suspicious activity
 

Whenever i put a search in whatever i have searched for will within 1-2 minutes return 2 suspicious matches.What is suspicious you ask? the 2 files will always have the same amount of kb and 4 stars and at least 2 hosts for each match usually it is four ie if i was searhing for Edit in audio then a result like this will occur

****4 Edit mp3 1,904KB T3 or....
****4 Edit mp3 378KB T3 or....

At first i was fooled and downloaded the match, only to discover the file would not work.I immediately deleted it.After watching these matches come up every time for every search and always the 2 together and always with the same KB i have become suspicious.They will even match to any old combination of letters you make up.
Does anyone know what this is ? Is it some kind of virus?Has anyone else noticed this?

Roscoe

Yeah, I've noticed it. I've never tried to download one. I usually will add those hosts to my blocked list so that they don't come up. Every time new ones show up, I block them.

saw it too
 

I saw it too, eg. search for Edit and get back Edit and Edit both ~350KB. Downloaded one, got paranoid halfway through, and aborted. Looked at a hex dump of the file fragment, it looks like an audio file, but wouldn't play in WA. Looks like someone has put something together which matches all searches and sends "something" back. RIAA? Tracking IPs of Gnutella users?

I just logged on to find out what these posts are too. Always 378 KB and invariably with these three coments: "the real thing!" "AWESOME!!!" and "please share." Don't have a clue what they are but my last four searches for Editall yielded exactly the same results.

I've had EXACTLY the same problem...same file sizes, names, etc. Julie, thanks for suggesting blocking the hosts. I didn't know LimeWire had the capability; it works like a charm. The offending host IP I've seen is 38.144.198.150. Is there a way to see the offering host IP address without initiating a download?

(Before I blocked the IP, I did send out a search with my name, just to get back the bogus file describing me as AWESOME!)

Again, thanks for your help!

Hey! Maybe I should try that... Sure could use the ego boost! :p

RipTags: What system do you use? If Mac, I can tell you how to add the column to show Location (host IP address).

If you use Windows, try searching the forums for "Adding columns to search window" or something like that.

:cool:

I'd like to learn how to add "location" for Macs.
I've had luck blocking by going to Preferences and blocking the words "AWESOME!!!" "the real thing" and "please share"
So far, so good.

I have also recently noticed this. Many of my recent music searches have included in the result list files with (AWESOME!!!), (please share!!!), or (the real thing!) tacked onto the end of the (supposed) song name, and always (it appears) with a size of 378KB. I have a ‘cookie crusher‘ and anti-virus software by the truckload on this machine, so out of curiosity I downloaded one of these files. WARNING: unless you are into In-Your-Face Porn offerings, coupled with a barrage of sticky pop-ups, don’t download these files.

You should be able to play and view audio and graphic files (.mp3, .jpg, etc) files safely, there's no way for them to run any code on your machine. NEVER run any executable file from an untrusted source (.exe .com .vbs and unfortunately more I can't recall right now, if you don't recognise the extension don't double click on it).

The file I got had an .mp3 extension, so AFAIK there's no way it should be able to do any virus-like things by itself when you play it in WA or similar. Of course it DIDN'T play in WA or similar, so its most likey a goofed-up spoof, but it could be a backdoor key to a compomised player, or ?

Control-click (not command-click) on one of the headers (such as quality, name, #...) A menu will come up with boxes to check what you would like to be displayed. Click Location. Also, if you want more info for Audio or Video, they have submenus where you can choose more options.