Re: Damaged MP3 Files
Franklin
>
> The file arrived as an MP3 not as an WMA and *I* changed it to WMA to
> get it to play correctly.
>
Hello Hummingbird. You didn't convert the audio data. What you did was
alter the three letters of the file type.
When you wrote "the file arrived as an MP3" what you mean is that it
arrived labelled as an MP3. It was actually a WMA all the time.
> Nothing tried to "change the file from MP3 to WMA" as that article
> cut/pasted by Franklin says
The article I linked said the virus would convert MP3 files to WMA. I'm
not clear how wholesale conversion from MP3 to WMA could be done
surreptitiously on a user's MP3 collection but Christoph Alme of Secure
Computing seems to have said that.
<http://www.darkreading.com/security/app-security/showArticle.jhtml?
articleID=211201147>
> and nothing asked me to d/l a fake codec. And during playing, at no
> time did anything try to make an external connection to d/l a fake
> codec. So Franklin's article is very inaccurate.
I didn't get a pop up either and I used WMP. However you can see an
unexpected URL in the file's metadata (http://www.delit.net). I can't
find the jpeg you identified.
In the past I've had several WMA files which attempt exactly the same
trick to get approval to connect to an unknown site.
--
inc alt.comp.virus
Johnw
I'm with you Franklin, also the download site say's it has a virus.
http://www.mediafire.com/i/?nnemntz3lwn
Avast picked it up as soon as I started the download.
http://www.mediafire.com/i/?amkyzalnyz1
The Virustotal results posted by Dave U. Random, list the programs that
pick up the virus.
http://a.nf/3ffc68
Here is page 2 & 3 for easier reading of the posts.
Johnw
> Franklin explained :
>> hummingbird wrote:
WMA:Wimad
http://www.google.com.au/#hl=en&q=WMA%3AWimad&meta=&aq=&oq=&fp=f9c89b0729237c88
How to Remove Trojan Downloader WMA Wimad
http://www.ehow.com/how_5130161_remove-trojan-downloader-wma-wimad.html
David H. Lipman
The way to remove a media file deemed to be a wimad trojan is simply delete the media
file.
--
Dave
http://www.claymania.com/removal-trojan-adware.html
Multi-AV - http://www.pctipp.ch/downloads/dl/35905.asp
David H. Lipman
>>The way to remove a media file deemed to be a wimad trojan is simply delete the media
>>file.
| That's my advice too...it's a messy audio file.
| IMO the file in question MAY have been cleaned at some time but
| still has fragments of the malware in it, hence the AVG warnings.
| That might explain the fact that the malware didn't do what it is
| claimed to do in the article someone posted.
After viewing numerous Wimad trojan media files, they are really junk files. Many just
using sex in Social Engineering.
A big culprit a couple of years ago was Zango/180Solutions.
David H. Lipman
| 'David H. Lipman' wrote thus:
>>From: "hummingbird" <hummingb�r...@127.0.0.1>
>>>>The way to remove a media file deemed to be a wimad trojan is simply delete the media
>>>>file.
>>| That's my advice too...it's a messy audio file.
>>| IMO the file in question MAY have been cleaned at some time but
>>| still has fragments of the malware in it, hence the AVG warnings.
>>| That might explain the fact that the malware didn't do what it is
>>| claimed to do in the article someone posted.
>>After viewing numerous Wimad trojan media files, they are really junk files. Many just
>>using sex in Social Engineering.
| Sounds *almost* interesting ;-)
Naw... d!ck tease at best. :-)