Rash of new spam pushes malware disguised as screensavers

Screensaver123812388b

Screensaver123812388c

Both of the sites that we have observed hosting these screensavers appear compromised. One is already down, and we are in the process of attempting to get the other one taken down.

Clicking on the link brings the user to a very realistic “3d screensaver” page:

Screensaver 56597

Screensaver 56597a

Of course, installing one of these screensavers will not actually avail oneself to the ostensible benefits of watching Santa’s Home or the Matrix. Instead, one may get a rather nasty surprise.