When you click on links to various merchants on this site and make a purchase, this can result in this site earning a commission. Affiliate programs and affiliations include, but are not limited to, the eBay Partner Network.
Dude that was a riot...that guys got some skills...my favorite part was the bit at the end there. But if I hadn’t had DSL that would have taken me far longer than I would have wanted to spend. But since I had DSL it took me all of 30 seconds to download.
When I click on the link, my virus and ad software detects and deletes a downloader trojan. When I then run adaware software it detects malware put on to my computer by the site.
I did it twice just to be sure and it happened both times. No harm done as all my detecting software worked as it should and all offending bugs were removed.
Just wondered if it happened to anyone else. I guess if you are not running a program like adaware, you might not know, although my Norton antivirus picked up the trojan part of it right away.
Yes, IE. Thing is that each time after Norton alerted, I ran AdAware and found the same files. Norton will occasionally alert to a downloader trojan. It seems to do that when a site tries to download certain kinds of advertising. When Norton does this, I have learned to run an AdAware scan and usually find what AdAware calls "malware" and sometimes a reference in the registry to the ***** file Norton has deleted.
On edit: I just tried to access that site again and paid closer attention to what happens. It is as described, but additionally the "exe" file is named "istinstall_si*****". It tries to execute automatically, but WinPatrol catches it as a newly installed program. Norton alerts that it has deleted an attached trojan. WinPatrol shows the file as coming from a company called "Thunderdome". I seem to remember some bad things about them. I will do an search for this company and the exe file and see what I learn.
What I found out is that the file istinstall_si***** is the one that Norton alerts on and it is infected with the download.trojan "virus". The winpup32 file and registry entry are put on my computer at the same time, along with rico***** and asdiair*****. All these came from the site that is linked in the first post above. Rico***** hijacks or disables the windows media player if allowed to execute. I could not find out anything about the asdiair***** file. Winpup***** is apparently a particularly pesty type of spyware or malware.
Anyway, all very interesting and sneaky! No harm is done to my computer as Norton, WinPatrol and AdAware worked as they should.
Just out of curiosity, those of you who visited the above site could search your computers and registries for files and or references to "winpup", "istinstall", "rico*****" and "asdiair*****". I have seen postings in virus news groups that indicate these are sometimes hard to detect. Also some people posted that if these types of files are allowed to execute the first time, changes are made to the computer configuration that makes them even harder to detect and remove.
Well.... I have discovered that my windows media player is infected with the Trojsmall.GL virus. Norton does not detect this until you try to run media player, then it alerts to the activity the trojan is trying to perform. Norton does not seem to detect or remove the small.GL file.
Oh, and now that I fixed media player, I was able to see the puppet and it is unbelievable! Can someone really do that or is it a computer graphics trick?