A couple of weeks ago a new rogue security application appeared. Here's a FreeFixer log from the infected machine. I've marked the Presto Tuneup file with red:
FreeFixer v0.41 log
http://www.freefixer.com/
Operating system: Windows XP Service Pack 1
Log dated 2009-05-18 12:46
Registry Startups
HKCU\..\Run, MSMSGS = "C:\Program\Messenger\msmsgs.exe" /background
Processes (17 whitelisted)
C:\Program\Messenger\msmsgs.exe
C:\WINDOWS\System32\notepad.exe
C:\Program\FreeFixer\freefixer.exe
C:\Documents and Settings\All Users\Application Data\8f0d\PrestoTuneUp.exe
The Presto Tuneup domain, prestotuneup.com, resolves to 64.213.140.69. These are the other sites available on this IP address: antivirus09.net, malwarecatcher.net, scan-ultraantivirus2009.com, update1.virusalarmpro.com, update2.prestotuneup.com, updvms.cn, virussweeper-scan.net, www.malwarecatcher.net and promo.fastantivirus09.com.
On the prestotuneup.com web site I also found a file called Work.exe, which installs HOSTS file redirects of a large number of Google's web sites to 206.53.61.77.
FreeFixer v0.41 log http://www.freefixer.com/ Operating system: Windows XP Service Pack 1 Log dated 2009-05-18 12:25 Registry Startups HKCU\..\Run, MSMSGS = "C:\Program\Messenger\msmsgs.exe" /background HOSTS file 206.53.61.77 google.ae 206.53.61.77 google.as 206.53.61.77 google.at 206.53.61.77 google.az 206.53.61.77 google.ba 206.53.61.77 google.be 206.53.61.77 google.bg 206.53.61.77 google.bs 206.53.61.77 google.ca 206.53.61.77 google.cd 206.53.61.77 google.com.gh 206.53.61.77 google.com.gi 206.53.61.77 google.com.hk 206.53.61.77 google.com.jm 206.53.61.77 google.com.ly 206.53.61.77 google.com.mx 206.53.61.77 google.com.my 206.53.61.77 google.com.na 206.53.61.77 google.com.nf 206.53.61.77 google.com.ng 206.53.61.77 google.ch 206.53.61.77 google.com.np 206.53.61.77 google.com.om 206.53.61.77 google.com.pa 206.53.61.77 google.com.pr 206.53.61.77 google.com.qa 206.53.61.77 google.com.sg 206.53.61.77 google.com.tj 206.53.61.77 google.com.tr 206.53.61.77 google.com.tw 206.53.61.77 google.com.ua 206.53.61.77 google.dj 206.53.61.77 google.com.vc 206.53.61.77 google.it.ao 206.53.61.77 google.de 206.53.61.77 google.dk 206.53.61.77 google.dm 206.53.61.77 google.dz 206.53.61.77 google.ee 206.53.61.77 google.fi 206.53.61.77 google.fm 206.53.61.77 google.fr 206.53.61.77 google.ge 206.53.61.77 google.gg 206.53.61.77 google.gm 206.53.61.77 google.gr 206.53.61.77 google.gy 206.53.61.77 google.ht 206.53.61.77 google.ie 206.53.61.77 google.im 206.53.61.77 google.in 206.53.61.77 google.it 206.53.61.77 google.ki 206.53.61.77 google.kz 206.53.61.77 google.la 206.53.61.77 google.li 206.53.61.77 google.lk 206.53.61.77 google.lv 206.53.61.77 google.ma 206.53.61.77 google.md 206.53.61.77 google.ms 206.53.61.77 google.mu 206.53.61.77 google.mv 206.53.61.77 google.mw 206.53.61.77 google.nl 206.53.61.77 google.no 206.53.61.77 google.nr 206.53.61.77 google.nu 206.53.61.77 google.pl 206.53.61.77 google.pn 206.53.61.77 google.pt 206.53.61.77 google.ro 206.53.61.77 google.ru 206.53.61.77 google.rw 206.53.61.77 google.sc 206.53.61.77 google.se 206.53.61.77 google.sh 206.53.61.77 google.si 206.53.61.77 google.sm 206.53.61.77 google.sn 206.53.61.77 google.st 206.53.61.77 google.tl 206.53.61.77 google.tm 206.53.61.77 google.tt 206.53.61.77 google.us 206.53.61.77 google.vg 206.53.61.77 google.vu 206.53.61.77 google.ws 206.53.61.77 google.co.bw 206.53.61.77 google.co.ck 206.53.61.77 google.co.id 206.53.61.77 google.co.il 206.53.61.77 google.co.in 206.53.61.77 google.co.jp 206.53.61.77 google.co.ke 206.53.61.77 google.co.kr 206.53.61.77 google.co.ls 206.53.61.77 google.co.ma 206.53.61.77 google.co.mz 206.53.61.77 google.co.nz 206.53.61.77 google.co.th 206.53.61.77 google.co.tz 206.53.61.77 google.co.ug 206.53.61.77 google.co.uk 206.53.61.77 google.co.za 206.53.61.77 google.co.zm 206.53.61.77 google.co.zw 206.53.61.77 google.com 206.53.61.77 google.com.af 206.53.61.77 google.com.ag 206.53.61.77 google.com.ai 206.53.61.77 google.com.ar 206.53.61.77 google.com.au 206.53.61.77 google.com.bn 206.53.61.77 google.com.br 206.53.61.77 google.com.by 206.53.61.77 google.com.bz 206.53.61.77 google.com.co 206.53.61.77 google.com.cu 206.53.61.77 google.com.ec 206.53.61.77 google.com.et 206.53.61.77 google.com.fj 206.53.61.77 www.google.ae 206.53.61.77 www.google.as 206.53.61.77 www.google.at 206.53.61.77 www.google.az 206.53.61.77 www.google.ba 206.53.61.77 www.google.be 206.53.61.77 www.google.bg 206.53.61.77 www.google.bs 206.53.61.77 www.google.ca 206.53.61.77 www.google.cd 206.53.61.77 www.google.com.gh 206.53.61.77 www.google.com.gi 206.53.61.77 www.google.com.hk 206.53.61.77 www.google.com.jm 206.53.61.77 www.google.com.ly 206.53.61.77 www.google.com.mx 206.53.61.77 www.google.com.my 206.53.61.77 www.google.com.na 206.53.61.77 www.google.com.nf 206.53.61.77 www.google.com.ng 206.53.61.77 www.google.ch 206.53.61.77 www.google.com.np 206.53.61.77 www.google.com.om 206.53.61.77 www.google.com.pa 206.53.61.77 www.google.com.pr 206.53.61.77 www.google.com.qa 206.53.61.77 www.google.com.sg 206.53.61.77 www.google.com.tj 206.53.61.77 www.google.com.tr 206.53.61.77 www.google.com.tw 206.53.61.77 www.google.com.ua 206.53.61.77 www.google.dj 206.53.61.77 www.google.com.vc 206.53.61.77 www.google.it.ao 206.53.61.77 www.google.de 206.53.61.77 www.google.dk 206.53.61.77 www.google.dm 206.53.61.77 www.google.dz 206.53.61.77 www.google.ee 206.53.61.77 www.google.fi 206.53.61.77 www.google.fm 206.53.61.77 www.google.fr 206.53.61.77 www.google.ge 206.53.61.77 www.google.gg 206.53.61.77 www.google.gm 206.53.61.77 www.google.gr 206.53.61.77 www.google.gy 206.53.61.77 www.google.ht 206.53.61.77 www.google.ie 206.53.61.77 www.google.im 206.53.61.77 www.google.in 206.53.61.77 www.google.it 206.53.61.77 www.google.ki 206.53.61.77 www.google.kz 206.53.61.77 www.google.la 206.53.61.77 www.google.li 206.53.61.77 www.google.lk 206.53.61.77 www.google.lv 206.53.61.77 www.google.ma 206.53.61.77 www.google.md 206.53.61.77 www.google.ms 206.53.61.77 www.google.mu 206.53.61.77 www.google.mv 206.53.61.77 www.google.mw 206.53.61.77 www.google.nl 206.53.61.77 www.google.no 206.53.61.77 www.google.nr 206.53.61.77 www.google.nu 206.53.61.77 www.google.pl 206.53.61.77 www.google.pn 206.53.61.77 www.google.pt 206.53.61.77 www.google.ro 206.53.61.77 www.google.ru 206.53.61.77 www.google.rw 206.53.61.77 www.google.sc 206.53.61.77 www.google.se 206.53.61.77 www.google.sh 206.53.61.77 www.google.si 206.53.61.77 www.google.sm 206.53.61.77 www.google.sn 206.53.61.77 www.google.st 206.53.61.77 www.google.tl 206.53.61.77 www.google.tm 206.53.61.77 www.google.tt 206.53.61.77 www.google.us 206.53.61.77 www.google.vg 206.53.61.77 www.google.vu 206.53.61.77 www.google.ws 206.53.61.77 www.google.co.bw 206.53.61.77 www.google.co.ck 206.53.61.77 www.google.co.id 206.53.61.77 www.google.co.il 206.53.61.77 www.google.co.in 206.53.61.77 www.google.co.jp 206.53.61.77 www.google.co.ke 206.53.61.77 www.google.co.kr 206.53.61.77 www.google.co.ls 206.53.61.77 www.google.co.ma 206.53.61.77 www.google.co.mz 206.53.61.77 www.google.co.nz 206.53.61.77 www.google.co.th 206.53.61.77 www.google.co.tz 206.53.61.77 www.google.co.ug 206.53.61.77 www.google.co.uk 206.53.61.77 www.google.co.za 206.53.61.77 www.google.co.zm 206.53.61.77 www.google.co.zw 206.53.61.77 www.google.com 206.53.61.77 www.google.com.af 206.53.61.77 www.google.com.ag 206.53.61.77 www.google.com.ai 206.53.61.77 www.google.com.ar 206.53.61.77 www.google.com.au 206.53.61.77 www.google.com.bn 206.53.61.77 www.google.com.br 206.53.61.77 www.google.com.by 206.53.61.77 www.google.com.bz 206.53.61.77 www.google.com.co 206.53.61.77 www.google.com.cu 206.53.61.77 www.google.com.ec 206.53.61.77 www.google.com.et 206.53.61.77 www.google.com.fj 206.53.61.77 search.yahoo.com 206.53.61.77 www.search.yahoo.com 206.53.61.77 search.live.com 206.53.61.77 search.msn.com 206.53.61.77 googleads.g.doubleclick.net 206.53.61.77 www.googleads.g.doubleclick.net 206.53.61.77 pubads.g.doubleclick.net 206.53.61.77 www.pubads.g.doubleclick.net 206.53.61.77 partner.googleadservices.com 206.53.61.77 www.partner.googleadservices.com 206.53.61.77 www.partner.googleadservices.com Processes (15 whitelisted) C:\Program\Messenger\msmsgs.exe C:\Program\FreeFixer\freefixer.exe
sir, i am using windows xp professional sp3, freefixer did not proceed after "scanning recently created or modified" and i waited for an hour as told to wait for a while.
regards
arun
# 16 Jan 2010, 9:40
arun prasad writes