Today, I was browsing Google for the recent False Positive from McAfee. Blackhat SEO has been targeting the keywords for this subject. Some related keywords are: McAfee, wecorl, patch, DAT5958
Suddenly, I got redirected to a fake scanner page.
Whois record for safetypcwork4.com
Registrant Contact:
Name: Garritt Kooken
Phone: +86.592257788 fax: +86.592257788
Address: Rue de Virton 237
City: Evegnee 4631
Country: Belgium
packupdate_build107_287.exe
Result: 8/40 (20.00%)
MD5: 9d44165fa043a2f9674055055233598e
VirusTotal
Anubis Report
ThreatExpert Report
Fake Scanner Page: hxxp://www2.safetypcwork4.com
This rogue is called “Windows Performance Center“.
Some screenshot examples:
The Fake Scanner Page
When executing the dropped file ( packupdate_build107_287.exe ):
Setup of the Rogue Program
0 Responses to “new rogue domain: safetypcwork4.com”
Leave a Reply
You must login to post a comment.