Adware in Exchange for Videos and Music in P2P, reports Panda Software14 December 2005
PandaLabs has detected a series of files being circulated across the Internet that supposedly contain music and videos, but also contain an unwanted gift: in order to get the videos and music, users must install adware. The excuse used is that a license is needed in order to play the files, which involves agreeing to install adware. The files received by PandaLabs up until now do not actually contain any type of video or music. However, this possibility has not been ruled out. These files are detected by Panda Software as WmaDownloader.B.
The problem starts when the user downloads an alleged video file (*.wmv) or de audio file (*.wma). When the user tries to run these files to view them on the computer, a window is displayed that prompts the user to acquire a license. The message explains that in order to get the free license, the user must install IST Toolbar, a known adware program that is used as an entry-point for many other threats.
"Although users are warned that adware will be installed and gives the user the opportunity to read the license agreement, it is formulated in clearly abusive terms, and also exploits the fact that few users are aware of the impact that installing this spyware program can have on their computers, as this spyware allows many other threats to get into the system," explains Luis Corrons, director of PandaLabs. "What's more, it is important not to forget that in the samples received by PandaLabs, the system is even more fraudulent, as there is not even a video or music file."
When this message is displayed, the user is also asked to install an ActiveX Control, which is the IST Toolbar mentioned in this window. If users do not agree to install it, they will not be affected, but neither will they be able to play the video or audio file. If users agree to install it, the IST Toolbar (detected by Panda Software as ISTBar) will be downloaded, infecting the system and allowing the file to be played, if it exists. A window notifying users that they must acquire a license will also appear.
However, this might not always be the case, says Luis Corrons. "The warning about the installation of the ActiveX Control is not always displayed in computers with the security level configured as low, which could occur because the user has configured it in this way or because one of the many other malware specimens with this function has already affected the computer. For this reason it is extremely important to check the browser settings in order to neutralize installation of ActiveX Controls of dubious origin." This process is only valid in computers with Windows Media Player 9 or a later version installed.
About PandaLabs
Since 1990, its mission has been to analyze new threats as rapidly as possible to keep our clients safe. Several teams, each specialized in a specific type of malware (viruses, worms, Trojans, spyware, phishing, spam, etc), work 24/7 to provide global coverage. To achieve this, they also have the support of TruPrevent(TM) Technologies, which act as a global early-warning system made up of strategically distributed sensors to neutralize new threats and send them to PandaLabs for in-depth analysis. According to AV-Test.org, PandaLabs is currently the fastest laboratory in the industry in providing complete updates to users (more info at http://www.pandasoftware.com/pandalabs.asp).
For more information:
Joann Chan
Public Relations Research Manager
Panda Software, USA
Tel: 818-543-6967
pr@pandasecurity.com
Source: prnewswire
All trademarks and copyrighted information contained herein are the property of their respective owners.
The Shield Pro 2006
Related Articles
|
