Users Fear Of Illegal Content Targeted By Social Engineering Trojan
Another Trojan, discovered by Sophos, targets the fear of legally forbidden pornographic content and forces users into purchasing a fake anti-spyware/anti-virus application. The Trojan “Troj/FakeAle-BJ” installs an icon on the Desktop with the filename “CP illegal content.URL” and an bitmap image containing the text “CHILD PORN VIDEO”:
It also displays the following message:
Windows Alert
Critical System Warning! Your system is probably infected with version of Spyware.IEMonster.b. Spyware.IEMonster.b is spyware that attempts to steal passwords from Internet Explorer, Mozilla Firefox, Outlook and other programs, including logins and passwords from online banking sessions, eBay, PayPal. It may also create special tracking files to log your activity and compromise your Internet privacy. Spyware.IEMonster then sends stolen passwords and other sensitive information to a php script at a pre-specified website where the stolen details are logged. Click here to protect your computer (recommended).
The message is followed by a link that takes users to xpantivirussite.com website.
The Trojan targets users fears (as do almost all email and internet scams) and at this point most users will believe they’ve already clicked on something they shouldn’t have. For users who share a computer, having pornographic icons showing all over the Desktop is usually embarrassing, but when they contain the text “CHILD PORN” the impact can be much greater since it is an illegal content and might lead to a lawsuit if discovered. It’s not something most people would want to be associated with in any way, so they gladly click the link and go to xpantivirussite.com where they subscribe and purchase “XP antivirus”, a fake software that is hard to uninstall and most likely adds nothing but spyware/adware (and possibly a malware) to users Windows based system.
Posts
Leave a Reply
Comments with unsolicited links to other resources will be marked as spam. Please leave your real email, it wont be published.