Japanman

Hi you guys,
I took a look at the hobby lobby Mig video and the next thing I knew my virus protection software gave me a warning that a trojan hose virus had come in the same download. I did a live update and then a complete scan and that trawled up a few more from the same site. I suggest all you guys who have been to the hobby lobby site recently do the same.

J.M

edit - Title change as I found that this may not be specific to hobby lobby and want to troubleshoot with you guys. RCadmin

P-51B

My Feedback: (5)

Been there, looked at the video, did not have any problems.

Lynn S

I think those are very common now. Sometimes my hard drive is working away and I wonder who is in there taking a look at what is on my computer.
I get the trojan horse virus warning a lot from my Norton Internet Security firewall.

DICKEYBIRD

Man, this spyware, browser hijacking, etc. is a real pain.[:@][:@] I have a constant struggle on my home system trying to clean out the stuff. Trouble is, they get into your registry and keep reinstalling themselves over & over again! There oughta' be a LAW with severe penalties that hits these slimeballs where it hurts. I guess the only way to completely eliminate it is to switch from IE to Mozilla or one of the other browsers that don't get hit by it.

2fast4u

My Feedback: (5)

YEP!!!! THERE OUGHT TO BE A LAW...[:'(] [:@] [:'(] [>:]

combatpigg

My Feedback: (3)

Thanks for the warning JM. The next step is to contact HOBBY LOBBY, let them know what professional and special interest organizations that you belong to, and also let them know that you are organizing a "black list boycott" of their products "till they can furnish proof that they have cleaned up their act. Let them also know about how the bulletin boards are passing the word along. It is up to US to take back the internet through economic sanctions. It would only take 20 of us guys to act on this matter within the next few days to initiate a response from HL. I'm going to contact them right now.

Their address is: 7707 S.W. 44th ST. Oklahoma City, OK 73179 Let's get the word out and do our part to help stamp out WORMY business practice.

DualdudE

Just downloaded the file to check it out. There's nothing wrong with the video file.

The thing that is possible that software like NIS (Norton Internet Security) notices that some application is trying to make a connection to the outside world. It's very likely Windows Media Player is doing this. Software like NIS give a lot of 'error' messages but many of them are based on non-threatning events.

There is also the possability that the trojan was already on your computer. As a result of that the MIG file got infected. Also computer-viruses spread themselves. Imho hobby-lobby isn't to blame

combatpigg

My Feedback: (3)

What are the odds that both JM and I got the same warning after doing the same thing?

mvigod

I downloaded it without warning. However Duralite has a real trojan and they are moving their site as I type this. I posted an announcement from the yesterday about this.

Now if everyone would buy a Macintosh this wouldn't be an issue anymore...no more trojans or virus

Andrew

We manage about 4300 faculty/staff machines plus another 3000 on the student side -- last fall, two days after the semester started, NACHI took all 7300 computers down in 19 minutes. We were flatlined for 60 hours and crippled for a full week -- had we gotten our hands on the author of NACHI, we would have gladly lynched him with a network cable.

I have downloaded and scanned both the Real Player and Media Player files with no hits. Media Player has some security holes which can be patched thru the Windows Update site -- for those of you that may not have the most recent OS patches, you can have the patches installed by opening Internet Explorer, choosing TOOLS on the menu bar and WINDOWS UPDATE from the dropdown. Microsoft may request that you install the most recent version of the Windows Update Software. When this completes, select Scan for Updates. I would recommend that you install any Critical Updates and Service Packs that may be missing -- some of the hunters out there can be really nasty and will install on an unpatched machine without your knowledge.

Lastly, if you think your machine might be infected, you can download and run Stinger available from McAfee Antivirus. This executable will search for and remove the most widely spread viruses. It can be found [link=http://us.mcafee.com/virusInfo/default.asp?id=stinger]here[/link]

the "other" Andrew

mvigod

I downloaded the Hell Raiser biplane wmv file and got the trojan warning just now with mcafee. I let hobby lobby now about it but it may or may not even be their site. I had larry do it and his d/l just fine without warning the same file. weird stuff.

mvigod

UPDATE:

I just deleted all my temporary internet files (cache) and restarted my browser then went to download the videos again without getting any warnings from McAfee this time. I think this is not related to the Hobby Lobby website or files but perhaps some lagging files that are sitting in some users cache's. The files might be trojans or just files pushing the triggers of the virus software.

If some of you guys can scan your disks to remove any virus then delete all temp files from your browser cache and then go to the video, site or file that caused the warning to see if it is gone we can determine if my theory is correct.

Billy Hell

My Feedback: (2)

Hobby Lobby has never attached data gathering devices or anything else to files, which we have for download. We never will! Hobby Lobby uses corporate strength software, scanning our office computers and server daily. In the last hour we have verified that all Hobby Lobby downloadable web files are clean. You can download our videos with confidence just as you always have. Hobby Lobby takes this seriously and will continue to do everything we can to keep our files clean.

Jim T. Graham
PR and Marketing
Hobby Lobby
615 373 1444 ext. 216

Japanman

Jim,
Good to hear from you about this.
You will appreciate that it was my responsiblity to warn others of this problem as directly as possible to stamp that b*stard virus out.


Marc, It may be that they were newly created trojans as NIS could not remove them or detect all of the infected files on my computer without a live update. Given that i had liveupdated two days earlier I`d say they were newly created viruses- well, from my computer illiterate stadpoint anyway

J.M

Billy Hell

My Feedback: (2)

I will always appreciate a heads up on anything like this. Please feel free to call.
Jim T. Graham
PR and Marketing
Hobby Lobby
615 373 1444 ext. 216

Rebellion

My Feedback: (2)

Ok, checked to make sure my system was clean. Shut down my firewall software and downloaded the two videos in question from Hobby Lobby. Then ran a full system scan with Norton av and, just to be thorough, a couple of anti-spyware programs I have installed. My system came up 100% clean. As expected.
Billy Hell, it's good to see your rapid response to the situation. Not suprising as I have been doing business with Hobby Lobby for several years now, both through phone order and in person at your shop in Brentwood. I have always found your people to be honest and sraightforward and your customer service second to none. IMHO it would have been totaly out of character for you to have something like this in your system.
Combatpig, the address you gave was for an arts and crafts outfit. Hobby Lobby International's address is 5614 Franklin Pike Circle, Brentwood, Tn. 37027.


David E.

Lynn S

Does deepmetrix.com show up as a trojan horse on anyone else's firewall??
As soon as I logged on to RCU just now, I got a message that deepmetrix.com wanted my home address which as been flagged not to be sent out. I have been told by RCU that this was an error on the part of my Norton Internet Security and deepmetrix does not get that kind of information, but I still wonder why it picks up things like my credit card number, and home address.
It seems to be looking at information used to order online, or maybe Norton is wrong.???

mvigod

Lynn,

Norton is wrong. No site can retrieve information that it has not set in a cookie itself. Both RCU and deepmetrix set cookies otherwise you would have to log in on every page of RCU since we would not know who you are. We (nor deepmetrix) can ask for cc numbers or address unless we already know that information, set it in a cookie and then ask for it back (and ask yourself what would the sense of that be?).