Avast WEBforum

Other => General Topics => Topic started by: Wayne158 on June 29, 2021, 12:25:44 AM

Title: PDF995 as ransomware
Post by: Wayne158 on June 29, 2021, 12:25:44 AM
Curious if people have heard of the following which smacks of being ransomware in my book.
H&R Block Tax prep software saves peoples tax returns in a proprietary format. No problem so far.
They tell consumer to save as PDF as that is how they extract last years tax data if you use their software over multiple years.
So, you click "Save as PDF" which again not that unusual.
Here's where it gets shaky.
You click Save as PDF and HR Block conveniently provides an application, PDF995, that seems pretty innocuous. Converts to PDF and should be end of story.
Well, I am trying to get my fathers papers in order for him to move. One of things was to gather up all his tax documents and transfer to new laptop.

So I just randomly opened one of his 1040's and it was emblazoned with big picture on each and every form and worksheet that said click here to upgrade to I think it was PDF995 Plus AND remove the banner we have parked on each page.

I had a computer chat with HR Block and I think they were in the dark that PDF995 was effectively ransoming their tax documents. They knew PDF995 was converter, they did not know about PDF995 effectively corrupting the complete document. Not by encrypting the data but by putting this big banner on each page that rendered the pages useless.

That to me has all the hallmarks of ransomware. I have Adobe Acrobat Pro DC which is full blown PDF editor so I was able to MANUALLY remove each image and the underlying hhyperlink. It was tedious and annoying that I had to do and big picture super perturbed at the people who are unwittingly forced to buy software they don't need. Acrobat Reader is ubiquitous on computers. But even though file says it is a PDF and .pdf files are set to open in Acrobat reader, this PDF995 is latching on to it by way of this big graphic banner.

I expect 99.99% of population ends up paying PDF995 their "Upgrade " fee just to access old tax documents.to access their tax forms. If that's not a scam I don't know what is.