Tag: Cwsandbox

Casino Spammers still user Yahoo for Spam : Could this be Malware?

Paul

It just shows you just how one Geocities was taken down by Yahoo who owns it, the spammers have to come up with more ways to get you to download there software.

[ad]In my previous post about [intlink id=”3199″ type=”post”]Casino programs[/intlink],  They were using Geocities to host the page for the link to the download.

casinosmartdownload

It seems to be linking to “http://bestwinscasino.com/SmartDownload.exe“.  From [intlink id=”3199″ type=”post”]previous post[/intlink] I talked about what that program did but I wanted to do another test with CWSandbox and see what has change. It looks like they must be having problems lately,  So If you want to do your own test and send me the link by all means.  I don’t know what is going on but, it probably is like the other post about wanting to do some bad things.  Virustotal has some anti-virus programs flagging this so I am unsure of the Harmlessness of this file but I wouldn’t install this software.  According to Avinti this program is a trojan dropper.  So Iwill let you decide on installing this software or not.

While the CWSndbox checks for malware, I went to Whois and looked up the domain.   Very interesting,  According to Whois this domain is located in China?  You don’t say, we’ve heard a lot of stuff coming from China from Graham Cluely Blog.  So it only makes me wonder what they are attempting to do now.  I do know never download a file you haven’t heard off

This is a good time to install some [intlink id=”2205″ type=”page”]Free Anti-virus and Free Firewall [/intlink]software to better protect your system.

New spam Campaign — Casino Anyone?

Paul

Looks like there is a new Campaign going on with regards to having VIP access.

geocitiesspam

So I go to the site:

geocitiesspam1

[ad#cricket-right-ez]

I decide to have a little fun and download the file.  The Filename is “Smartdownload.exe“.  Now you shouldn’t install any software or programs from sites you don’t know about or have any idea of what changes are going to be made.  I use CWSandbox to better understand this file.  Here are a few thinks I’ve found:

  • This program connects to three different IP’s [Your broadband Modem,200.122.168.237, and 212.201.100.136]

  • It also Changes your Autoexec.bat file.  (Not good)

  • Changes access flags on several different program (not good either)

  • It also tries to be Anonymous.  If you checks the logs out your self you will find it very interesting.

  • It looks like it connects to the servers every time you boot up!! (Not good either)

I don’t know what it is trying to do but everything I see about this file makes me think this is trying to avoid virus detection.  I ran Kasperky and Avast file check, it came up clean.   I think what happens is you download the virus after you install this software.  I wouldn’t download this or install it, even though it advertise you 800% free that has to be scam or just a flat lie to get you to install software.  Everything about this program doesn’t make me want to to install this software, although it doesn’t seem to be a virus.  It however does make me want to delete the file.  Remember to use[intlink id=”2205″ type=”page”] Anti-virus and Firewalls[/intlink], that is your first line of defense.