Spyware Warrior

cppgenius · Posted: Sat Jul 12, 2008 1:57 pm Post subject: Suspicious Website

Hi there. I've been doing some research on a loan scam involving the name of a company called Future View Financial Services. Now the e-mail did not come from this company but from someone posing as a representative of this company.

I did a Google search for "Future View Financial Services" and found a website for this company. Once I visited the website, I could not visit any other website anymore, not in Firefox, not in Opera nor IE, so something went wrong on my system globally, it was not just the browser. I restarted my PC and everything was back to normal. I cannot find any visible signs of an infection and everything running on my system is legitimate, there are no suspicious processes running in my system's memory. I'm not saying this site is malicious, and the problem could be related to the flash content on the site, but I want someone else to check it out for me if possible, please.

Website in question is: www[dot]futureview[dot]com[dot]ng

The fact that the website messes up my whole system worries me. I running an Apache server, with PHP and MySQL on my PC, so perhaps the site is causing some kind of irrecoverable clash with the server and a restart solves the problem, I don't know. Confused

I know all the ins and outs of my system and have solid experience with malware and malware removal, so I find it very frustrating not being able to determine the reason for this crash/corruption. Mad

Any help would be appreciated very much. Thanks.

suzi · Posted: Sun Jul 13, 2008 3:23 pm Post subject:

Hi,

Looking at the whois information, it looks somewhat suspicious

http://whois.domaintools.com/futureview.com.ng

This is odd on the whois page:

suzi · Posted: Sun Jul 13, 2008 3:32 pm Post subject:

Were you running a firewall that would have logs, or a packet sniffer on the machine, by change? That might give a clue.
_________________
Former Microsoft MVP 2005-2009, Consumer Security
Please do not PM or Email me for personal support. Post in the Forums instead and we will all learn. Smile

cppgenius · Posted: Tue Jul 15, 2008 9:05 am Post subject:

Firewall log reports nothing strange and the packet log shows nothing from the IP 69.80.208.224

However I have tracked down the problem to this specific file:
http://www[dot]futureview[dot]com[dot]ng/price_watch.aspx

At the moment it seems like a problem with my security software and I'm confirming the details with the vendor. Will post the details as soon as I have received confirmation from them.

Even if it is only a software related problem on my PC, a couple of things still do not match up about the site:

They've been accused of self-promotion on Wikipedia:
http://en.wikipedia.org/wiki/FutureView_Financial_Services_Limited

Their anchor text of the homepage link on Wikipedia (at the bottom of the gray box on the right-hand side) is www.future.com.ng, but the underlying link still goes to futureview[dot]com. So much for branding your domain. However this could possibly be just a typo.

As you pointed out, the SSL Cert looks very funny indeed. The Registry Data is missing in Domaintools.com and DNS Stuff reports Nigeria has no WHOIS or Web Based Whois.

The following site gives more info about the domain
http://www.nigeriancomputersociety.com/domainregistration/whois.nigeria.php

but I can't find a single WHOIS service giving me the Creation date of this domain. Any suggestions?

suzi · Posted: Tue Jul 15, 2008 9:13 am Post subject:

You might try here:

http://www.uwhois.com/domains.html
_________________
Former Microsoft MVP 2005-2009, Consumer Security
Please do not PM or Email me for personal support. Post in the Forums instead and we will all learn. Smile

MysteryFCM · Posted: Tue Jul 15, 2008 12:30 pm Post subject:

They seem to be having problems (deliberate?) with their WhoIs server. It's not connecting either on the normal WhoIs port, or via HTTP;

http://pgebrehiwot.iat.cnr.it/

Ref:
http://www.rwgusa.net/whois-ng.php
http://www.iana.org/domains/root/db/ng.html

Querying their alternate WhoIs server doesn't inspire confidence either as it seems to return WhoIs details for all domains they hold?

http://hosts-file.net/?s=futureview%2Ecom%2Eng

.... and none of the records returned, include the one you mentioned Confused

Querying their alternate server via their own web interface however, is a different story. Again, whether this is deliberate or not is debatable (I don't trust Nigerians as a matter of course), but;

cppgenius · Posted: Wed Jul 16, 2008 9:47 am Post subject:

MysteryFCM · Posted: Wed Jul 16, 2008 12:44 pm Post subject:

I've got a sneaky suspicion that their WI servers behaviour may be deliberate .... but I always was the suspicious type Wink

_________________
Regards

Steven Burn
I.T. Mate / hpHosts
it-mate.co.uk / hosts-file.net

MysteryFCM · Posted: Wed Jul 16, 2008 2:11 pm Post subject:

WRT futureview.com.ng, antnet noticed the following;

Proactive Services · Posted: Thu Jul 17, 2008 1:46 am Post subject:

I'm rather inclined to say that this huge string is in fact some sort of entire product range/catalogue data set. Something that should be in a database! I couldn't see any of the usual exploit code padding or embedded commands in the base64. It's quite possible it can crash a browser due to its sheer poor coding.
_________________
Adam Piggott, Proprietor, Proactive Services (Computing)

Professional, friendly computer support in Hampshire, UK.