Today we found a new site distributing the rogue anti-malware software, Wista Antivirus 2009. The file downloaded at the website (setup_en.exe (575953F4912EA2B9FF2598D0EE561828) currently shows zero detection over at VirusTotal. If we click on the “Free Scan” we are redirected to fake scan page and the removal file provided points to “Spyware Isolator”, which is detected by most AV’s.
Site: hxxp://wista-antivirus2009.com
File: setup_en.exe 3126445 bytes | spywareisolator_installer.exe 81920 bytes
MDB Path: /lithium-malware/setup_en.zip | /lithium-malware/

site is down
Fixed the link. Thanks.