Malware Database

I was taking another stroll around the seedy side of the Internet the other day hunting for rogues and it didn’t take long to find one.  It’s called Spyware Protect 2009, original name there ha ha.  It’s another fraud/scareware product that requires you to hand over $49.95 before you can try out what I’m *sure* is a great fully functional anti-spyware product (*cough* *cough*).

As I poked around their website I noticed information about the company behind the software and I decided to do some Googling.

The company they claim to be is Magic Software, Inc.  I find a company with that name in my search, except they are actually called Magic Software Enterprises.  They appear to be legitimate with a legit NASDAQ stock listing and everything (MGIC).  Their website (http://www.magicsoftware.com/).  And then I found what I thought I’d find: a fraud alert notice linked off their home page.

“We are aware that there is an entity pretending to be Magic Software Inc., distributing notices promoting Spy-protec.com, a corrupt website soliciting visitors to purchase its anti-spyware called Spyware Protect 2009.  Please be advised that both Spy-protec.com and Spyware Protect 2009 are fraudulent browser programs that hijack your computer and modify your browser configuration.  Please be aware that this fraudulent entity has nothing to do with either Magic Software Enterprises Ltd., or Magic Software Enterprises Inc. We are not a part of, and we have no relations with this aforementioned entity.”

So, there IS a real Magic Software but they don’t sell anti-spyware software.  Big surprise – the criminals behind the fraudware are using yet another deceptive tactic.

WARNING: Stay away from these domains, nothing but badness!

spy-protec.com (n/a)
REG DATE: January 1, 2009
REGISTRAR: REGTIME LTD.
STATUS: Placed on hold, no registrant info

antiwareprotect.com (91.212.65.122)
REG DATE: April 13, 2009
REGISTRAR: BLUE GRAVITY COMMUNICATIONS, INC. (I’ve seen alot of registrars but have never seen this one before)
REGISTRANT: Protected by PrivacyProtect.org (No surprise there)

91.212.65.122 has a couple of bad domains on it:
antiwareprotect.com
spyware-protector-2009.com
secure.spyware-protector-2009.com

The whole 91.21.65.0/24 block has a bunch of rogue suspects like:
free-webscaners.com
free-web-scaners.net
free-web-scaners.org
globalsecurityscan.com
securedonlinecomputerscan.com
antivirusxppro-2009.com
spywareprotector-2009.com
spyware-protector-2009.com
internetsafetyexamine.com
malwarefront.info
antivirus-xp-pro-2009.com

–mwdisector