Troj/FakeAV-CLJ

Hi there,

here's more information:

http://www.sophos.com/security/analyses/viruses-and-spyware/trojfakeavclq.html

http://www.sophos.com/security/analyses/viruses-and-spyware/trojfakeavclj.html

Just in case I have blocked already 91.217.162.99 which should be repoiury.com even though the site was already taken down by authorities i guess. 

Are there any honeypot operators in here who could tell the source of this malware? We get swamped with it and I would like to have the sites blocked from where it originates.

Thanks for any insight given. I appreciate it.

Edit

Sophos blocked files with the following names/keywords:

%random%.htm

bugguardpc.htm
coverlightswitch.htm
annefrankbio.htm
blocklightreach.htm

GandhiAntivirus.htm