home

utwzz.playnow.treatmenthook.biz

Fundacion Private Whois  (Proxy Registrant)

Domain Information

The domain utwzz.playnow.treatmenthook.biz is registered by proxy through INTERNET.BS CORP. and was originally registered in September of 2014. This domain has been known to host and distribute adware as well as other potentially unwanted software. The hosted servers are located in New York City, New York within the United States which resides on the Bodis, LLC network.
Registrar:
INTERNET.BS CORP.

Server location:
New York, United States (US)

Create date:
Wednesday, September 10, 2014

Expires date:
Wednesday, September 9, 2015

Updated date:
Monday, September 15, 2014

ASN:
AS53665 BODIS-1 - Bodis, LLC,US

Root domain:
treatmenthook.biz

Whois:
1 treatmenthook.biz record

Scanner detections:
Detections  (100% detected)

Scan engine
Details
Detections

Reason Heuristics
PUP.PluginUpdateSL.O
100.00%

VIPRE Antivirus
Threat.4783235
100.00%

ESET NOD32
Win32/SoftPulse (variant)
100.00%

Microsoft Security Essentials
Threat.Undefined
100.00%

avast!
Win32:SoftPulse-AH [PUP]
100.00%

MicroWorld eScan
Gen:Variant.Adware.Zusy.107390
100.00%

nProtect
Trojan-Clicker/W32.SoftPulse.1344704
100.00%

McAfee
SoftPulse
100.00%

Malwarebytes
PUP.Optional.DomaIQ
100.00%

Zillya! Antivirus
Adware.Agent.Win32.12586
100.00%

K7 AntiVirus
Unwanted-Program
100.00%

NANO AntiVirus
Trojan.Win32.SoftPulse.dewgcl
100.00%

Bitdefender
Gen:Variant.Adware.Zusy.107390
100.00%

Agnitum Outpost
Riskware.Agent
100.00%

Lavasoft Ad-Aware
Gen:Variant.Adware.Zusy.107390
100.00%

The domain utwzz.playnow.treatmenthook.biz has been seen to resolve to the following 5 IP addresses.

199.59.243.117
September 21, 2014

199.59.243.121
September 21, 2014

199.59.243.120
September 21, 2014

199.59.243.119
September 21, 2014

199.59.243.118
September 21, 2014

File downloads found at URLs served by utwzz.playnow.treatmenthook.biz.

30 / 68    (Adware)
http://utwzz.playnow.treatmenthook.biz/TUGdriverddlCA.html?__tc=1410650718293&url=%download_url%&caption=?ption%&fileName=%filename%  (driver_updater.exe)

30 / 68    (Adware)
http://utwzz.playnow.treatmenthook.biz/TUGdriverddlCA.html?__tc=1410650718293&url=%download_url%&caption=?ption%&fileName=%filename%  (driver_updater.exe)

The following file have been seen to comunicate with utwzz.playnow.treatmenthook.biz in live environments.

TCP » 199.59.243.120:80
qvtp.crx

URL:
http://utwzz.playnow.treatmenthook.biz/

Web server:
Microsoft-IIS/7.5

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.