User User name Password  
   
Sunday 8.11.2009 / 09:19 AM
Search AfterDawn.com:        In English   Suomeksi   På svenska
afterdawn.com > news > fake media files hit file sharers with trojan
Show topics
News
News

Fake media files hit file sharers with trojan

8 May 2008 12:36 by Dave "Davedough" Horvath | 56 comments

Fake media files hit file sharers with trojan Sources from the security firm McAfee have stated that over 500,000 machines have reported being infected by a new trojan going around that's disguised as media files shared on popular P2P networks. These files can either look like a popular and heavily seeded music or movie file and often contain the name of whatever popular file is going around the P2P networks now is actually a trojan loaded with tons of malware packages to make a file sharer's day a lot less enjoyable.

McAfee states that this fake file outbreak is the worst that its seen in three years. Users who get attacked by the fake file are treated to an array of pop-ups and open back doors to the world for their computers to be compromised. These files are mostly predominant on the eDonkey and Limewire networks and are often labeled with a different language to confuse users. The titles make the file appear to be music tracks, pornography and full versions of popular movies. Once downloaded, the user is asked to install a specific codec to view the media, and its then that the trojan is launched.

Included in the bundled of malware from this package is a media player that will only play included media files, thereby disabling any other media player or media files on the user's machine from being played. McAfee stated that of the 500,000 cases it's seen, only 10% of those have gone as far as installing the malicious package.

Permalink to this article

Get AfterDawn's news to your favourite feed reader! Share this story with your friends!
 

 
Related articles:

  • Court says Edonkey server admin cannot be held liable for infringement (10 September 2008)
  • Limewire store adds over 1 million tracks (31 August 2008)
  • Limewire files motion to have case dismissed (20 July 2008)
  • Limewire wants to share ad revenue with record labels (14 May 2008)
  • MPAA awarded $110 million in TorrentSpy suit (8 May 2008)
  • Swedish file-sharer gets convicted (6 May 2008)
  • Andersen wants to end the RIAA (5 May 2008)
  • NiN giving away The Slip (5 May 2008)
  • Popcorn Hour now available for pre-order (4 May 2008)
  • Judge shuts down RIAA in music piracy case (30 April 2008)
  •  

    « Previous news article
    MPAA awarded $110 million in TorrentSpy suit
    Next news article »
    Microsoft may implement copyright cops into every Zune
     Post your comment
    Discuss this article!  There are more user comments available, read them here
    rayals (Inactive) 8 May 2008 20:30 Send private message to this user   
    Using a public tracker is asking for trouble. Best thing to do is get on a private tracker and follow the rules. I have been a torrent d/l for a couple of years and NEVER have a problem. I get music in full album sets and cams/propers/r5's/screeners/r1's with no problems. Software is also easily available and untainted.
    I agree that if you are getting these type of viruses/trojans, you should not be using a computer. You do not know the basics of using a computer, nor do you know basic internet security. Your security is your business. Take note.


    This message has been edited since posting. Last time this message was edited on 8 May 2008 20:33

    edge2000 (Junior Member) 8 May 2008 23:58 Send private message to this user   
    I dont use McAfee so I am sure that I am protected against this trojan. I use Limewire all the time so I am a little concerned. Never had a trojan or virus come through any P2P network for me. McAffe and Norton are viruses. Uninstall them and use AVG Free!
    borhan9 (AfterDawn Addict) 9 May 2008 0:03 Send private message to this user   
    Well this is not good news for p2p users they have to be weary. The new viruses are worse than ever. I just spent the other day removing a worm from my dads work pc and u should have seen the effects this worm was having and it was really bad. I did manage to get rid of it by using Kaspersky Antivirus i have to say its the best out there i have seen worth the money.
    nobrainer (Inactive) 9 May 2008 1:46 Send private message to this user   
    Originally posted by rayals:
    Using a public tracker is asking for trouble. Best thing to do is get on a private tracker and follow the rules. I have been a torrent d/l for a couple of years and NEVER have a problem. I get music in full album sets and cams/propers/r5's/screeners/r1's with no problems. Software is also easily available and untainted.
    I agree that if you are getting these type of viruses/trojans, you should not be using a computer. You do not know the basics of using a computer, nor do you know basic internet security. Your security is your business. Take note.
    correctumundo, i have in the last.... years, never once seen a virus on a closed tracker, other than demonoid once, but it was quickly removed, the problem for ppl is getting in though!

    @ as varnull states you have to RUN the dam .exe what moron would confuse that with either an mp3 or a picture file?


    The BPI Are: SONY, UNIVERSAL, WARNER GROUP, EMI.
    The RIAA Soundexchange Are: SONY, UNIVERSAL, WARNER GROUP, EMI.
    The IFPI Are: The same anti consumer lot as listed above!
    The MPAA Are: SONY, UNIVERSAL, WARNER GROUP, DISNEY, PARAMOUNT, FOX.

    This message has been edited since posting. Last time this message was edited on 9 May 2008 1:56

    mspurloc (Member) 9 May 2008 2:14 Send private message to this user   
    Any little, spotty-faced, teen bleeder who creates or distributes a virus should be shot through the head on international television.
    domie (Member) 9 May 2008 6:26 Send private message to this user   
    Quote:
    Originally posted by ivymike:

    Emule are you kidding one of the worst ones out there since I knew about it I have never used it full of spy-ware and ad-ware.

    I'm puzzled how you would know it is full of spyware and adware if you have never used it.

    Emule is open source, free and has been the number 1 download on the sourceforge.net developers projects page for about 5 years running - twice as many downloads as bittorrent and azureus combined - no way would it be there if it was bundled with spyware and adware.

    http://sourceforge.net/top/topalltime.php?type=downloads


    I think you are confusing it with something else.
    varnull (Inactive) 9 May 2008 6:51 Send private message to this user   
    Fact... there is malware in the wild

    Fact... It can infect your hardware

    Fact... It isn't just "script kiddies" who make and distribute malware (sony rootkit fiasco)

    Fact... ddos attacks and spamming via botnets is a source of large amounts of revenue for the less morally concerned

    Fact... Any code that can be run or opened on your pc can be malware (vista is a great example of malware)

    Fact... when you visit ANY website you are at risk of encountering malware and exploits

    Fact.. javascript and flash media can be used to install exploits as easily as you downloading something (be aware of flash content on warez sites)

    Fact... windows is insecure

    So.. live with it and take the risks with an open mind. Run quality antivirus and use it with common sense... unix has a better solution.. Nothing downloaded can be just run, you have to change it's properties and permissions before it can install or exploit anything which may be system changing. Compared to that windows is like a free for all.. every file can do whatever the hell it wants all the time, regardless (it seems) of the owner and users permissions. With windows files can be "Administrator Always" which is where the problem comes from in the first place.

    Good antivirus (free is good enough) windows firewall.. a couple of anti-spyware,/anti malware applications (avg anitspyware is excellent.. spybot is also adequate.. combined with adaware and avast home edition antivirus they are nearly invincible)
    use Firefox, and install no-script plugin so that you can see what is trying to load... don't allow java to run anything you are unsure of, and certainly for general browsing block by default... Also look at where images are loading from.. be aware of cross site scripting exploits and xss trickery.

    This internet isn't a place for spoonfed n00bs.. unfortunately it is full to the brim of nasties just waiting for you to arrive with internet explorer wide open and the M$ trained behaviour of "allow" "next next next"

    The secret of safe p2p use and general internet use is this...
    Get clued up, and use your comon sense.. If a site feels wrong.. and sometimes it is only a feeling, don't let your guard down.. and finally.. Be prepared to wipe everything and start over until you get those gut feelings about what is and isn't correct behaviour from a file, website or whatever it may be.. they come with time and experience. Keep your OS on a different partition from your data (I install windows on E: which is only 20 gigs.. that confuses lots of malware)

    OR... use linux for your general browsing and day to day internet wotsits, and forget about the malware pretty much completely, and the need for pirate software or continual use of your credit card, which is an added bonus.

    I won't bash anybody who has encountered malware by accident.. I actively hunt for it and save it when found.. I will have a tickle at people who stupidly trust everything.. just because somebody says it is a safe street doesn't mean you should leave your car unlocked with the keys in does it.



    Free open source software = made by end users who want an application to work.... #1 image again.. check it out ;)

    This message has been edited since posting. Last time this message was edited on 9 May 2008 6:56

    akira247 (Junior Member) 9 May 2008 9:43 Send private message to this user   
    yeah ive just got rid of a virus(trojan vundo),and few others viruses
    hit me 5 may..took ne 2 days to get rid and it still popped up next day,gone now though..

    ive not had any problems for 3 years,running mcaffe and use few other cleaners,constant torrent user,and thats were i think i got it from a torrent site,coz not any limewire programs shareza etc for long time..
    im sure it was a HD wallpaper pack.

    but i had constant popups for few days,mcafee never saw anything
    used MalwareBytes Anti-malware and the Vundofix,and a spyware program...found lots of things that were not there week before..

    everything been ok for couple days now..wouldnt mind but i recently bought my annual renual from mcaffe.....what for??

    This message has been edited since posting. Last time this message was edited on 9 May 2008 9:48

    B33rdrnkr (Newbie) 9 May 2008 15:37 Send private message to this user   
    limewire sux anyways..
    Fibroptik (Inactive) 9 May 2008 21:37 Send private message to this user   
    One fine day IvyMike glorked:

    IM> Emule are you kidding one of the worst ones out there since I knew about it I have never used it full of spy-ware and ad-ware.

    What a lot of nonsense.

    > I'm puzzled how you would know it is full of spyware and adware if you have never used it.

    IvyMike is obviously clairvoyant. Dead people talk to him.

    > I think you are confusing it with something else.

    He is confusing it with Shareza. He is confused.

    FiberOptik
    varnull (Inactive) 9 May 2008 21:53 Send private message to this user   
    Emule Shareza limewire frostwire... ahhhhh.. my malware supermarket of choice..

    Used by connosuers of malware and the intentional spreaders of trojans and virus files since the beginning of the internet.. Gotta love it. If I had a share folder I would put a few bombs in it for the unwary. There is an E-war going on above and beyond national borders here.. The mpaa etc are joining and logging downloads.. they are scanning ip's for certain files.. they find them, they download them to get your ip and the evidence of what you are sharing... why not hide some really nasty malware in a file as a trap for them? I do. It isn't sensible to download anything too obvious from my share folders... especially any .exe files. I run linux..(you need to know me to know that.. so you would be on my "permitted lists" anyway.. strangers beware) so what the hell are exe files doing on my machine??? heh heh heh.. my minefield.. waiting for adobe and others.. every button is already clicked.. an e-bomb if you would.

    Last real nasty I saw off limewire actually run and trash a system started downloading without even being selected.. so much for norton too.. it got infected itself and then helped replicate the virus.. it just came and ran with no interaction from the user at all.

    I know the name of a really nasty virus that will need a complete format, then a 3 pass wipe with killdisk, followed by a total repartition and reinstall, a bios virus check and a ram virus check to remove completely.... should I give the file name for the limewire fans...

    alladobekeys&serials2k7... there you go. Probably circulated by adobe themselves.. and believe.. it's a hottie ;)



    Free open source software = made by end users who want an application to work.... #1 image again.. check it out ;)

    This message has been edited since posting. Last time this message was edited on 9 May 2008 22:01

    FredBun (Senior Member) 9 May 2008 22:05 Send private message to this user   
    excellent advise from varnull
    phate316 (Junior Member) 10 May 2008 15:09 Send private message to this user   
    you should know all about safe streets varnull after having 3 cars stolen , did u leave the keys in them ????(sorry had to get last word in )
    CF01 (Junior Member) 24 July 2008 1:49 Send private message to this user   
    i dont see why these ppl need to make virus and malware apparently they have no lives
    core2kid (Senior Member) 31 August 2008 22:58 Send private message to this user   
    I actually got hit with this one from BearShare twice. Luckily Avast deleted it on the spot both times.
    varnull (Inactive) 1 September 2008 12:54 Send private message to this user   
    Originally posted by CF01:
    i dont see why these ppl need to make virus and malware apparently they have no lives
    It's not about having no lives.. It's about EXPLOITING YOUR COMPUTER AND INTERNET CONNECTION to do things without your knowledge and permission!!

    test your antivirus ;) careful now.. it's a real live one XD



    Free open source software = made by end users who want an application to work. An engineer with a single tool in his toolbox is an idiot, not an engineer

    This message has been edited since posting. Last time this message was edited on 1 September 2008 12:57

    L-Burna (Senior Member) 1 September 2008 13:32 Send private message to this user   
    Easy solution use newsgroups or reliable torrent sources.If you get rid of one geek that thinks its funny to mess up others computers there will always be another one ready to replace them.I like the idea of severe punishment for virus creators,but maybe that is a little too far.I think if a trojan is on somebodies computer gathering valuable information isn't that the same as stealing somebodies wallet or robbing a bank.We all know its probably some low life who wants to get a giggle out of screwing people over.

    @varnull you make some very good points on Windows,but not everything is made for Unix.Sure you can probably get some things to run on Unix,but the majority of companies that make software buy into MS operating systems.I don't like to support Windows,but if this is the only OS that can run all my programs then I have no choice but to use it.




    ...........................:SiG cReAtEd By Phantom69:............................
    Fibroptik (Inactive) 1 September 2008 13:36 Send private message to this user   
    >McAfee stated that of the 500,000 cases it's seen, only 10% of those have gone as far as installing the malicious package.

    Which covers the percent of incredibly stupid computer owners in the US of A. Anyone who DLs a file from any P2P source without checking it probably voted for Bush the second time. Only morons voted for him the first go 'round.

    > McAfee states that this fake file outbreak is the worst that its seen in three years

    Of course. Back in the day those of us with a mild paranoid sensibility figured it was Peter Norton's crew writing viral junk. Great way to sell product.


    FibrOprik
    L-Burna (Senior Member) 1 September 2008 13:44 Send private message to this user   
    Originally posted by Fibroptik:
    >McAfee stated that of the 500,000 cases it's seen, only 10% of those have gone as far as installing the malicious package.

    Which covers the percent of incredibly stupid computer owners in the US of A. Anyone who DLs a file from any P2P source without checking it probably voted for Bush the second time. Only morons voted for him the first go 'round.

    > McAfee states that this fake file outbreak is the worst that its seen in three years

    Of course. Back in the day those of us with a mild paranoid sensibility figured it was Peter Norton's crew writing viral junk. Great way to sell product.


    FibrOprik
    ???Why is Bush brought into the picture are we talking about politics or did you just want to start some political discussion like a moron.You suck go away with your politics nobody wants to hear it in an article discussion about something completely different.By the way people shouldn't need virus protection programs if the OS is secure like Varnull said.




    ...........................:SiG cReAtEd By Phantom69:............................
    Fibroptik (Inactive) 1 September 2008 16:01 Send private message to this user   
    L-Burna took the bait: here fishy fishy

    L-B> Why is Bush brought into the picture are we talking about politics or did you just want to start some political discussion like a moron.

    Yes and like a fish you took the bait. You must be one of those morons who voted for Bush. I understand you. Maybe we can chat. I have a brother who's an idiot so I'm fluent in dumb-ass.

    FibrOptik
    L-Burna (Senior Member) 1 September 2008 19:30 Send private message to this user   
    Fibroptik if you think bringing in politics to prove a point is smart then yeah I disagree with you and like I said your a moron.Politics and religion do not belong in discussions that do not involve politics or religion.Your trying to start a flame war which I do not condone.If your trying to instigate something this is not the right place for you go somewhere else.

    Nobody wants to hear politics or religion when the subject has nothing to do with it.

    Quote:
    I have a brother who's an idiot so I'm fluent in dumb-ass.
    I don't doubt it you seem like your pretty fluent with it as you take after your brother from the way you view him.I'm not sure if that was an insult,but it sounded like you put yourself down.




    ...........................:SiG cReAtEd By Phantom69:............................

    This message has been edited since posting. Last time this message was edited on 1 September 2008 19:42

    varnull (Inactive) 1 September 2008 21:48 Send private message to this user   
    I'm not even running any agenda here.. a computer is only as secure as the software it runs and the attitude of the operator.

    I come from a time when having a computer in the house made you unusual. You knew how it worked, and how the software worked after a fashion at least.

    While not everything may be made for a particular platform that really isn't the point.. there are applications for non windows platforms that make most M$ closed code apps look like toys for the very reason they are open source and have been modified to do what the end users want instead of what a business wants to sell you, and keep selling you when the next closed OS arrives and all they have to do is change a couple of flags somewhere in it to force you to buy the same stuff again. (dx10 on xp.. open source would have exposed this vista lockin lie)

    Like McD's just because everybody uses it and it is everywhere doesn't mean it is good, just that it is well known and marketed at you (vista trial versions bloatware anybody?)

    The point I'm trying to make is this.. I don't hate M$ and I don't hate Bill.. they did a pretty amazing thing for computers in the home with windows95 just at the right time. Trouble is they made it too easy.. they took the thinking out of owning a machine that was soon to be connected everywhere across the world.

    The difference is as simple as that. Non windows users tend to be a little more clued up about their hardware and software. We get our software legally from trusted sources (because it is open source we don't need to steal it from dubious places). We run our browsers in a safe environment and with sensible user practices. We know pretty much what should be where and what does and doesn't need access to the wider internet. I think I said before about the windows trained behaviour.. "allow"--"next-next-next-finish-reboot".. Foolproof? Yeah, it will install a good program as easily as it will install some virus or malware.
    The M$ motto should be "let us do your thinking". The main suggestion I see about vista almost everywhere is to disable it's security features, because they get in the way all the time. That says to me that the OS is flawed at the core. If it needs intrusive security systems which are so intrusive they need to be killed then they haven't thought it through, or they are trying to sell a feature that nobody wants/understands.

    What do the open source operating systems actually do? Pretty much anything they want you to with the added bonus.. they are all different. I'm not scared by a bsd or a solaris machine or even, god forbid, a vista machine.. why?.. because it's only a machine running some code. It's supposed to only do what I tell it to do. That's why I don't agree with the M$ mindset of taking control from the user and hiding it away.

    I see kids coming out of school with IT qualifications... what they really have is some training in a few closed source windows platform applications.. that has nothing to do with IT and I see them every day fighting with industrial and business hardware which runs something completely alien to them and without the pretty GUI tools they are used to. Luckily the collapsing economy means that schools are having to rethink their IT strategies and are moving to open source systems which don't need new hardware to run up to date relevant applications. They may not be M$ word.. but OO writer and abiword are word processors which are both business standard and quality.. what does it matter.. The user has no trouble using M$ word after learning on a few open source alternatives... different mindset.. look at the menus.. have an experiment.. don't accept it will all be done for you ;)

    Nobody wants to try my malware then? It's supposedly a patch to allow M$ publisher to save in sla/slt/slb open source publishing formats. XD



    Free open source software = made by end users who want an application to work. An engineer with a single tool in his toolbox is an idiot, not an engineer
    L-Burna (Senior Member) 1 September 2008 22:39 Send private message to this user   
    Well yeah I'm going to be honest I don't use just one OS,but its true if the OS is secure antivirus programs wouldn't be needed.As you mentioned most apps now can perform without the users request.There are no permissions in Windows depending on which OS we are talking about,although Vista tries to encorporate permissions by asking users to allow anything to run everytime the app is trying to open it bogs the system down.Its true Linux and Unix systems are not for the faint hearted or overwhelm some normal users.They are more secure as you mentioned,and they may not be as flashy as Windows but can perform better in my opinion.The majority of large corporations normally buy into Windows,and its true if we did a poll I bet there are more organizations using Windows than any other OS.If we are talking about normal users its a preference of choice like you mentioned,but I do see Windows being the mainstream for business.It doesn't always work for some,but there are a bunch of businesses that use it as most prebuilt computers come with Windows installed on it.There are some exceptions but the majority as mentioned are brought into Windows from the start.Its like going to an interview for the first time the first impression plays a big role.




    ...........................:SiG cReAtEd By Phantom69:............................

    This message has been edited since posting. Last time this message was edited on 1 September 2008 22:41

    varnull (Inactive) 1 September 2008 23:59 Send private message to this user   
    I think it depends very much what industry it is. Most heavy manufacturing runs hardcore unix.. because it's what was about 20 years ago when they tooled up last. Same seems to go for banks and other large and wide networked business.. travel agents and national distributors I see running mostly solaris for some odd reason.. probably like heavy industry it was what was available when they built their systems in the 70's and 80's.
    Publishers and the newspapers seem to run a bit of a hotch potch.. lot of BSD type unix there, some of it seems totally in house.

    It's the small offices where windows seems to be the norm.. 5 or 6 computers all individually networked and seemingly under no overall control.

    My view is probably skewed because of the nature of my business, but I think the corporate windows use is just shy of 50%.. mainly because they are the only people who are counting every single machine it seems to be higher. How many business users runing linux/unix or other open source have ever bothered registering it? In my experience it's just installed and left to get on with it until the IT manager retires and they get some snotty nosed 20 year old who has never seen anything but windows.. faced with a bill in the tens of thousands to make the IT "expert" happy with his xp or vista that's when my phone starts ringing ;) I love my job... honest.



    Free open source software = made by end users who want an application to work. An engineer with a single tool in his toolbox is an idiot, not an engineer
    EricCarr (Member) 2 September 2008 0:17 Send private message to this user   
    If you use torrent sites. Just read the comments before downloading a file. They will tell you if it fake, virus, or trojan ect ect ect.
    varnull (Inactive) 3 September 2008 22:53 Send private message to this user   
    Not always... You find files with loads of comments and heaps of seeds.. they can be infected too, The comments and seeds are the botherding group XD ... as can a legit file which somebody has tampered with since downloading ;)

    How is it done? http://www.757labs.com/projects/mp3nema/



    Free open source software = made by end users who want an application to work. Just put your hands up its a raid!
     Post your comment
     

    Subscribe to our newsfeed

    Get the latest headlines delivered directly to your favourite RSS reader or content aggregation service by using the links below.

    AfterDawn.com: News - RSS feed
    Add to Google
    Add to My Yahoo!
    Add to MyMSN

    Search for headlines

    Search through our news archive.

    Last week's most popular software downloads

    Digital video: AfterDawn.com | AfterDawn Forums
    Music: MP3Lizard.com
    Gaming: Blasteroids.com | Blasteroids Forums | Compare game prices
    Software: Software downloads
    Blogs: User profile pages
    RSS feeds: AfterDawn.com News | Software updates | AfterDawn Forums
    International: AfterDawn in Finnish | AfterDawn in Swedish | download.fi
    Navigate: Search | Site map
    About us: About AfterDawn Ltd | Advertise on our sites | Rules, Restrictions, Legal disclaimer & Privacy policy
    Contact us: Send feedback | Contact our media sales team
     
      © 1999-2009 by AfterDawn Ltd.