home

files.openwindowsfiles.com

Contact Privacy Inc. Customer 0126783033  (Proxy Registrant)

Domain Information

The domain files.openwindowsfiles.com is registered by proxy through TUCOWS DOMAINS INC. and was originally registered in February of 2010. This domain has been known to host and distribute adware as well as other potentially unwanted software. The hosted servers are located in Hollywood, Florida within the United States which resides on the Prolexic Technologies, Inc. network.
Registrar:
TUCOWS DOMAINS INC.

Server location:
Florida, United States (US)

Create date:
Thursday, February 4, 2010

Expires date:
Saturday, February 4, 2017

Updated date:
Wednesday, January 20, 2016

ASN:
AS32787 PROLEXIC-TECHNOLOGIES-DDOS-MITIGATION-NETWORK - Prolexic Technologies, Inc.,US

Root domain:
openwindowsfiles.com

Whois:
1 openwindowsfiles.com record

Scanner detections:
Detections  (100% detected)

Scan engine
Details
Detections

Reason Heuristics
PUP.Air Software.AirSoftware.Bundler (M), PUP.Air Software (M)
100.00%

avast!
Win32:Adware-CAH [PUP]
50.00%

Dr.Web
Adware.Downware.624
50.00%

Emsisoft Anti-Malware
Gen:Variant.Application.Bundler.AirInstaller
50.00%

Lavasoft Ad-Aware
Gen:Variant.Application.Bundler.AirInstaller.4
50.00%

VIPRE Antivirus
Threat.4782985
50.00%

ESET NOD32
Win32/AirAdInstaller.A potentially unwanted application
50.00%

F-Secure
Riskware.Gen:Variant.Application.Bundler
50.00%

Sophos
AirInstaller
50.00%

Bkav FE
W32.HfsAdware
50.00%

MicroWorld eScan
Gen:Variant.Application.Bundler.AirInstaller.4
50.00%

Quick Heal
Adware.AirAdInstaller.I5
50.00%

K7 AntiVirus
Unwanted-Program
50.00%

Agnitum Outpost
PUA.AirAd
50.00%

Bitdefender
Gen:Variant.Application.Bundler.AirInstaller.4
50.00%

The domain files.openwindowsfiles.com has been seen to resolve to the following IP address.

72.52.4.91
unknown.prolexic.com
February 25, 2016

File downloads found at URLs served by files.openwindowsfiles.com.

1 / 68      (Adware)
http://files.openwindowsfiles.com/get/.../?b=d1143310&filename=File_opener  (file_opener.exe)

26 / 68    (Adware)
http://files.openwindowsfiles.com/get/.../?b=d1143310&filename=File_opener  (file_opener.exe)

The following 17 files have been seen to comunicate with files.openwindowsfiles.com in live environments.

TCP » 72.52.4.91:80
jingling.exe

TCP » 72.52.4.91:80
rlvknlg.exe (Relevant-Knowledge by TMRG)

TCP » 72.52.4.91:80
crossbrowse.exe (Crossbrowse)

TCP » 72.52.4.91:80
hbpzabffmyx.exe

TCP » 72.52.4.91:80
pbiiuvda.exe

TCP » 72.52.4.91:80
ContentFinder.exe (ContentFinder by DigitalSoftware Group)

TCP » 72.52.4.91:80
winsysapp.exe

TCP » 72.52.4.91:80
chromeplugin.crx

TCP » 72.52.4.91:80
winalert.exe

TCP » 72.52.4.91:80
rlvknlg.exe (Relevant-Knowledge by TMRG)

TCP » 72.52.4.91:80
autoDENGI.exe (autoDENGI by autodengi.com)

TCP » 72.52.4.91:80
ContentFinder.exe (ContentFinder by ContentFinder Software)

TCP » 72.52.4.91:80
rlvknlg.exe (Relevant-Knowledge by TMRG)

TCP » 72.52.4.91:80
emuletorrent.exe

TCP » 72.52.4.91:8080
smu.exe (W by Search Module)

TCP » 72.52.4.91:80
ContentFinder.exe (ContentFinder by ContentFinder Company)

TCP » 72.52.4.91:80
Proxomitron.exe (Proxomitron by Groom-A-Zebu (tm))

URL:
http://files.openwindowsfiles.com/

Title:
“openwindowsfiles.com - This website is for sale! - openwindowsfiles Resources and Information.”

Description:
“This website is for sale! openwindowsfiles.com is your first and best source for all of the information you’re looking for. From general topics to more of what you would expect to find here, openwindowsfiles.com has it all. We hope you find what...”

Web server:
Apache (PHP/5.3.3-7+squeeze28)

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.