View Single Post
  #1 (permalink)  
Old June 7th, 2007
birdy's Avatar
birdy birdy is offline
Join Date: October 18th, 2004
Location: Perth, Australia
Posts: 889
birdy has a distinguished reputationbirdy has a distinguished reputation
Default Music files changing to zip or exe: some info

Recently, some users have found that their music files have suddenly changed to .zip or .exe format & therefore are unplayable. This is caused by the user downloading an infected file.

Everyone MUST be aware of how many infected files are being shared on the network these days & be extra careful about what they download. Keep your AV program updated & scan every file that you've downloaded, before you open it.

Check your search results before you download. Look at the icons that show beside a file...are they music icons? Check the file size. File size will vary according to the song's bitrate, the higher the bitrate, the larger the file. Files less than 1000 KB in size are bound to be suspicious. See an example of real file sizes & music icons here (icons that you see are determined by your default music player).
Music files changing to zip or exe: some info-real-mp3-results.jpg

People are being infected because they're downloading files which show up in a music search...but the files are not music files. They have the programs icon, the file type is exe (DANGER SIGN) & files are way too small to be a valid music file. These files are usually 408.0 KB in size & are infected with this worm: Worm/Fontra.C - Full description
You might also see files of 228.0 KB, these are infected with the trojan TR/Drop.VB.ME.1 or TR/Drop.VB.ME.20
Do not download these files.
Music files changing to zip or exe: some info-exe-results-beware.jpg

AVG Anti-Virus Free Edition will find this worm. As the name suggests, AVG Free is free to download & is a reliable antivirus program. Download from the link below. Make sure that you update AVG before you scan your computer.
AVG Anti-Virus Free Edition

Avira AntiVir PersonalEdition Classic will also find the worm. Antivir will detect the worm during download & by default will deny access to the file, even if the download is completed as long as the AntiVir Guard is activated (ie when you see an open umbrella icon in the system tray). Download the free edition from the link below. Make sure that you update AntiVir before you scan your computer.
Avira AntiVir PersonalEdition Classic - MORE THAN SECURITY

There are probably other AV programs which will detect this worm, users of other AVs might like to add more info.

Once you've downloaded a file, before you open it, hover your mouse over the completed download, in the download pane below the search results. If you see .mp3.exe, the file is NOT a music file & is dangerous.
Do not open the file, delete it from your computer.
Music files changing to zip or exe: some info-mp3.exe-download.jpg

People have also been infected through downloading files which have "BitDownloader" or "Bitdownload" in the title. These show up often as being 220.5 KB in size & contain Trojan.Obfuscated.en. See the link below for an example.
Problem with downloaded files

If you see "file name Bitdownload/er" in your search results...these are dangerous files & will infect your computer.
Do not download these files.
Music files changing to zip or exe: some info-bitdownloader-results.jpg

The real BitDownload is a BitTorrent client & has been known to install spyware, so it would be wise to stay away from that as well
Yahoo! Answers - What is exactly the bitdownload?
Removing BitDownload from my computer - SWI Forums

For more info about viruses on the network, read the thread below.
WARNING: Viruses on network you should be aware of!

For links to free security programs, click the blue link here

For further specialised help with virus/malware removal, please visit one of the sites below.
Spyware Warrior :: Index

CastleCops® » Security Forums

SpywareInfo Forum FAQ - SWI Forums

Last edited by birdy; February 13th, 2008 at 07:41 PM.
Reply With Quote