Jump to content

Malwarebytes

festplattencleaner.com

Started by Yourhighness, Mar 06 2008 08:41 PM

2 replies to this topic

#1
Yourhighness
Posted 06 March 2008 - 08:41 PM

    Advanced Member

  • Experts
  • PipPipPip
  • 135 posts
  • Gender:Male
  • Location:Hamburg, Germany
  • Interests:Too many things for too little time :p
hxxp://festplattencleaner.com/

Very much looking like a German rogue:
O4 - HKLM\..\Run: [Salestart] "C:\Programme\Gemeinsame Dateien\FestPlattenCleaner\strpmon.exe" dm=http://festplattencleaner.com taken from here:
http://www.techsupportforum.com/security-center/hijackthis-log-help/218433-please-help-totally-frustrated.html
and further mentioned here: http://forum.hijackthis.de/showthread.php?t=28637

Whois: http://www.dnsstuff.com/tools/whois.ch?ip=http://festplattencleaner.com/

#2
MysteryFCM
Posted 06 March 2008 - 10:11 PM

    Forum Deity

  • Moderators
  • PipPipPipPipPipPip
  • 4,231 posts
  • Gender:Male
  • Location:Tyneside, UK
It's old IP (660 other domains on the same IP):

http://hosts-file.ne...show=87.117.252.

It's new IP (8 other domains on the same IP):

http://hosts-file.ne...?show=89.18.181.

http://hosts-file.ne...ttencleaner.com
Steven Burn
Research Engineer

Posted Image

Follow us: Twitter, Become a fan: Facebook

#3
SwampDiner
Posted 11 March 2008 - 03:28 AM

    True Member

  • Experts
  • PipPipPipPip
  • 419 posts
  • Location:The Internets
Added to blacklist 168
Back to Newest Rogue Threats · Next Unread Topic →


1 user(s) are reading this topic

0 members, 1 guests, 0 anonymous users

  1. Malwarebytes Forum
  2. → Research Center
  3. → Newest Rogue Threats

Products

About

Partners

Follow Us