Blog Archive

Wednesday, 23 June 2010

The joys of file sharing: malware sharing

MyWebSearch, the old familiar toolbar, is still around

The team came across these yesterday on a file-sharing network in a file “Power DVD 8 Cracked.rar.”

It installs, without proper notice, MyWebSearch, FLV Direct Player and other garbage. Adam Thomas found a similar surreptitious install of FLV in April – clearly that was part of an affiliate program scheme in which someone was getting paid each time FLV got installed.

See Sunbelt Blog: “Bot installs adware along with video player”

The MyWebSearch Toolbar is a customizable Internet Explorer search toolbar which installs other tools, including pop-up blockers, screensavers, and cursors. Searches entered into the toolbar search field are directed to MyWebSearch.com. MyWebSearch has been around for five years.

(Click images below to enlarge.)


Webfetti


Fetti

Fun_stall


Fun_tool

It does have the URL to an end user licensing agreement buried in its code http://www.stasga.com/view-eula.php which pretty much describes what it’s going to do:

“7. By pressing ‘Accept’ you agree to the terms of the following: You allow us to modify your HTTP packets in your packet filters. This will allow us to modify your URL in your browser. “

For some strange reason, the EULA has no section six.

Thanks Adam,

Tom Kelchner

No comments:

Post a Comment