Google Group Spammed with Rouge Antispyware

Here is the Posting to a google group

 

this link redirects to

hxxp://numberstencils.net/images/www/index.php

above link connected with following rouge antispyware

hxxp://scanonlinesite.info/downloads.php/?aff_id=91&aff_Aid=20106&adult

above fake scanner is loaded from the web page and drops following file.

Following file prompts to run as administrator and here is the manifest

<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
  <trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">
    <security>
      <requestedPrivileges>
        <requestedExecutionLevel level="requireAdministrator"></requestedExecutionLevel>
      </requestedPrivileges>
    </security>
  </trustInfo>
</assembly>