Several months ago I wrote a blog post about an adware downloader which after execution downloaded a few adware programs and installed them on the computer, giving no chance for the user to skip or bypass their installation. This time, we will analyze an application, which installs similar types of adware programs on user computers.
We received a file which appeared to be a crack of Pinnacle Studio HD Ultimate. After displaying the initial splash screen, it offers the user to install Pinnacle Pixie Activation 500. After confirmation, the crack is installed, but in addition to the crack, other programs and toolbars unexpectedly appeared on the compromised computer. Pinnacle was not the only target of this kind of attack. Cracks for programs like Sims, Nero, Rosetta Stone, and Pro Evolution Soccer 2013 were also used in distribution.
I don’t know what kind of curiosity leads people to the dark corners of the internet, when they want to obtain a new version of antivirus software. It’s somehow irrational to find security software at insecure places. But…. it happens.
As you can see, the file name is Avast_Antivirus_2012_Trial_Verion.exe – but it is definitely not a proper setup released by us. Here are some facts, that are worth remembering:
The phishing scam creators are really getting creative. Of course one could question their targeting such in this case. Czech republic is known for our quite lenient view of laws and rules and – especially – the need to pay (or the lack of there off) of any fines especially when imposed by so called municipal police. Who would bother… Hence, an email urging to pay a fine is normally filed directly into the ‘round file’. Known as trash. Well in this case… there actually might be a good reason to look at this closely Read more…
Have you received an email saying a friend tagged you in a photo on Facebook? Use extreme caution before clicking to see photos in the attachment. In a typical phish, cybercrooks are using a fake Facebook photo notification email designed to spread malware allowing them to gain control over Windows-based computers.
Avast Virus Lab detected the malware as Win32:Trojan-gen and added the definition to the database yesterday, so all avast! users are protected.
The email looks innocent enough with the familiar blue header and logo. Serious Facebookers may know that Facebook never sends you photos that you’ve been tagged in as attachments; rather they send links to the photos. Unfortunately, most of us are too busy to notice the difference.
Please share this warning with your Facebook friends, and recommend that they get avast! Free Antivirus, so they’ll always be protected. You can share avast! by clicking on our recommend avast! app here.