New Problem with Fileserve: Malware

[clemh01]

I tried to download a file through fileserve from one of Mamasa's Seeded Fed & Wet, entry #421 Swimteam through this link:
http://www.fileserve.com/file/uASkzD...T3am_scn#5.wmv

When I clicked the slow download button and typed in the code and then waited the 30 seconds, I clicked on the green slow download button and instead of downloading the file it downloaded, nearly instanteously something called "Win 7 Security 2012" which proceeded to appear as if it were running a scan and then told me that my computer was infected with all sorts of malware and it would not let me launch much of anything. I could not uninstall it not could I avoid it. I finally had to do a system restore to a previous uninfected time in order to get rid of it. It kept directing me to screens saying that I was infected and asking if I wanted to pay them. It even told me that my version of McAfee Internet Security was infected with a Trojan horse virus. Never had this problem before with fileserve. Don't know if it affects highspeed downloads, but I spent 45 minutes to an hour messing with this.

 

[gb2000ie]

I tried to download a file through fileserve from one of Mamasa's Seeded Fed & Wet, entry #421 Swimteam through this link:
http://www.fileserve.com/file/uASkzD...T3am_scn#5.wmv

When I clicked the slow download button and typed in the code and then waited the 30 seconds, I clicked on the green slow download button and instead of downloading the file it downloaded, nearly instanteously something called "Win 7 Security 2012" which proceeded to appear as if it were running a scan and then told me that my computer was infected with all sorts of malware and it would not let me launch much of anything. I could not uninstall it not could I avoid it. I finally had to do a system restore to a previous uninfected time in order to get rid of it. It kept directing me to screens saying that I was infected and asking if I wanted to pay them. It even told me that my version of McAfee Internet Security was infected with a Trojan horse virus. Never had this problem before with fileserve. Don't know if it affects highspeed downloads, but I spent 45 minutes to an hour messing with this.

What makes you sure this has anything to do with FileServe? Co-incidence is evidence of nothing.

B.

 

[clemh01]

Well it is coincidence, but since I had never had this problem before and doing a system restore seems to have solved the problem, it is logical to assume that the problem arose from fileserve. Co-incidence may be evidence of nothing, but occam's razor would point to fileserve. Why do you think it has nothing to do with fileserve? Have you tried the link in question?

 

[gb2000ie]

Well it is coincidence, but since I had never had this problem before and doing a system restore seems to have solved the problem, it is logical to assume that the problem arose from fileserve. Co-incidence may be evidence of nothing, but occam's razor would point to fileserve. Why do you think it has nothing to do with fileserve? Have you tried the link in question?

In computers, you simply can't make assumptions that coincidence means proof. Many things happen at the same time on a computer, and they are not all related.

Malware like these fake AVs will sit in wait until either a certain time interval has passed, or until they see you doing something that an AV might realistically intercept, say downloading a file.

All we know is that you have a virus, and that you use FileServe.

As for me following the link, no point since I'm on a Mac so I can't get windows malware.

B.

 

[slimjim]

Hi Clem.. Well I don't know what this means but the link in your post is now showing up with the error message: 404 - Page not found... but the link in mamasa's post is still active... maybe some "corruption" has found it's way onto that link when you opened it??? ...I'm not techie minded enough to know if this is a possible explanation.

 

[clemh01]

Slimjim,

I just copied the link from Mamasa's post into my post. The problem arose after I had clicked the link in his post and gone through the rigamarole of doing a free download (type in the code, wait 30 seconds), then when I clicked the link to actually download the file, is when the problem arose. I don't know for certain that somehow that computer was not infected previously, who knows gb could be correct, but since I had downloaded other files from GH provided links as recently as yesterday with absolutely no problem, I think the problem lies with the fileserve link. It may be restricted to that particular file. I just wanted others to know that, at least potentially, there is a real problem and to be aware.

 

[slimjim]

Slimjim,

I just copied the link from Mamasa's post into my post....

... It may be restricted to that particular file. I just wanted others to know that, at least potentially, there is a real problem and to be aware.

Yeah, that was the "weird" thing - that the copied file was dead, but the original was still live... that's what made me think of some kind of "corruption". And you were right to flag it up as potentially suspect.

Glad to read that a Restore cleaned your system

 

[gb2000ie]

It may be restricted to that particular file. I just wanted others to know that, at least potentially, there is a real problem and to be aware.

If that's true, then the problem is not with FileServe, but with the file that was uploaded by the uploader.

Ultimately, all these file hosting services do the same thing, they allow a person to share files with loads of people. The actual file shared could be anything, and has nothing to do with the service it is being shared with. It could be a book, a song, a doent, a movie, porn, a boring annual report, software, or, malware.

If, as you think, it came from the download link, then the problem is as likely to come from the poster as from the upload service. The uploader's computer could be infected with something, so even if the uploader is the blame, that does not imply any malice.

One thing to say, on all ad-supported sites, and I do mean all, there is a risk of infected ads being displayed. This happened on the NYT site, so it if it can happen there, it can happen anywhere. It may be wise to at the very least run a flash blocker, and perhaps even an ad blocker for your own protection, especially on the underbelly of the net, which porn certainly is.

B.