A new software test.
Something announced as free … but it’s not really for free.
Today I wanted to see what level of browser hijacking is running out there.
Browses hijack:
“A
program changes your home page, redirects browser typos to a search
engine you have never heard of or to other sites. This is annoying,
popping up ads and displaying unwanted site”
So.
I
have seen alot of ”good” things like: a java ”update”, winning iphones,
free apps, cassino offers, games, some redirections… etc.
This code was injected in my browser.
”xxxx.
rsc.cdn77.org
install malicious extensions, plug-ins, ads, banner ads, pop-up ads,
etc and creates mess on your browsers. Even if mistakenly you click on
any ads or link then also it redirects you to some other websites. It
also uses cookie and keep spy on your online activities like browsing
history, mostly visited websites, login, password details, etc. The
redirect virus has the ability to disable the anti-virus and other
security program without your knowledge.” Source: removemalwarevirus.com
Here you can see some of the domains i visited in this journey:
- rsc.cdn77[.]org
- liveadexchanger[.]com
- static.199.55.201.138.clients.your-server[.]de
- timetrackingext.xyz
- 2048-game[.]review
search.findthatsearch[.]com
findthatsearch[.]com
minesweepx[.]com
solitaire4u2[.]com
tetrigame[.]com
certifiedwinners[.]info
wtrtr1[.]com
ads.dlvr[.]live
betano[.]com
digitaldsp[.]com
c.codeonclick[.]com
join.pro-gaming-world[.]com
I found some extra files on my browsers… .js , .cfg and .dll.
3327329.js — ”pref(“general.config.obscure_value”,
0);pref(“general.config.filename”,
“3321791.cfg”);pref(“network.proxy.type”,
2);pref(“network.proxy.autoconfig_url”,
“http://unstop-access.biz/wpad.dat?cb241ce907c6857bc3c28a220ec2076437981150”);pref(“network.proxy.autoconfig_url.include_path”,
true);”
3321791.js
— ”pref(“general.config.obscure_value”,
0);pref(“general.config.filename”,
“3327329.cfg”);pref(“network.proxy.type”,
2);pref(“network.proxy.autoconfig_url”,
“http://unstop-access.biz/wpad.dat?cb241ce907c6857bc3c28a220ec2076437981150”);pref(“network.proxy.autoconfig_url.include_path”,
true);”
Adware Agent – PUA.YoBrowser:
myographical.dll = sandastros.dll
- MD5: 8ecbfcb3c062755a3d5b3851cbe98357
- SHA-1: 5d1cccd87d0e4d81090d288d201d9c4467765513
Virus Total Report
Virus Total Graph
Fake Java Update
Virus Total Report
It is clear that it is not a pleasant trip for those who do not know how to protect themselves.
Have fun & Stay safe!!!
http://www.prodefence.org/
In the same way it is using the /POST request for sending stealed data, when the victim visits some bank account, paypal…etc.
