DMusic.com | for indie musicians and fans | Free MP3 music downloads - Forums: Complaints: DMusic's Nasty New Adware Problem

Forums > Help: Complaints

DMusic's Nasty New Adware Problem

Woof	Date: February 13, 2008 @ 5:32 PM Hello. I just thought that you'd want to be made aware of the fact that the nastiest kind of adware appears to have infested our beloved site. I clean my cache, cookies, and form information at the end of almost every session. My browser is set to Google for its' homepage, and for the last several days, whenever I click on the bookmark to DMusic's home page, I'm greeted with these pop-up messages, and the DMusic homepage disappears: This one appears in the center of my monitor: It's accompanied by this popup in the lower right: When I close these ads, my browser opens on this page: When I try to close that page, I get the following message: Somewhere in the course of this process, my antivirus alerts me that a download to my computer has been blocked. Finally, when I attempt to close that last ad, I get this: I've just redone my hard drive, my PC runs Vista and IE7 and I've got all the latest patches, so I'm sure I haven't been infected. This has only happened when visiting DMusic. And it has happened daily, when I visit DMusic. I've had no similar problem with any other site that I've visited. I'm posting this in the "complaints" forum, but really I'm just trying to help... And also hopefully prevent other users from falling for this. The ad resembles an official notice from Microsoft when it first appears, so it could trick a lot of people into believing that this is a function of their OS. That's what makes it so evil.
Distilled1	Date: February 13, 2008 @ 5:42 PM I don't get it. I have seen it its based on CoolWebSearch and I bet the Aurora Trojan. with the site being down to about 50% I don't think its from here run HiJack this and you'll find the culprit. if your getting a block from your Norton (I am assuming its that as its notifying you it did) and your running a scan and its not finding a trojan/ad ware it has the hole and this trojan got past your protection. only here? are you positive? and I guess I say this as I have re done friends computers that got this pop up (and its a browser hijacker (IE 7 is not SAFE!! (.) ) do you run any pop up blockers? and what are they? it is possible one of the add servers is throwing this one on to IE users but I don't know I don't get the adds. what if you manually type in a dmusic page url like yours or the main page? is it the same? maybe it has infected your bookmarks?
Distilled1	Date: February 13, 2008 @ 5:45 PM Run. Type regedit Then click OK How to Remove/Modify Registry Entries HKEY_LOCAL_MACHINESOFTWAREClassesTypeLib{12398A44-7DFC-4C46-BD8F-41259D169A0D} HKEY_LOCAL_MACHINESOFTWAREClassesTypeLib{4567AB12-AE24-4FD6-B479-E2B464F32DA6} HKEY_LOCAL_MACHINESOFTWAREClassesTypeLib{ABCD4567-7437-43EF-AB74-4AB1D3A37411} HKEY_LOCAL_MACHINESOFTWAREClassesUWAS6.UWAS6 HKEY_LOCAL_MACHINESOFTWAREClassesuwasfsd.CreationNotifier HKEY_LOCAL_MACHINESOFTWAREClassesuwasfsd.CreationNotifier.1 HKEY_LOCAL_MACHINESOFTWAREClassesuwashellext.ShellHook HKEY_LOCAL_MACHINESOFTWAREClassesuwashellext.ShellHook.1 HKEY_LOCAL_MACHINESOFTWAREClassesuwashellext.WASContextMenu HKEY_LOCAL_MACHINESOFTWAREClassesuwashellext.WASContextMenu.1 (D) Search and delete these WinAntiVirus Pro 2007 Related Files [If Exists ] * %program_files%\ winantivirus pro 2007\ activate.exe * %program_files%\ winantivirus pro 2007\ autoplay.exe * %program_files%\ winantivirus pro 2007\ avkernel.dll * %program_files%\ winantivirus pro 2007\ avupd.exe * %program_files%\ winantivirus pro 2007\ fat.exe * %program_files%\ winantivirus pro 2007\ fopnl.dll * %program_files%\ winantivirus pro 2007\ fsflt.sys * %program_files%\ winantivirus pro 2007\ fsflti.exe * %program_files%\ winantivirus pro 2007\ fwbho.dll * %program_files%\ winantivirus pro 2007\ ih.exe * %program_files%\ winantivirus pro 2007\ mngras.dll * %program_files%\ winantivirus pro 2007\ ntft.exe * %program_files%\ winantivirus pro 2007\ report.dll * %program_files%\ winantivirus pro 2007\ restart.exe * %program_files%\ winantivirus pro 2007\ rsrv.dll * %program_files%\ winantivirus pro 2007\ support.exe * %program_files%\ winantivirus pro 2007\ wav6com.dll * %program_files%\ winantivirus pro 2007\ winav.exe * %program_files%\ winantivirus pro 2007\ winavpgi.dll * %program_files%\ winantiviruspro2006scannerinstall.exe * %program_files%\ windrivecleaner 2005 trial\ windc.exe * %program_files%\ winfixer2005install.exe * %windows%\ downloaded program files\ conflict.11\ uwfx5y_0001_m57m1412netinstaller.exe * %windows%\ downloaded program files\ uers_0001_ni57m1124netinstaller.exe * %windows%\ downloaded program files\ uersi_0001_lpnetinstaller.exe * %windows%\ downloaded program files\ uwa5pnetinstaller.exe * %windows%\ downloaded program files\ uwa6p_0001_n73m0604netinstaller.exe * %windows%\ downloaded program files\ uwa6p_0001_n73m1004netinstaller.exe * %windows%\ downloaded program files\ uwa6p_0001_n822m1605netinstaller.exe * %windows%\ downloaded program files\ uwa6p_0001_n85m0307netinstaller.exe * %windows%\ downloaded program files\ uwa6pm_0001_n73m1004netinstaller.exe * %windows%\ downloaded program files\ uwa6ps_0001_n91m2107netinstaller.exe * %windows%\ downloaded program files\ uwa6pv_0001_n91m2107netinstaller.exe * %windows%\ downloaded program files\ uwa6py_0001_n76m1904netinstaller.exe * %windows%\ downloaded program files\ uwas5_0001_n57m0812netinstaller.exe * %windows%\ downloaded program files\ uwas6_0001_n57m1312netinstaller.exe * %windows%\ downloaded program files\ uwas6_0001_n68m2301netinstaller.exe * %windows%\ downloaded program files\ uwas6_0001_n69m0703netinstaller.exe * %windows%\ downloaded program files\ uwas6y_0001_n91m2208netinstaller.exe * %windows%\ downloaded program files\ uwfx5lp_0001_0516netinstaller.exe * %windows%\ downloaded program files\ uwfx5q_0001_n56m3011netinstaller.exe * %windows%\ downloaded program files\ uwfx5u_0001_n56m1711netinstaller.exe * %windows%\ downloaded program files\ uwfx5v_0001_n57m1212netinstaller.exe * %windows%\ downloaded program files\ uwfx5z_0001_n57m1412netinstaller.exe * %windows%\ downloaded program files\ uwfx5z_0001_n660117netinstaller.exe * %windows%\ downloaded program files\ uwfx6_0001_n57m0912netinstaller.exe * %windows%\ downloaded program files\ uwfx6_0001_n69m0603netinstaller.exe * %windows%\ downloaded program files\ uwfx6_0001_n69m0903netinstaller.exe * %windows%\ downloaded program files\ uwn5lp_0001_0815netinstaller.exe * winantivirus.pro.exe * winantiviruspro2006freeinstall.exe * winantiviruspro2007freeinstall.exe Notes: 1. %ProgramFiles% is a variable that refers to the program files folder. By default, this is C:\Program Files. 2. %Windows% is a variable that refers to the Windows installation folder. By default, this is C:\Windows (Windows 95/98/Me/XP) or C:\Winnt (Windows NT/2000).
Distilled1	Date: February 13, 2008 @ 5:45 PM well wait heres the link YOU ARE INFECTED! http://www.pcontech.com/spyware/remove/winantivirus-remove.htm
Distilled1	Date: February 13, 2008 @ 5:47 PM WinAntiVirus Pro 2007 is a rogue security program that is known to issue fake warnings on your computer in order to manipulate you into buying its full commercial version. If you are infected with this program you may receive warnings in your task bar that appear to be from Microsoft Security Center stating that you are infected with spyware and to run its special anti-spyware tool. This tool turns out to be the commercial version of WinAntiVirus Pro 2007. These warnings are fake and are a goad to have you buy the commercial version of this software. If your computer is infected by Trojan.Zlob and hijacked by the WinAntiVirus Pro 2007 then your computer is in trouble because it does transfer back and forth information from the infected computer which makes it a potential for application/data theft.
Distilled1	Date: February 13, 2008 @ 5:48 PM Im trying to find HOW you get infected as well to help ... because I don't think its here. or my lap top that is completely free of any protection doesn't get it.
Distilled1	Date: February 13, 2008 @ 5:53 PM Winantiviruspro is a malware program that is extremely difficult to get off your computer. See the following page: http://forums.spybot.info/archive/index.php/t-12290.html its a drive by hi jacker it could just be any place you have surfed if its still on or your still getting any thing related to it (even a clean re install wont fix it) use the manual removal stuff it took me about 17 hours non stop on the one I cleaned. started with clean up, hijack this and SB spybot ad aware (sucks now) and finally manual removal... they got it from a my space page link that was the 2006 version. this could have been sitting in waiting for a while as well.
Distilled1	Date: February 13, 2008 @ 5:56 PM FUCK what did I do! I was going to say as well those that think IE is good now are wrong YOU WONT SEE THIS WITH FIRE FOX
Distilled1	Date: February 13, 2008 @ 5:58 PM also Be sure to disable Win XP/vista restore mode. If you do not it will reinstall the malware on each reboot. It sounds like the computer defenses stopped the malware but restore may be trying to reinstall on reboot. this is a must belive me it will keep re installing its deep in sys files.
Distilled1	Date: February 13, 2008 @ 6:00 PM If your computer has become infected with one of these "spyware removal programs", you probably downloaded an infected codec program when you tried to watch a video online or you may have been hit by a "drive-by" installation of Smitfraud. SmitFraud attacks show fake antispyware programs popups on your screen and/or a balloon popup from the windows system tray displaying a warning message that your computer is infected with spyware and telling you to purchase, download & install their program to remove it. The creator of each popup is an affiliate of the particular antispyware program they are promoting, so each time an unsuspecting user purchases the advertised program in hopes of removing the trojan the person behind the attack gets paid. Not a very ethical way of selling an antispyware, antivirus, or other computer pest removal product. In many of the infected computers I've dealt with, programs like "Video Access ActiveX Object" show up in the Control Panel and are the initial infection that start the whole issue. Most of these programs when scanned with an up-to-date virus scanner are shown to be infected with viruses like Troj.Zlob.AN, which was part of the original SpyAxe trojan attack a couple years ago. These attacks have spawned over 100 different varieties of malware issues. Many times the home page is redirected to a fake "online security center" or a user will receive a popup that looks almost identical to the normal Windows Security Center but isn't. You can see a couple of these fake alerts by clicking on the images below.
Distilled1	Date: February 13, 2008 @ 6:02 PM and unless we have videos (we don't yet ) its from one of those sites my space (where people put crap all over their page) or a you tube type site read that last post there and look for that as well. I hope you get it resolved. and as well Jack takes a look to make sure nothing is in the ad server here.
Distilled1	Date: February 13, 2008 @ 6:08 PM a great bunch of info on this one here http://www.pchell.com/support/smitfraud.shtml
Woof	Date: February 13, 2008 @ 6:26 PM Thank you for all of the help and information, Distilled... Unfortunately, none of the registry keys that are listed exist on my machine. Nobe of the .exe or .dll files exist on my machine, either. And yes, this only happens when I visit DMusic. The ad runs, and when I go through the process of closing it out, it doesn't appear again for approximately 24 hours. After another 24 hours has passed, I can surf the web for hours without having this appear... until I come to the DMusic home page. What there is of this program resides in my IE Temporary Internet Files Folder, and all traces of it seem to be deleted after I close the program and clean the cache. Then it won't bother me for another 24 hours or so. That's what leads be to believe it's a temporary script or something that I'm getting as a result of visiting the DMusic home page.
Distilled1	Date: February 13, 2008 @ 6:33 PM nope its in your registry or the explore shell )this can be even diffrent than whats out there as thats the 2006 variant I killed on my friends computer. really dig into that last link and see what I mean, it isn't here at all its just using the bookmark somehow. if you did az re install and that restore (windows thing ) was on its gona do that it will get worse than 24 hours it will eventually be every page and will not allow you to even go anywhere HIjack this is a god send trust me
Distilled1	Date: February 13, 2008 @ 6:35 PM its hot now and re written for all the new holes yesterday was MS update day! that always creates a new hole in IE
Woof	Date: February 13, 2008 @ 8:25 PM Well with all due respect, I do have to mention that I ran into a similar problem last summer. I scanned the PC with every tool imaginable, checked registry keys, compared notes, reformatted my HD with a 3x overwrite, and reinstalled my OS from the factory issue recovery disc set. This was to ensure that there would be no "leftovers" lurking on my PC. Same deal... all went well until I visited a particular website, and whenever I'd visit that site, I'd get the same symptom... once a day, just like now. I stopped visiting that site, and never had the problem again. Until now. I should note that this was happening every day for a couple of days prior to reformatting my HD and reinstalling my OS, and it's been happening daily since I've done that. Same as last time, there appears to be no trace of anything unusual on my PC, with the exception of a file or two in the IE Temporary Internet Files Folder that apparently gets deleted when I clean the cache.
LiQuidMetamo...	Date: February 13, 2008 @ 9:48 PM Dmusic is not the cause of this, although certainly, some of the ads carried by google or this website from 3rd parties can cause gremlins if you click on them. Download HijackThis, make sure you turn on hidden files and print a log. And - download the trial of Webroot Spysweeper, it is by far the most effective anti-spyware out there, 14 days trial and it removes not just detects. Also try running the online free trend micro spyware scanner and bitdefender free anti-virus check. and (no accusations), surfing porn sites, p2p sites, free online cards/cursors/banners/fonts/clipart, etc are notorious. If this is connected with CoolWebSearch (CWS) try downloading CWS Shredder (I think Trend own it now) but Spysweeper by Webroot eliminates it. Post up your hijack log .txt here on on a respected site and you will probably find the rogue registry and startup entries.
LiQuidMetamo...	Date: February 13, 2008 @ 9:51 PM one last thing - any popup box you get surfing complaiing about registry performance, antispyware, antivirus, not up to optimal speed and such - do not click YES or NO. Use task manager CTRL+ALT+DEL to close the program down and run an anti=spyware and anti=-virus check IMMEDIATELY. (You think malware would just let you say 'No' and go away....devious, clicking yes or no has no effect other than YES) BIN IE. If you don't like Firefox, use Opera or anything else. IE7 is just as much a security hole as IE6, drive by downloading just happens because active X controls are the easiest to manipulate for silent spyware.
Distilled1	Date: February 13, 2008 @ 10:36 PM ^ this one is a video codex that WAS downloaded by you at some point. like I said re intall is no good if the Windows restore is not turned off. it will leave traces to come back and haunt you a year later even
Distilled1	Date: February 13, 2008 @ 10:41 PM oh and if you want to post your Hi jack this log here or e-mail it to me I can send you exactly what to fix using hijack this but again theres more that will need to be done I can and will certainly help if you want. anything with an active X or Codec that needs to be installed and they all get past IEs stupid blocker cause IE sucks! can cause this like leads said Xing out of those types of pop ups or saying no actually installs the crap and it replicates over and over every time you re start IE or your computer.
LiQuidMetamo...	Date: February 13, 2008 @ 10:47 PM Good stuff, Woof should be able to rid himself of this problem eventually. Sad fact - Norton is no longer a great tool, it is almost as bad as a virus for resource hogging, it's detection rates and updates are no longer stellar, such a pity, once upon a time a great program. Seriously this is one reason why people run Linux or Mac - the are so low down on the radar for mass marketing that people don't bother writing viruses and malware.
evansorchid	Date: February 13, 2008 @ 11:03 PM My computer is always running slower than normal...Should I be worried? Well, sometimes it runs just fine and I guess I just don't notice it as much. It seems to be running fine tonight, but for a few days last week it kept frustrating me with pop up messages about my wireless server...........I don't know??? Can a PC be bipolar?
ChillinBuzz	Date: February 13, 2008 @ 11:18 PM AVG Anti-Virus Free. Trend Micro Anti-Virus (the version i run does not need installing and runs from DOS or Windows, i get the updates from their site every other week as i use this only as a backup... and it has caught a couple of things AVG has missed). Spybot 1.4 (i also run 1.5 on a machine and it seems awfully slow to get going compared to 1.4) Ad-Aware has changed to a 2007 version from the old 1.06SE (and it now runs a "service" in startup that is needed to run the app itself, which i don't agree with. it can be set to manual but only if you know what you're doing with the administrative tools - i assume there must be some similarity with these between XP and Vista, correct me if i'm wrong). DarkSpy 1.05 and IceSword 1.22 - advanced detection tools i use for checking things at the API level, not really recommended for security n00bs (that's the type that throw on a firewall, anti-virus, maybe anti-spyware and think they know it all about security!). AVG Anti-Rootkit (1.1.0.42) from their site. Free. Sophos Anti-Rootkit (1.3) like AVG, from Sophos website. CWShredder - Trend Micro CoolWebSearch trojan remover, i have quite an old version but i keep it around, haven't checked for an updated version lately. If anyone knows if any of these don't work with Vista, save me some time later this year when I start testing the OS and let me know if they don't work, since I'm pretty happy with XP SP3 beta right now and see no reason to replace the entire network with an operating system that's getting worse reviews than XP did when it came out (and it took me 3 1/2 years to "adopt" XP!)
Opossum	Date: February 14, 2008 @ 10:07 AM On 13th Feb 2009, leedsquietman said: and (no accusations), surfing porn sites, p2p sites, free online cards/cursors/banners/fonts/clipart, etc are notorious. Yes, I've found that free screensavers and such are often the worst offenders. I once had a screensaver that, after it installed, gave 75+ malware warnings relative to files, registry entries, etc., even when I told it to NOT install the additional "offers". On 13th Feb 2009, leedsquietman said: one last thing - any popup box you get surfing complaiing about registry performance, antispyware, antivirus, not up to optimal speed and such - do not click YES or NO. Use task manager CTRL+ALT+DEL to close the program down and run an anti=spyware and anti=-virus check IMMEDIATELY. Yep, most pop-ups are total fakery relative to "buttons" that do nothing. This includes all those bogus "winner" notices. At any rate, I use the hosts file, so rarely see any data of any ad server or fake site anyway.
Distilled1	Date: February 14, 2008 @ 11:15 AM I still use Norton with no issue but did do the FREE upgrade to 2008 and now it takes a few min to load going to drop back to 2007 as it was fast and didn't seem to effect any resorces this is doing a lot runing SL (witch many of you have found needs some massive CPU and memory to run at the same time shoutcast firefox (surfing here and all over) as well as Krystal audio FLstudio and the E-MU patch soft mixer. I have avg on the old box killed everything else but counter spy a paid for spywear remover blocker that I think is well worth the $ supper fast
Distilled1	Date: February 14, 2008 @ 11:18 AM ^ to add I run clean up every couple of weeks along with HijackThis for GP no issues in over 3 years. and I visit P2p, porn , but not the free stuff sites those tend to be the worst and the kids always manage grabing those
Woof	Date: February 14, 2008 @ 10:54 PM Well here's the follow up story: After logging off last night, I reformatted my HD and reinstalled the OS from the factory discs... again. So far, I haven't had this problem recur. A couple of things that I ought to mention: I work with both Vista and XP, and to date, this particular problem has only affected Vista. Yes, I use IE7. The main reason I use it is because many, many users never use Firefox, and if there are problems to be found on the web, IE is usually quick to pick them up. Yes, I'm setting myself up as a guinea pig. This is because I don't believe that parts of the web should only be comfortably accessible by people using Firefox, or Apple OS'es, or Windows XP. If a site causes problems for XP users, for example, there's something wrong with the site. The solution is to fix the problem with the website, not to attach a disclaimer that instructs users to upgrade their OS or their browser. As for eliminating any problems on this end, I learned a lot. I do watch foreign programs occasionally on my PC, and a rogue codec seems to be the likeliest explanation of how I managed to pick anything up. I've since set WMP not to acquire codecs automatically, and I'm hoping that this will prevent a reinfection. That still doesn't explain why I could surf the web for days without experiencing any problems, and the minute I arrive at DM, I got these popups, though. I'd like to know why that only happened here. On a final note, there are only a few adware/spyware removal programs that I trust. Spybot, Kephyr's Bazooka, and Norton are the first line of defense. None of those programs detected any infection on my end. One program did, though: Enigma Software's Spy Hunter. It found a registry entry that it labelled as the Vundo Trojan. I removed the registry entry, and the popup ads that I showed in the screenshots above went away. Unfortunately, after the removal, whenever I'd come to DM, the DMusic index page would redirect me to other sites that sold spyware removal software. I was redirected three times, to three different sites before I gave up. I ran Spybot, and it detected SpyHunter as adware. I removed all traces of SpyHunter, and the redirects stopped. However, whenever I'd visit the DM index page after the uninstall, the original popups were back. This is what makes this so aggravating. I've read on the web that a number of these spyware/adware removal programs actually do remove the original problem, but then install their own brand of adware. Apparently, this is what happened with SpyHunter. And that's what makes resolving this problem such a pain. You could eliminate one program, but pick up two or three more problems in the process. I'd still like to know why the problem only appeared here. I'd really like a member of the DM staff to say that they've checked the contents of the site since it's been moved, and can guarantee that there is no problem on their end. No offense, but that's what I really wanted to hear when I first posted this. Anyway, it looks like I'm okay for now, at least... and I sure hope that this hasn't happened to anyone else.
LiQuidMetamo...	Date: February 15, 2008 @ 9:00 AM The only anti=spyware programs I trust are Spybot (but it's very ineffective), CA Pest Patrol (better detection but not the best), Ad-Aware (I found it to be quite ineffective), Spyware Doctor (usually rated in the top 3 in tests but not as often as Spysweeper) Microsoft DEFENDER (which they bought from Sunbelt and is a derivative of Counter Spy), it's detection rates are quite good but it flags more false positives but without a doubt the best rated one I;ve used over the past 4 years or so and is consistently awarded the highest rank is Webroot Spysweeper - it removes the Virtundo trojan no problem and has better active shields than the rest. I got the trojan in the first place because I was surfing after recording, where I turn off all a/v,a/s and even the wireless network for better recording performance and I had forgotten to turn Spysweeper back on. Trend's free online scanner is quite good and sometimes gets things missed by others and Bitdefender free A/V is also good (as is Kaspersky). The majority of anti=spyware programs are rogue. read this info http://blogs.zdnet.com/Spyware/?p=727 http://www.spywarewarrior.com/rogue_anti-spyware.htm and the TRUSTED http://www.spywarewarrior.com/rogue_anti-spyware.htm#trustworthy
Distilled1	Date: February 15, 2008 @ 9:31 AM it kept coming back here because IE allowed it to hijack the browser and it was somehow affiliating itself to go off at this particular URL maybe one you goto the most? if it was here I would have it. I tried to get it even loged in as a non sub and clicked all the adds ...nothing. WMP is another HOLE in security its a blotted pile of crap. I have never seen a web site say I have to upgrade my OS some are built around certain browsers but thats the designers choice see Microsoft wont go with a web html standard but MOZILA (Firefox has) and anything that works on IE will work on Firefox besides MS update and a very few video sites like netflix instant watch video. Woof on a brand new HD you shouldn't be doing all that re formating and re installing. when you have have you made sure that the vista recovery counsel is turned off? if not it will still be hidden on that HD just waiting... re formating don't really wipe it clean. just marks the space available to write
GeneHilbert	Date: February 15, 2008 @ 10:09 AM I can't seem to get Firefox to install Java plugins..... but everything else seems to work.....
Distilled1	Date: February 15, 2008 @ 10:15 AM Gene yeah its weird with java plugins and sometimes flash as well. I think I did a manual install from java itself and once it was on it was there. that would be my only complaint with Firefox is until all the little plugins ypu need are in it can be a little maddening trying to do somethings.
NosmoKing	Date: February 15, 2008 @ 10:19 AM You may want to consider grabbing spyware blaster. It is free from places like download.com ... and very good at stopping malware before it hits your system as opposed to finding it later! Search and Destroy is another free one that is also very good! Both easy to find and worth the dl! If your running Vista.. forget it
NosmoKing	Date: February 15, 2008 @ 10:26 AM Ok.. I take that back it seems they have added Vista to Search and Destroy.. Now there are 3 programs that run on that pig of an OS
zedsalt	Date: February 15, 2008 @ 11:23 AM Once again, LQM has provided some links to really useful, valuable info! Thanks to those lists, I know that if I take NosmoKing's recommendation of Spyware Blaster, I should get the one from javacoolsoftware.com, NOT the one of the same name from spyware-blaster-software.com! We had Spybot Search and Destroy for awhile, but it only ever found one data miner over and over again, while AdAware SE was finding dozens. We abandoned AdAware when they stopped offering free updates, and updated to the latest Norton the moment we had the chance. Symantec said the new Norton has anti-spyware, but when I run it, then the AdAware, what I get is one threat found and eliminated by Norton, followed by forty to eighty-some found and eliminated by the not-recently-updated version of AdAware.
NosmoKing	Date: February 17, 2008 @ 7:18 AM Search and Destroy has an updated engine.. now it will find two!
sprog	Date: February 17, 2008 @ 10:59 AM Hi all, poggy here... I'm at work so using my "roaming" account. N.B. only subscribers should have roaming accounts, and I only use this account for when I'm accessing dmusic on a system that I don't handle the security on It's been interesting reading woof's lovely WinAntiVirus Pro 2007 infection, It's a work of art, this one It got me thinking... at this point, DMusic doesn't really have much in the way of articles that users can access for the purpose of locking down their computers, and lets face it, musicians would rather be fiddling with their music, not thier spyware removers.. I will look into writing something like this up in the near future.
sprog	Date: February 17, 2008 @ 11:35 AM ...it certainly looks as if a browser hijack is involved as a part of the infection. The problem with popups such as this is to do with the way that they are coded. If such a popup appears, and you click on the Okay, Cancel or even the Red Cross, it has most likely been coded so that the spyware will go ahead and install anyway. The only way around this is to press Alt-F4 to close the popup, or as stated earlier, Ctrl-Alt-Del and kill the process with the task manager... Alt-F4 is easier, and usually they havn't coded in an exploit to install on this combination. Looking at the series of events, it is probable that the infection has contaminated the system restore, so turning it off, restart, turn it back on, restart will clear that out. As for it coming up on dmusic only, it is most likely a browser hijack, and/or a modification of the host file that basically will redirect you back to the rogue site and re-infecting... I'm thinking either triggered by DMusic itself, or more likely one of the companies that advertises with DMusic. For example, your host file can be modified so that every time the zzsounds.com banner ad is displayed, it will redirect you to the WinAntiVirus Pro 2007 address in the background. Vundo has been in the past quite difficult to stamp out because every time the security companies release a fix for it, the spyware writers simply modify a file name to release yet another variant... even worse, sometimes they make the spyware self-generate a random .dll file to carry the nasties around.
leflaw	Date: February 17, 2008 @ 11:44 AM Let us know if you find any dmusic "infection"- these are brand spanking new servers....
ChillinBuzz	Date: February 17, 2008 @ 5:23 PM Yeah, HOSTS file is a good place to do a lot of blocking. I have a customised one I started working on back when I used ZoneAlarm as my firewall and caught it talking to the net one day... Found it did that quite often, so I blocked all of its destinations in HOSTS. Made a mess of my Yahoo email screen too because some of their ads at the time were coming through the same server as some of their other coding... Sorted eventually though. My setup works pretty well, to date the only thing to have passed through was stumbling across a page that stuck me in a loop and demanded I install ActiveX (onto Firefox? get lost!) but since I had several pages open I didn't have bookmarks for and work I was reviewing, I finally accepted the download and AVG annihilated it the moment it touched down.
Opossum	Date: February 17, 2008 @ 5:52 PM My hosts file is up to about a megabyte in size.
Distilled1	Date: February 18, 2008 @ 3:37 AM I have been testing this... as I like to get infected just to learn how to kill and fix. I can not get this from DMusic I have clicked every add etc. anyone that has it have you been able to goto any dmusic pages without it? and if its one page that causes it can you post it and note the add that is in the banner?
ChillinBuzz	Date: February 18, 2008 @ 8:09 PM A megabyte? mine's considerably smaller... Oh, you do know that a large HOSTS file can bog down a Windows machine? However, disabling the DNS service is supposed to fix this... But if your network connection drops dead afterwards, don't look at me. I have the DNS service disabled here but I fixed all the network IP addresses and settings manually so I don't really need it.
miraclemaker	Date: February 18, 2008 @ 11:56 PM I am convinced that visiting sites on myspace can create numerous adware and or virus related problems... I actually go there allot less, and only cause I have a page and clients there. Also STAY CLEAR OF CLICKING ANY ACTIVE X OR ADDS IN GENERAL. I was getting booted off this site(and then offline with a messege that my system was runnin low and needed to run some crap) and had almost the same nasty adware problem - but I seemed to fix it when i eliminated an Active X update, and ran Adaware 07
jack	Date: February 19, 2008 @ 1:06 PM I haven't been able to track down the source of the problem yet, we only have one add that is served on a rotation basis and that just looks like banners, as far as I've tested. However, if this happens to you, please let me know ASAP and pass along a screenshot of the page it originated from.
ShadowMom	Date: February 19, 2008 @ 2:42 PM As I said, this has happened before. http://www.dmusic.com/forum/complaints/23663%5Bhl\|popup+ads%5D And if you look down the posts, there is a mention of some of these programs there. Maybe bringing this up will help, maybe not. But it looks like the same type of thing to me.
Distilled1	Date: February 19, 2008 @ 3:19 PM ooglesyndication.com/pagead/iclk?sa=l&ai=BqXx4KZy7R_fWMai64wGlvbGOBd6FtReu--GwA8CNtwGgnAEQARgBIMmNzAM4AFDVwdjo-v____8BYMnO-ofwo-wSqgEKMDI2NjY5MTMzMLIBEWxlZmxhdy5kbXVzaWMubmV0ugEJNDY4eDYwX2FzyAEC2gEZaHR0cDovL2xlZmxhdy5kbXVzaWMubmV0L4ACAagDAcgDBegDI-gDwQLoA9gB&num=1&adurl=http://mzeus.com&client=ca-pub-9481392970019966&nm=6&jca=7404 clicking on that link.
Distilled1	Date: February 19, 2008 @ 3:20 PM well it cut off but its an add here that has some script in re directs over and over ...still got no issue
jack	Date: February 19, 2008 @ 3:21 PM java script implementation
jack	Date: February 20, 2008 @ 12:07 PM got this today when I was messing around on IE 6, only time I've had it happen to me before. However now I'm 100% sure it's coming from DMusic. I have a sneaky suspicion that this is coming from Google. In fact, I'm just about sure it is.
ShadowMom	Date: February 20, 2008 @ 12:31 PM New Google Trojan Software Swaps Google Ads for Malware
Distilled1	Date: February 21, 2008 @ 5:11 AM time to kill the google adds !
Distilled1	Date: February 21, 2008 @ 5:15 AM another reason to STAY AWAY FROM IE !!!! but no its secure its MIcro$oft thats all that is their security is I hate that I even have WIN OS I really wish I could run a MAC! (afford ) but my PC blows the most expensive OoTB MAc away for 1/2 the price
DaveWL	Date: February 21, 2008 @ 5:22 AM On 20th Feb 2009, jack said: got this today when I was messing around on IE 6, only time I've had it happen to me before. However now I'm 100% sure it's coming from DMusic. IS that a typo - Don't you mean 100% sure that it is NOT coming from DMusic. Anyway I have caught this on my work computer now. I don't know where I caught it from but it appeared not long after I accessd Dmusic.
Distilled1	Date: February 21, 2008 @ 5:56 AM its really from the google add server read the link Shadowmom posted! and let your work know thats what it was as well or they'll block the wrong things like DMusic hehe
jack	Date: February 21, 2008 @ 6:02 AM No, Dave, the ad is being served from DMusic. As Distilled pointed out, it looks like it's coming through Google ads. I'm disabling them for the time being.
ChillinBuzz	Date: February 21, 2008 @ 10:15 AM Whatever you disabled, it didn't stop it. I was accessing DMusic from a downstairs machine (as that one has SP1 and IE6 untouched on it) but after visiting my music page, I got a popup from a different site to the one above. I don't get the issue here because I have Google Ads blocked using Adblock but the system downstairs doesn't have my ridiculously strict level of security...
ChillinBuzz	Date: February 21, 2008 @ 10:18 AM Oh, I forgot to add the popup appeared in Firefox, not IE. Only the once, couldn't get it to show up again. One thing I noticed is that the user had installed WindowBlinds and some stupid screensaver that updated from the net... So I'm assuming a possible infection. Spybot and AVG didn't pick it up, so I've just been informed as I write this.
jack	Date: February 21, 2008 @ 10:26 AM On 21st Feb 2009, ChillinBuzz said: Oh, I forgot to add the popup appeared in Firefox, not IE. Only the once, couldn't get it to show up again. One thing I noticed is that the user had installed WindowBlinds and some stupid screensaver that updated from the net... So I'm assuming a possible infection. Spybot and AVG didn't pick it up, so I've just been informed as I write this. Okay, thanks. The same happened to me, once I got it show, I couldn't get it again. Currently I'm trying to get it to show on my vanilla install but I'm having trouble. However there's now absolutely no java script served ads on the website, I'm quite confused.
ChillinBuzz	Date: February 21, 2008 @ 10:35 AM I checked for installed plugins on Firefox downstairs and they have Fasterfox. I have never used that plugin before so I don't have a clue how it works. Have convinced them to backup their data and get a reformat on the cards, since the machine hasn't had a good flush out in nearly 2 years (not my fault, they wouldn't let me) and the system is full of crap. I may make a clone of it to study it closer but I doubt I will find anything. What I'm trying to work out is why none of the basic security apps are catching anything but I haven't assaulted it with my heavy duty tools yet.
Distilled1	Date: February 21, 2008 @ 10:59 AM maybe Google is on the ball and catching it?
8111	Date: February 21, 2008 @ 2:59 PM I've tried Avast, PC Doctor, Seek and Destroy, Adaware, Bitdefender, etc., etc...but this is what finally worked for me. http://www.simplysup.com/
shadowself	Date: February 21, 2008 @ 3:46 PM BRING BACK THE BENEVOLENT OLD ADWARE PROBLEM!!!
Woof	Date: February 21, 2008 @ 6:00 PM Well, when I had this problem, it appeared to be on a 24-hour cycle. In other words, I suspect my IP was being checked, and the ad would not reappear for 24 hours after I closed it out. I'd wait a day, and sure enough it would come back. Just once. BTW, I would like to thank you all, once again, for looking so deeply into this. Especially Jack, who I'm sure has millions of things to attend to, in addition to this. Much appreciated.
Woof	Date: February 21, 2008 @ 6:02 PM PS. By "Just once", I mean just once per 24-hour period. I believe I received this ad once a day, for approximately five days.
jack	Date: February 22, 2008 @ 1:48 AM I think I've fixed it, if anyone has this or anything like it again, post here.
CarvinAbuser	Date: February 22, 2008 @ 10:20 AM I got the same initial popup that Woof got about 5 minutes ago right after logging in. I'm using Firefox also.
NickSawyer	Date: February 22, 2008 @ 10:36 AM FUUUUUUCK! I just got it here with Firefox
Woof	Date: February 22, 2008 @ 10:59 AM If it's any help, I had something like this happen to one of my personal websites a couple of years ago. Since it was a personal site, there was no advertising, linking to search engines, or much of anything else on it. Just an index page with some graphics and text. I used it as a utility site, so I wasn't working on it a lot. A couple of months went by, and when I went to check it, BOOM! Redirect! I downloaded the index page from my site, and compared the code with the index page that I'd originally uploaded. It turned out that additional code had been written into my index page. I don't know how. At the time, I assumed it was just a formatting thing that occurred during my upload. Anyway, I deleted the live version of my index page and replaced it with my original version. That fixed the problem, and it hasn't been back since.
Distilled1	Date: February 22, 2008 @ 10:16 PM I final got it. FF malware scan pop up and re direct. community page logged in.. blockers on. (well it may just be showing now as i was trying to get w/ no security...) 0515 hrs est 2/23
jack	Date: February 22, 2008 @ 11:00 PM Ah, bugger..
Distilled1	Date: February 23, 2008 @ 12:42 AM only 1 time cat get it back and scans/hi-jack this find nada! Google/yahoo tool bar intrusion?
TameasDust	Date: February 23, 2008 @ 5:42 AM And I thought it was my drugs making that pop up on the screen ... well whatta yah know
Distilled1	Date: February 23, 2008 @ 6:49 AM so I can't get it on my main box. Only the lap top but they are running about the same. Like I said I got it one time community page logged in (no ads) macafee security (all up to date*it came with the lap top ) I ctrl-alt-del of the window. (i xed the pop up and it re directed to malware scan something I was drowsy as I wasent really awake kinda in a stupor (wish I had been here to do some research on the site it re directed to) if anyone gets this and its something like malware scan needed , if you get to the full size page PLEASE post the url address of the page that it goes to from there it should show somewhere if its still a dmusic.com url, please see if you can goto view page sorce and e-mail me the source Detroit68(remove-no spam)@Gmail.com so that I can try and help find what it is that is getting us. as Firefox is now getttting hit by it and by the looks ^^^^ its starting hard. on a maybe related note everytime I restart any of the 3 computers here I get the Microsoft update shield in the task bar saying downloading updates 0% and then it goes away if I try and click to see what. this makes me wonder what damn Winblows security hole gates opened with last Tuesdays updates!
Distilled1	Date: February 23, 2008 @ 6:56 AM Run): ping -t pagead2.googlesyndication.com The response should look similar to this: Pinging pagead.l.google.com [6x.xxx.xxx.xxx] with 32 bytes of data: where the x's represent digits. If you are not infected, the first digit will be a 6 (as in the example). If you are infected, the first digit will be a 9. http://www.bitdefender.com/VIRUS-1000239-en--Trojan.Qhost.WU.html
Distilled1	Date: February 23, 2008 @ 6:58 AM To check if you are affected, you should issue the following command (from the command line that stuff above!^ also the link tells how to kill it. Jack its google adsence text adds please make sure they are off all the pages I think Google is trying but they can't check all the ads.
Distilled1	Date: February 23, 2008 @ 7:02 AM So I am on the big box I ping a 209.85.159.164 but thats a 2 not a 6 or 9 not sure what that means going to check the lap top.
Distilled1	Date: February 23, 2008 @ 7:09 AM laptop is a 64.xxx.xxx.xx ! so I will find how to remove it
shadowself	Date: February 23, 2008 @ 7:12 AM On 23rd Feb 2009, Distilled1 said: this makes me wonder what damn Winblows security hole gates opened with last Tuesdays updates! Gates has not written code for Microsoft products since 1989.
Distilled1	Date: February 23, 2008 @ 7:21 AM I am running bit defender on the lap top free version now. then to find the damn host file and change/remove it. I will post the free bit defender results when done.
Distilled1	Date: February 23, 2008 @ 8:10 AM ^ yeah I am some days///
Distilled1	Date: February 23, 2008 @ 8:11 AM bit defender found other crap but not that it moved all gota get in the registry and try to remove that line from the host file ...I hate messing with the reg edt.
Distilled1	Date: February 23, 2008 @ 8:14 AM Did remove it. now geting a 209.xxx.xxx.xx gona leave the host file alone for now see if it comes back.
Distilled1	Date: February 23, 2008 @ 8:19 AM http://shoppingsearch.bizrate.com/ is on the front page still its bizrate I don't know if google was on last night but my guess is this is the one that got me last night /this AM
ChillinBuzz	Date: February 23, 2008 @ 9:06 AM Thing is, if it's already made its way onto machines, people may continue to see it. Set your HOSTS file to read-only after removing any references to "pagead2.googlesyndication.com" in it. I'm not going to describe how to deal with it because someone's bound to cock it up and blame me for it, so go look online for it.
ChillinBuzz	Date: February 23, 2008 @ 11:27 PM It seems some people are still running into this... What the heck is going on?
NickSawyer	Date: February 24, 2008 @ 10:41 AM I have not read any of this forum so forgive me that this is most likely totally irrelevant, but I don't think it has to do with Dmusic. I don't know why. I just don't.
Distilled1	Date: February 25, 2008 @ 5:31 AM Nick it is not DMusic but the ads that server on the pages. and I got my "test" laptop (i dont care about as it stores maybe some games and a few songs pics) to get it finaly the other day logged in well now I cleaned it and finaly got the host file refrence found and removed (god I hate reg editing its scary! ) well this AM I wake up (lap tops on all night on my user page always) was logged in... clicked to goto the main page Home thru the logo , was logged off saw the page less that 2 seconds and was re directed to the maleware opo up. LefLaw please have Jack or another coder remove all ad server adds that are text based (I don't think the banners can do it ...yet) from all I have read Google and Biz what ever... are trying there best to keep stuff out. and I know we use these on a pay per view on pages as well as 10000's of sites but this is going to effect non subscribers and apparently subscribers them selfs. Chris can you e-mail me or note me how to set to read only (i wont yell if I bugger up my box )
Distilled1	Date: February 25, 2008 @ 8:06 AM I am finding it more and more on the front page .. I do notice that the advert (text) area is placed adds so I don't think its there. is the Google one gone? I see a Biz thing atthe bottom left. is this serving a bad ad?
ChillinBuzz	Date: February 25, 2008 @ 9:52 AM Rich, you know something? I have this feeling the ad would never be able to push through anything, not even malware, if instead of the solution about removing the HOSTS entry it was to change the IP address it lists to 127.0.0.1 - That way nothing from that address would ever show, bad or good. As for making it read-only, I set mine with a right-click on the file, selecting properties and then "read only"... Nothing's touched it, not even WinMX when I last installed it (ages ago now). Mind you, if you modify it, remember to take the read-only off first... DISCLAIMER: What works for me may not work for you. If you manage to kill your OS, be it XP like mine or the sorry Vista that you might be lumbered with, tough poop. Nobody told you to copy me, therefore I am not responsible for anything going wrong, including but not limited to: Acts of God, headless chickens clogging up the fans, monkey jism in the USB ports and n00bs looking for a quick pleasure experience.

Post A Reply
From:	guest	(Icons - Linking)
Post: