Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Malicious IP that pushes Rogue-Ware


  • Please log in to reply
16 replies to this topic

#1 koolkat

koolkat

  • Banned
  • 71 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:09:53 PM

Posted 20 April 2009 - 01:26 PM

:trumpet: I have discovered that this IP 216.24.138.135 is behind about 90% of Rogue-AV-Ware on the intenet.


:thumbsup: I recommend everyone have these sites Blocked by a Firewall.

Malicious Site

Block sites:

66.220.17.154

216.24.138.135

217.73.66.16

hxxp://123urlaub.info ip 216.24.138.135

antimalwareguard.com ip 216.24.138.135

antispyexpert.com ip 216.24.138.135

antivirus2009.com ip 82.165.245.27

Anti-VirusNumber1.com ip 216.24.138.135

AntivirusXPPro.com ip 216.24.138.135

avsystemcare.com ip ptr-216-8-179-24.ptr.next.dimensioninc.com or 216.8.179.23

hxxp://best-click-scanner.info ip 216.24.138.135

hxxp://bs.serving-sys.com ip 12.129.210.76 or 12.129.210.71 or 216.24.138.135

call-kelly.com ip 216.155.138.228.choopa.net or 216.155.138.228

hxxp://click-my-scanner.info ip 216.24.138.135

clicksor.com ip 66.48.81.155

crackle.com ip 12.129.210.76 or 208.78.224.202

edebiyatogretmeni.net ip 85.25.120.83 ip loft1404.serverloft.de

hxxp://emediate.eu ip 216.24.138.135

hxxp://get.virusscanneronline.info/ ip 216.24.138.135

gomyhit.com ip 216.24.138.135

greenantivirus2009.com ip-70-38-73-28.static.privatedns.com or 70.38.73.28

imageservr.com ip 208.73.210.121 ip parkinglot.searchportal.informatiom.com

infolinks.com ip 194.90.11.196

insightexpressai.com ip 209.244.156.19 unknown.Level3.net

interclick.com ip 216.52.167.80

kaaza.com ip 12.129.210.76 or 66.226.75.118

live365.com ip 216.235.95.145 www.live365.com

MalwareDefender2009.com ip 211.95.73.189

malware-scan.com ip 64.40.103.249 ns 1.domainmanager.com or 209.59.194.20

malwarealarm.com ip 74.54.82.209 d1.52.364a.stactic.theplanet.com

hxxp://www.maxmind.com//GeoIP.dat.gz ip 216.24.138.135

Noadware.net ip 69.20.104.139

hxxp://online.antivirusscan1.info ip 208.43.47.213 208.43.47.213-static.reverse.softlayer.com

onerateId.com ip 216.24.138.135

hxxp://onlinescannerav1.info ip 216.24.138.135

hxxp://regedintheclub.info ip 216.24.138.135

hxxp://run.av-best.info ip 209.59.194.20 vip-vr20tuk.trafficz.com or 216.24.138.135

s1.on-line-virus-scanner.info ip 208.43.47.213

hxxp://safetydownload.com ip 216.24.138.135

hxxp://scanner.av-best.info/ ip 216.24.138.135

securityclick.net ip 216.24.138.135

hxxp://serving-sys.com ip 216.24.138.135

sevdayeri.net ip 85.25.120.145

spywareguardpro.com ip 216.24.138.135

spywareprotect2009.com ip 204.13.161.102

hxxp://spywarestormer.com ip 216.24.138.135

hxxp://statsreportserver.com ip 216.24.138.135

svinushka.net ip 216.24.138.135

hxxp://tds.best-click-go.info ip 216.24.138.135

hxxp://tds.checkclick-1.info ip 216.24.138.135

tlal.exelator.net ip 8.19.18.81 or 209.190.74.70

hxxp://trafficconverter.biz ip 216.24.138.135

hxxp://trustedantivirus.com ip 216.24.138.135

virusranger.com ip 216.86.155.41

virusremover2008.com ip 216.24.138.135

virusremover2008flash.com ip 216.24.138.135

virusremover2009.com ip 69.46.228.182

virusrescue.com ip 82.98.86.175

virusschlacht.com ip 216.24.138.135

hxxp://websecurityexamine.com/ ip 216.24.138.135

WinPCDefender.net ip 216.24.138.135

zango.com ip 64.94.137.72


I hope this helps out everyone. :inlove:

Avoid being infected by Rogue-AV-Ware in the first place & have these sites Blocked. :flowers:


Edited to disable malicious links - Gal

Edited by Galadriel, 24 April 2009 - 02:06 AM.


BC AdBot (Login to Remove)

 


#2 buttoni

buttoni

  • Members
  • 267 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:Temple, Texas
  • Local time:11:53 PM

Posted 20 April 2009 - 01:50 PM

Great research, but that's too much host file editing or firewall rules for most users, myself included. I'll wait until MVPS.org (Spybot, SpywareBlaster or other hosts files creators) to add them to their list. FAIK they may be on the lists already.
HP Pavilion desktop p6270z; 8 GB ram; Win7 Home Premium x64 bit; FX 4.0; DSL 2Wire modem/router; MVPS Hosts; Comodo FW 5.3(D+ & Sandbox enabled); MSSE; MBAM on demand.

#3 koolkat

koolkat
  • Topic Starter

  • Banned
  • 71 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:09:53 PM

Posted 21 April 2009 - 11:11 AM

:inlove: Fine suit yourself , but don't say I didn't warn you. Anyway you should at least have these 2 IP's blocked with a Firewall.

216.24.138.135 :thumbsup: This IP is behind most of the Rogue-AV-Ware.

spywareprotect2009.com IP 204.13.161.102 :flowers: This IP is behind the dangerous Rogue-AV-Ware that can infect your computer with the Conficker Worm !!


I added these to the list above.

Anti-VirusNumber1.com ip 216.24.138.135

AntivirusXPPro.com ip 216.24.138.135

MalwareDefender2009.com ip 211.95.73.189

WinPCDefender.net ip 216.24.138.135





:trumpet: Warning ! Do not even think about visiting these sites ! They can severally damage your computer !

Edited by koolkat, 21 April 2009 - 11:15 AM.


#4 Romeo29

Romeo29

    Learning To Bleep


  • BC Advisor
  • 3,194 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Location:127.0.0.1
  • Local time:11:53 PM

Posted 21 April 2009 - 12:43 PM

Outpost Firewall blocks access to these IP address :thumbsup:

#5 o_rly

o_rly

  • Members
  • 193 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:An unclean desk
  • Local time:10:53 PM

Posted 22 April 2009 - 06:04 PM

:thumbsup:


hxxp:// regedintheclub.info
Don't mind me, I'm just lurking.

#6 Nawtheasta

Nawtheasta

  • Members
  • 396 posts
  • OFFLINE
  •  
  • Location:New England, USA
  • Local time:12:53 AM

Posted 23 April 2009 - 08:05 PM

I have started working my way down the list. I am cutting and pasting these to my McAfee Firewall banned IP list. One I cannot get to add. It says it is not a valid IP address. Just the 1st from this line, 2nd added ok. I just noticed as I am typing this, is it because there are dashes between the numbers and not periods?

avsystemcare.com ip ptr-216-8-179-24.ptr.next.dimensioninc.com or 216.8.179.23

I know I should know this but is an I.P. address always just numbers and periods? Also is there a minimum or maximum number of digits in an I.P. address??
Does anyone know where that Virut infection comes from? I would love to block that.
Thanks for the research and posting of these evil addresses!
Best Regards
Nawtheasta

#7 Galadriel

Galadriel

    Bleepin Elf


  • Malware Response Team
  • 2,753 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:Missouri, USA
  • Local time:10:53 PM

Posted 24 April 2009 - 01:59 AM

First i want to warn everyone to NOT visit any of these sites. I'll be disabling the links. In the future when pasting a list like this, it would be much more prudent to disable them like o_rly has done by changing the http to hxxp.

One I cannot get to add. It says it is not a valid IP address. Just the 1st from this line, 2nd added ok. I just noticed as I am typing this, is it because there are dashes between the numbers and not periods?

avsystemcare.com ip ptr-216-8-179-24.ptr.next.dimensioninc.com or 216.8.179.23


That's because it isn't a valid IP. The one I colored blue is a Resolved Host Name, and the one in red, is an actual IP. It's not because of the dashes, although that's part of it, it's the whole structure that's different.

A good tool to research IPs and Hostnames is http://www.domaintools.com/

I know I should know this but is an I.P. address always just numbers and periods? Also is there a minimum or maximum number of digits in an I.P. address??


A valid IP will always be in the nnn.nnn.nnn.nnn format. *Where n= any digit from 0 through 9. So the maximum number of digits is 12. A maximum of 3 for every section of the whole. That's a rather simple explanation of a pretty complex system, but for clarity's sake, it should do. If you want to learn more about IPs, I'm sure google can shed some light on the more technical aspects of this.

Does anyone know where that Virut infection comes from? I would love to block that.


I would be very surprised if Virut came from a single IP/Range. You have to understand the differences between a domain pushing rogue applications and a file infector that can actually spread. Typically, Rogues do not spread. They infect by using social engineering tactics (in other words, by making you do what they want you to do) to make sure the program is initiated/executed. Most of those rogues require some type of interaction (most, not all) to 'install/infect' a computer. Their purpose is to trick the user into spending money to buy an application (scam). Virut is in a different category entirely. It's purpose is to do as much damage as it can (whether intentional on the malware writer's part or not, that's what file infectors are really good at) and to attach/inject itself to as many executable files (exes, dlls, some types of archives like rars and zips and some html files among others) as it can find. Virut doesn't care about making you click here, or there. Most of the times, it will be silent, until the damage to the Operating System files is already irreversible. And it can actively search for new hosts to infect, without interaction.

While block lists are good to have, they can also be tedious to maintain, and are not, nor should they be expected to provided full protection. New malware pushing domains pop up by the thousands daily. A comprehensive block list is not something that is 'easily attainable'.
I cemna prestar aen. Han mathon ne nen. Han mathon ne chae. A han noston ne 'wilith. - Galadriel
'The avatar is changed; I can feel it in the water, I can feel it in the earth, I can smell it in the air.'

Phear teh ceiling cat, for he is roofkittehd! - Basement Cat

I'm a Bleeping Folder, are you? - Join BC in the fight against diseases - Click here
Become a BleepingComputer fan: Facebook

#8 Romeo29

Romeo29

    Learning To Bleep


  • BC Advisor
  • 3,194 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Location:127.0.0.1
  • Local time:11:53 PM

Posted 24 April 2009 - 07:21 AM

A valid IP address is made of four octets. All octets are written seperated by a dot. Each octet can range from 0 to 255.

in general ip address can be of form a.b.c.d where all a,b,c and d are four octets and they all can be from 0 to 255.

#9 koolkat

koolkat
  • Topic Starter

  • Banned
  • 71 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:09:53 PM

Posted 24 April 2009 - 10:16 AM

@Galadriel well I am sorry to post the http:// links :cool: , I meant no harm ( thats why I also posted :trumpet: Warning do
not even think about visiting these sites !).

:flowers: Nothing is full protection & although tedious to maintain , a block list is a %100 better than no block list.
:thumbsup: I can't tell you how much this block list has saved me from being re-infected by the the same bugs.


@Nawtheasta
The actual IP for avsystemcare.com is 216.8.179.23 unless they have a new IP now ,or are using a proxy ,or stactic IP.
If your firewall allows it , type just the host name avsystemcare.com & your firewall should look up & block the IP.

You could try this with Virut , but I have to agree with Galadriel I don't think Virut is being pushed through a domain
like Rogue-AV-Ware.

As Galadriel just explained Rogue-AV-Ware is designed to hold your computer at Ransom so they can get you to pay
them to undo it, which is a lie they just take your money and leave you with a infected computer.

Virut is a whole different bug that plain simply wants to destroy your computer !! Ransom & money is not Virut's goal.


@o_rly :inlove: Look you goofball ,I didn't post hxxp://. The Mods changed it to make the links not clickable !!

Edited by koolkat, 24 April 2009 - 10:48 AM.


#10 Nawtheasta

Nawtheasta

  • Members
  • 396 posts
  • OFFLINE
  •  
  • Location:New England, USA
  • Local time:12:53 AM

Posted 24 April 2009 - 11:24 AM

Thanks to all who have answered my questions. This is why Bleepingcomputer is so great. Those with the knowledge share with us who do not in a respectful way.
I do understand the difference between pure virus authors , who for their own twisted reason want to poison the pond for everybody and the rougeware people that are really just criminals out to make a buck. A curse on both their houses!! Just imagine how the internet would explode if viruses and other forms of malware could be defeated once and for all!
Octets , now that’s a new word for me. Always something new to learn!
Thanks for the explanation on I.P. Structure.
Since my experience with malware in early 2008 I try to stay far away from typing anything remotely associated with a bad site. As long as it is ok to do I will just cut and paste the IP addresses from the listing to my banned I.P. list
In regards to Virut. Well it was just a thought about blocking. Is this virus, if that is what it is, in some sort of form that anti virus programs can guard against? I wonder if who every came up with this has their own defense so that their system would not be infected.
Again , My thanks to all in the Bleepingcomputer community!
Best Regards
Nawtheasta

#11 scff249

scff249

    Indecisive Lurker


  • Members
  • 1,319 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:A galaxy far, far away...
  • Local time:11:53 PM

Posted 25 April 2009 - 11:36 PM

This is why Bleepingcomputer is so great. Those with the knowledge share with us who do not in a respectful way.


It's basically the same reason why I come here as well. It's full of knowledgeable people as well as a great deal of information. Another thing is that it comes out in a respectful way as well.

Well it was just a thought about blocking. Is this virus, if that is what it is, in some sort of form that anti virus programs can guard against?


This, I wouldn't know since I'm not really a part of a security specialistic...something...(wow random words are now coming out of my mouth). In Layman's terms, I'm not sure. I want to assume yes; but at the same time, I want to say no since, from the sounds of it, it's unstable and can misinfect or something along those lines. Whether or not that can affect how Virut infects .exe files is another issue that I'm not sure of.

I'd better shut up.

Edited by scff249, 25 April 2009 - 11:37 PM.

"Ototo'i wa usagi o mita no...Kino wa shika...Kyo wa anata." -Kotomi Ichinose (Clannad) [see below for translation]
"Day before yesterday I saw a rabbit, and yesterday a deer, and today, you." -The Dandelion Girl
"You are not alone, and you are not strange. You are you, and everyone has damage. Be the better person." -Katawa Shoujo


#12 m0le

m0le

    Can U Dig It?


  • Malware Response Team
  • 34,527 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:London, UK
  • Local time:04:53 AM

Posted 26 April 2009 - 08:18 PM

:thumbsup:

hxxp:// regedintheclub.info


@o_rly :flowers: Look you goofball ,I didn't post hxxp://. The Mods changed it to make the links not clickable !!


I think o_rly was just liking that particular URL name rather than laughing at a random hxxp prefix from the list.
Posted Image
m0le is a proud member of UNITE

#13 koolkat

koolkat
  • Topic Starter

  • Banned
  • 71 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:09:53 PM

Posted 22 May 2009 - 01:55 AM

:thumbsup: New updated list .

Malicious Sites

Block these sites:

66.220.17.154

85.25.120.145

216.24.138.135

217.73.66.16

hxxp://123urlaub.info ip 216.24.138.135

Angsecuritycenter.info or hxxp://online.antivirusscan1.info ip 208.43.47.213

antimalwareguard.com ip 216.24.138.135

antispyexpert.com ip 216.24.138.135

antivirus2009.com ip 82.165.245.27 or ip 217.73.66.16

Anti-VirusNumber1.com ip 216.24.138.135

AntivirusXPPro.com ip 216.24.138.135

avsystemcare.com ip 216.8.179.23

hxxp://best-click-scanner.info ip 216.24.138.135

hxxp://bestvirusremover2009.com/ ip 216.24.138.135

hxxp://bs.serving-sys.com ip 12.129.210.76 or 12.129.210.71 or 216.24.138.135

call-kelly.com ip 216.155.138.228

hxxp://click-my-scanner.info ip 216.24.138.135

clicksor.com ip 66.48.81.155

Coolwebsearch.com ip 66.250.74.150

Coolwebsearch.net ip 69.46.228.189

Coolwebsearch.org 77.232.68.11

crackle.com ip 12.129.210.76 or 208.78.224.202

edebiyatogretmeni.net ip 85.25.120.83

hxxp://emediate.eu ip 216.24.138.135

hxxp://get.virusscanneronline.info/21/bWUwQzE0eDBDMTQ3OWl3MUFORw== ip 216.24.138.135

gomyhit.com ip 216.24.138.135

greenantivirus2009.com ip 70.38.73.28

imageservr.com ip 208.73.210.121

infolinks.com ip 194.90.11.196

insightexpressai.com ip 209.244.156.19

interclick.com ip " 216.52.167.80 ?" or 216.24.138.135

kaaza.com ip 12.129.210.76 or 66.226.75.118

live365.com ip 216.235.95.145

MalwareDefender2009.com ip 211.95.73.189

malware-scan.com ip 64.40.103.249 or 209.59.194.20

malwarealarm.com ip 74.54.82.209

hxxp://www.maxmind.com//GeoIP.dat.gz ip 216.24.138.135

hxxp://www.mobularity.net ip 74.86.46.8

noadware.com ip 216.40.230.4

Noadware.net ip 69.20.104.139

onerateId.com ip 216.24.138.135

hxxp://onlinescannerav1.info ip 216.24.138.135

powerfulvirusremover2008.com ip 216.24.138.135

hxxp://regedintheclub.info ip 216.24.138.135

hxxp://run.av-best.info ip 209.59.194.20 or 216.24.138.135

hxxp://s1.on-line-virus-scanner.info ip 208.43.47.213

hxxp://safetydownload.com ip 216.24.138.135

hxxp://scanner.av-best.info/scan.php?campaign=mmb_7853320802&landid=4 ip 216.24.138.135

securityclick.net ip 216.24.138.135

hxxp://serving-sys.com ip 216.24.138.135

sevdayeri.net ip 85.25.120.145

spywareguardpro.com ip 216.24.138.135

spywareprotect2009.com ip 204.13.161.102

hxxp://spywarestormer.com ip 216.24.138.135

hxxp://statsreportserver.com ip 216.24.138.135

svinushka.net ip 216.24.138.135

hxxp://tds.best-click-go.info ip 216.24.138.135

hxxp://tds.checkclick-1.info ip 216.24.138.135

hxxp://tlal.exelator.net ip 8.19.18.81 or 209.190.74.70

hxxp://trafficconverter.biz ip 216.24.138.135

hxxp://www.traffz.com/stats.php?p=megaclickdsmu ip 72.20.122.66

hxxp://trustedantivirus.com ip 216.24.138.135

Vegatradingltd.com ip 70.38.73.28

virusdoctor.com ip 208.87.33.150

virusdoctor.net ip 66.116.109.44

virusranger.com ip 216.86.155.41

virusremover2008.com ip 216.24.138.135

virusremover2008flash.com ip 216.24.138.135

virusremover2009.com ip 69.46.228.182

virusrescue.com ip 82.98.86.175

virusschlacht.com ip 216.24.138.135

hxxp://websecurityexamine.com/scan/index2.php?affid=02100 ip 216.24.138.135

WinPCDefender.net ip 216.24.138.135

zango.com ip 64.94.137.72


:trumpet: Warning do not even think about visiting these sites !



all http's have been changed to hxxp

:flowers:

Edited by koolkat, 22 May 2009 - 08:38 AM.


#14 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 50,945 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:12:53 AM

Posted 22 May 2009 - 07:24 AM

To expand further on Galadriel's noteworthy reply.

Virus writers and attackers use various methods and techniques to spread malware.

A large number of infections are contracted and spread via Internet Relay Chat, by visiting gaming sites, porn sites, using pirated software, cracking tools, and keygens.

...warez and crack web pages are being used by cybercriminals as download sites for malware related to VIRUT and VIRUX. Searches for serial numbers, cracks, and even antivirus products like Trend Micro yield malcodes that come in the form of executables or self-extracting files...quick links in these sites also lead to malicious files. Ads and banners are also infection vectors...

Keygen and Crack Sites Distribute VIRUX and FakeAV

Infections also spread by using peer-to-peer (P2P) file sharing programs. They are a security risk which can make your computer susceptible to a smörgåsbord of malware infections, remote attacks, exposure of personal information, and identity theft. Malicious worms, backdoor Trojans IRCBots, and rootkits spread across P2P file sharing networks, gaming, porn and underground sites. Users visiting such pages may see innocuous-looking banner ads containing code which can trigger pop-up ads and malicious Flash ads that install viruses, Trojans, and spyware. Ads are a target for hackers because they offer a stealthy way to distribute malware to a wide range of Internet users. The infection also spreads through emails containing links to websites that exploit your web browser’s security holes and by exploiting a vulnerability in older versions of Sun Java. When you click on an infected email link or spam, Internet Explorer launches a site that stealthy installs a Trojan so that it can run every time you startup Windows and download more malicious files.

Rogue security programs infect machines by using social engineering and scams to trick a user into spending money to buy a an application which claims to remove malware and is often seen with a Vundo infection. Vundo is a Trojan that infects a system with malicious Browser Helper Objects and .dll (Dynamic Link Library) modules attached to system files like Winlogon and Explorer.exe. The infection is responsible for launching unwanted pop ups, advertising for rogue antispyware programs, and downloading more malicious files which hampers system performance. Newer variants of Vundo typically use bogus warning messages and alerts to indicate that your computer is infected with spyware or has critical errors as a scare tactic to goad you into downloading a malicious security application to fix it. The messages can mimic system messages so they appear as if they are generated by the Windows Operating System. The problem with these types of infections is that they can download other malicious files so the extent of the infection can vary to include backdoor Trojans and rootkit components which make it more difficult to remove. For more detail on how these types of rogue programs and infections install themselves, read:Other types of infections spread by downloading malicious applets or by visiting legitimate web sites that have been compromised through various hacking techniques used to host and deliver malware via malicious code, automated SQL Injection and exploitation of the browser/operating system vulnerabilities.

...More than 90 percent of these webpages belong to legitimate sites that have been compromised through hacking techniques such as SQL Injection...Hackers are apparently planting viruses into websites instead of attaching them to email. Users without proper security in place get infected by simply clicking on these webpages.

One webpage gets infected by virus every 5 seconds
.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif

#15 koolkat

koolkat
  • Topic Starter

  • Banned
  • 71 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:09:53 PM

Posted 22 May 2009 - 08:07 AM

:flowers: Wow ! Very informative quietman7. :thumbsup:

:inlove: An yes even good legitimate sites can be infected. When this happens , I try to contact the owner of the site to let them know.


Just say No to all Malware ! :trumpet:

Edited by koolkat, 22 May 2009 - 08:19 AM.





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users