I have to take a break now and go clean things up. I wasted a lot of time trying help the ABP guys troubleshoot their software because I believe in open source, and this is what I get for my efforts. The Google web store is probably loaded with malware. I am also seeing new misspelled versions of AdBlock Plus on the Google Web Store now, and foreign language versions that were not there before. This means the infection has been going on since at LEAST. When that guy mentioned the "sweet" page * he was talking about browser windows that open when the malware triggers. It looks like this malware utilizes the " InstallPath Install Manager" to deliver its payload. I immediately recognized that it was malware though, and attempted to log its actions. Unfortunately I launched the file thinking it was legitimate before I saw this thread. That is not the correct name of the extension (or the name of the malware file), but I just assumed the installer script failed and the name got mangled because my version of Chrome was buggy or incompatible with the web installer. (That is why I disagree with Google's attempt to withdraw old versions of Chrome its useful for ALL kinds of testing purposes.) On the download tile it says: Apparently it was renamed to something they did not expect or it failed to launch automatically on this old version of Chrome for some other reason. It seems that the hacker tried to create a malformed file name in order to make an EXE file appear as a CRX file on the Chrome download tile. But the file name might be generated randomly, it sure looks that way. A closer inspection of my Download folder turned up the file that it had intended to run. I think the Adblock Plus web site also attempted to serve me the malware, but I did not realize this because Chrome said " Failed - No file" when I attempted to download ABP from there. I found the post mentioned above when I came here to report this issue, and saw that someone else had already complained. Thats what I saw on the Google Chrome web store. Filenames starting with "_" are reserved for use by the system forum/viewtopic.php?f=10&t=23406&start=0 Cannot load extension with file or directory name _.
0 kommentar(er)
