1/27/2009 7:00:00 PM
[Not After]
  4/28/2009 7:59:59 PM <-- notice the expiration Date

I just revisited rapid-antivirus2009. com and Comodo issued them a new certificate ...

== Server Certificate ==========
[Subject]
  CN=secure.xsoftstore.com, OU=Free SSL, OU=Hosted by LiderTelecom LTD, OU=Domain Control Validated
[Issuer]
  CN=EssentialSSL CA, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB
[Serial Number]
  00C2ECCD1FEFB7508CA5D7ADB6E405E192
[Not Before]
  4/29/2009 8:00:00 PM
[Not After]
  7/29/2009 7:59:59 PM

Comodo is supposed to be one of the good-guys ... and they even describe themselves as "Internet security software products including SSL certificates and Free Firewall Antivirus software among others from Comodo, a leading global trust provider" ... however I have been reporting on them since the WinFixer days and it seems it just falls on deaf ears ... and now that they bundle the Ask Toolbar it really makes you wonder ...

Posted by winhelp2002 with no comments

MVPS HOSTS File Update May-11-2009


The MVPS HOSTS file was recently updated [May-11-2009]
http://www.mvps.org/winhelp2002/hosts.htm

Download: hosts.zip (145 kb)
http://www.mvps.org/winhelp2002/hosts.zip

How To: Download and Extract the HOSTS file
http://www.mvps.org/winhelp2002/hosts2.htm

HOSTS File - Frequently Asked Questions
http://www.mvps.org/winhelp2002/hostsfaq.htm

Note: the "text" version makes a great resource for determining possible culprits ...
http://www.mvps.org/winhelp2002/hosts.txt (597 kb)

Posted by winhelp2002 with no comments

Microsoft MVP Award Program Blog

Yes it's a shameless plug ... but I got a nice writeup today on their blog ...

A little update on Zango ... I looked thru the sites I had listed that were using/linking to Zango and the vast majority are still using their code on these sites ... duh! Do these sites using Zango's code still think they will get paid for directing visitors to Zango/Hotbar? They owe the bank over $44 million ... so I think they will be waiting a long time ...

Zango's site itself is still up and running with no mention of their bank foreclosure ... typical for these scum-bags!
Untrustworthy to the end ...

I'm working on a new HOSTS update that should be ready shortly ... as I was hoping to remove the hundreds of Zango/Hotbar entries ... but I guess we'll have to wait until their servers get shut down or sold ...

Posted by winhelp2002 with 2 comment(s)

Is Blinkx acquiring Zango?

Although still in the rumor stage ... indications look like Blinkx may be acquiring Zango ...

TechFlash is reporting "Zango mum on acquisition buzz" ... and if you read that article and the blog post by Ken Smith (former Zango CTO) it certainly seems something is in the works ...

Blinkx is already using some questionable practices ... I downloaded their "BlinkxBroadbandTV.exe" (Trojan.Win32.Agent.wif) and submitted it to VirusTotal and well the results are not good (21/40 (52.50%) and then there is the Blinkx Toolbar ...

"The blinkx Video Toolbar uses Ask.com as its Internet search provider. If you consent to make Ask.com your default search, your Internet browser default search feature will be set to Ask.com and you will access Ask web search services (i) by entering queries in your browser chrome search box; (ii) by entering queries in your browser address bar, and (iii) in response to misspelled, incorrectly formatted or unresolved DNS submission in your browser address bar." (more here) (emphasis added)

So if the rumors prove true ... I suspect Blinkx will adopt their own Toolbar (from Zango) and phase out Ask ...
It should be interesting ...

Posted by winhelp2002 with 3 comment(s)
Filed under:

MVPS HOSTS File Update April-19-2009


The MVPS HOSTS file was recently updated [April-19-2009]
http://www.mvps.org/winhelp2002/hosts.htm

Download: hosts.zip (144 kb)
http://www.mvps.org/winhelp2002/hosts.zip

How To: Download and Extract the HOSTS file
http://www.mvps.org/winhelp2002/hosts2.htm

HOSTS File - Frequently Asked Questions
http://www.mvps.org/winhelp2002/hostsfaq.htm

Note: the "text" version makes a great resource for determining possible culprits ...
http://www.mvps.org/winhelp2002/hosts.txt (596 kb)

Posted by winhelp2002 with 1 comment(s)

The MVPS HOSTS update Mailing List has been discontinued

Regretfully I can no longer accept any more subscribers to the MVPS HOSTS file update mailing list. The response has far exceeded my expectations and the list has out-grown the available software for providing a timely update.

I have been researching for a viable (freeware) solution ... however there doesn't seem to be any that meets my needs. As for those that have previously subscribed I will retain your email address for a short time in the event a solution is found ... (which I doubt) then I will simply delete all the existing addresses.

I'd like to thank everyone that has participated in the Mailing list. I will continue to post the update notices on my site and also here on my blog.

Posted by winhelp2002 with 9 comment(s)

MVPS HOSTS File Update March-15-2009


The MVPS HOSTS file was recently updated [March-15-2009]
http://www.mvps.org/winhelp2002/hosts.htm

Download: hosts.zip (146 kb)
http://www.mvps.org/winhelp2002/hosts.zip

How To: Download and Extract the HOSTS file
http://www.mvps.org/winhelp2002/hosts2.htm

HOSTS File - Frequently Asked Questions
http://www.mvps.org/winhelp2002/hostsfaq.htm

Note: the "text" version makes a great resource for determining possible culprits ... (605 kb)
http://www.mvps.org/winhelp2002/hosts.txt

Sign up for HOSTS file update notices
http://www.mvps.org/winhelp2002/updates.htm

Posted by winhelp2002 with no comments

Bogus Video Decryption Tool

Landing on the following site the visitor is presented with a (bogus) message:
These Malware writers sure have a vivid imagination when it comes to messages to fool the public ...

As you can see you are redirected to "xp-police-09" for the download ... which my AV (NOD32) blocked ...

Also on the same IP block ... we find yet another bogus prompt ... look close it's an image not a prompt ... anyway this one falsely shows it from Microsoft. Yeah right! ... Microsoft's install prompts certainly do not look like that ... but I imagine some people will fall for this trick ...

However the download (DivX.Codec.8.0.beta.exe) is from "titmix. net"
The Google Diagnostic reports: "Malicious software includes 63 trojan(s)"

The Google Diagnostic report for "0dax" = "Malicious software includes 50 trojan(s)"

Posted by winhelp2002 with 2 comment(s)

pcbutts1 now serving up Malware?

Recently I was advised of a new site (ms-mvp.org) that is redirecting to pcbutts1 .com ... which I have mentioned before, due to the fact that it was a rip-off of my HOSTS file ... as well as many other files that Butts falsely lays claim to ...

Let's take a "Google" look ... shall we ...

However when I attempt to download (npremove-itsetup.zip) my Antivirus NOD32 jumps up with the following warning then breaks the connection to prevent possible infection ...

It makes me laugh the Butts doesn't even deny hijacking my HOSTS file ... then modifying it to include legitimate security sites. Oh I see these are the ones that constantly expose Butts about what is really going on ...

The "ms-mvp.org" site is just another blatant attempt to legitimize Butts' false claim to being a Microsoft MVP ...

Posted by winhelp2002 with 4 comment(s)

MyWebSearch goes Hardcore Adult

Sometimes while researching you end in in some surprising places ...


Clicking the above Google search link ... look what we find!

 (Image edited)

MyWebSearch (MyFunCards) using the Microsoft format for an Information Bar prompt ... can't you people come up with anything better that copying someone else's idea? ... Anyway look at the type of content (adult video) that they are trying to attract new customers from ...

Not only that ... the prompt is a complete lie! ..."The video will start after you download it ..." simply clicking the embedded link in the video will allow the video to play without installing anything from MyWebSearch ... if you do fall for this deceptive prompt you end up at their Toolbar install ...

hxxp://ads.digitalalchemy.tv/hs.php?o=175
redirects to:
hxxp://www.myfuncards.com/dl/index.jhtml?partner=ZUxdm265&sub_id=29062&spu=true&theme=winter&ac=0

 "Download the MyFunCards toolbar and you will be able to find and send a e-card for any holiday... Birthday's, Christmas, Mother's Day and much more. ..." and apparently Adult Videos too! It really makes you wonder "what were they thinking" ...

Posted by winhelp2002 with no comments
Filed under:

How Malware is invading YouTube

While researching several codec type sites I happened to notice several links to YouTube for these sites

Although the video itself is safe to view ... notice the highlighted link to "view the full video" ...

These are teaser videos to get you to click the link ... and you guessed it = infected ...


(Images edited for display purposes)

Notice the message embedded in the teaser video ... yeah right ... "playofsex. com" redirects to "uporntube2009. com"

There are several other sites related to the above ... all are to be avoided ...

Google Diagnostic report for uporntube2009.com
Of the 52 pages we tested on the site over the past 90 days, 41 page(s) resulted in malicious software being downloaded and installed without user consent.

Google Diagnostic report for porntubenew.com
97 page(s) resulted in malicious software being downloaded and installed without user consent.

Google Diagnostic report for porn-tube09.com
22 page(s) resulted in malicious software being downloaded and installed without user consent.

Google Diagnostic report for tubeporn08.com
15 page(s) resulted in malicious software being downloaded and installed without user consent.

Google Diagnostic report for tubeporn09.com
20 page(s) resulted in malicious software being downloaded and installed without user consent.

Google Diagnostic report for xxxporn-tube.com
75 page(s) resulted in malicious software being downloaded and installed without user consent.

All of the above are hosted at Worldstream:

Hopefully Google/YouTube can find a way to keep these culprits from increasing this trend ... although you would think that Google would be able to cross-reference their own Diagnostic reports against submitted videos and links ...

Posted by winhelp2002 with no comments

A double-wammy fake PornTube site

Landing on the following site not only prompts you with a fake "video decoder" ... look at the fake Antivirus scanner that tries to trick the visitor into thinking they are infected ... well you will be if you click either of these ...

As usual this download is not very well detected ... VirusTotal results here ... ThreatExpert has a detailed report of what happens to your machine should you become infected ... this one is very nasty!

"vidsxxxtube. com" redirects the download (3913181.exe) to a IP address - detected as "Win32/Adware.IeDefender.NIC"
"xp-police-av. com" (fake scanner) is detailed in the ThreatExpert report above ...

Although the Registrars and Hosting services shutdown hundreds of these type sites each week ... it seems that even more pop-up to take their place. As usual it's all about the almighty $$$ ... these Registrars charge these culprits for registering, then shut them down several weeks later ... only to claim that they are doing their part to combat the spread of malicious sites ... yeah right! ... then why do they continue to do business with the same culprits over and over? = $$$

Posted by winhelp2002 with no comments

MVPS HOSTS File Update February-11-2009


The MVPS HOSTS file was recently updated [February-11-2009]
http://www.mvps.org/winhelp2002/hosts.htm

Download: hosts.zip (144 kb)
http://www.mvps.org/winhelp2002/hosts.zip

How To: Download and Extract the HOSTS file
http://www.mvps.org/winhelp2002/hosts2.htm

HOSTS File - Frequently Asked Questions
http://www.mvps.org/winhelp2002/hostsfaq.htm

Note: the "text" version makes a great resource for determining possible culprits ... (597 kb)
http://www.mvps.org/winhelp2002/hosts.txt

Sign up for HOSTS file update notices
http://www.mvps.org/winhelp2002/updates.htm

Posted by winhelp2002 with 1 comment(s)

Another bogus Flash Media Player

I see so many of these bogus sites that I rarely mention them anymore ... but this one is a little different. As you can see below the images in the video is blurred, in order to trick the viewer into thinking they need this bogus update to your Flash Player ...

Now if you do fall for this all you get is a nasty infection ... VirusTotal results here
"FlashUpdate_3176.exe" from "extrabrake. com" is not very well detected ... (6/38 (15.79%)

"extrabrake. com" is hosted at Eu-zz [AS12553][94.247.2.0 - 94.247.3.255]
Eu-zz is a know haven for Trojan.Codec and fake AntiSpyware sites. Google Diagnostic report here ...

Posted by winhelp2002 with 1 comment(s)

MVPS HOSTS File Update January-08-2009


The MVPS HOSTS file was recently updated [January-08-2009]
http://www.mvps.org/winhelp2002/hosts.htm

Download: hosts.zip (145 kb)
http://www.mvps.org/winhelp2002/hosts.zip

How To: Download and Extract the HOSTS file
http://www.mvps.org/winhelp2002/hosts2.htm

HOSTS File - Frequently Asked Questions
http://www.mvps.org/winhelp2002/hostsfaq.htm

Note: the "text" version makes a great resource for determining possible culprits ... (610 kb)
http://www.mvps.org/winhelp2002/hosts.txt

Sign up for HOSTS file update notices
http://www.mvps.org/winhelp2002/updates.htm

Posted by winhelp2002 with 1 comment(s)
More Posts Next page »