Here we have a website claiming you can “Play Super Mario Online”, complete with looped Youtube video and a large “Start Here” button at the bottom of the page.
As you’re about to see, The Princess is most definitely in another Castle.
Hitting the “Start Here” button downloads a file called “SuperMario.exe”. However, this isn’t so much “It’s a me, Mario” as it is “It’s a me, a bunch of other stuff instead”.
We’re still looking at it, but the “competitor killer” file has a rather interesting name – especially if you remember these antics from 2004/05. Here’s an example of adverts appearing on Facebook with this installed:
We informed Zugo about this bundle, and they reported to us that they were in the process of identifying and terminating the affiliate responsible. At time of writing, our US based researchers confirm Zugo is still appearing in testing, whereas other regions end up with something altogether different. For example, this one is from the UK – say hello to “FaceTheme”:
Christopher Boyd (Thanks to Matthew for finding this one)
Update 1: Matthew performed some additional analysis on the competitor_killer.exe. Here’s a list of the apps it targets (based on strings found in the file) – notice FaceTheme is listed, even though it is appearing in installs alongside Web Essentials above…