Our intrepid rogue investigator Patrick Jordan was checking the latest evolution of the ThinkPoint FakeRean rogue and passed this along.
The fake “you need to install flash player in order to watch movie” gimmick obviously is still out there. The malicious folks behind ThinkPoint.FakeRean are using it to trick victims into downloading their rogue.
“They are making them look real, but if the URL doesn’t show adobe.com then it is a fake,” Patrick pointed out.
Just because the “name” is flash_player_installer.exe, that doesn’t mean it’s genuine. This lure is especially suspicious because the pop-up window shows that it is going to download from the site pics24.video.servepics.com and not Adobe.
(click on graphic to enlarge)
Here is the real Adobe page to download Flash Player: http://www.adobe.com/products/flashplayer/
Rogue Blog entry for ThinkPoint.FakeRean: http://rogueantispyware.blogspot.com/2010/10/thinkpoint.html
Thanks Patrick
Tom Kelchner