Jquery4html.co.cc – Malware update – Fake AV Redirections

Weekly (kinda daily) malware update. You can track all our updates by following our malware_updates category.

*If your site has been affected with any of these issues, contact us at support@sucuri.net or visit http://sucuri.net to get help, or if you want to share some information with us.


Today we started to see a lot of sites infected with an iFrame malware from jquery4html.co.cc (yes, always the .co.cc). What is funny is that when we tried to access this site to identify what was going on, we were greeted with a page from the .co.cc registrar saying that the domain was available:

The domain jquery4html.co.cc is available Continue to registration >>

If you want to build a site at this address, please visit us at www.co.cc

We found that very strange and tried to register the domain to see what was going on (their registration is free), but when we were close to completing the registration they said that the domain was not available anymore… Too bad.

A few hours later, that domain was already loading additional malicious iframes from diagnostic-scanner-xp-protection.com, hilitsors.cz.cc and many other intermediaries:

$ curl http://jquery4html.co.cc
<!DOCTYPE HTML PUBLIC “-//W3C//DTD HTML 4.01 Frameset//EN” “http://www.w3.org/TR/html4/frameset.dtd”>
<html>
<head>
<title>Security report #7233 / 2011-04-25..

<frameset rows=”*,90″>
<frame src="http://diagnostic-scanner-xp-protection.com/index2.php?06a..
<frame src="http://hilitsors.cz.cc/xp/index.php?tp=3..7405e1″ noresize scrolling..
..

There are many other sites being used as intermediaries (and just by looking at the domain names you can guess that they try to push the infamous Fake AV), including hundreds of .com:

hilitsors.cz.cc
tempviews.cz.cc
viables.cz.cc
antivcastscanwinxp.com
antivirbestbabyscan.com
antivirbestbarsscan.com
antivirbestdietscan.com
antivirbestgamesscan.com
antivirbestscan.com
antivirus-best-blog-scan.com
antivirusbestblogscan.com
antivirusbestdownloadscan.com
antivirus-best-scan.com
antivirusbestsolutionscan.com
antivirusfirstamendmentscan.com
antivirusfirstladyscan.com
antivirusfirstnationsscan.com
antivirusgreatdepressionscan.com
antivirusgreatesthitsscan.com
antivirusgreatlakesscan.com
antivmagazinescanwinxp.com
antivscancomputerswinxp.com
antivscancorporationwinxp.com
antivscandefinitionwinxp.com
antivscandocumentswinxp.com
antivscanengineswinxp.com
antivscanenginewinxp.com
antivscanimageswinxp.com
antivscanspeedwinxp.com
antivscantechnologieswinxp.com
antivscantoolswinxp.com
antivscantoolwinxp.com
anti-v-scan-winxp.com
antivscanwinxp.com
bestbonescanantiv.com
bestcolourscanantiv.com
bestlaserscanantiv.com
bestliverscanantiv.com
bestlungscanantiv.com
bestprogressivescanantiv.com
bestquickscanantiv.com
bestscanadamantiv.com
bonescanantivfree.com
cardscannerprotectionfast.com
cardscannerprotectionfree.com
card-scanner-win-protection.com
cardscannerwinprotection.com
card-scanner-xp-protection.com
cardscannerxpprotection.com
cheapscannerprotectionfast.com
cheapscannerprotectionfree.com
cheapscannerwinprotection.com
cheap-scanner-xp-protection.com
cheapscannerxpprotection.com
codescannerprotectionfast.com
codescannerprotectionfree.com
codescannerwinprotection.com
code-scanner-xp-protection.com
codescannerxpprotection.com
colorscannerprotectionfast.com
colorscannerprotectionfree.com
colorscannerwinprotection.com
color-scanner-xp-protection.com
colorscannerxpprotection.com
colourscanantivfree.com
compactscannerprotectionfast.com
compactscannerprotectionfree.com
compactscannerwinprotection.com
compact-scanner-xp-protection.com
compactscannerxpprotection.com
desktopscannerprotectionfast.com
desktopscannerprotectionfree.com
desktopscannerwinprotection.com
desktop-scanner-xp-protection.com
desktopscannerxpprotection.com
diagnosticscannerprotectionfast.com
diagnosticscannerprotectionfree.com
diagnosticscannerwinprotection.com
diagnostic-scanner-xp-protection.com
diagnosticscannerxpprotection.com
digitalscannerprotectionfast.com
digitalscannerprotectionfree.com
digitalscannerwinprotection.com
digital-scanner-xp-protection.com
digitalscannerxpprotection.com
documentscannerprotectionfast.com
documentscannerprotectionfree.com
documentscannerwinprotection.com
document-scanner-xp-protection.com
documentscannerxpprotection.com
imagescannerprotectionfast.com
imagescannerprotectionfree.com
imagescannerwinprotection.com
image-scanner-xp-protection.com
imagescannerxpprotection.com
laserscanantivfree.com
liverscanantivfree.com
lungscanantivfree.com
memoryscannerprotectionfast.com
memoryscannerprotectionfree.com
memoryscannerwinprotection.com
memory-scanner-xp-protection.com
memoryscannerxpprotection.com
mobilescannerprotectionfree.com
mobilescannerwinprotection.com
mobile-scanner-xp-protection.com
mobilescannerxpprotection.com
negativescannerprotectionfree.com
negativescannerwinprotection.com
negative-scanner-xp-protection.com
negativescannerxpprotection.com
photoscannerprotectionfast.com
photoscannerprotectionfree.com
photoscannerwinprotection.com
photoscannerxpprotection.com
portablescannerprotectionfree.com
portablescannerwinprotection.com
portablescannerxpprotection.com
portscannerprotectionfree.com
portscannerwinprotection.com
portscannerxpprotection.com
printerscannerprotectionfree.com
printerscannerwinprotection.com
printerscannerxpprotection.com
progressivescanantivfree.com
protectinstantwinscanner.com
protectionboostxpscanner.com
protectioninstantwinscanner.com
protectionmicrosoftxpscanner.com
protectionsafexpscanner.com
protectionwinscan.com
protectionwinscanneralbum.com
protectionwinscanner.com
protectionwinscannerdefinition.com
protectionwinscannerdriver.com
protectwinscanneralbum.com
protect-win-scanner.com
protectwinscanner.com
protectwinscannerdefinition.com
protectwinscannerdriver.com
protectwinscannerdrivers.com
protectwinscannerfeatures.com
protectwinscannerglass.com
protectwinscannerguide.com
protectwinscannerhardware.com
protectwinscannerinterface.com
protectwinscannermaintenance.com
protectwinscannermanufacturer.com
protectwinscannermanufacturers.com
protectwinscannermaster.com
protectwinscannermodels.com
protectwinscannerprofile.com
protectwinscannerprogramming.com
quickscanantivfree.com
quickscanantivwin.com
scanadamantivfree.com
scanantbiteivfree.com
scanantcolonyivfree.com
scanantfarmivfree.com
scanantivfree.com
scanantivirusvwin.com
scanantivwcarsin.com
scanantivwdealerin.com
scanantivwdealersin.com
scanantivwdriversin.com
scanantivwenginesin.com
scanantivwgolfin.com
scanantivwin.com
scanantivwinfoin.com
scanantivwmodelsin.com
scanantivwstorein.com
scanantivwtrucksin.com
scanantivxp.com
scanaquilanerantv.com
scanbandieranerantv.com
scanborsanerantv.com
scancronacanerantv.com
scandolcenerantv.com
scan-er-antivn-oew.com
scan-er-antivnoew.com
scan-eranti-vn-oew.com
scan-eranti-vnoew.com
scan-erantivn-oew.com
scan-erantivnoew.com
scanfiumenerantv.com
scanforestanerantv.com
scanfreccianerantv.com
scanguardianerantv.com
scanner-ant-farm-iv-xp.com
scanneranthillsivxp.com
scanner-ant-iv-xp.com
scannerantlionivxp.com
scannerantv.com
scannerblueantivxp.com
scannerprotectiondogsfree.com
scannerprotectionexpertsfree.com
scannerprotectionfactorfree.com
scannerprotectionfast.com
scannerprotectionfilterfree.com
scannerprotectionfree.com
scannerprotectionfunctionsfree.com
scannerprotectionkansasfree.com
scannerprotectionmeasurefree.com
scannerprotectionmethodsfree.com
scannerprotectionofficesfree.com
scannerqueenantivxp.com
scannerwingamesprotection.com
scanner-win-protection.com
scannerwinprotection.com
scanner-win-stuff-protection.com
scannerwinstuffprotection.com
scannerxpdesktopprotection.com
scannerxpdriversprotection.com
scannerxpinstallationprotection.com
scannerxppracticesprotection.com
scannerxpprotection.com
scannerxprepairprotection.com
scannerxpstyleprotection.com
scannerxpthemesprotection.com
searchableantiv.com
slidescannerantivxp.com
slidescannerwinprotection.com
thescannerantiv.com
virus-scanner-win-protection.com

We are seeing WordPress and Joomla sites infected with this malware but attackers are certainly scanning for ANY type of target. So if you have a web site, make sure it is updated, you are using good passwords, etc ,etc (the normal guidelines).

We will post more details are we track them. If you have any question, let us know. If you need help with this type of malware, we are here to assist.

1 comment

Comments are closed.

You May Also Like