Files downloading themselves

[Jumjalum]

Why are there files that keep appearing in my download window that I havent seen before. The same one keeps coming back every time I cancel it. I came on yesterday to find a folder full of 300 MBs of empty MP3s I hadnt seen before. It seems like a virus or something.

[nasrules]

thats really weird! thisll sound basic but could sum1 else be using ur computer to start them downloading? wot app u usin?

[Jumjalum]

Its possible over New Year someone came in and was messing with it but I'm sure I would have noticed. I'm using Kazaa 2.02.

[TFoS_Fan]

I think your computer may be cursed, or evil, or both, lol, sorry

this is wierd, my only thought that it could be a rather pointless virus (as it doesnt do anything to your comp), but can't say I have heard of anything like this.

What program are you using and could you tell us a bit more about these empty mp3s like filenames, try scanning them to see if they are viruses.

Maybe its the RIAA, nah.... that would involve them being good with pcs and the internet and seeing that their site has been hacked the odd million times, its not looking very likely, lol :cross

[peace]

[Jumjalum]

The program is Kazaa 2.02 with ShareMonkey, the file that keeps coming back is called !01 - Bullets.mp3 and since I first wrote this post I've cancelled it, cleared it and its come back again! I can only assume that this is connected to the big folder of strange MP3s that appeared at the same time. I just did a quick Norton scan of my kazaa folder and my shared folder and nothing came up and my definitions are only a couple of days old.

[Ken17625]

Did you run a virus scan with updated definitions?

[Jumjalum]

Yes, but just on the 2 folders so far...also the username that appears with the download is dummy@dummy.net but most of the time it doesnt find any sources. It had gone offline by the time I'd typed in a message.

[overdo]

dummy@dummy.net is the username specified by Sig2Dat. have u clicked on a link recently which never appears to load up in IE or netscape?

[wonderboy2005]

yeah... it could be a sig2dat problem.... do you ever use sig2dat? if not that, are you running a firewall? somone could be hacking you and just playing around.... tho if thats it, its a pretty worthless hack...

my bet is somthing with sig2dat...

[Jumjalum]

Hmmm...never heard of Sig2dat, I dont know if I've clicked any links like that but I dont think so. I'm not running a firewall either. I've reinstalled Kazaa from scratch but that didnt help, but I never had to re-enter any of my info despite deleting the whole folder manually.

[e160877]

I too am having that problem with the !01.bullets mp3 that mysteriously keeps returning. I have to put it on permanent pause. I have no idea what this sig2dat is so I don't know whether I've clicked something relating to it or not.:shy

[chipperrox]

sounds like a dumbass virus to me- its not really virus, id call it a "barbara streisand" its not really useful- just there to annoy you

[venicebeach]

I know the answer to this one!

Buried in Windows XP's system32 folder is a subfolder called "klm." It contains the executable ws32kza.exe which is identified as a "ProphoApp MFC Application." Also in the folder was ws32m.dll version 1.0.0.1, a "Propho MP3Maker" dll.

Two data files also reside in the folder: ms32kza.dat and ws32bak.dat -- and the latter contained all of the data for the "!01 - Bullets.mp3" song.

I've removed these files and k-lite performs just fine -- and the mystery download file no longer appears in k-lite's default download folder. Ws32kza.exe had installed itself in Windows autostart -- which is how I found it -- and which explains why the mystery downlad file kept being written whether k-lite was open or closed. Open your autostart directory and remove Ws32kza.exe from it.

This is a primitive trojan horse. While cruising KaZaA, I never found anyone serving up !Bullets.mp3, so I can't say whether it contained anything nasty that might have really harmed your system.

Good news is you won't have to sweep your hard drives or reinstall WIndows. I've been running k-lite for a month since removing these perky files and everything is cool. No further problems.

[Jumjalum]

Cool, thanks for the info =)