New Harry Potter Scam Installs Fake Antivirus

BitDefender's researchers have found a new wave of spam attacks that entice users to watch the new movie "Harry Potter and the Half-Blood Prince" for free to deceive users into installing a phony antivirus suite known as 'Personal Antivirus.'

The spam attacks used different subject lines like - "New Harry Potter movie survey. Enter for a chance to see it free!," "Pre-Book Your 'Harry Potter' Tickets At Hoyts And Hoyts IMAX Now!" and "Watch Harry Potter and the Half-Blood Prince clips."

Users who click on the free broadcast link of the movie are taken to another malicious website. After this, the browser window is minimized and an alert message notifies the user about numerous system infections and the availability of a solution known as 'Personal Antivirus.'

If the user clicks on either OK or CANCEL, a fake movie starts to play in the restored browser window. The movie imitates an on-going scanning process that discovers malware within the system. At the end of the installation process, the user is suggested to install 'Personal Antivirus' to get rid of around 500 files distorted by several kinds of malware.

After the installer component finishes the installation of 'Personal Antivirus,' it also ingeniously connects to a Microsoft Windows Update Thank You to suggest that the software belongs to an authentic source and is genuine. Personal antivirus rogue changes the registry settings, asks the user to purchase or renewed a license and installs extra malware accountable for the phony alert it shows. To remain unnoticed, it ceases the Windows Defender process.

It also installs a Trojan, Trojan.Downloader.PersonalAntivirus.A, and steals credit card details of computer users who try to watch the new movie free online.

Head of BitDefender's anti-spam Research, Vlad Valceanu, states that web users should be careful of any sites claiming free screenings of the new Harry Potter movie or any of the new blockbuster releases. He further states that the only way users can secure themselves is to be aware of these kinds of devious attacks and always use a genuine security solution for protection, as reported by NETGUIDE on July 27, 2009.

Related article: New Zealand Releases Code To Reduce Spam

» SPAMfighter News - 8/10/2009