home

mw2swxu.advidwebsite.com

Domain Information

Server location:
Northern Ireland, United Kingdom (GB)

Root domain:
advidwebsite.com

Scanner detections:
Malware distribution  (100% detected)

Scan engine
Details
Detections

McAfee
RDN/Generic.dx!c2r
100.00%

K7 AntiVirus
Spyware
100.00%

Norman
Suspicious_Gen4.FMTSJ
100.00%

Sophos
Mal/Generic-S
100.00%

Baidu Antivirus
Trojan.JS.Clicker
100.00%

Fortinet FortiGate
JS/TrojanClicker_Agent_NFJ.gen!tr
100.00%

AVG
Generic_c
100.00%

MicroWorld eScan
Dropped:Trojan.Agent.JS.GR
100.00%

avast!
Win32:Dropper-gen [Drp]
100.00%

Bitdefender
Dropped:Trojan.Agent.JS.GR
100.00%

Lavasoft Ad-Aware
Dropped:Trojan.Agent.JS.GR
100.00%

Emsisoft Anti-Malware
Dropped:Trojan.Agent.JS.GR
100.00%

F-Secure
Trojan.Agent.JS.GR
100.00%

G Data
Dropped:Trojan.Agent.JS.GR
100.00%

IKARUS anti.virus
Trojan-Dropper.Agent
100.00%

The domain mw2swxu.advidwebsite.com has been seen to resolve to the following IP address.

92.242.140.21
unallocated.barefruit.co.uk
May 4, 2015

File downloads found at URLs served by mw2swxu.advidwebsite.com.

16 / 68    (Malware)
http://mw2swxu.advidwebsite.com/.../xz.php?ii=djYyMVMyNTJoMjE0TDczOEY0MjJDOTMy&id=22&a=23509&l=xh  (s.exe)

The following 230 files have been seen to comunicate with mw2swxu.advidwebsite.com in live environments.

TCP » 92.242.140.21:80
smelled.exe (Smelled)

TCP » 92.242.140.21:443
dca-monitoring.exe (Compete DCA Monitoring Tool by Compete)

TCP » 92.242.140.21:80
marini.exe (Marini)

TCP » 92.242.140.21:443
client.exe (ClientWrapper)

TCP » 92.242.140.21:80
thebrowser.exe (TheBrowser by Goobzo)

TCP » 92.242.140.21:443
dca-monitoring.exe (Compete DCA Monitoring Tool by Compete)

TCP » 92.242.140.21:443
WindowService.exe (WindowService)

TCP » 92.242.140.21:443
ciuninstall.exe

TCP » 92.242.140.21:1866
jutched.exe

TCP » 92.242.140.21:443
dca-monitoring.exe (Compete DCA Monitoring Tool by Compete)

TCP » 92.242.140.21:80
masterupdater.exe

TCP » 92.242.140.21:80
pricemeterexpress.crx

TCP » 92.242.140.21:80
chrome.crx

TCP » 92.242.140.21:80
app-center.crx

TCP » 92.242.140.21:80
ntp.crx

TCP » 92.242.140.21:80
3dayinvite.crx

TCP » 92.242.140.21:80
twitter.crx

TCP » 92.242.140.21:80
viewlater.crx

TCP » 92.242.140.21:80
rss.crx

TCP » 92.242.140.21:80
datapump.crx

 
Latest 20 of 230 files

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.