| View previous topic :: View next topic |
| Author |
Message |
AlphaCentauri
SIRT Handler
Premium Member
Joined: Nov 20, 2003
Posts: 2899
|
 Posted: Wed Dec 26, 2007 4:13 pm Post subject: Media Cool 2.0 |
|
|
This definitely qualifies as "unknown file." I received the following spam (cc'd to multiple other email addresses on my ISP, just the way ecard spam used to come):
| Quote: | Hello,
Merry Christmas and Happy New Year.
I'm sorry for taking your time reading this message. I would like to
introduce a product.
Media Cool 2.0 is a media searching/extracting/playing tool for your home
entertainment. Do you have problem downloading flv videos (such as youtube
video) or do you want to save these online music to your disk or ipod? Media
Cool helps to make it.
You may find evaluation copy by googling:
http://www.google.com/search?hl=en&q=media+cool+2.0&btnG=Google+Search
Hope it useful for you.
Also, please see here for how to use it:
http://www.youtube.com/watch?v=KUbAAL8_xI4
Have a good day. |
It looks suspicious in every possible way, and I can't think of any reason a legitimate program would be promoted in this way. But Virus Total and Jotti found nothing:
Virus Total
AhnLab-V3 2007.12.27.10 2007.12.26 -
AntiVir 7.6.0.46 2007.12.26 -
Authentium 4.93.8 2007.12.26 -
Avast 4.7.1098.0 2007.12.26 -
AVG 7.5.0.516 2007.12.25 -
BitDefender 7.2 2007.12.26 -
CAT-QuickHeal 9.00 2007.12.25 -
ClamAV 0.91.2 2007.12.26 -
DrWeb 4.44.0.09170 2007.12.26 -
eSafe 7.0.15.0 2007.12.25 -
eTrust-Vet 31.3.5400 2007.12.24 -
Ewido 4.0 2007.12.26 -
FileAdvisor 1 2007.12.26 -
Fortinet 3.14.0.0 2007.12.26 -
F-Prot 4.4.2.54 2007.12.25 -
F-Secure 6.70.13030.0 2007.12.26 -
Ikarus T3.1.1.15 2007.12.26 -
Kaspersky 7.0.0.125 2007.12.26 -
McAfee 5192 2007.12.24 -
Microsoft 1.3109 2007.12.26 -
NOD32v2 2747 2007.12.25 error - password-protected file
Norman 5.80.02 2007.12.26 -
Panda 9.0.0.4 2007.12.25 -
Prevx1 V2 2007.12.26 -
Rising 20.24.21.00 2007.12.26 -
Sophos 4.24.0 2007.12.26 -
Sunbelt 2.2.907.0 2007.12.21 -
Symantec 10 2007.12.26 -
TheHacker 6.2.9.168 2007.12.22 -
VBA32 3.12.2.5 2007.12.26 -
VirusBuster 4.3.26:9 2007.12.26 -
Webwasher-Gateway 6.6.2 2007.12.26 -
Additional information
File size: 527174 bytes
MD5: 6f2d28bd3182a08b405ebf2e0de5695b
SHA1: 43337acae2346f839ff113c19876be9b320c1724
PEiD: -
Jotti
Scanner results
Scan taken on 26 Dec 2007 16:02:32 (GMT)
A-Squared
Found nothing
AntiVir
Found nothing
ArcaVir
Found nothing
Avast
Found nothing
AVG Antivirus
Found nothing
BitDefender
Found nothing
ClamAV
Found nothing
CPsecure
Found nothing
Dr.Web
Found nothing
F-Prot Antivirus
Found nothing
F-Secure Anti-Virus
Found nothing
Fortinet
Found nothing
Ikarus
Found nothing
Kaspersky Anti-Virus
Found nothing
NOD32
Found nothing
Norman Virus Control
Found nothing
Panda Antivirus
Found nothing
Rising Antivirus
Found nothing
Sophos Antivirus
Found nothing
VirusBuster
Found nothing
VBA32
Found nothing
|
|
| Back to top |
|
 |
tetak
MIRT Team Lead
Premium Member
Joined: Jan 19, 2007
Posts: 5879
|
| Posted: Wed Dec 26, 2007 4:50 pm Post subject: |
|
|
call234.rar - Password protected
proposal.pdf - Stock spam scam.
I installed the program and scanned the files it installed but there were no hits on VT.
Maybe the point of the spam was to get you to read the .pdf file.
_________________
Got Windows XP? Help protect your PC from malware with Microsofts anti-spyware program Windows Defender.
Download it for free from http://www.microsoft.com/athome/security/spyware/software/default.mspx
|
|
| Back to top |
|
|
AlphaCentauri
SIRT Handler
Premium Member
Joined: Nov 20, 2003
Posts: 2899
|
| Posted: Wed Dec 26, 2007 5:01 pm Post subject: |
|
|
| tetak wrote: | | Maybe the point of the spam was to get you to read the .pdf file. |
I guess the stock spammers just sit around thinking, "What could we do that's even more stupid than audio spam?"
|
|
| Back to top |
|
|
beenieman
Cadet
Joined: Mar 18, 2007
Posts: 2
Location: Canada
|
| Posted: Fri Dec 28, 2007 6:46 pm Post subject: |
|
|
Just a little more info on this crapware. 
"After checking my spambox and seeing one for " media cool " software, I did a bit of checking on this slightly different way of marketing crapware. The sender uses a Google search link to send the recipient to google pages with download sites in the results. However, it has backfired. Following the Google search link provided in the spam only exposes him as a spammer.
Additionally, suppose you get one of those spams for software, enlargement or other crap that shows up in Google's top rankings. You can report it to Google at »www.google.com/contact/spamreport.html
tip source - Spamcop forums at
»forum.spamcop.net/forums/lofiver···739.html
original ISC diary entry from Sept 2007
»isc.sans.org/diary.html?storyid=3408 "
_________________
Whenever you are asked if you can do a job, tell 'em, "Certainly I can!" Then get busy and find out how to do it. - Theodore Roosevelt (1859-1919)
|
|
| Back to top |
|
|
brewt
SIRT Handler
Premium Member
Joined: May 29, 2007
Posts: 792
Location: USA
|
| Posted: Fri Dec 28, 2007 8:58 pm Post subject: |
|
|
| beenieman wrote: | tip source - Spamcop forums at
»forum.spamcop.net/forums/lofiver···739.html |
that "link" doesn't work.
|
|
| Back to top |
|
|
beenieman
Cadet
Joined: Mar 18, 2007
Posts: 2
Location: Canada
|
| Posted: Sat Dec 29, 2007 1:10 am Post subject: |
|
|
| brewt wrote: | | beenieman wrote: | tip source - Spamcop forums at
»forum.spamcop.net/forums/lofiver···739.html |
that "link" doesn't work. |
Sorry about that, here is the link that does work.
http://forum.spamcop.net/forums/lofiversion/index.php/t8739.html
_________________
Whenever you are asked if you can do a job, tell 'em, "Certainly I can!" Then get busy and find out how to do it. - Theodore Roosevelt (1859-1919)
|
|
| Back to top |
|
|
|
|
Forum FAQ
Search
Usergroups
Profile
Login to check your private messages
Login
