Advertisement box compromised

[vbjsk]

Hello,

I suggest the advertisements shown in the ad box for non Pro/Plus users be filtered better or removed altogether. Today I opened Vuze and it started opening IE windows with malware saying my computer was infected. I used task manager to end all IE window tasks but they kept coming back until I also ended the task for Vuze. This is compromising the security of my computer. I have saved the two intected advertisments that resulted in this malware attach and zipped them into a password protected file. I can upload them if you need proof.

The malware identified coming from Vuze ad window were Rogue:JS/FakeCall.D and Ransom:JS/FakeBsod.A

Regards,
Chris

[parg]

Please tell me if you continue to see things like this - our ad provider has disabled a campaign that they believe was the source of this.

Thanks for reporting.

[vbjsk]

Please tell me if you continue to see things like this - our ad provider has disabled a campaign that they believe was the source of this.

Thanks for reporting.

 

Thanks,

Will do,
Chris

[DanDan]

This is incredibly frustrating. I don't mind ads if they help support the product, but malicious ads are an insult to all users. Ads that spawn pop-ups are nearly as bad. You can disable and/or unload azpromo, but it always comes back. Something has to be done about this.

[Red_Blue]

Please tell me if you continue to see things like this - our ad provider has disabled a campaign that they believe was the source of this.

Thanks for reporting.


 

I'm not sure, but I believe it is related. The suspicious activity is after Vuze install, an executable with the name of ??.tmp (with ? being a number) being downloaded to [TEMP] and ???????.dll (with ? being lower case letter) downloaded to C:\Documents and Settings\[User]\Local Settings\Application Data and a key added to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ to autostart it with Windows logon.

Heuristically all this points very heavily to malware type behavior, using randomly changing names and arranging startup with obscure registry keys. The dll and tmp executable lack provider identity data or signatures.

Versions:
Java 1.8.0_60
 Oracle Corporation
SWT v4508, win32
Windows XP v5.1, x86
V5.6.2.0/4 az3

[Red_Blue]

F-Secure indicates that the temp files are trojans of unidentified type (by heuristics). FS nor ZA reports nothing about the DLL, but I would expect it to be the launcher for the TMP files. Disinfection of this is easy, just remove the registry key for the DLL and then the DLL and TMP files. Doesn't look like this malware has any serious stealth features, so it seems different from the detections listed by vbjsk.

[timandjoe]

I had an audio message played through vuse this morning saying my computer has become compromised and all of my data has been accessed including banking details. It was showing this message through the ad provider. Is there anything I need to do? As a saftey precaution I have deleted my Vuze.

[Tiberio]

Please Vuze,

DON'T open the door to Mackeeper, the most invasive malware for Mac. Thanks

[Image: o8b70x.png]

[denverbot]

Hello,

I suggest the advertisements shown in the ad box for non Pro/Plus users be filtered better or removed altogether. Today I opened Vuze and it started opening IE windows with malware saying my computer was infected. I used task manager to end all IE window tasks but they kept coming back until I also ended the task for Vuze. This is compromising the security of my computer. I have saved the two intected advertisments that resulted in this malware attach and zipped them into a password protected file. I can upload them if you need proof.

The malware identified coming from Vuze ad window were Rogue:JS/FakeCall.D and Ransom:JS/FakeBsod.A

Regards,
Chris


 

Same thing here. Just happened today. Thankfully, I have Norton antivirus to stop the pop-up ad virus attacks from Vuse. I think I'll look to switch if it happens again. What good are program features if they come with viruses?