Scareware / Trojan downloader.
URL: kjremover.info/hitin.php?affid=02944

Download file name: setup.exe
alias: 02944.exe

Currently low VirusTotal scan results this will change when other AV's are made aware; I've just submitted to Avira

download file locations:
q2bf0fzvjb5ca.cn/get.php?id=02944
without the get.pgp included all the domains look like: www .58.com

Please rate RED
Scareware / Rogue AV scanner software / Trojan::downloader

220.196.59.23
0ni9o1s3feu60.cn
3uxyctrlmiqeo.cn
4go4i9n76ttwd.cn
6pj2h8rqkhfw7.cn
7bs5nfzfkp8q8.cn
7cib5fzf462g8.cn
7mx1z5jq0nt3o.cn
7zju2l82i2zhz.cn
84u9wb2hsh4p6.cn
bnfdxhae1rgey.cn
f1uq1dfi3qkcm.cn
fb7pxcqyb45oe.cn
freechinadns.com
fyivbrl3b0dyf.cn
gjpwsc5p7oe3m.cn
kt4lwumfhjb7a.cn
kzvi4iiutr11e.cn
mf6gy4lj79ny5.cn
mfbj6pquvjv8e.cn
mt3pvkfmpi7de.cn
ns1.freechinadns.com
ns2.freechinadns.com
od32qjx6meqos.cn
p0umob9k2g7mp.cn
p7keflvui9fkl.cn
q2bf0fzvjb5ca.cn
rncocnspr44va.cn
t1eayoft9226b.cn
ue4x08f5myqdl.cn
z6ailnvi94jgg.cn

212.117.160.21
kjremover.info
dercleaner.info
dnsfreeservice.com
ekacleaner.info
ryacleaner.info

Registered, no active website, but are part of this "group"
clean-pc-now.net
clean-pc-now.org
fast-spyware-cleaner.org
free-spyware-checker.org
free-spyware-cleaner.com
free-spyware-cleaner.net
kill-spyware-now.org
malware-scanner.com
scan-pc-now.com
spyware-killer.biz
spyware-scaner.com
spyware-scaner.net
webmasters-paradise.com

FAKE online pharmacy
PHISH / Scam
generictoday.com