The Return of the Hijacked Desktop

Is this really a return? Maybe not, since it never went away. But I was surprised nonetheless to see that it was still exploited.

It starts with an Acrobat Reader exploit… pushing an executable (wJQs.exe):

A few seconds later, your desktop is changed to display this:

A few more seconds later, a rogue anti-spyware program pops up. This one is Antivirus XP Pro.

I checked its main site and found some disturbing contradictions in their “About Page”.

Other than the ridiculous marketing propaganda, it looks like the good old ‘copy and paste’ went awol. In particular, it mentions AVSystemcare… Yes, you heard it right!
Same folks? It is quite likely. Or maybe they were just lazy and re-used a template. 

Jerome