3 replies to this topic

[salmon]

Saw a page on facebook with 100,000 fans supporting FLVDirect.exe and ChameleonTom.exe

http://www.facebook.com/pages/OMG-I-LAUGHED-SO-HARD-WHEN-I-SAW-THIS-PIC-OF-CHERYL-COLE-AND-JOHN-TERRY/386706143273?v=wall
Links on the side

http://www.virustotal.com/analisis/7ebed52...63f8-1268564974
Result: 4/42 (9.53%)

http://chameleontom.com/#download

related sites:
http://chameleontom.org/
http://plugin.chameleontom.com/gettom
Charmy.net

Is this adware?

Attached Files

•  ChameleonTom.zip   652.32K   16 downloads

[cycl0ne]

yeah these install a bunch of adware to your machine-- some registry keys of interest include
HKU\S-1-5-21-602162358-823518204-1417001333-1003\Software\AppDataLow
HKU\S-1-5-21-602162358-823518204-1417001333-1003\Software\AppDataLow\-2vGtn_7rYg3
HKU\S-1-5-21-602162358-823518204-1417001333-1003\Software\AppDataLow\-2vGtn_7rYg3\MCACM-ZVK7-9M3
HKU\S-1-5-21-602162358-823518204-1417001333-1003\Software\AppDataLow\FLV Player
HKU\S-1-5-21-602162358-823518204-1417001333-1003\Software\AppDataLow\HavingFunOnline

They also change all of your homepages/search engine information/and creates a weird dll file called l_WiRc.dll -- which shows some malware unpacking characteristics
inflate 1.2.3 Copyright 1995-2005 Mark Adler
which is a commonly used unpacker for malware.

Hope this helps

[salmon]

Thanks ^.^ I don't know if i attached the file so i did it again

[S!Ri]

Hello.
Attached file will be verified.
Thank you for your help.