home

dc97.4sharedhelper.com

China Capital Investment Limited

Domain Information

The domain dc97.4sharedhelper.com registered by China Capital Investment Limited was initially registered in August of 2015 through GODADDY.COM, LLC. This domain has been known to host and distribute adware as well as other potentially unwanted software. The hosted servers are located in Amsterdam, Noord-Holland within Netherlands which resides on the RIPE Network Coordination Centre network.
Registrar:
LEATHERNECKDOMAINS.COM, LLC

Server location:
Noord-Holland, Netherlands (NL)

Create date:
Tuesday, August 4, 2015

Expires date:
Thursday, August 4, 2016

Updated date:
Monday, March 7, 2016

ASN:
AS16265 LEASEWEB LeaseWeb B.V.

Root domain:
4sharedhelper.com

Whois:
4 4sharedhelper.com records

Scanner detections:
Detections  (93% detected)

Scan engine
Details
Detections

Reason Heuristics
PUP.NewITLimited.R, PUP.ITMANAGEMENTGROUP.c, PUP.NewITLimited.j, PUP.New IT Limited, PUP.New IT Limited.NewIT.Bundler (M), PUP.New IT Limited.NewIT (M)
92.31%

ESET NOD32
Win32/4Shared.D potentially unwanted application, Win32/4Shared.C potentially unwanted application, Win32/Jeefo.A virus
30.77%

Dr.Web
Adware.Toolbar.111, Adware.Downware.2538, Adware.Siggen.26344, Win32.HLLP.Jeefo.36352
30.77%

avast!
Downloader-TQP [PUP], FourShared-D [PUP], Win32:Gardih
30.77%

McAfee
PUP-FIV, PUP-FIV!91886FA6C8CB, Program.PUP-FIV
30.77%

F-Prot
W32/4Shared.G.gen, W32/A-98e3043d, W32/Jeefo.A
30.77%

VIPRE Antivirus
Threat.4150696, 4Shared, Threat.4758582
23.08%

AVG
Adware MultiBundle, Adware MultiBundle.AI, Potentially harmful program Skodna.Downloader.K
23.08%

K7 AntiVirus
Unwanted-Program
23.08%

Agnitum Outpost
PUA.4Shared
23.08%

NANO AntiVirus
Riskware.Win32.Toolbar.dbxkdu, Trojan.Win32.Siggen.cxgqun
23.08%

Comodo Security
Application.Win32.NewIT.A, Application.Win32.4Shared.G, Application.Win32.NewIT.B
23.08%

Sophos
4Share Downloader, PUA '4Share Downloader'
23.08%

Rising Antivirus
PE:PUF.4Shared!1.9C25
23.08%

IKARUS anti.virus
PUA.VisualTools, APPL, possible-Threat.Skodna
23.08%

The domain dc97.4sharedhelper.com has been seen to resolve to the following 6 IP addresses.

199.83.132.93
199.83.132.93.ip.incapdns.net
June 24, 2016

104.130.124.96
April 17, 2016

208.91.197.197
March 3, 2016

141.8.226.14
November 9, 2015

95.211.186.130
hosted-by.leaseweb.com
November 2, 2014

208.88.227.137
c-r111-uc0054-137.webazilla.com
February 27, 2014

File downloads found at URLs served by dc97.4sharedhelper.com.

1 / 68      (Adware)
http://dc97.4sharedhelper.com/downloadhelper/named/xerox3240_br/r1qs3L5x/.../platinabrasil - crack alh_2.exe  (ea4848b62bc32fdb4954adcd6bc7fe9a)

8 / 68      (PUP)
http://dc97.4sharedhelper.com/downloadhelper/named/xerox/pHmanAXX/.../Matematikos kontroliniai darbai su sprendimais. 11 klase. 2 dalis (2006) by Cloud Dancing.exe  (matematikos kontroliniai darbai su sprendimais. 11 klase. 2 dalis by cloud dancing.exe)

1 / 68      (Adware)
http://dc97.4sharedhelper.com/downloadhelper/named/trinity/FY2wXCNg/.../zikir munajat full - astro oasis.exe  (40406cab2a838fd221b3d004cf7f6267)

1 / 68      (Adware)
http://dc97.4sharedhelper.com/downloadhelper/named/trinity2240_br/f7TT-1uF/.../Gigi D'Agostino - I'll Fly With You.exe  (ab4d934bf8056d2b4ec21769344207d3)

1 / 68      (Adware)
http://dc97.4sharedhelper.com/downloadhelper/named/trinityep2230_br/hd_-F8Hu/.../mod - pente de turbina scania v.1.0 para v.1.3.1 by diego s. e linux.exe  (1f2b22669ad464dfed65c156de3269a6)

0 / 68
http://dc97.4sharedhelper.com/downloadhelper/named/xeroxep3290_all/Y3um0E9x/.../webfreer_setup_1.0.3.005.exe  (webfreer_setup_1.0.3.005_2.exe)

1 / 68      (Adware)
http://dc97.4sharedhelper.com/downloadhelper/named/trinity2240_th/MJeECa5t/.../sunshine - ??????????_1.exe  (sunshine - คนชั่วคราว_1.exe)

1 / 68      (Adware)
http://dc97.4sharedhelper.com/downloadhelper/named/xerox3240_br/yvVz0PGv/.../Redes Sociais na Internet - Raquel Recuero.exe  (bfd360319cbd9f6b6cd0967cc52743de)

1 / 68      (Adware)
http://dc97.4sharedhelper.com/downloadhelper/named/xerox3240_br/yvVz0PGv/.../Redes Sociais na Internet - Raquel Recuero.exe  (522dcca5de465eff16abe631d52b2cc3)

1 / 68      (Adware)
http://dc97.4sharedhelper.com/downloadhelper/named/xeroxep32190_th/NNuV6XnZ/.../18 ??-???? ????.mp3 - 4shared.com - ????????????????????????????????????? - ?????????.exe  (18 ฝน-เสือ ธนพล.mp3 - 4shared.com - การจัดเก็บแฟ้มและใช้งานร่วมกันออนไลน์ - ดาวน์โหลด.exe)

19 / 68    (Adware)
http://dc97.4sharedhelper.com/downloadhelper/named/trinitymaxidelta/rhRxwyN9/.../Slow Jams - Luther Vandross - If Only For One Night.exe  (aaed4b2d79f72b61f2dd1a39508cf9d8)

20 / 68    (Adware)
http://dc97.4sharedhelper.com/downloadhelper/named/xerox/KtXEPJwP/.../stockett, kathryn - een keukenmeidenroman.exe  (4ff3adf2998e07cee7597bc212a18130)

19 / 68    (Adware)
http://dc97.4sharedhelper.com/downloadhelper/named/xeroxmaxidelta/DGEb5nZf/.../whiterunoutskirtsmarket0.4.7_jppatch.exe  (107b062ea644ade7e6fc9eba9b4b8dcb)

1 / 68      (Adware)
http://dc97.4sharedhelper.com/downloadhelper/named/xerox/OGfU7HiP/.../Imperialcity_v11.1.exe  (abbead43b739099025c6c5d530d890f5)

The following 7 files have been seen to comunicate with dc97.4sharedhelper.com in live environments.

TCP » 208.88.227.137:443
desktop.exe (Desktop by New IT Solutions)

TCP » 208.88.227.137:443
UCBrowser.exe (UC Browser by UCWeb)

TCP » 104.130.124.96:443
translategenius.crx

TCP » 104.130.124.96:443
translategenius.crx

TCP » 104.130.124.96:443
translategenius.crx

TCP » 104.130.124.96:443
translategenius.crx

TCP » 141.8.226.14:80
google-bookmarks.crx

URL:
http://dc97.4sharedhelper.com/

Web server:
nginx/1.8.1

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.