See VT report here, only detected by TrendMicro:
http://www.virustotal.com/url-scan/report.html?id=6f7744cf106604aaa7434c360512b9e6-1306152868
Accompanying file detection for mir3.dat: http://www.virustotal.com/file-scan/report.html?id=2a906d82b63c51e618b97f4851ee05bdc19d410a39d62e21438a7f0d7575f26c-1306158272
SOSWebScan misses it, SucuriSiteCheck misses it also, and does not give the blakclisting status it has
for this site from NSW: http://safeweb.norton.com/report/show?url=178cq3.com
detected here as well: http://global.sitesafety.trendmicro.com/ dangerous /distribution of malicious source code
http://www.browserdefender.com/site/178cq3.com/ (site gives away version number of server software and may be
therefore vulnerable to these exploits)
DrWeb also misses the direct link, see:
-http://www.178cq3.com/updata/mir3.dat packed by ASPACK
-http://www.178cq3.com/updata/mir3.dat packed by UPX
-http://www.178cq3.com/updata/mir3.dat - Ok (actually not OK!)
IP info, re: http://ip.chinaz.com/IP/?IP=58.251.49.216
查 询 查询结果[1]: 58.251.49.216 ==>> 58.251.49.216 ==>> 989540824 ==>> 广东省深圳市 联通
transl: 58.251.49.216 ==>> 58.251.49.216 ==>> 989540824 ==>> Shenzhen City, Guangdong Province, China Unicom
polonus
reported via virus AT avast dot com