Wednesday, February 8, 2012

Abnow.com

Abnow.com could be quite harmless and even somewhat useful url, if its visits were not in their majority induced by redirect viruses. Experts assessed outbound traffic to the website as mostly consisting of the same visitors. Such disproportion of unique visitors and page impressions suggested the repeated visits from the same IP were nor deliberate acts of users.
Removal of Abnow.com is a popular topic raised on computer security related forums. That is another clear evidence for the website relying on redirect agents.
Several variants of redirects specific to the websites have been observed in the wild. Fortunately, a single technique of computer cleanup enables users to get rid of Abnow.com re-routing issue. The method is available with free scanner right here


Abnow.com domain details:

Domain abnow.com:
  Whois Privacy Services Pty Ltd
  Domain Hostmaster, Customer ID : 13451161463754
 
  PO Box 923
  Fortitude Valley QLD 4006 AU

Administrative contact:
Technical contact:
Billing contact:
  Whois Privacy Services Pty Ltd
  Domain Hostmaster, Customer ID : 13451161463754
 
  PO Box 923
  Fortitude Valley QLD 4006 AU
  Phone: Phone: +61.730070090
  Fax: Phone: +61.730070091

Record dates:
  Record created on: 1999-09-01 19:15:09 UTC
  Record modified on: 2011-07-27 17:31:07 UTC
  Record expires on: 2012-09-01 UTC

Nameservers:
  ns2.smartname.com:
    204.228.229.171
  ns1.smartname.com:
    204.228.229.170

Monday, February 6, 2012

Just4hookup.com

Just4hookup.com is the latest browser hijacker \ redirector related to dangerous rootkit. Download Spyware Doctor to get rid of  of Just4hookup.com redirects.

Just4hookup.com screenshot:


Just4hookup.com domain details:
Reverse Whois:
"Todd Reiley" owns about7 other domains
Email Search:
is associated with about 8 domains
NS History:
1 change on 2 unique name servers over 0 year.
IP History:
3 changes on 4 unique IP addresses over 0 years.
Whois History:
7 records have been archived since 2012-01-06 .
Reverse IP:
5 other sites hosted on this server.
Log In or Create a FREE account to start monitoring this domain name

DomainTools for Windows®

Now you can access domain ownership records anytime, anywhere... right from your own desktop! Download Now>

Get your domains at Name.com.

Domain Name: just4hookup.com
Registrar: Name.com LLC

Expiration Date: 2013-01-05 04:36:31
Creation Date: 2012-01-05 04:36:31

Name Servers:
 ns1.name.com
 ns2.name.com
 ns3.name.com
 ns4.name.com

REGISTRANT CONTACT INFO
Todd Reiley
Todd Reiley
4401 N Federal Hwy #204
Boca Raton
Florida
33431
US
Phone: +1.5613953771
Email Address:

ADMINISTRATIVE CONTACT INFO
Todd Reiley
Todd Reiley
4401 N Federal Hwy #204
Boca Raton
Florida
33431
US
Phone: +1.5613953771
Email Address:

TECHNICAL CONTACT INFO
Todd Reiley
Todd Reiley
4401 N Federal Hwy #204
Boca Raton
Florida
33431
US
Phone: +1.5613953771
Email Address:

BILLING CONTACT INFO
Todd Reiley
Todd Reiley
4401 N Federal Hwy #204
Boca Raton
Florida
33431
US
Phone: +1.5613953771
Email Address:

Wednesday, February 1, 2012

Askthecrew.net

If browser keeps redirecting you to Askthecrew.net and other similiar web-sites - your PC is infected with Redirect Virus\Rootkit. We recommend to use Spyware Doctor in order to detect and eliminate this annoying malware. Remember that Askthecrew.net manual removal (changing your browsers settings) will not delete the reason of frequent redirections. 

Askthecrew.net screenshot:


 Askthecrew.net domain details:
 Registrant:
   Domains By Proxy, LLC

   Registered through: Go Daddy
   Domain Name: ASKTHECREW.NET

   Domain servers in listed order:
      NS31.DOMAINCONTROL.COM
      NS32.DOMAINCONTROL.COM


Remove Searchcore.net

Searchcore.net does not ask user’s permission to get loaded into browser. The permit is issued by another authority, which is a hijacker infection. Its mission is to take over software responsible for navigation through the worldwide web on affected machines (any PC , once the hijacker has integrated itself into it, is an affected machine). In the other words, every browser installed on your Pc is recognized by the infection for the purpose of gaining control over every tool for Internet surfing.
In that connection, removal of Searchcore.net is by mistake considered by some self-announced malware experts and therefore by users a problem related to single specific browser only. What is worse, some victims do believe they only need to change their current browser to another, say, IE to Google Chrome – and the problem is gone.
The solution is different, but somewhat even simpler though. What a victim of repeated redirects to the above url needs is simply get rid of Searchcore.net hijacker, which is the malicious controller affecting every browser. Click here to get free scanner installed in order to quickly and safely detect, and get rid of, the web related infection, as well as other parasites detected on your PC. 

Searchcore.net screenshot:


Searchcore.net domain details:
 Registrant:
   Domains By Proxy, LLC

   Registered through: Go Daddy
   Domain Name: SEARCHCORE.NET

   Domain servers in listed order:
      NS65.DOMAINCONTROL.COM
      NS66.DOMAINCONTROL.COM





Tuesday, January 31, 2012

Vipsearchs.net

Vipsearchs.net is the latest search engine redirector and browser hijacker related to TDSS and Zeroaccess rootkits, that opens security holes on your PC and redirects to different malicious web-sites. So, Vipsearchs.net belongs to this malware family. We recommend to use Spyware Doctor in order to detect and remove rootkits that causes redirections to Vipsearchs.net and other shady sites.

Vipsearchs.net screenshot:


Vipsearchs.net domain details:
Domain vipsearchs.net

Date Registered: 2011-7-13
Date Modified: 2011-7-13
Expiry Date: 2012-7-13

DNS1: ns-canada.topdns.com
DNS2: ns-uk.topdns.com
DNS3: ns-usa.topdns.com

Registrant
 Private Whois vipsearchs.net
 Private Whois vipsearchs.net
 *******PLEASE DO NOT SEND LETTERS******
 ****Contact the owner by email only****
 c/o vipsearchs.net
 N4892 Nassau
 Bahamas
 Tel: +852.81720004

Administrative Contact
 Private Whois vipsearchs.net
 Private Whois vipsearchs.net
 *******PLEASE DO NOT SEND LETTERS******
 ****Contact the owner by email only****
 c/o vipsearchs.net
 N4892 Nassau
 Bahamas
 Tel: +852.81720004

Technical Contact
 Private Whois vipsearchs.net
 Private Whois vipsearchs.net
 *******PLEASE DO NOT SEND LETTERS******
 ****Contact the owner by email only****
 c/o vipsearchs.net
 N4892 Nassau
 Bahamas
 Tel: +852.81720004

Registrar: Internet.bs Corp.
Registrar's Website : http://www.internetbs.net/

Monday, January 30, 2012

Zinkzo.com

Zinkzo.com is the latest search engine hijacker and redirector. This web-site is related to dozens of others, with the same design and similiar domain details. TDSS rootkit use this sites to redirect your searches from Google \ Bing \ Yahoo and show commercial ad's. We strongly recommend to remove Zinkzo.com redirector using Spyware Doctor (it will also remove the rootkit).

Zinkzo.com screenshot:

Zinkzo.com domain \ server details:
Registrant:
 Corporation Service Company
 Domain Registrar
 2711 Centerville Road Suite 400
 Wilmington, DE 19808
 US
 Email:

 Registrar Name....: CORPORATE DOMAINS, INC.
 Registrar Whois...: whois.corporatedomains.com
 Registrar Homepage: www.cscprotectsbrands.com

 Domain Name: zinkzo.com

 Created on..............: Wed, Sep 02, 2009
 Expires on..............: Sun, Sep 02, 2012
 Record last updated on..: Sun, Feb 13, 2011

 Administrative,Technical Contact:
 Corporation Service Company
 Domain Registrar
 2711 Centerville Road Suite 400
 Wilmington, DE 19808
 US
 Phone: +1.3026365400
 Email:

 DNS Servers:

 dpns2.dnsnameserver.org
 dpns1.dnsnameserver.org
 dpns4.dnsnameserver.org
 dpns3.dnsnameserver.org

Sunday, January 29, 2012

Ahmedriad75.jeeran.com

Ahmedriad75.jeeran.com is a typical redirector landing page that uses dozens of redirects to lead you to other web-sites that may be infected by malicious scripts. Some trojan horses and rootkits may popup ads that leads to ahmedriad75.jeeran.com. Sometimes this web-site may redirect your search queries. We recommend to use Spyware Doctor in order to remove ahmedriad75.jeeran.com hijacker and related infections.

ahmedriad75.jeeran.com screenshots:




Vkernel.org

Vkernel.org is the latest malicious web-site (that use misleading schemes to hijack your browser \ redirect searches) with fake browser update. Don't download this update - your computer will be seriously infected by dangerous trojan horse \ rootkit. Use Spyware Doctor antimalware to remove Vkernel.org redirects and related trojan infections

Vkernel.org screenshots:


Vkernel.org domain details:
Domain ID:D164425595-LROR
Domain Name:VKERNEL.ORG
Created On:18-Jan-2012 14:56:36 UTC
Last Updated On:18-Jan-2012 14:56:36 UTC
Expiration Date:18-Jan-2013 14:56:36 UTC
Sponsoring Registrar:Bizcn.com, Inc. (R1248-LROR)
Status:CLIENT TRANSFER PROHIBITED
Status:TRANSFER PROHIBITED
Registrant ID:orgpl26898594625
Registrant Name:Henry Nguyen Gong
Registrant Organization:Privacy-Protect.cn
Registrant Street1:26 Rue Jean Reboul
Registrant Street2:
Registrant Street3:
Registrant City:Nimes
Registrant State/Province:Languedoc-Roussillon
Registrant Postal Code:30900
Registrant Country:FR
Registrant Phone:+33.466583875
Registrant Phone Ext.:
Registrant FAX:+33.466583875
Registrant FAX Ext.:
Registrant Email:
Admin ID:orgpl26898595079
Admin Name:Henry Nguyen Gong
Admin Organization:Privacy-Protect.cn
Admin Street1:26 Rue Jean Reboul
Admin Street2:
Admin Street3:
Admin City:Nimes
Admin State/Province:Languedoc-Roussillon
Admin Postal Code:30900
Admin Country:FR
Admin Phone:+33.466583875
Admin Phone Ext.:
Admin FAX:+33.466583875
Admin FAX Ext.:
Admin Email:
Tech ID:orgpl26898595543
Tech Name:Henry Nguyen Gong
Tech Organization:Privacy-Protect.cn
Tech Street1:26 Rue Jean Reboul
Tech Street2:
Tech Street3:
Tech City:Nimes
Tech State/Province:Languedoc-Roussillon
Tech Postal Code:30900
Tech Country:FR
Tech Phone:+33.466583875
Tech Phone Ext.:
Tech FAX:+33.466583875
Tech FAX Ext.:
Tech Email:
Name Server:NS3.CNMSN.COM
Name Server:NS4.CNMSN.COM
Name Server:
Name Server:
Name Server:
Name Server:
Name Server:
Name Server:
Name Server:
Name Server:
Name Server:
Name Server:
Name Server:
DNSSEC:Unsigned


Friday, January 27, 2012

Clkpop.com

Clkpop.com is a malicious web-site that can redirect your searches to it's internal pages and generate tonns of popup ads using rrealted trojan horses. We recommend to remove clkpop.com using Spyware Doctor (free scan).

Domain and server details:
Domain Name: clkpop.com
Registrar: Name.com LLC

Protected Domain Services Customer ID: NCR-3754561

Expiration Date: 2013-01-06 13:00:53
Creation Date: 2012-01-06 13:00:53

Name Servers:
 ns1.adleet.com
 ns2.adleet.com

Domain privacy provided by Protected Domain Services. For more information see
www.protecteddomainservices.com

REGISTRANT CONTACT INFO
Protected Domain Services - Customer ID: NCR-3754561
P.O. Box 6197
Denver
CO
80206
US
Phone: +1.7202492374
Email Address:

ADMINISTRATIVE CONTACT INFO
Protected Domain Services - Customer ID: NCR-3754561
P.O. Box 6197
Denver
CO
80206
US
Phone: +1.7202492374
Email Address:

TECHNICAL CONTACT INFO
Protected Domain Services - Customer ID: NCR-3754561
P.O. Box 6197
Denver
CO
80206
US
Phone: +1.7202492374
Email Address:

BILLING CONTACT INFO
Protected Domain Services - Customer ID: NCR-3754561
P.O. Box 6197
Denver
CO
80206
US
Phone: +1.7202492374
Email Address: 


Thursday, January 19, 2012

Star.feedmixer.org

hxxp://Star.feedmixer.org is the latest search redirection\ hijacker web-site. Use Spyware Doctor to remove it and prevent further Google\Bing redirections and home page replacements.


 Domain and server details:
Domain ID:D159272038-LROR
Domain Name:FEEDMIXER.ORG
Created On:26-May-2010 11:30:40 UTC
Last Updated On:24-May-2011 07:20:25 UTC
Expiration Date:26-May-2012 11:30:40 UTC
Sponsoring Registrar:GoDaddy.com, Inc. (R91-LROR)
Status:CLIENT DELETE PROHIBITED
Status:CLIENT RENEW PROHIBITED
Status:CLIENT TRANSFER PROHIBITED
Status:CLIENT UPDATE PROHIBITED
Registrant ID:CR48823637
Registrant Name:Cem Dulda
Registrant Street1:Seref Efendi Sk. No 38 Nuruosmaniye
Registrant Street2:
Registrant Street3:
Registrant City:Istanbul
Registrant State/Province:Fatih
Registrant Postal Code:34120
Registrant Country:TR
Registrant Phone:+90.5322126088
Registrant Phone Ext.:
Registrant FAX:
Registrant FAX Ext.:
Registrant Email:
Admin ID:CR48823642
Admin Name:Cem Dulda
Admin Street1:Seref Efendi Sk. No 38 Nuruosmaniye
Admin Street2:
Admin Street3:
Admin City:Istanbul
Admin State/Province:Fatih
Admin Postal Code:34120
Admin Country:TR
Admin Phone:+90.5322126088
Admin Phone Ext.:
Admin FAX:
Admin FAX Ext.:
Admin Email:
Tech ID:CR48823639
Tech Name:Cem Dulda
Tech Street1:Seref Efendi Sk. No 38 Nuruosmaniye
Tech Street2:
Tech Street3:
Tech City:Istanbul
Tech State/Province:Fatih
Tech Postal Code:34120
Tech Country:TR
Tech Phone:+90.5322126088
Tech Phone Ext.:
Tech FAX:
Tech FAX Ext.:
Tech Email:
Name Server:NS35.DOMAINCONTROL.COM
Name Server:NS36.DOMAINCONTROL.COM
Name Server:
Name Server:
Name Server:
Name Server:
Name Server:
Name Server:
Name Server:
Name Server:
Name Server:
Name Server:
Name Server:
DNSSEC:Unsigned