There’s no denying that sex thrills and kills.
In the case of Troj/AdClick-FR, it actually does one but not the other. This malware won’t thrill you but what it will do is kill your anti-virus processes and services.
This malware manifests itself on your system in the form of this innocuous looking file called EroticPamela.mpg. To lull people into a false sense of security, it even tries to mimic itself to look like a Windows media file. However, just because the description says it’s a Windows Media Video, it has a Windows Media icon doesn’t mean it’s actually a Windows Media Video file. When it comes to malware, never ever take things at face value. In reality, it is actually a file executable.
The first thing you will likely notice when this Trojan is run is that your anti-virus and various security related processes either stops running or terminates. This Trojan will attempt to stop processes and services such as Sygate Firewall, Norton AntiVirus Auto-Protect Service and ESET Smart Security.
Not only does it also turn off your Windows firewall and disables registry tools, but it also embeds itself so that it is run automatically on system logon and modifies your Windows Explorer settings. To add insult to injury, Troj/AdClick-FR also changes your System Properties page to look like this as a tell tale sign that you’ve been infected: