Camoflagued Mp3s Contain A Backdoor Beware

TranceAddict Forums (www.tranceaddict.com/forums)
- Music Discussion
-- Camoflagued Mp3s Contain A Backdoor Beware
Pages (2): [1] 2 »

Posted by 8Wonders on Dec-12-2002 04:33:

Camouflaged MP3s Contain A Backdoor. Beware.

WATCH OUT! That camoflague thing you need to decode installs backdoors on your system EVERYTIME YOU PLAY HIS TRACKS.

Also note, that it CANNOT BE DELETED unless you go into the recovery console.

It installs a bunch of executables in your winnt/system32 directory and then runs them in the background.

I was wondering where the fuck I was getting these from as I wasn't even downloading anything, then I remembered the camoflague thing (Which i was very suspicious of in the first place). Then I decided to "test" my theory, surely shortly after I placed one of his reconstructions (Ocean Lab - Beautiful (Signum Remix) I got the same files copied!!

Now this MAY NOT be his fault but rather the utility he was using to encode, nevertheless DO NOT DOWNLOAD.

ADMINS: Take care of business.

Posted by 8Wonders on Dec-12-2002 05:25:

Important bump.

Posted by Seventh City on Dec-12-2002 05:48:

can we get the names of these?

Posted by 8Wonders on Dec-12-2002 06:25:

I don't have the list as I've deleted them all, sort your system32 folder by date and check for any supicious exes such as sysconf32.exe or screwed.exe, psexec.exe, etc..

Posted by arj1o1 on Dec-12-2002 07:01:

i think you can found it by using ad-aware

Posted by [mart] on Dec-12-2002 09:38:

Zoiks!

Posted by raver31 on Dec-12-2002 09:45:

its kinda funny. i tried uninstalling camouflage and i cant delete the dir. it says that camshell.dll is being used by another program.
what software did u use to remove those gay ass backdoors?

Posted by flystyler on Dec-12-2002 09:57:

I use an old version, and it seems to be fine.

Overall it is a good prog, and does hide mp3s succesfully from server bots.

But obviously backdoors r not good

Posted by Fundamental on Dec-12-2002 10:05:

What is "the camoflague thing"?

Posted by flystyler on Dec-12-2002 10:15:

quote:
Originally posted by DJ Fundamental
What is "the camoflague thing"?

It is a programme that lets u hide files in jpg images, so they appear to any server bot as a normal jpg, but are infact a hideen mp3

The programme encodes and decodes them for you

A good way to hide mp3s on the net, to host them

Posted by teo on Dec-12-2002 10:52:

i have dled danceaddicts reconstruction of albinoni but i didnt noticed any camoflage file or anything....but some days after i had prob. with a worm..

Posted by Intense_Sounds on Dec-12-2002 11:09:

hahah....this is all too funny!

Posted by danceaddict on Dec-12-2002 12:17:

Hmm didnt know bout that, arg gonna look on my own pc aswell then, thanks for mentioning it.

My big excuses for it, I tried it a week myself (after I saw someone used it) it seemed to work ok, so I decided to use it so files wouldnt get deleted from a server that fast..

Thanks again for the info, I took all the files offline aswell.

2teo: if u downloaded it straight from the hub you shouldnt have any problems with it, that file isnt camouflaged. It's the program itself that is

Posted by webmeister on Dec-12-2002 12:27:

just another bump .. people should be aware of this...

thankfully my system was clean

Posted by DJPrototypeX on Dec-12-2002 20:19:

could be the source of my problems...my comps all facked up...

Posted by Fast Turtle on Dec-12-2002 20:27:

11. What happens if a file containing a virus is camouflaged inside a seemingly harmless file?

Although camouflaged files containing encrypted 'virused' files would pass through a virus-checker, as the virus itself would be encrypted (and therefore scrambled), it could not possibly be triggered or cause any harm. Opening a camouflaged file simply reads the archive information, which would again not trigger any hidden viruses. The only way a virus could be triggered would be to extract a file from the Camouflaged file and then run that file (which would have to be capable of containing a virus, for example, an .exe, .com, script file or Word document) without first checking it.
If you're concerned about viruses, simply extract the files from the camouflaged file and scan them using your virus checker

My directories are clean...another worm possibly infected the file and is causing this behaviour, or it is downloaded from a 3rd party site.

uninstalling cleans itself out fine, too.

Posted by k.k.d. on Dec-12-2002 20:29:

heh... luckly i dont download crap like "camouflage", preciselly because of the aforementionned reasons... I don't trust random internet crap

Posted by Ste on Dec-12-2002 20:31:

one more virus wont really makeany difference on MY comp

Posted by [N]�k|��[Z] on Dec-12-2002 20:32:

well this may be irrelevant....... but..... when im in #ukta on mirc........ after i been online for more than 10 mins or so..... if i try ti send a file to sumone it says that i cant, cos my ip isnt my own... i aint d/l'ed any of danceaddicts stuff (sorry dood ) but i did virus scan.... and it came up with 4 infected files... all of which i know where i got and know what files they r... they r little gay exe thingys.... i cleaned em all... but still the same happens... i d/l'ed from the file sharing area wher danceaddict posts his tunes.... so maybe other files in there are or have been infected?????? i dont know.... maybe im clutching at straws, but i suggest be careful, incase it is sumthing from there, but probably im wrong ????!!????

Posted by Fast Turtle on Dec-12-2002 20:41:

Well, it's possible. It's easy to hide files in exe files. There's a program out there called silk rope that does that, iirc. You're also running NT and me 98. There seems to be way too much time put into the program for it to be a virus, though... Who knows. It's likely the remains of something else in your system. I know the klez worm infected my totalrecorder and made it reinstall itself whenever I ran it.

Posted by tranceman78 on Dec-12-2002 22:36:

I've run camoflage for a while and haven't had any problems with it. I haven't downloaded any of Danceaddict's reconstructions either. It's entirely possible that your problems are being caused by something else. Stuff like that is a bitch to get rid of.

Posted by DJPrototypeX on Dec-13-2002 12:39:

quote:
Originally posted by tranceman78
I've run camoflage for a while and haven't had any problems with it. I haven't downloaded any of Danceaddict's reconstructions either. It's entirely possible that your problems are being caused by something else. Stuff like that is a bitch to get rid of.

i been meanin to uninstall this for awhile...my comps been slow...everythin takes forever even though i defraged a couple of days ago...so i uninstalled it last night...cept the folder didnt go...anyway...my comps alright now...kinda...lol...

Posted by 8Wonders on Dec-13-2002 23:49:

A little update.

The best way to remove it is to delete the folder right away on a fresh boot, do not run any applications. That'll get rid of it.

Appologizes to Danceaddict, this thread was somewhat negative towards him, as if it was his fault, which it really isn't. It's the assbags behind the software.

One thing I've noticed when I had the misfortunes of having it installed is that the CPU usage jumped to the roof, so it indeed does affect system performance. I'd also advise anybody who has had it installed to scan for viruses.

Posted by speedracer_mec on Dec-14-2002 00:21:

someone name his reconstructions...

Posted by danceaddict on Dec-14-2002 00:28:

2DC: thanks m8

2Speedracer_mec:
I only used the camouflage software for:
Oceanlab - Beautiful Together (Signum Remix)

later as a backup also for:
Rollerball - Albinoni
Altitude - Tears In The Rain

BUt.. if u got the mp3's without having to use the camouflage software (for example on the hub, or the first time when I posted albinoni/tears in the rain) then you don't have to worry about this issue

Pages (2): [1] 2 »