Fake Scan page Not detected

Viruses and worms
1

Fake scan page here:
hxxp://virusalertwarning.com/windows/?utm_source=windows-mark&utm_medium=pop&utm_term=MICROSOFT

See:
http://zulu.zscaler.com/submission/show/0f850a6801e1a71da24f4b3eaaa71a4c-1409386500

It somehow locks up chrome until you tell chome to stop the site from sending more messages.Not blocked by avast.

Reported to virus AT avast DOT com

2

My Samsung tab now has more then 300 virus … and still counting ;D

3

Yeah even I have a SM-T211 running a custom 4.4 Kitkat ROM.Same happened here.Somehow in my VM it didnt allow me exit the web site in IE :o

I am going to try to give them a call and ask them about their fantastic product ;D

4

Well most browsers are protected from Google Safebrowsing if they pay attention to that blocking the page as blacklisted.
Re: codesign found: https://github.com/mhussain/redesign/blob/master/index.html
See: http://mobile.urlquery.net/report.php?id=1397678181180:

polonus

5

Hi Pol,

We finally detect…among the few! Just got the above PM from Pondus.Finally our work comes to play :slight_smile:

6

still not blocked by Malwarebytes URL block?

but listed at Malwarebytes hpHosts
https://www.virustotal.com/nb/url/6abc46965d0219e7f2d5890d805f4f3eaf00859c0d7f2a442bf9b10eb1dc41ee/analysis/1409484904/

7

Hmm yeah…We both reported that to them as we spoke in PM.Its interesting how even the big MBAM is late sometimes.I will continue to report this bad boy further to AV vendors.

8

Hi True Ind,

Here you see that bad sites are always found/hosted in bad places (a registrar like GODADDY.COM, LLC is concerned more about profits than security, and not particularly interested about what annoyance it brings to the average visitor of such domains. See: http://whois.domaintools.com/virusalertwarning.com
Also see: https://manage.centralnic.com/support/domain_doctor/virusalertwarning.com →
http://dnscheck.pingdom.com/?domain=NS1.MD-58.WEBHOSTBOX.NET&timestamp=1409485189&view=1

You, Pondus and little old me have a sort of inbuilt experience website chart to navigate by but the average user has not. We avoid such places like the plague others may get infested really bad time, which is a pity really.

polonus

9

Pol,I have seen alot of malware domains registered under go daddy hosts.Hope they grow responsible.

FAIL means: First attempt in learning.

So Lets be positive. ;D

10

Hello, this and few similar sites are bloked now (FakeAV). thank you

11

As does Google Chrome:

12

Thanks todah its great to have more analysts here.So cheers!