davecabezo wrote:Yes it takes you to Filefactory and when I clicked on the first part of the file it proceeded to download but it was strange in so much as it said it was download ing the file but I suspect it was really downloading a load of malware first, then after a couple of minutes I got a proper filefactory banner saying something like "Filefactory fast download and it started to count down the % of the download

When filefactory opened, did you get the same page as the last 2 screen shots depict? If so, did you click the red "Slow Download" button, seen in the page 3 lower screen shot? If YES, the red Slow Download button should have changed to a gray oval 60 second countdown timer. At the end of the countdown, the page should have changed to one with a single red "Click here to begin your download" button, with a checked box under it titled "Download with FileFactory's download manager".

Hi tendriver,

Today I got my old computer and connected to internet etc as there is nothing on the old computer that is important so I tried the downloads again. Same results and I kept the reports from the antivirus software so that members can be very carefull in their dealings with linksave. I assume, as there are no other threads to the contrary, that if you get through to linksave as the forum expects there are any problems.
The attachments are from the 3 A/V programs that I had available, they do not tell the whole story as the Malware disables ALL Search engines and the adverts etc consume the PC.

Please view the attachments and I will be happy to answer any questions.

I would suggest however that the powers that be on the Forum approach Linksave and ask what is going on.

Regards,
Unfortunately I can only attach 5 small .txt files, these attachments are only about 20% of the Malware discovered

Dave58845883588058815882

That is exactly as it happened. The only difference to what you've posted and what happened is in the first screen shot.

I have uploaded some copies of the Malware installed on my computer,

regards,

dave

With Jdownloader all you do for normal filehosters and linkcrypters:
Install JD,
start JD,
copy the link into the clipboard and wait a moment,
JD takes over and will prompt you for all captchas or passwords.
With a righ click on a file in the list you can select several things incl. whe to save the file on your PC if the default is no good.

davecabezo wrote:1. Please view the attachments and I will be happy to answer any questions.
2. I would suggest however that the powers that be on the Forum approach Linksave and ask what is going on.

1. In the years that we have been doing this, you are only the 2nd member to have an issue of the magnitude that you claim. Question: In all of these years, why do you think this supposed malware was loaded onto your computer & nobody elses, except the 1 previously mentioned. Based on my comments in this point, I doubt you will get many, if any questions.
2. We have 265,788 members & 2 member complaints. How do we justify contacting Linksave and ask what is going on?

Confirm that you are saying, when filefactory opened, you got the same page as the last 2 screen shots depict. You clicked the red "Slow Download" button, seen in the page 3 lower screen shot. The red Slow Download button changed to a gray oval 60 second countdown timer. At the end of the countdown, the page changed to one with a single red "Click here to begin your download" button, with a checked box under it titled "Download with FileFactory's download manager". It was when you clicked "Click here to begin your download", that the malware was downloaded to your computer.

That's exactly the way it happened tendriver. I am at a loss as to why there are only 2 of us to experience this malware. I have Avast free, Superanti spyware,Mbam and winpatrol all active on startup and they are constantly trying to stop the installation. After clicking to download the map file questions pop up asking if you want various "helper" programs installed, even if you click decline they are still downloaded and installed.
It's a shame but it looks as if I will have to either stay with my out of date maps or save up for new ones.

Regards,

dave

Or simply trust us if we say that there are no viruses in our files.
I'm almost certain you don't get a real virus warning but a generic one.
Dumb scanners report all programs that will try to access your files and folders as malware if not mentionen in their whitelist.
Since it costs top dollar and no program used for illegal stuff makes in a whitlist anyway...
If there would be a virus in our map one of the thousands of users downloading would have complained. ;)

Sorry Downunder but your way out of line. You've no idea what the Virus was like. I'm not talking about an extra file here or there but real virus that knocked out my IE and Google Chrome to the point that I had to reinstall them. That is not imagination.
Do the enclosed attachments look like generic Virus. Do Generic Virus Knockout IE & Google Chrome. Are you calling MBAM,Hitman Pro, Superanti Spyware Pro & Avast Dumb Scanners??
I cannot understand or fathom out why no one else has complained. Why don't you try downloading just 1 of the batch which I downloaded and report back. During the download it give the user the chance to decline download the internet browser help files and also easylife, but decling makes no difference as they are downloaded and installed anyway. If you had the facility for me to upload ALL of the A/V reports then you would in fact see the extent of the infestation. I am not saying NaviTotal included the virus but someone certainly has. These viruses are mostly installed as a way of generating cash due to the incessant advertising banners etc.

I am computer literate and know what I'm doing most of the time and I do know a virus when I see one.

Regards,

Dave

I can only tell you that no files uploaded by our team members or in your case our uploader Popeye will contain any harmful code.
The file(s) you claim to have cause your attack have been downloaded many times before and certainly also after you tried to get them - so why does no other user have his computer infected?
Just to try clearing this up:
If your attck happend when starting an installer you are right to assume the file was infected - but this case would be almost impossible.
If, however, your attack happened when you tried to download the file you have two options:
Either you clicked on the wrong button and sadly got an ad that was infected,
or some other internet related process was infected.
So you see why I say your scanners are crap
There is no scanner that reports a file while downloading, at least none that I call trustworthy.
If a loophole for a browser attack was found and used they won't help you either
And if your download really was completed and the scanner complained than no damage could have been done unless you allowed the suspicious program to continue anyway.
By the way: I wasted a GB for downloading and unpacking your "infected" Central_and_Eastern_Europe 915.5074 and neither had a problem downloading, nor unpacking and activating - the problem is on your end only!

Downunder35m wrote:I wasted a GB for downloading and unpacking your "infected" Central_and_Eastern_Europe 915.5074 and neither had a problem downloading, nor unpacking and activating

I have also tried to duplicate this issue by downloading & unzipping numerous 915 maps & have had no success.

Next week I will try again on my old stripped down computer and report back

regards,

dave

davecabezo wrote:Next week I will try again on my old stripped down computer and report back

Uncheck "Download with FileFactory's download manager".

Hi,

This is a step by step account of what happened when I downloaded the files for Europe map no 915 - 5074. zip 4
From clicking on map I got diverted to Linksave.in. No facility to enter password so clicked on Slow Download . Waiting for the download to start and noticed bottom LH side a lot of "Waiting for" then what looks like adware sites.
After a while I then get a box Download EasyLife web search. I press the decline button then another banner saying "are you sure? by clicking OK you agree to install EasyLife Home page and set EasyLife search engine as default", the only other option is Cancel which I pressed. Then 2 more similar attempts by EasyLife and then exactly the same sequence for PC Speedup software OPTIMISER.
Then the D/L of the map file starts. Within a minute or 2 I get a warning from my AVG saying that PUP File Name: c\documents and settings\anyone\local settings\temp\68525fg0tp_5uyWvz.dll, threat name: Adware Generic 5 AHSR detected on open of file.
I chose to delete the file and wait and see if it damaged the Map ZIP File.
Then after 90% of D/L another warning PUP file name: c\system volume information\restore 952DCA5E_E3DG-41C3-9465-A927F129AB87\RP157\A0060416.dll again I chose to delete.

Tried another D/L and got the visitors password box
entered password and began D/L Still boxes asking if you want to D/L spyware viz:
1st was Download Keeper, I decline but then another box pops up asking Are You Sure
then came Easy Life Ditto above
then came Search product Ditto above
Then came Speedup PC Optimizer Ditto above
The D/L of zip 5 then begins and there was no Alerts from my A/V program

I did notice that when I got to the D/L section after submitting the password there was only 5 zip files whereas when there wasn't a password box the D/L area had 7 files (6x200mb & 1x127mb) unfortunately I didn't get the size of the 5 zips and I got the password box only once out of about a dozen attempts.
Why there are 2 sets of downloads must be a mystery and also why I have difficulty getting to the password stage.
The only difference between us is that I live in Tenerife and will be using Telefonica as against BT.

Don't know if you will be able to offer a solution but I will keep checking this thread

regards,

dave

Hi All,

Just tried 915.5074 UK & IRE on Navcore 9.510 (TT XL) and it keeps saying I cannot use that map, yet the table says it should? Should I try manually patching?

fire-host wrote:Hi All,

Just tried 915.5074 UK & IRE on Navcore 9.510 (TT XL) and it keeps saying I cannot use that map, yet the table says it should? Should I try manually patching?

This is the classic message for an unpatched map. A patched map will have a .meta file & a .meta.dct file in the 915.5074 map folder.