Win 7 compatibility checker punts Trojan

[Jacee]

Miscreants have disguised Trojan horse malware under the guise of a Windows 7 compatibility checker.
The malware comes as a zip-based attachment to email messages supposed offering "help" on upgrading Windows boxes. But this "Windows 7 Upgrade Advisor Setup" assistant offers only a Trojan, instead of the promised compatibility checking tool

Win 7 compatibility checker punts Trojan ? The Register

 

[hackerman1]

hi !

if you install Foxit-Reader 3.3 there is a "ASK-Installchecker" that wants to connect to internet,
it´s running immediately, even before showing any setup-screens.
makes you wonder what that actually is....
i´s perhaps related to the W7 compatibility checker ?

 

[Jacee]

That would be the "Ask Toolbar" :warn: Many programs come bundled with garbage that you don't want and don't need. This is all the junk it wants to download:
ThreatExpert Report

 

[CarlTR6]

I recommend that you uninstall it.

 

[hackerman1]

oh yes, it´s going to be uninstalled later tonight.

i only installed it to check the new version, i´ve posted a detailed report (including screenshots !) about Foxit in this thread: http://www.sevenforums.com/system-security/83984-foxit-adds-safe-mode-counter-pdf-attacks.html

i´m NOT going to use it...

 

[CarlTR6]

I meant uninstall the toolbar.

 

[polarbear]

Some malware programs class the "Ask Toolbar" as adware... as posted above, uninstall the toolbar... GL

 

[Night Hawk]

I always uncheck any toolbar item found when installing any new program whether it's for Ask, Google, Yahoo, or another other search engine since it opens you up for any variety of adwares or other bugs!

Another report labeled "Windows 7 'compatibility checker' is a Trojan" goes as follows.

May 10, 2010

Windows 7 'compatibility checker' is a Trojan

A fake email with the Trojan lifts text from a Microsoft Web site about the real software

By Robert McMillan
IDG News Service

Scammers are infecting computers with a Trojan horse program disguised as software that determines whether PCs are compatible with Windows 7.

The attack was first spotted by BitDefender on Sunday and is not yet widespread; the antivirus vendor is receiving reports of about three installs per hour from its users in the U.S. But because the scam is novel, it could end up infecting a lot of people, according to Catalin Cosoi, the head of BitDefender's Online Threats Lab. "This actually works because of the interest in Windows 7," he said.

[ Learn how to secure your systems with Roger Grimes' Security Adviser blog and Security Central newsletter, both from InfoWorld. ]

The scammers steal their marketing text directly from Microsoft, which offers a legitimate Windows 7 Upgrade Advisor in its Web site.

The rest is seen at Windows 7 'compatibility checker' is a Trojan | Security Central - InfoWorld

 

[hackerman1]

CarlTR6 & polarbear: i have NOT installed any toolbar.
first, i let a2 block ASK-Installchecker from connecting to internet.
second, during the installation i didn´t install any "extras".
the screenshots in the other thread only shows how it looks during the installation,
pointing to the danger of installing Foxit.

Jacee: thanks for the info, it seems to be a lot of BS that it wants to download.
maybe it tries to install ASK-Toolbar, but the toolbar is also offered during the installation.

 

[CarlTR6]

Good post. Thanks for the warning.

I always uncheck any toolbar item found when installing any new program whether it's for Ask, Google, Yahoo, or another other search engine since it opens you up for any variety of adwares or other bugs!

Another report labeled "Windows 7 'compatibility checker' is a Trojan" goes as follows.

May 10, 2010

Windows 7 'compatibility checker' is a Trojan

A fake email with the Trojan lifts text from a Microsoft Web site about the real software

By Robert McMillan
IDG News Service

Scammers are infecting computers with a Trojan horse program disguised as software that determines whether PCs are compatible with Windows 7.

The attack was first spotted by BitDefender on Sunday and is not yet widespread; the antivirus vendor is receiving reports of about three installs per hour from its users in the U.S. But because the scam is novel, it could end up infecting a lot of people, according to Catalin Cosoi, the head of BitDefender's Online Threats Lab. "This actually works because of the interest in Windows 7," he said.

[ Learn how to secure your systems with Roger Grimes' Security Adviser blog and Security Central newsletter, both from InfoWorld. ]

The scammers steal their marketing text directly from Microsoft, which offers a legitimate Windows 7 Upgrade Advisor in its Web site.

The rest is seen at Windows 7 'compatibility checker' is a Trojan | Security Central - InfoWorld

 

[CarlTR6]

CarlTR6 & polarbear: i have NOT installed any toolbar.
first, i let a2 block ASK-Installchecker from connecting to internet.
second, during the installation i didn´t install any "extras".
the screenshots in the other thread only shows how it looks during the installation,
pointing to the danger of installing Foxit.

Jacee: thanks for the info, it seems to be a lot of BS that it wants to download.
maybe it tries to install ASK-Toolbar, but the toolbar is also offered during the installation.

Very good. I also do not install toolbars.

 

[Night Hawk]

The only toolbar added on besides a few quick launch bars added onto the main taskbar here is the IE security toolbar that's an option in AVG. That seems to be a good for flagging sites that try placing anything on your system.

From there I put the main portion of AVG on the disabled list in the msconfig and run a different antivirus program found to be far better at finding and removing all sorts of bugs and doesn't intrude on other softwares. Even with the idea that an MS named tool of any type being altered to contain any malware is certiainly something to watch out for.