"One must know the past in order to understand the present if one is to change the future!"  

             Home

The DollarRevenue - Paris Hilton Video Scams

11 September 2006
 Today while starting a search in Google for malware, I used the keywords "sexy paris hilton"  and the first site at the top of the list was called sexybabesx.com. 
  

 
The site is one of those that cater to celebrity images and the main page was devoted to Paris Hilton with her 6.00 dollar Spicy Burger commercial she made in 2005. 
 
Clicking on the image as it is made to be like a video you get to watch, I got an install popup box to run an exe file called parisspicyburger.exe with no links to any EULA, or something to tell me what I was about to install as it looked like a video made into an executable.  Got a second box and clicked ok also.  Surprise, surprise NO Movie!
 

  
No Movie, however, checking my transmissions I found that the parisspicyburger.exe called the Dollarrevenue installer: promo.dallarrevenue.com / bundle/ loader.exe and instead of a movie of a 6.00 hamburger, I got a stealth massive adware infestation from Dollarrevenue!
  
I made a movie clip of the install and can be seen in the link in the blog at Sunbelt-software.com
 
Files:
 sexybabesx.com / parisspicyburger.exe
sexybabesx.com / parismovie1.exe
sexybabesx.com / parismovie2.exe
sexybabesx.com / parismovie3.exe
     
Whois Information:
 

Domain: sexybabesx.com
IP: 68.142.234.53

Cache Date: 2006-09-11
Registrar: INTERCOSMOS MEDIA GROUP, INC. D/B/A DIRECTNIC.COM

Registration and WHOIS Service provided by directNIC.com

Intercosmos Media Group, Inc. provides the data in the directNIC.com
Registrar WHOIS database for informational purposes only. The information
may only be used to assist in obtaining information about a domain name's
registration record.

directNIC makes this information available "as is", and does not guarantee
its accuracy.


Registrant:
Aster Edward Umali
Unit 24i Tower 2
Paseo Parkview Suites
Valero Street, Salcedo Village
Makati City, Metro Manila 1200
PH
+63.9203480622


Domain Name: SEXYBABESX.COM

Administrative Contact:
Umali, Aster Edward azterusa @ yahoo.com
Unit 24i Tower 2
Paseo Parkview Suites
Valero Street, Salcedo Village
Makati City, Metro Manila 1200
PH
+63.9203480622


Technical Contact:
Umali, Aster Edward azterusa@yahoo.com
Unit 24i Tower 2
Paseo Parkview Suites
Valero Street, Salcedo Village
Makati City, Metro Manila 1200
PH
+63.9203480622


Record last updated 09-03-2005 01:38:55 PM
Record expires on 01-09-2007
Record created on 01-09-2002

Domain servers in listed order:
YNS1.YAHOO.COM 66.218.71.205
YNS2.YAHOO.COM 216.109.116.20