![\"stop\"](\"https:\/\/www.cryptocabaret.com\/wp-content\/uploads\/2021\/06\/stopblock.jpg\")
For a few years now, copyright holders have warned that people who use pirate sites risk running into malware and other malicious content. <\/p>\nFor a few years now, copyright holders have warned that people who use pirate sites risk running into malware and other malicious content. <\/p>\n
These warnings are meant to dissuade people from using these sites. However, a new type of malware already does that in a more direct way. <\/p>\n
In an article published this week, British security company Sophos highlights<\/a> a malware campaign that actively targets pirates. Not to harm their computers, but to block them from accessing pirate sites in the future.<\/p>\n The malware in question is disguised as pirated software and is shared on regular torrent sites and other places. The packages look like regular \u2018cracked\u2019 releases but those who try to install the software are in for a surprise. <\/p>\n Instead of installing a cracked version of the software users were looking for, the malware triggers a fake error message which mentions that a DLL file is missing. <\/p>\n \u201cThe program can\u2019t start because MSVCR100.dll is missing from your computer. Try reinstalling the program to fix this problem,\u201d the error reads while executing the malware in the background.<\/p>\n<\/p>\n Once executed, the malware tries to contact the 1flchier[dot]com domain, which is a typo variation of the file-sharing site 1fichier. When successful, it downloads a new payload titled \u2018ProcessHacker.jpg,\u2019 while sharing the filename of the pirated software the victim was planning to use. <\/p>\n It is unclear if this data is being used for anything but at the moment, the malicious domain is no longer accepting requests. However, it appears that the malware has been in use for several months<\/a> at least, so this may have been different in the past.<\/p>\n Where the malware really shines, is when it actively modifies the \u2018hosts\u2019 file on users\u2019 computers. This file can be used to override how domain names resolve. The attackers use it to link a few hundred to over a thousand pirate domain names to the localhost address, 127.0.0.1.<\/p>\n This change effectively blocks victims from accessing the sites, which includes The Pirate Bay and many of its proxies.<\/p>\n<\/p>\n Interestingly, this isn\u2019t the first time we\u2019ve seen malware do this. More than a decade ago a similar threat was widely shared on torrent sites. This also modified the \u2018hosts file<\/a>\u2018 to block The Pirate Bay. In addition, it also triggered popups that played a sound file saying that \u201cdownloading is wrong\u201d.<\/p>\n Sophos has no idea who is behind the malware and neither have we. While it could be an interesting anti-piracy strategy, it\u2019s unlikely that the malware comes from that angle. It could just as easily come from a rival pirate site that is not on the blocklist.<\/p>\n In any case, Sophos reports that its software blocks the threat, so its users are safe. Also, people whose computers are compromised can easily fix the problem themselves too. <\/p>\n \u201cUsers who have inadvertently run one of these files can clean up their HOSTS file manually, by running a copy of Notepad elevated (as administrator), and modifying the file at c:WindowsSystem32Driversetchosts to remove all the lines that begin with \u201c127.0.0.1\u201d and reference the various ThePirateBay (and other) sites,\u201d Sophos writes.<\/p>\n From: TF<\/a>, for the latest news on copyright battles, piracy and more.<\/p>\nDisguised as Pirated Software<\/h2>\n
![\"pirate](\"https:\/\/www.cryptocabaret.com\/wp-content\/uploads\/2021\/06\/pirate-error.png\")
<\/center><\/p>\nBlocking Hundreds of Pirate Sites<\/h2>\n
![\"\"](\"https:\/\/www.cryptocabaret.com\/wp-content\/uploads\/2021\/06\/piratehosts.jpg\")
<\/center><\/p>\nEasily Fixed<\/h2>\n