Fans of Steam beware: there are YouTube videos currently in circulation claiming to offer a Steam Key Generator, which supposedly hands out free game codes with the push of a button. Here’s a shot of one of the videos below, touting said Keygen.
The YouTube vid (which has since been removed) offers up an initial URL:
adtrack1(dot)pl/go(dot)php?a_aid=5597181674b85
From there, we’re served a Zip from
equality-download(dot)eu
The Zip contains an executable called Setup_11652_il38449, weighing in at 777KB, and users of Malwarebytes Anti-Malware will find we detect the file as PUP.Optional.Amonetize.
It’s gone by a number of different names from the looks of it, as per the VirusTotal page:
At various points, this file has been called everything from “SketchupPro2015” and “RazerSurroundProCrack” to “HackToolv23” and “Farming Simulator 15 Full”.
Should the person sitting at the desk run the file, they’ll be presented with the following InstallPath Install Manager prompt:
You’ll notice that there’s an awful lot of programs offered up here – typically when I see these kinds of installer, there are maybe 3 or 4 programs tops [1], [2]. However, this one has no less than 10 individual entries:
Start your installation and install Setup, Coupoon, FastSearch, Nuvision Global Data Remarketer, Cross Browser, AnySend, My Best Offers Today, SushiLeads, Lolli Scan, PPS Video Player
Here’s all of the text from the installer with the default options ticked:
There is an option to exit out of the Installer, but what happens if you try to do so could be a little confusing to some.
The Close button is in the bottom left hand corner. Press it, and:
Are you Sure?You are about to exit the installation. Click OK to Exit and install DownloadManagerModern including other optional programs.
Okay / Cancel
In other words, the flow as you’d expect it to be is:
1. Close
2. Are you sure?
3. Okay or Cancel
Hitting Okay would ordinarily close the install procedure down and exit out of the install manager.
Here, however, the additional text in the middle of the box effectively interrupts the expected flow and reverses the button you’d need to hit to exit out as a result – instead of hitting “Okay”, you’d need to click “Cancel” to not end up installing something.
Should you miss the text in the middle, or just assume it’s some “You’re about to abort the installation” waffle and not read it, or just get a bit confused and hit Okay, you’d see this:
Finalizing Installation. You may continue your work while we install your software
That’s certainly one of the more interesting installer exit routines I’ve seen.
Here’s some example screenshots of what you can expect to see on your PC should you complete the install. We have the Program Files folder after the installs have taken place alongside the contents of one of the program folders, Crossbrowse running in the background behind an AnySend Setup box, and the browser window sporting an advert under the search bar along with some additional “Skype Add-on” and “Scan your PC” options at the bottom:
A lot of files and programs installed, then – and disappointment for our would-be game getter as the supposed Steam Keygen hasn’t made an appearance. While this sure to be no surprise to regular readers of the blog, one can imagine the confusion on the part of the person sitting in front of the PC after everything has been installed.
Save yourself the hassle and don’t fall for dubious “Get everything for nothing” claims on random YouTube video uploads. Nine times out of ten, all you’ll receive is a collection of programs you may not have actually wanted in the first place.
Christopher Boyd
