Pirated Windows 7 Builds Botnet with Trojan

Hi all

Why don't people EVER give PROPER info for this stuff

1) If MS knows that these are "Infected" - give the hashes for the "Infected" builds -- we've all got the hashes for the Official builds so it's easy to check.

2) Say WHAT BUILDS are infected. Microsoft has been burying its head like an Osterich in the sand even refusing to ACKNOWLEGE any builds other than the BETA 7000 and the official 7100 EVEN EXIST.

3) If this stuff has a botnet / trojan in it publish a method of detection -- some people will ALWAYS use stuff from "dubious" sources -- and in doing so can transmit stuff to software obtained Legitimately.
By just saying certain downloads might contain a Botnet etc without publishing methods of detection etc is just being PLAIN IRRESPONSIBLE.

Information such as saying "XXXX" might contain a virus / malware etc doesn't actually help ANYBODY and merely re-inforces the perception that they are just scaremongering.

If your build matches the Official one it WON'T contain anything it shouldn't.

Of course with the Official RC being easily (and quickly) available it really doesn't make any sense to download it from a torrent -- but that is a TOTALLY different issue.

Cheers
jimbo

Jimbo ditto, the chatter is crazy, no solutions, no symptoms, no victims just noise!

best

barney

Night Hawk said:

Well it was I tried to point out before and got a lot of back talk about people matching up hashes there are ways around things in order to slip bugs into the various leaks. Earlier you saw the MS official warning about downloading from torrent sites. Now you see a strong one here about the RCs being polluted.

And the 4/24 date sounds awful familiar doesn't it? Airbot

Another sentence to add here is the start of the following paragraph in the article seen at the link there. "Targeting users through pirated software is nothing new for hackers." It makes far more sense to stay with the genuine article coming direct from Microsoft rather then thinking you are getting something still good elsewhere and to run into something like that.

I just got pointed to another article on this seen at Pirated Windows 7 software part of criminal botnet

jimbo45 said:

Hi all

Why don't people EVER give PROPER info for this stuff

1) If MS knows that these are "Infected" - give the hashes for the "Infected" builds -- we've all got the hashes for the Official builds so it's easy to check.

2) Say WHAT BUILDS are infected. Microsoft has been burying its head like an Osterich in the sand even refusing to ACKNOWLEGE any builds other than the BETA 7000 and the official 7100 EVEN EXIST.

3) If this stuff has a botnet / trojan in it publish a method of detection -- some people will ALWAYS use stuff from "dubious" sources -- and in doing so can transmit stuff to software obtained Legitimately.
By just saying certain downloads might contain a Botnet etc without publishing methods of detection etc is just being PLAIN IRRESPONSIBLE.

Information such as saying "XXXX" might contain a virus / malware etc doesn't actually help ANYBODY and merely re-inforces the perception that they are just scaremongering.

If your build matches the Official one it WON'T contain anything it shouldn't.

Of course with the Official RC being easily (and quickly) available it really doesn't make any sense to download it from a torrent -- but that is a TOTALLY different issue.

Cheers
jimbo

Excellent post and agree 100%
The one's that got a clean, untampered with leak know who they are and knew what it was they were downloading.
Time to move on and stop whining..

No worries...

Well, if you do install the RC from torrents, check this:

If you do install an official RC build then you should confirm that the MD5 checksum on the ISO is the same as a known safe MD5. Known safe MD5s are:

Windows 7 RC Build 7100 x86 is 8867C13330F56A93944BCD46DCD73590

Windows 7 RC Build 7100 x64 is 98341af35655137966e382c4feaa282

And:

Apparently someone released an ISO distribution with a trojan attached to the setup.exe

MD5/SHA1 etc they are check sum control numbers, and it is used to identify whether two files are the same / different. Basically if two files have eeven a single byte different, their checksums will be way different.

Hash Calculator to Get, Compute and Calculate MD5 and SHA1 File Checksum or Hash Value » My Digital Life

Also sometimes downloaded files may be corrupted during download due to various causes, bad data coming from the routers, bugs in the download programs etc, checking your downloaded file checksum against what the provider numbers ensures the file integrity, in this case the .ISO image.

I got this from:
Dan Dar3: Windows 7 beta build 7057 on ASUS R2H

Apparently someone released an ISO distribution with a trojan attached to the setup.exe

MD5/SHA1 etc they are check sum control numbers, and it is used to identify whether two files are the same / different. Basically if two files have eeven a single byte different, their checksums will be way different.

Hash Calculator to Get, Compute and Calculate MD5 and SHA1 File Checksum or Hash Value » My Digital Life

Also sometimes downloaded files may be corrupted during download due to various causes, bad data coming from the routers, bugs in the download programs etc, checking your downloaded file checksum against what the provider numbers ensures the file integrity, in this case the .ISO image.

That is correct, it's the padded setup.exe that is more than likely responsible. Also, affected will be people who upgraded from their previous OS as if booted from the ISO, the setup.exe would not run or be accessed in any capacity.

So if you ran an upgrade from an earlier Beta or previous OS using the leaked torrent, you are more than likely "botting" :)

Lordbob75 said:

LOL. Why?

The RC is free..... Why are people so stupid?

~Lordbob

I second that.... downlaoding from a Torrent is like somebody slipping you a mickey and the next morning you're sitting in your undies wondering what happened....