CastleCops® New rogues from SpywareNo family

Need help? Click here to register for free! Absolutely zero advertisements on this site!

	Donation/Premium

	Donations. Become Premium Today!

	Security Central

	· Home · PIRT/Fried Phish · MIRT · SIRT · Deutsch · Wiki · Newsletter · O16/ActiveX · CLSID List · Contest2007 · Downloads · Feedback (send) · Forums · HijackThis · Hijacktrend · LSPs · My Downloads · O18 · O20 · O21 · O22 · O23 · O9 · Premium · Private Messages · Proxomitron · Reviews · Search · StartupList · Stories Archive · Submit News · WsIRT · Your Account · Acceptable Use Policy

Forum FAQ

Usergroups

Profile

Select FavForums

New rogues from SpywareNo family

All -> FavForums -> Web Malware Links

[del.icio.us!] [digg it!] [reddit!]

View previous topic :: View next topic

Author

Message

sparsha

Trooper
Trooper

Joined: Nov 06, 2007
Posts: 31
Location: India

Posted: Mon Mar 03, 2008 11:54 am Post subject: New rogues from SpywareNo family

TheSpyBot.com and SpyWatchE.com are the latest rogues from the SpywareNo/Spysheriff family of rogue security applications.

maliciousbrains

Sergeant

Premium Member

Joined: Feb 23, 2008
Posts: 103

Posted: Mon Mar 03, 2008 5:49 pm Post subject: TheTheSpyBotSetup.exe & TheSpyWatchESetup.exe

Url: hxxp:// spywatche.com Clicking �Try Now For Free� or downloads the file TheSpyWatchESetup.exe and below is the scan result: Result: 5/32 (15.63%) Antivirus Version Last Update Result AhnLab-V3 2008.3.4.0 2008.03.03 - AntiVir 7.6.0.73 2008.03.03 - Authentium 4.93.8 2008.03.02 - Avast 4.7.1098.0 2008.03.02 - AVG 7.5.0.516 2008.03.03 Downloader.Webinstall.B BitDefender 7.2 2008.03.03 - CAT-QuickHeal 9.50 2008.03.01 - ClamAV 0.92.1 2008.03.03 - DrWeb 4.44.0.09170 2008.03.03 - eSafe 7.0.15.0 2008.02.28 - eTrust-Vet 31.3.5582 2008.03.03 - Ewido 4.0 2008.03.03 - FileAdvisor 1 2008.03.03 - Fortinet 3.14.0.0 2008.03.03 - F-Prot 4.4.2.54 2008.03.02 - F-Secure 6.70.13260.0 2008.03.03 - Ikarus T3.1.1.20 2008.03.03 - Kaspersky 7.0.0.125 2008.03.03 not-a-virus:FraudTool.Win32.SpySheriff.w McAfee 5242 2008.02.29 - Microsoft 1.3301 2008.03.03 - NOD32v2 2918 2008.03.03 Win32/Adware.SpySheriff Norman 5.80.02 2008.03.03 - Panda 9.0.0.4 2008.03.02 - Prevx1 V2 2008.03.03 Generic.Malware Rising 20.34.02.00 2008.03.03 - Sophos 4.27.0 2008.03.03 - Sunbelt 3.0.906.0 2008.02.28 - Symantec 10 2008.03.03 Downloader.MisleadApp TheHacker 6.2.92.231 2008.03.02 - VBA32 3.12.6.2 2008.02.27 - VirusBuster 4.3.26:9 2008.03.03 - Webwasher-Gateway 6.6.2 2008.03.03 - Additional information File size: 50176 bytes MD5: 47539fbbcece16b4076327273df26eab SHA1: c72a7ae6df53f5e5b4e700e2e727a33973487a87 PEiD: Armadillo v1.71 Prevx info: http://info.prevx.com/aboutprogramtext.asp?PX5=53C8FF9C001E8581C41C000B01F9DD00E5F3FCD6 CWSandBox Submission : Success: Your file has been submitted to the processing queue. You will receive an email in a few minutes with the analysis. Sunbelt Sandbox ID: 3336347 \| Not Yet Analyzed ListServ link: /p1061709-MD5_47539fbbcece16b4076327273df26eab.html#1061709 Url: hxxp://thespybot.com Clicking �Try Now For Free� or downloads the file TheTheSpyBotSetup.exe and below is the scan result: Result: 5/32 (15.63%) Antivirus Version Last Update Result AhnLab-V3 2008.3.4.0 2008.03.03 - AntiVir 7.6.0.73 2008.03.03 - Authentium 4.93.8 2008.03.02 - Avast 4.7.1098.0 2008.03.02 - AVG 7.5.0.516 2008.03.03 Downloader.Webinstall.B BitDefender 7.2 2008.03.03 - CAT-QuickHeal 9.50 2008.03.01 - ClamAV 0.92.1 2008.03.03 - DrWeb 4.44.0.09170 2008.03.03 - eSafe 7.0.15.0 2008.02.28 - eTrust-Vet 31.3.5582 2008.03.03 - Ewido 4.0 2008.03.03 - FileAdvisor 1 2008.03.03 - Fortinet 3.14.0.0 2008.03.03 - F-Prot 4.4.2.54 2008.03.02 - F-Secure 6.70.13260.0 2008.03.03 - Ikarus T3.1.1.20 2008.03.03 - Kaspersky 7.0.0.125 2008.03.03 not-a-virus:FraudTool.Win32.SpySheriff.w McAfee 5242 2008.02.29 - Microsoft 1.3301 2008.03.03 - NOD32v2 2918 2008.03.03 Win32/Adware.SpySheriff Norman 5.80.02 2008.03.03 - Panda 9.0.0.4 2008.03.02 - Prevx1 V2 2008.03.03 Generic.Malware Rising 20.34.02.00 2008.03.03 - Sophos 4.27.0 2008.03.03 - Sunbelt 3.0.906.0 2008.02.28 - Symantec 10 2008.03.03 TheSpyBot TheHacker 6.2.92.231 2008.03.02 - VBA32 3.12.6.2 2008.02.27 - VirusBuster 4.3.26:9 2008.03.03 - Webwasher-Gateway 6.6.2 2008.03.03 - Additional information File size: 50176 bytes MD5: a16f5e7dc19f5aa01dacc5549a3999b2 SHA1: e86096cf7704a7f7ff0fc52a2df5d7f4ddd6b315 PEiD: Armadillo v1.71 Prevx info: http://info.prevx.com/aboutprogramtext.asp?PX5=95773C360073B4A0C42A002FA8A26000CF6C0CA9 CWSandBox Submission : Success: Your file has been submitted to the processing queue. You will receive an email in a few minutes with the analysis. Sunbelt Sandbox ID: 3336389 MMPC submission has been assigned ID 15927085. Initial analysis summary: ================= Total Files: 5 Clean: 0 Malware: 0 Malware Related: 0 Malware Container: 0 Potentially Unwanted Software: 0 Potentially Unwanted Software Container: 0 Postponed: 0 Not Yet Analyzed: 5 ================= Per-file summary: ================= 20080303_093537547_0_NewSpywares.zip \| Not Yet Analyzed TheSpyBot_&_SpyWatchE.doc \| Not Yet Analyzed TheSpyWatchESetup.zip \| Not Yet Analyzed TheTheSpyBotSetup.zip \| Not Yet Analyzed ~$eSpyBot_&_SpyWatchE.doc \| Not Yet Analyzed ListServ link: /p1061708-MD5_a16f5e7dc19f5aa01dacc5549a3999b2.html#1061708 _________________ .:: Malicious Brains ::. http://www.malwareinfo.org http://blog.malwareinfo.org http://forum.malwareinfo.org There are no patches or service packs for ignorance!

maliciousbrains

Sergeant

Premium Member

Joined: Feb 23, 2008
Posts: 103

Posted: Tue Mar 04, 2008 3:32 am Post subject: MMPC Analysis Summary

MMPC Analysis Summary TheSpyWatchESetup.zip \| Potentially Unwanted Software: Program:Win32/SpySheriff http://go.microsoft.com/fwlink/?linkid=95666&name=Program%3aWin32%2fSpySheriff TheTheSpyBotSetup.zip \| Potentially Unwanted Software: Program:Win32/SpySheriff http://go.microsoft.com/fwlink/?linkid=95666&name=Program%3aWin32%2fSpySheriff _________________ .:: Malicious Brains ::. http://www.malwareinfo.org http://blog.malwareinfo.org http://forum.malwareinfo.org There are no patches or service packs for ignorance!

	All -> FavForums -> Web Malware Links	All times are GMT
Page 1 of 1

You can post new topics in this forum
You can reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You can attach files in this forum
You cannot download files in this forum


	2002-2008 � Computer Cops LLC dba CastleCops®. All rights reserved. Acceptable Use Policy. Use signifies your agreement. 160ppm 0.364s (0.059s) Making cybercriminals unhappy since 2002*