Drive By Computer Infections From Facebook and Torrent Websites

Me | 05/10/2010 | Vanity

[Wooly]

In case you have not heard or have not had this happen to you, a company named LoudMo is promoting a $2.00 pay per install program for its affiliates. This has led to an increase in stealth placement of an advertisment program that give you pop-ups that offer free downloads of FLV Player, Chameleon Tom,BabelFish, or Gateway Content Protection. The adware program is a drive by install that has largly been seen on Facebook and Bit Torrent, but will probably become more widespread. This program can infect all platforms and your anti-virus will not find or get rid of it since it is not doing any damage. For Windows platforms this program work by installing an infected csrss.exe that can be seen in the task manager and a self- extracting component in the MsConfig startup list. If you have this or get this download/install/update/run Malwarebytes ( http://www.malwarebytes.org/mbam.php )and then SuperAntiSpyware ( http://www.superantispyware.com/download.html ) to get rid of it. It does not do any damage to your computer.

[Fire_on_High]

Sounds a bit off to me, but in any case...there is NO excuse for seeing ads in this day and age. Firefox has a good popup blocker, and you can block ads, Flash, and Javascript very easily, which prevents this sort of thing.

[Wooly]

This is not a normal pop-up that a pop-up blocker will block. This is an actual program that is installed on your computer by stealth action, just logging on to facebook or opening a torrent can install it. Since it works this way it could even be installed to your computer if someone was to infect the free republic website.
Although new, the pay per install method of getting garbage on peoples computers is a growing industry. So watch out and do not get comfortable.
I have never had a virus or adware on my computer in the last 13 years, but I got this one from Facebookand I am just telling you what I found out and how to get it off your computer.

[Fire_on_High]

Still think that sounds fishy.

[APFel]

How would opening a torrent file cause an infection? It isn’t an executable.

Sounds like those phony MP3 virus rumors that were popular ten years ago.

APf

[Wooly]

Maybe if you look at a few of the links below you will drop the “Fishy” comment.

http://sataid.net/forum/showthread.php?t=19333

http://stream-recorder.com/forum/flvdirect-com-nasty-spyware-do-not-download-t6320.html?s=e31aaaea22daf66d5c0388274d9ba991&;

http://www.amnavigator.com/blog/2010/02/05/parasite-alert-directcpv-loudmo-contextual-adware/

http://forums.cashcrate.com/showthread.php?t=33050

http://www.computing.net/answers/security/is-directcpv-popup-ad-spyware-or-adware/29165.html

http://support.mozilla.com/tiki-view_forum_thread.php?locale=it&comments_parentId=646309&forumId=1

[Fire_on_High]

That’s my thought. I don’t doubt this fine Freeper really got a malware infection somehow, I just believe they’re mistaken about how it happened. Even if they didn’t do anything stupid or careless, someone else certainly could have on the machine.

Malware Bytes is good stuff, tho...I tend to check things over every day or so with it anyway.

[lowbridge]

bump

[Fire_on_High]

Ok, forget trying to give you the benefit of the doubt then. Looks to me from those links like anyone who installed those apps got nailed, just plain old tricked and made a fool out of.

There, happy? :-)

(Next time I’m trying to let you save face...understand what you’re reading and take the chance.)

[arthurus]

Is the Malwarebytes compatible with anti-virus and firewall software?

[Fire_on_High]

I’ve got the free version and yes, absolutely it is.

I don’t know how nicely the active protection on the paid version plays with various things, but you should be able to check their forums and read what other users of the same combination you’ve got have found out.

[arthurus]

I downloaded it and when I get properly backed up with a restore point, I will install it. Thanks.