Kazaa Users Warning!

In case you have not read my replies on my thread. I got infected with a trojan just using KaZaA. The trojan was encountered by my McAfee VirusScan when an ad popped up on KaZaA. The trojan's name is JS/NoClose and is known for being found in ads and banners. The trojan does not have a destructive payload at all (it doesn't harm anything on your computer) but just to stay secure, I don't want it on my system and I'm sure everybody else wouldn't want it. This trojan was found on a dating ad that popped up while I was using KaZaA. This has happened to me once before too. The infected file name is KZPOP(1).HTM . Just to let everyone know and for everyone to stay updated with their antivirus programs.

THE AD IS FROM www.cupidsdatabase.com . IT JUST POPPED UP AGAIN!!!!! I will be complaining to the makers of this ad and the owners of KaZaA. The ad says GOT DATES? on it.

hey dude thanxs for the info...thats why i started to use kazaalite it is bannerless ...

damn, that advert comes up all the time, updates here we come...
Thanks - Prankster

I doubt it is a trojan. It seems to me like a "malicious script" made in JS. I am not too worried.

Yeap kaazalite is far better, no adverts, and kaaza wonder why people get annoyed with all the adverts

I agree with alittlebitnumb. It does sound more like a malicious script, rather than a trojan.

yes i have also previously had this trojan, fortunatley my virus scanner picked up on this.
I didnt get this trojan from kazaa though beacuse i dont use kazaa so it must be getting used on other websites and stuff.

I used to use Kazaa Lite until I read the EULA. Turns out that using the program is ILLEGAL. It says so right in it. I guess thats because it has a modified version of the cd_clint.dll file (which is adware from CyDoor, http://www.cydoor.com). Whatever the case, you still need to watch for viruses. The W32.Benjamin.Worm is spreading on Kazaa, (you can read about it here:http://securityresponse.symantec.com...amin.worm.html)
Another one that I find often is the Hacktool.Flooder virus. All I really have to say is KEEP THEM VIRUS SCANNERS UPDATED!!!

anybody know exactly what it does?
and do you think Norton FW/AV will pick it up and disable it?

Thanks guys :-)

Quote:

---

I used to use Kazaa Lite until I read the EULA. Turns out that using the program is ILLEGAL.

---

Funny you should mention that. KaZaA is saying "don't violate our copyrights" when they facilitate piracy (and we all know it's there, and I am sure they know too), it's simply a game of cat and mouse like it always has been and always will be.

The bottom line is, p2p is like drugs: People are gonna possibly get infected sharing, just make sure you watch yourself out there and take the necessary precautions, or not do it at all; I choose the latter.

JS/NoClose is a trojan file and its effects did work on me. The ad window was minimized and I had to keep right clicking on it and nothing would happen for like 2 minutes. Then the little Close, Minimize, or Maximize thingy came up. "In HTML form, a browser window is created which is minimized and can not be easily maximized or closed." This is what happened to me because it was in HTML form (it was an ad window). To see more about it click on this URL: http://vil.nai.com/vil/content/v_99279.htm

Well Ryan,

You could have got this trojan from almost anywhere.. Kazza being only one possable..

How well did you read the info on the link you posted?

here is a C&P from ryans link....http://vil.nai.com/vil/content/v_99279.htm

Quote:

---

This javascript trojan allows various hidden functions to take place on a users system. It exists in two forms.
In HTA form, an HTML Application is created which is not visible to the user and can not be closed.
In HTML form, a browser window is created which is minimized and can not be easily maximized or closed.
Typically these window "tricks" are seen associated with advertisement and banner ad programs. Especially affiliated with pornographic sites and sites which pay commissions to others for displaying banner ads.
The trojan does not contain any other payload and does not cause any damage to the local system. Files which trigger this detection should be deleted.


Top of Page

Symptoms
Minimized web browser window which can not be easily maximized.

Top of Page

Method Of Infection
Viewing a web page which contains this trojan javascript code creates the mysterious window in question.

---

So Ryan you may need to avoid some of the web sites you were visiting around the time of the infection..
played with *nix latley?

Cheers

i agree with und3rtak3r u can get a trojan from almost anwhere on the web embbeded in websites hidden in files etc

Sorry to be the one thats agreeing that there are trojans on Kazzaa/Morpheus but its true and thier tons more so be care plus its not only trojans there're virus,worm and much more soagain becarefull!!!!!! :eek:

No, it was from KaZaA. Almost everytime I open KaZaA up, I get McAfee popping up telling me that it found the JS/NoClose virus. The file name is always the same. It is KZPOP(1).HTM. Doesn't that look alot like KazaaPopup(1).HTM? The way I can tell is that I right click on the minimized ad and nothing happens. I have to keep clicking for about 2 minutes and then the little "Restore, Maximize, Close" thing comes up (the thing that comes up when you right click a minimized site). No internet exploring programs are running at the time.

Quote:

---

"sites which pay commissions to others for displaying banner ads"

---

Doesn't that also sound alot like KaZaA advertising?

For Norton Firewall/Internet Security users...if you enable the ad blocking feature, that should help with the ads, on Kazaa or off Kazaa.

well I relly do believe it is not from kazia,I mean hey you probabily downloaded something or someone mailed you the virus,I should know about mail virus cos I wrote some myself.I trust tha kazia software..

Alright I don't claim to be an expert on trojans, but I do have some knowledge of the subject. I've used trojans on my own network for research purposes, so I understand the basic structure of them. From what I've seen in every case so far, a trojan is a client and server based structure of two files. Both client and server are executable files. The client is sent to the victim, and the victim believes it to be another program, thus clicking on it. Once clicked on, the Server has the ability to connect to the client, allowing him to take control of the victim's computer. With this being the basic structure of a trojan, I do not believe what you are dealing with is a trojan at all, because a trojan would be used by the attacker to gain access to your computer, and that does not seem to be the case. Like what was said previously, I believe you just ran into some malicious code.

Please correct me if I am wrong about the structure of trojans.

I quit using any flavor of KaZaA months ago and I block pop-ups at my router. I don't want to see or redistribute ads for anyone else. I pay monthly for a cable connection and I think that's good enough. Why do these people want to aggravate and track users so relentlessly? Free society no longer exists? When I want to buy something I know where to go. I have never bought something because of a frigging pop-up.

**********************
Yeap kaazalite is far better, no adverts, and kaaza wonder why people get annoyed with all the adverts
**********************

Kazaa dosn't wonder, Kazaa dosn't give a ****. Its not like this is unusual for them. **** like this happens all the time. Their making money and thats all they care about.

intresting as i have not got a virus scanner does anybody know were i can get one from as i dont have a clue.hope this question isnt to stupid for yous as im a newbie.

I got sick of Kazaa and deleted it and everything realated to it in the registry yesterday. :)

It got kinda annoying with all the popups and the sheer amount of traffic that did/attempted to come through my firewall.

Xolox is my choice of out of all the P2P apps. But even now they are starting to play the "marketing" game. :mad: