Slashdot Mirror
Walmart Photo Keychain Comes Preloaded With Malware
Blowit writes "With the Christmas holidays just past and opening up your electronic presents may get you all excited, but not for a selected lot of people who got the Mercury 1.5" Digital Photo Frame from Walmart (or other stores). My father-in-law attached the device to his computer and his Trend Micro Anti-virus screamed that a virus is on the device. I scanned the one I have and AVAST did not find any virus ... So I went to Virscan.org to see which vendors found what, and the results are here and here." Update: 12/29 05:44 GMT by T : The joy is even more widespread; MojoKid points out that some larger digital photo frames have been delivered similarly infected this year, specifically Samsung's SPF-85H 8-inch digital photo frame, sold through Amazon among other vendors, which arrived with "W32.Sality.AE worm on the installation disc for
Samsung Frame Manager XP Version 1.08, which is needed for using the SPF-85H as a USB monitor." Though Amazon was honest enough to issue an alert, that alert offers no reason to think that only Amazon's stock was affected.
No one has disassembled the binary yet to see what it does? Does it call SetWindowsHookEx or something?
I have read about Sony adding Malware (and Rootkits) to their consumer USB removable devices before...
I also wonder if these files "DPFMate.exe" and "FEnCodeUnicode.dll" are something someone post-production put on the devices or if these files are some intended application?
Never using a digital photo frame before, I assume one simply copies image files into a mounted USB attached drive letter folder? (similar to how USB drives mount as a removable drive letter folder in Windows)
This is old news. It has happened before. Case and Point.
If our elected representatives no longer represent us, do we still live in a Democracy?
Write them a letter telling them what you found. Try this link http://walmartstores.com/contactus/feedback.aspx to get to their headquarters, where something might get done about it. Include enough technical detail for them to replicate the problem, especially the model number or any other identifying information from the package.
If you want someone to care enough to write back, try to not sound accusatory or threaten to sue them. I'm sure they get enough of that on a daily basis.
John
Did you take a picture of it?
Shit anti-viruses shitting their pants over the packer used and then pumping out a false positive (yes, in this case, I'm pointing at you too Avira!).
It's all heuristics. I doubt it's actually anything to worry about.
Looks to me like they used some kind of packer to make the exe's small to not take up a lot of space on the device (understandably). A lot of scanners will automatically detect packing as malware and, due to the nature of how a packer works, trojan is the logical choice. I have a similar problem with anything I compile with delphi since a lot of malware is developed in delphi.
My 2 cents worth...
this time it seems like it was the vendor's screwup, which is very rare, but it's very easy for someone to have a clean USB stick, then plug it into an infected PC and unknowingly get a trojan written to the USB stick.
i recently had close call myself when i took my PSP to work and plugged it into a workstation (i had some utilities and e-books saved on the memory stick). when i got home and plugged the PSP into my desktop, i noticed the PSP memory stick was displayed with an odd icon in My Computer. so i looked at the root directory and found a suspicious .exe file that i hadn't placed there, which was also referenced by a new autorun.inf file.
with thumbdrives, external hard drives, portable media players, and other flash memory devices becoming increasingly common, i expect more and more malware writers will exploit them as an infection vector, especially as autoplay is usually enabled by default on Windows systems. the only reason i had autoplay disabled was because i found it annoying, and that's the only reason i lucked out.
If avast didn't find it then....
Eviscerate the Proletariat!
According to those links you provided, Trend Micro did not find anything wrong. (could be different settings, version, &c.) However... many of the positives were heuristic and, as further evidence of this, the identifications were not consistent.
Maybe it's just badly coded junk; nearly as bad, perhaps, but exactly what you'd expect from the Wal*Mart holiday special.
(insert obligatory comment about slashdot editors)
"They were pure niggers." – Noam Chomsky
Keep in mind that it might be a false positive. Those happen, and sometimes you find the same false positive in more than one AV product when they simply copy from each other instead of creating their own definitions from the real thing.
An example is the game The Witcher, which triggered a false AV protection in ESET Nod32 antivirus. Then, suddenly, a couple of months later, a couple of other products also started seeing a virus here. There was none -- the packer that had been used by the game had also been used for a virus, and the signature was copied from NOD32 to some less successful AV programs without further ado.
So, don't just take it on face value that there is a virus -- especially not when none of the really big players with low false positive rates can detect it. It may be one, but don't blindly assume so.
Hmm... I see a bunch of AV's that are prone to give false positives give positives, while F-Secure, Kaspersky, Antivir, AVG, McAffee don't give anything off, Gee, could it possibly be that it's a false positive? [Hurr]OH I DUNNO[/Durr]
For those sarcastically challenged.
Yes, it's to 99.99% sure it's a false positive.
I didn't RTFA...whatever. Anyway, I'm sure this product came from China since it was sold a Walmart. I remember a while back people speculating about China's x86 compatible processor having undocumented opcodes for some alterior motive. This is all part of the China conspiracy.
It's not a virus, it's just a exe packer they used.
Virus scanners have been labeling PE Packers as viruses for ages now, simply because a virus could be packed with them, and it's easier to pick out a packer header than a virus contained in it.
A lot of false positives are caused by this, and this looks like one of those cases based on what you linked. "Generic" "NSPack" "PossibleThreat" in the VirSCAN links give that away.
EXE/PE Packers simply compress a binary and decompress it on the fly, simply to save space or "load faster". Likely Walmart's programmers used one to keep the app's size small on a small device like that.
I've dealt with this situation in size-coding competitions before, and it's not fun. A lot of false positives are caused simply because a packer was used.
Fortunately, some of the better virus scaners actually unpack the software before checking it, or look for valid virus signatures instead of a simple Packer.
This basically is just a case of virus scan companies being lazy.
Actually, there are multiple Christmas holidays. Besides Christmas Day itself, how about Advent and Three Kings Day.
Plus, what Americans call "vacation" is referred to as "holidays" in Britain.
Do you ignorant people know how stupid you sound to other, more cosmopolitan people?
More sane... or just saner?
The holidays are at Christmas, hence "Christmas Holidays". Sheesh!
So people should change to take your beliefs into account? We could call it "the period surrounding Christmas", would that term be correct with your single-holiday politics? I'm sorry, we should be more sensitive to your needs.
I drink my eggnog straight out of the [redacted]
Christmas is a twelve day feast that starts on Dec 25, and doesn't let up until Epiphany.
And Walmart employees also cough on the their real photos. Double virus score!
Sigh, still no cross-platform support for Malware!
Liberal use of the words 'allegedly', 'might' and 'may' - and a few question marks - might have been appropriate here.
How many samples of the product have been tested, did you give the supplier a chance to verify your findings or consult an independent expert?
More importantly, how much have you set aside to cover the possible lawsuit for damaging Walmart's sales?
AT&ROFLMAO
Can you send a picture (not infected of course) of this ?
You think they buy virus scanner software in a Chinese factory? No, these guys cut every corner they can to meet those razor thin profit margins.
“Common sense is not so common.” — Voltaire
Perhaps where you live, but for others Christmas starts on Dec 24.
i got my hands on a pink "MP5" thing (hate that mp4/mp5/mp6 crap), and it not only have a autorun.inf pointing to a virus as you expect, as it keeps rewriting the damn thing when i erase it, and it points to a file on the recycler, and the recycler of the device has a weird file on it its like the own MPthing firmware is actually writing the virus on it
Do you know how biased you sound to other, more objective people when you act like being more cosmopolitan gives you some intrinsic value over others? Why don't you just come out and say "more civilized," or "more white," since you're making value judgments based on bias over reason anyways.
company website: http://www.mercury-ce.com/product.php?productid=16151&cat=251&page=1
parent company: http://www.kobian-inc.com/?page=contact-us
Fuck off, farmboy
For Windows XP, SP2 ... Tweak UI allows disabling of AutoPlay either by device type (eg CD) or drive letter, and the setting is stored in the user registery under [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer], but Tweak UI only shows the settings if the user is an Administrator.
However according to Microsoft's TechNet web-site, the NoDriveTypeAutoRun setting in HKCU is ignored if there is a corresponding entry in HKLM, so to disable AutoPlay on all drive types for all users:
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer]
"NoDriveTypeAutoRun"=dword:000000ff
If AutoPlay is enabled, actions per content type can be set per user by right-clicking the drive in Explorer, then selecting the AutoPlay tab. The options are stored in [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\UserChosenExecuteHandlers]. The default (which is to prompt the user) can be restored by deleting the entries.
Note that there doesn't appear to be an option for "data only". So far as I know, if AutoPlay is enabled (which it is by default), you can't disable AutoRun.inf. However, if the user is not an administrator, Explorer will prompt for an Administrator logon before doing anything.
Another proof that Wine is not yet fully compatible :D
Patents Drive Free Software as Hurricanes Drive Construction Industry
I note that virtually none of the major commercial scanners found anything.
I have trouble believing there's any significant malware that is generally known to the AV industry but is not detected by any of McAfee, Sophos, Symantec or Kaspersky. Particularly when the industry depends so heavily on scaring people into believing they are likely to become infected.
I have trouble believing there's any significant malware that is generally known to the AV industry
You must be joking, they know about all the viruses, they write them.
FYI: Officially Festivus is on the 23rd of December.
Don't be apathetic. Procrastinate!
[citation needed]
Besides, I always thought those photo frames were a bit silly, anyway.
Ruby Neural Evolution of Augmenting Topologies
My father-in-law got the LG Chocolate thanks to his daughter for christmas, only to find out you can't set MP3's as ringtones out of the box. He had used the Verizon Vcast Music software that came with the phone, and that its self is also junk. Anyhow, I downloaded BitPim and got the MP3's to transfer and setup as ring tones. Then his other daughter was on myspace and who knows what else, and here dad decided to scan his computer for malware. I believe the program is called MalRemover or Malware Remover or something, but it listed the LG USB Driver as malware, and I was wondering if anyone else has gotten a hit on this, or is this another "mistaken identity" like a lot of posts are mentioning about?
It's just another 2 for 1 offer!
Is that the gift that keeps on giving?
If that doesn't confuse the OP enough, the Eastern Orthodox world still regards Christmas day as falling on the 7th of January.
Why is this moderated as a troll? It sounds a bit angry, but unless there's something i don't know about OSX 10.5.6. that makes it impervious to all malware attacks it's pretty damn true.
And it doesn't end until someone is pinned.
Here ya go
Terminate and Stay Resident
Yes, I am the one with the legendary sig.
"Is Windows ready for the Picture Frame??"
Embedded Linux sure is. I can't understand HOW Windows ever ended up on a device like this. The license cost alone must seriously affect the profit margin, even discounting the annoyance of pre-installed malware. What are they going to do? Recall them?
Choosing Windows = pure dumbassery.
you had me at #!
Another device with said problem appears to be the fisher-price Kids Tough Digital cameras. Contains an exe detected as a virus along with an autorun.ini
All sounds to me that the Walmart photo frame may be truly infected. Interesting to see if a re-scan gives the same results, after AV signature updates.
To identify my photo frame, it has USB vendor code 1908:1320, and gives dmesg output as
and has files on it
Hey, I always stick odd USB devices into Linux first to check them out.
For background info, this photo frame does nothing when first connected. You can set it to "transfer" mode, at which point it emulates a USB CD-ROM of 304 Kbyte size. That CD image tries to autorun the DPFmate software to compress and transfer images to the device. The photos are *not* visible on the device through normal access, must have transferred them to a hidden area. I'd be interested if anyone has more info on the USB protocols used.
Andrew Yeomans
A holiday that consists of multiple days is still 1 holiday and therefore does not justify a plural form of "holiday". The plural of "day" would be warranted but not "holiday".
this nation, under God, shall have a new birth of freedom. -- Lincoln, Gettysburg Address
Hey, if you are going to be more sensitive to the few thousand people who celebrate Kwanzaa and the few million who celebrate Hanukkah then yes, you better be more sensitive to those who celebrate Christmas considering they are in the majority. But this isn't about Hanukkah and Kwanzaa (the submission said "Christmas holidays" not "holiday season"). It is about Christmas. There is only one Christmas holiday, whether it consists of multiple calendar days or not. Case closed.
this nation, under God, shall have a new birth of freedom. -- Lincoln, Gettysburg Address
The holidays are at Christmas, hence "Christmas Holidays". Sheesh!
Really? How do you figure? Christmas is only a single holiday so why refer to it in the plural? It sounds stupid and is grammatically incorrect. Why don't we refer to the New Year's holidays since it is only a single holiday consisting of a single day? Why not start referring to Thanksgiving as the Thanksgiving holidays? If we're going to be grammatically incorrect we may as well be consistent throughout the entire calendar year. "Christmas holidays" does not include Hanukkah and Kwanzaa so I hope that isn't the rationale here. People who celebrate those would be disenfranchised if so and we wouldn't want those million people to mount an uprising against the other 300 million people in the U.S. because they are disenfranchised.
this nation, under God, shall have a new birth of freedom. -- Lincoln, Gettysburg Address
Best of luck trying to run an exploit in an OS that requires a specific set of actions by the Admin to install software.
Unlike Windows and 'Autorun', and Outlook Express and Internet Explorer, and the SONY Rootkits, et al, etc.
Granted, even stupid people use Macs from time to time, so, I guess that it's potentially possible to actually get some moron to install a rootkit if he thought he'd was going to see (Female Celebrity) sex tape.
In my decades of using Macs, I've only run into ONE virus, and that was on a used Color Classic I bought at the now defunct Computer Renaissance shop in Cambridge almost 10 years ago.
Guaranteed! This comment 100% Anthrax free!
I strongly suggest that you stop trying to understand English from the outside and instead embrace and enjoy the language for what it is. Put down your computer and curl up with a book. Perhaps Twelfth Night?
Any OS more complex than that shipped with the VIC=20 can be exploited in some fashion.
Unlike Windows, the slutty whore that'll let ANYBODY screw her, Mac OS is much harder to mess with. No Autorun, no incestuous relationship between Mail.app and Safari, immune to SONY's CD based rootkits, ships with security options switched on by default, a virgin Mac OS X install can sit on an unfirewalled Internet connection for, essentially, forever, and not get 0wned, unlike Windows which lasts maybe 1 minute before getting 0wned.
And when, Oh happy day!, when Mac OS is the majority OS on the planet, I'll be concerned about exploits then. Until then...
Guaranteed! This comment 100% Anthrax free!
This is what we call a False-Positive. Case closed, on with the day.
Actually, in much of the rest of the Western world, there are two Christmas holidays; Christmas and Boxing Day.
Hey, I always stick odd USB devices into Linux first to check them out.
There's gotta be a joke in there somewhere...