Slashdot Mirror

← Back to Stories (view on slashdot.org)

Trojan Found At Torrent Sites Insists "Downloading Is Wrong"

Posted by Soulskill on from the attack-of-conscience dept.

NoisySplatter writes "Ernesto, founder of TorrentFreak, reports that a new trojan, 'Troj/Qhost-AC,' has been distributed on The Pirate Bay. The virus was disguised as a serial key generator, and the offending torrent has since been removed, but the source has not been identified. Troj/Qhost-AC makes changes to the user's hosts file that redirects The Pirate Bay, Suprbay, and Mininova to 127.0.0.1. In addition to making three popular torrent sites inaccessible, the virus also plays a sound file that says: 'downloading is wrong.' It looks like someone has finally stepped up to the plate to challenge Madonna for the title of 'Most Obnoxious Anti-Piracy Stunt.' Of course, this could just be the software industry's attempt at outdoing the RIAA and MPAA."

18 of 345 comments (clear)

  1. Another possibility by EdIII · · Score: 3, Insightful

    This could be the piracy groups themselves throwing this out there to stir up sentiment against the RIAA, MPAA, etc.

    Of course that's like adding a few cords of wood to the fires of HELL, but it is a possibility.

    P.S - This is not nearly as bad as the Sony Rootkit.

    1. Re:Another possibility by Firehed · · Score: 4, Insightful

      It's a trojan - you have no idea what else it's doing. If all it does is screw with your HOSTS file and play a stupid audio track I agree, but it could be doing all sorts of other unknown fun stuff to your machine with the root access it has.

      --
      How are sites slashdotted when nobody reads TFAs?
    2. Re:Another possibility by EdIII · · Score: 5, Insightful

      It's a trojan - you have no idea what else it's doing. If all it does is screw with your HOSTS file and play a stupid audio track I agree, but it could be doing all sorts of other unknown fun stuff to your machine with the root access it has.

      Actually you are factually incorrect. As you can see in the summary and article itself it is referred to as, "Troj/Qhost-AC" by Sophos. That would seem to indicate that at some level it has been reviewed by a Anti-Virus company and I believe they would have tried pretty hard to determine the full capabilities of this Trojan. One could even say it is highly likely.

      Even so, it may have been better for me to say, "This does not at first glance appear to be nearly as bad as the Sony Rootkit turned out to be".

      Let's also remember that the origins of this trojan virus are unknown at the moment while the Sony Rootkit has it's origins WELL DEFINED. Those origins being the Sony board members that have yet to receive prison terms for their actions. For those that think that is a little melodramatic, consider what kind of reception any other corporation or private citizen would have received for releasing the same type of rootkit onto the populace.

      If this does turn out to lead back to the feet of people working for the interests of Big Entertainment it will have been done for the same reasons the Sony Rootkit was put out. Their absolute and firm belief that YOU (the customer, citizen, etc.) have ZERO RIGHTS to any privacy or control over your own electronic equipment when their intellectual property is anywhere near it.

      The funny thing is that the only other people that seem to be able to act like that and get away with it are governments. So if you are not the government or Big Entertainment you go straight to Federal Pound Me In The Ass Prison when you do act like them. Isn't that just hilarious?

    3. Re:Another possibility by Culture20 · · Score: 3, Insightful

      I wonder if the ever agenda driven Slashdot would get a little butt hurt if somebody took one of their open-source programs or Linux; they closed sourced it to make it proprietary and hosted it on a torrent website.

      What, like BSD network stack and Windows? I think the BSD people are happy that Microsoft chose to use good code.

      Jail time for a rootkit, geez and here I thought the RIAA might have been a little psycho.

      Yes, jail time for a rootkit. If it makes more sense, it's jail time for hundreds of thousands of rootkits, several hundred in low-security government computers.

  2. Expect the reverse by KDR_11k · · Score: 5, Insightful

    A virus that instead plays "Downloading is right" and redirects the homepages of big software, music and movie companies to piratebay, mininova, etc...

    --
    Justice is the sheep getting arrested while an impartial judge declares the vote void.
    1. Re:Expect the reverse by Anonymous Coward · · Score: 3, Insightful

      Safety in numbers. The more people pirate stuff, the less chance you have of it being actually *you* that gets caught.

  3. Keygens by Metapsyborg · · Score: 5, Insightful

    It's pretty crazy to be running keygens on your system. Every time I do it, I think to myself "what are these guys getting for all their hard work?" The same thing with cracked software - you run an installer yourself how could the cracker pass up that type opportunity? I just assume most of them infect your computer with some spyware and trojans.

    --
    (\(\
    (^.^) INFECTED
    (")")
  4. Summary makes it sounds like a virus but it's not. by HumanEmulator · · Score: 4, Insightful

    From everything I've read (the slashdot summary excluded) this isn't really a virus -- it's a straight trojan. That means you would have to be trying to download a serial key generator in order to get it on your system. (ie. It doesn't spread to you from other people's machines.)

    I'm all against nefarious software creeping onto my system, but this is like complaining that the guy you tried to buy drugs from turned out to be a cop.

  5. Re:Please explain to me by MrMista_B · · Score: 5, Insightful

    Well, for one thing, it's illegal, immoral, and unethical. Fighting crime by being a criminal... well, you see where I'm going with that.

    Furthermore, do you want your company to get the reputation of a malware maker and distributor? That's not likely to increase your sales.

    Beyond even that, say, for example, someone repackages the malware you release as a 'linux-iso' or somesuch. Then you would be to blame for destroying the computers of innocent people.

    Y'know, based on this, if I were your boss, I'd fire you, because you're clearly lacking in ethical stability, and making threats such as you have marks you as a company liability. Hmm.

  6. Re:Summary makes it sounds like a virus but it's n by Warhawke · · Score: 4, Insightful
    You're assuming that the keygen downloader does not have the authority (i.e. ownership) of the program in question. Apparently you've never accidentally tossed or misplaced a CD-key.

    So really it's more like the guy you were trying to buy medical marijuana from turned out to be the naggy guy behind the Above the Influence campaign.

  7. Re:Running as admin is fun by BrokenHalo · · Score: 5, Insightful

    C:\Windows\System32\drivers\etc>cacls hosts
    C:\Windows\System32\drivers\etc\hosts NT AUTHORITY\SYSTEM:(ID)F
    BUILTIN\Administrators:(ID)F
    BUILTIN\Users:(ID)R

    Far out. I'll slap the next person who tells me Unix is hard to use, if that's Microsoft's idea of user-friendliness.

  8. Comment removed by account_deleted · · Score: 4, Insightful

    Comment removed based on user account deletion

  9. Re:Please explain to me by Craevenwulfe · · Score: 5, Insightful

    The Sony Rootkit affected people who bought shit legally. Where's the fucking relevance?

  10. Interesting artistic action by drx · · Score: 5, Insightful

    Actually i think this is an interesting action. As a communicative act, this trojan shows several things, e.g. that the internet stays an unstable place where everything is mostly determined by convention -- even with pirates -- AND that TPB is taking down torrents they don't like, despite being a stronghold of free speech. Of course "malicious software" is the argument here for removal of the torrent, but who defines what is malicious? In the end TPB caters to the needs of its community, by filtering "content" this community doesn't approve of.

    1. Re:Interesting artistic action by Opportunist · · Score: 3, Insightful

      That's the prerogative of people running a webpage. Detach yourself from the idea that "the internet" is a place without rules. It's not an anarchy, it's a collection of tiny dictatorships, with every server admin being a little dictator.

      The nice thing about the internet, compared to reality, is that you can simply walk away if you don't like the taste of said dictator and create your own little dictatorship.

      --
      We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
  11. The parent is not a troll so mod up please. by gatkinso · · Score: 4, Insightful

    Even though it was probbaly intended to be a troll, it is worthy of discussion.

    As a responsible software development shop, you should know that you absolutely do NOT want any version of your software floating around that attacks a users machine.

    All I need to hear is that your Application 2.1 will say, format a harddrive and delete all partitions... and I woould not touch it with a 10 foot pole.

    So. If you want to completely destry your customer base - go ahead and pull such a stunt.

    --
    I am very small, utmostly microscopic.
  12. Re:Running as admin is fun by marcosdumay · · Score: 3, Insightful

    Try to open regedit someday.

    Anyway, "easy to use" is jargon to "works like Windows" nowadays. So, obviously, Windows is "easy to use", you can't contest that.

    --
    Rethinking email
  13. Madonna has new strategy by fuliginous · · Score: 3, Insightful

    Madonna has since adopted an even nastier tactic, that of producing such lousy crap no one will want to pirate it (specifically her most recent album!).