Blog for hpHosts, and whatever else I feel like writing about ....

Monday, 2 January 2012

iLivid: Still using highly misleading marketing

Checking a newly registered site (, I stumbled upon what I thought at first, was going to be the usual fake codec notice that tends to lead to a trojan. Hovering over the image however, immediately pointed to its being an advert, rather than the typical fake codec stuff we're used to seeing.

Following the URL led straight to an iLivid executable;

1. hxxp://,eAGljd1ugzAMhZ-GO4RCQpMitIsUxFaJZItGV603Fc1CF638CDJK-.QLtNsLzLJs67N9jo-ikpRqecBlKBfwAAIc-SgoAIAYAOWCKIogCWGIMYCB-00FpZybWMRPBZF0jkfGM4vnOE51fZtfllOP05IEycwp1eaL3Jb.rmo4.5pav7u-9xbETSJWf-qJPLPt7vSci0uWM59DZlientirrzncjNlWoPdqM-6qNeRXAdhdx.4.uO6nMa2DqANTm8VHr7pB10dPtqOujeoKafSgPNlUdt0bB9mbvbm0ykGJLruiUg7EFvX6OiEEwAgXwLJe2c-mtgz7JEThD38xcEo=,

2. hxxp://,eAGljd1ugzAMhZ-GO4RCQpMitIsUxFaJZItGV603Fc1CF638CDJK-.QLtNsLzLJs67N9jo-ikpRqecBlKBfwAAIc-SgoAIAYAOWCKIogCWGIMYCB-00FpZybWMRPBZF0jkfGM4vnOE51fZtfllOP05IEycwp1eaL3Jb.rmo4.5pav7u-9xbETSJWf-qJPLPt7vSci0uWM59DZlientirrzncjNlWoPdqM-6qNeRXAdhdx.4.uO6nMa2DqANTm8VHr7pB10dPtqOujeoKafSgPNlUdt0bB9mbvbm0ykGJLruiUg7EFvX6OiEEwAgXwLJe2c-mtgz7JEThD38xcEo=,

3. hxxp://,eAFLjfIqKg1yzMqNCA1Lj0j0z.ZwqYqILPK0TEwuy6.wiDBJ19UFAPDEDJk=

4. hxxp://

The advert in question, if you've not seen the image above yet, is;


Which produces;

Oh and, in case you're wondering, isn't innocent in all of this either - as you'll notice if you browse the site a little. Every site it leads to, points either to more of the same, or if you're gullible enough to try the screensavers - a world of pain for your machine (courtesy of

Not surprisingly, is using CloudFlare services (seems to be a growing trend amongst the criminal fraternity over the past 12 months or so, with more and more moving to them to try and hide their real location). Its real IP however, is;

ASN: 32613 iWeb Technologies Inc.

The IP also houses (I've not gone through the content of all of these yet, so some may be unrelated to this - the list is simply those living on the same IP);

No comments: