Trojan.Win32.LinkReplacer spotted in the wild

Dec 18, 2007 15:06 GMT  ·  By

There are way too many rogue antispyware technologies out there, so Trojan.Win32.LinkReplacer is just another piece of security product that wants to steal your money. You know the procedure: you visit a pornographic website, you infect your computer and extremely annoying desktop adverts start appearing on your computer. Most messages inform you that your system got infected with Trojan.Win32.LinkReplacer and urge you to buy an application in order to remove the infection. The only problem is that the provided antispyware is actually useless and all it wants is to take your money.

"Trojan.Win32.LinkReplacer is a Trojan, which displays a fake Warning message that states 'Your browser was hijacked by Trojan.Win32.LinkReplacer'. Trojan.Win32.LinkReplacer's fake Warning message is intended to confuse you, make you believe that you're infected with spyware and finally to convice you to purchase the supposed 'reliable' anti-spyware application that they provide, which at the moment is IEDefender", SpywareRemove wrote in a notification published today.

Now, let me tell you how I got infected while conducting a test among the Google search results. Even if I knew that my computer might get infected with such a Trojan horse, I downloaded a fake codec and I attempted to run it and see if my antivirus or the antispyware technology really discovers it. Surprise!

Most antiviruses found the file clean (although it wasn't!), so my system got compromised. After installing all kinds of applications supposed to remove the infection, I managed to manually remove the infection and keep the system secure. As you can see, it all starts from a fake codec, so next time you're advised to install a codec in order to view a web-based movie, just be sure it isn't such an infection.

"Trojan.Win32.LinkReplacer infects your PC using fake codecs that pretend to be free video codecs, often found on pornography websites. If you download free video codecs from questionable wesbites, it is highly probable that you're allowing a Trojan to be installed in your computer.Trojans such as Trojan.Win32.LinkReplacer are notorious for this type of deceptive methods", the same source mentioned above added.

If you'd like to view more information about the Trojan, as well as manual removal instructions, please follow this link.