Download a cracked game and your PC may start renting out your internet connection

A free copy of Command & Conquer: Red Alert 2. A FabFilter plugin bundle. A Navicat crack, an auto-clicker, a voice changer. Microsoft's security researchers published a list of bait on Tuesday 3 November, and it reads like the download history of a lot of teenagers. Each one is a trojanized installer that looks like the real thing and, during the same setup, quietly adds a few extra programs its operators get paid for. Microsoft calls them "offers" and says they're often installed "without users' informed knowledge or consent."

Three kinds have been confirmed. The most intrusive is WorldProxyPool, proxyware that routes other people's internet traffic through your connection, so whatever those strangers do online appears to come from your home. It installs into C:\Program Files\WorldProxyPool\ and creates three scheduled tasks that run as SYSTEM: one at startup, a hidden watchdog every five minutes and an hourly updater, which is why deleting a single file won't get rid of it. The second branch adds CharityEngine and BOINC, distributed computing software that puts your processor to work for someone else, plus VirtualBox. The third is adware-style utilities called AW Manager or Windows Manager.

None of this is clever hacking. It works because people hunting for cracks and activators are already prepared to click past warnings. If anyone in your house grabs games or tools from unofficial sites, open Settings, then Apps, then Installed apps, and look for WorldProxyPool, CharityEngine, BOINC, VirtualBox or a Windows Manager nobody remembers installing. In Windows Security, under App & browser control, switch on reputation-based protection and its option to block potentially unwanted apps. Defender already flags these installers under names such as OfferLoader and Clover.

Tendvane's Safety check looks for this kind of unwanted software and lists what it finds, so you can decide what stays and what goes.