Rogue downloads look real: read the fine print

Our intrepid rogue investigator Patrick Jordan was checking the latest evolution of the ThinkPoint FakeRean rogue and passed this along.

The fake �you need to install flash player in order to watch movie� gimmick obviously is still out there. The malicious folks behind ThinkPoint.FakeRean are using it to trick victims into downloading their rogue.

 �They are making them look real, but if the URL doesn't show adobe.com then it is a fake,� Patrick pointed out.

Just because the �name� is flash_player_installer.exe, that doesn�t mean it�s genuine. This lure is especially suspicious because the pop-up window shows that it is going to download from the site pics24.video.servepics.com and not Adobe.


 (click on graphic to enlarge)

Here is the real Adobe page to download Flash Player: http://www.adobe.com/products/flashplayer/

Rogue Blog entry for ThinkPoint.FakeRean: http://rogueantispyware.blogspot.com/2010/10/thinkpoint.html

Thanks Patrick

Tom Kelchner