home

dl2.vie8installer.com

NATIVEX HOLDINGS, LLC

Domain Information

The domain dl2.vie8installer.com registered by NATIVEX HOLDINGS, LLC was initially registered in January of 2014 through ENOM, INC.. This domain has been known to host and distribute adware as well as other potentially unwanted software. The hosted servers are located in Dulles, Virginia within the United States which resides on the Limelight Networks, Inc. network.
Registrar:
ENOM, INC.

Server location:
Virginia, United States (US)

Create date:
Wednesday, January 15, 2014

Expires date:
Thursday, January 15, 2015

Updated date:
Wednesday, August 20, 2014

ASN:
AS22822 LLNW-AS Limelight Networks, INC. proxy AS object

Root domain:
vie8installer.com

Whois:
1 vie8installer.com record

Scanner detections:
Detections  (100% detected)

Scan engine
Details
Detections

MicroWorld eScan
Gen:Variant.Application.Bundler.Graftor.155902, Application.Bundler.InstallIQ.J
100.00%

McAfee
Artemis!0D58743C231F, PUP-FPB, Artemis!51B8D5CFE394, Artemis!4FC3C05DBD5E
100.00%

Malwarebytes
PUP.Optional.SafeInstall.A
100.00%

Zillya! Antivirus
Downloader.Agent.Win32.223881, Downloader.Agent.Win32.221392, Downloader.Agent.Win32.229729
100.00%

K7 AntiVirus
Unwanted-Program
100.00%

Kaspersky
not-a-virus:Downloader.NSIS.Agent
100.00%

Bitdefender
Gen:Variant.Application.Bundler.Graftor.155902
100.00%

NANO AntiVirus
Riskware.Win32.Searcher.csnymk
100.00%

Lavasoft Ad-Aware
Gen:Variant.Application.Bundler.Graftor.155902
100.00%

Comodo Security
Application.Win32.InstallIQ.B
100.00%

F-Secure
Gen:Variant.Application.Bundler, Application.Bundler.InstallIQ
100.00%

Dr.Web
Adware.Downware.2512, Adware.Downware.9554
100.00%

VIPRE Antivirus
InstallIQ Installer
100.00%

Sophos
InstallQ
100.00%

Avira AntiVirus
APPL/InstallIQ.Gen4
100.00%

The domain dl2.vie8installer.com has been seen to resolve to the following 2 IP addresses.

208.111.161.254
cdn-208-111-161-254.iad.llnw.net
November 17, 2014

208.111.160.6
cdn-208-111-160-6.iad.llnw.net
November 17, 2014

File downloads found at URLs served by dl2.vie8installer.com.

31 / 68    (Adware)
http://dl2.vie8installer.com/download/Base/400050/.../manualdownload.exe  (9d2895da5388fc7e26eb2e350e7c2597)

35 / 68    (Adware)
http://dl2.vie8installer.com/download/Base/362950/.../adobeflashplayer.exe  (ba2368971dc719f7d49a8591eff20966)

31 / 68    (Adware)
http://dl2.vie8installer.com/download/Base/401390/.../manualdownload.exe  (0d58743c231f62bef20c509d72f9bc0d)

31 / 68    (Adware)
http://dl2.vie8installer.com/download/Base/401390/.../manualdownload.exe  (51b8d5cfe39420bfebc139fdd40e2102)

The following 85 files have been seen to comunicate with dl2.vie8installer.com in live environments.

TCP » 208.111.161.254:80
AppVerifierapc.exe (AppApcVerifier)

TCP » 208.111.160.6:80
AppVerifierapc.exe (AppApcVerifier)

TCP » 208.111.161.254:80
crossbrowse.exe (Crossbrowse)

TCP » 208.111.160.6:80
rlvknlg.exe (Relevant-Knowledge by TMRG)

TCP » 208.111.161.254:80
UCBrowser.exe (UC Browser by UCWeb)

TCP » 208.111.161.254:80
browserairexec.exe (BrowserAir by Goobzo)

TCP » 208.111.160.6:80
rlvknlg.exe (Relevant-Knowledge by TMRG)

TCP » 208.111.160.6:80
1stbrowser.exe (1stBrowser by The 1stBrowser Authors)

TCP » 208.111.160.6:80
UCBrowser.exe (UC Browser by UCWeb)

TCP » 208.111.161.254:80
Patcher.exe (Audition Patcher by Axeso5.com)

TCP » 208.111.161.254:80
sysmon.exe (SysMon)

TCP » 208.111.160.6:80
SimpleMalwareProtector.exe (Simple Malware Protector by SimpleStar)

TCP » 208.111.161.254:80
AdvancedSystemProtector.exe (ASP)

TCP » 208.111.160.6:80
AdvancedSystemProtector.exe (ASP)

TCP » 208.111.161.254:80
rlvknlg.exe (Relevant-Knowledge by TMRG)

TCP » 208.111.160.6:80
rlvknlg.exe (Relevant-Knowledge by TMRG)

TCP » 208.111.160.6:80
rlvknlg.exe (Relevant-Knowledge by TMRG)

TCP » 208.111.161.254:80
rlvknlg.exe (Relevant-Knowledge by TMRG)

TCP » 208.111.160.6:80
UCBrowser.exe (UC Browser by UCWeb)

TCP » 208.111.161.254:443
vosteran.exe

 
Latest 20 of 135 files

URL:
http://dl2.vie8installer.com/

Title:
“Please Wait - You are being redirected.”

Web server:
Microsoft-IIS/7.5 (ASP.NET)

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.