www.win-install.net

Domains By Proxy, LLC  (Proxy Registrant)

Domain Information

The domain www.win-install.net is registered by proxy through GODADDY.COM, LLC and was originally registered in October of 2013. This domain has been known to host and distribute adware as well as other potentially unwanted software. The hosted servers are located in Ashburn, Virginia within the United States which resides on the Amazon.com, Inc. network. The domain uses the Amazon Web Services (AWS) cloud computing platform.
Remove Malware from www.win-install.net - Powered by Reason Core Security
Registrar:
GODADDY.COM, LLC

Server location:
Virginia, United States (US)

Create date:
Thursday, October 24, 2013

Expires date:
Monday, October 24, 2016

Updated date:
Thursday, October 16, 2014

ASN:
AS14618 AMAZON-AES - Amazon.com, Inc.,US

Root domain:

Scanner detections:
Detections  (94% detected)

Scan engine
Details
Detections

Reason Heuristics
PUP.Installer.SETUPPROCESS.S, PUP.Installer.AppsInstallerSL.U, PUP.AppsInstallerSL.M, PUP.Installer.Firseria.M, PUP.Installer.POPELERSYSTEMSL.S, PUP.CyberservicesBV.EE, PUP.OUTBROWSE.Q, PUP.Installer.EilioDevelopmentssl.I, PUP.Installer.BechiroSL.I, PUP.OUTBROWSE.L, PUP.PopelerSystemsl.M, PUP.EilioDevelopmentssl.Q, PUP.PopelerSystemsl.P, PUP.EilioDevelopmentssl.R, PUP.Bechirosl.K, PUP.Solimba, PUP.WebPick, PUP.Bundler.Solimba, PUP.Outbrowse.StartNow.Bundler (M), PUP.Solimba.AppsInstaller.Installer (M), PUP.installCore.ExtendedSetup (M), PUP.Solimba.SETUPPROCESS.Bundler (M), PUP.Solimba.POPELERSYSTEM.Installer (M)
93.33%

VIPRE Antivirus
Trojan.Win32.Generic, DownloadMR, Threat.4150696, Threat.4890059, Threat.4823950, Threat.4782980, Threat.4784459, Threat.4758821
70.00%

G Data
Win32.Application.Morstar, Gen:Variant.Strictor.55064, Gen:Variant.Application.Bundler.Firseria, Win32.Application.DownloadGuide
70.00%

Vba32 AntiVirus
Downloader.Morstar, Downware.Morstar, Hoax.PornoAsset, suspected of Heur.Malware-Cryptor.Multiplug
70.00%

K7 Gateway Antivirus
Unwanted-Program , Trojan
70.00%

Avira AntiVirus
APPL/Firseria.A.15, APPL/Bundler.Firseria.A.11, APPL/DownloadGuide.Gen2, APPL/Firseria.Gen8, APPL/Downloader.Gen, TR/Trash.Gen
70.00%

AVG
BundleApp, Solimba, Adware Generic_r, Adware BundleApp_r.AV, Found Win32/DH{gRKBDxMXADWBE0F8fS4gIls}, Adware BundleApp_r.AJ
70.00%

Sophos
Solimba Installer, OutBrowse Revenyou, PUA 'Solimba Installer', Generic PUA OL, PUA 'MultiPlug' (of type Adware)
66.67%

K7 AntiVirus
Trojan , Unwanted-Program , DoS-Trojan
66.67%

Malwarebytes
PUP.Optional.BundleInstaller.A, PUP.Optional.InstallCore, PUP.Optional.Firseria, PUP.Optional.Solimba, PUP.Optional.OutBrowse
60.00%

Comodo Security
Application.Win32.Solimba.UET, Application.Win32.FirseriaInstaller.RRB, Application.Win32.Firseria.AAFX, Application.Win32.Firseria.MAP
60.00%

Dr.Web
Trojan.DownLoader11.3531, Trojan.DownLoader11.4114, Adware.Downware.4802, Adware.Downware.5119, Adware.Downware.2081, Trojan.DownLoader11.24441, Trojan.DownLoader11.57090
60.00%

NANO AntiVirus
Trojan.Win32.DownLoader11.cwlzel, Riskware.Win32.Downware.dbojhq, Trojan.Win32.OutBrowse.ddvyee, Trojan.Win32.Morstar.deknwg
60.00%

Antiy Labs AVL
Downloader/Win32.Morstar, Trojan/Win32.TSGeneric, Riskware[:not-a-virus]/Win32.OutBrowse.g, Trojan[Downloader:not-a-virus]/Win32.Morstar.as
56.67%

Agnitum Outpost
PUA.Downloader, PUA.Firseria, PUA.Agent, Riskware.Agent, PUA.OutBrowse, PUA.Solimba
56.67%

The domain www.win-install.net has been seen to resolve to the following 7 IP addresses.

ec2-52-2-153-162.compute-1.amazonaws.com
February 11, 2016

ec2-54-164-36-16.compute-1.amazonaws.com
February 11, 2016

ec2-107-23-154-235.compute-1.amazonaws.com
August 13, 2015

ec2-52-0-144-33.compute-1.amazonaws.com
August 13, 2015

ec2-107-20-187-152.compute-1.amazonaws.com
May 7, 2014

ec2-54-235-147-60.compute-1.amazonaws.com
April 23, 2014

ec2-107-22-251-68.compute-1.amazonaws.com
February 8, 2014

File downloads found at URLs served by www.win-install.net.

1 / 68      (Adware)

1 / 68      (Adware)

1 / 68      (Adware)

1 / 68      (Adware)

6 / 68      (Adware)

35 / 68    (Adware)

23 / 68    (Adware)

35 / 68    (Adware)

37 / 68    (Adware)

13 / 68    (Adware)

33 / 68    (Adware)

25 / 68    (PUP)

28 / 68    (Adware)

27 / 68    (Adware)

4 / 68      (Adware)

28 / 68    (Adware)

19 / 68    (Adware)

16 / 68    (Adware)

32 / 68    (Adware)

39 / 68    (Adware)

17 / 68    (Adware)

13 / 68    (Adware)
http://www.win-install.net/microsoft-excel/download/.../bing  (win-install_microsoft excel_1.0.exe)

1 / 68      (Adware)

URL:
http://www.win-install.net/

Google Analytics:
UA-45215772

Title:
“Win-Install”

Network:
Amazon Web Services (AWS), running an EC2 instance

Web server:
nginx

Remove Malware from www.win-install.net - Powered by Reason Core Security