SySaver malware?

[of...@aol.com]

Earlier this week I downloaded the update, and then was directed to a page to pick a free gift app or something purporting to be from you-all for getting the update.  I selected something called ZIPdownload or something like that.  Soon every few links or even just blank parts of webpages I clicked on would instead open a new tab (I'm using Google Chrome Browser) offering me various convoluted consumer surveys, prizes, gift cards, etc.  The URLs of the pages 'popped-up' in this way included elements similar to those of the website I was trying to read or click from, so at first I assumed they were a new kind of annoying popup ad not yet blocked by normal popup blocking.


Then today I started seeing ads on Wikipedia!  They had a fundraiser recently, so I wondered if they'd had to just cave and sell space.  These ads were churning fast too, unlike normal web ads, and they were starting videos and audio automatically in their banners and squares.  This all became intrusive, so, suspicious, I found this page https://blog.wikimedia.org/2012/05/14/ads-on-wikipedia-your-computer-infected-malware/.  So I went into my browser extensions and found something unfamiliar to me calling itself SySaver and not saying anything about what it is (and I am extremely conservative about installing new programs/etc. on my laptop here, as well as knowledgeable about computers and software in general).  I googled SySaver and found mentions connecting it with ecommerce, and thought it might be the culprit, even though it's not the one mentioned in the 2012 Wikimedia article.  So I Trashed it in Extensions, Uninstalled it via Control Panel, noticed it had been installed just on 9/26, two days ago, same as ZIPdownload, so for good measure I uninstalled ZIPdownload too.  Somewhere while I was doing this, my browser got closed w/o asking me, so I reopened it, restored my closed tabs via the yellow warning bar, and the ads seem to have "disappeared" from Wiikipedia, as well as the extraneous neo-popups... so far.


Sorry if this is long-winded, but I never know what will be helpful to you-all, so I figure to err on the side of caution and give you these details.




---Pete in Pennsylvania

Re: SySaver malware?

[Donald Whytock <dw...@apache.org>]

On Sat, Sep 28, 2013 at 2:03 PM, <of...@aol.com> wrote:

>
> Earlier this week I downloaded the update, and then was directed to a page
> to pick a free gift app or something purporting to be from you-all for
> getting the update.  I selected something called ZIPdownload or something
> like that.  Soon every few links or even just blank parts of webpages I
> clicked on would instead open a new tab (I'm using Google Chrome Browser)
> offering me various convoluted consumer surveys, prizes, gift cards, etc.
>  The URLs of the pages 'popped-up' in this way included elements similar to
> those of the website I was trying to read or click from, so at first I
> assumed they were a new kind of annoying popup ad not yet blocked by normal
> popup blocking.
>
>
> Then today I started seeing ads on Wikipedia!  They had a fundraiser
> recently, so I wondered if they'd had to just cave and sell space.  These
> ads were churning fast too, unlike normal web ads, and they were starting
> videos and audio automatically in their banners and squares.  This all
> became intrusive, so, suspicious, I found this page
> https://blog.wikimedia.org/2012/05/14/ads-on-wikipedia-your-computer-infected-malware/.
>  So I went into my browser extensions and found something unfamiliar to me
> calling itself SySaver and not saying anything about what it is (and I am
> extremely conservative about installing new programs/etc. on my laptop
> here, as well as knowledgeable about computers and software in general).  I
> googled SySaver and found mentions connecting it with ecommerce, and
> thought it might be the culprit, even though it's not the one mentioned in
> the 2012 Wikimedia article.  So I Trashed it in Extensions, Uninstalled it
> via Control Panel, noticed it had been installed just on 9/26, two days
> ago, same as ZIPdownload, so for good measure I uninstalled ZIPdownload
> too.  Somewhere while I was doing this, my browser got closed w/o asking
> me, so I reopened it, restored my closed tabs via the yellow warning bar,
> and the ads seem to have "disappeared" from Wiikipedia, as well as the
> extraneous neo-popups... so far.
>
>
> Sorry if this is long-winded, but I never know what will be helpful to
> you-all, so I figure to err on the side of caution and give you these
> details.
>
>
>
>
> ---Pete in Pennsylvania
>

Hi Pete...

Thanks for your concern.  Sorry this wasn't responded to sooner.

Apache Open Office is free to download and distribute, so it's possible for
there to be any number of legitimate copies out there.  However, the only
ones we can swear by are our official downloads, from the official site at
openoffice.org.  We also have Sourceforge distros; the links to the
specific Sourceforge downloads are at
http://www.openoffice.org/download/other.html

If you downloaded from any other site, we have no control over it being
virus/malware free.  Was this an official AOO download?

Don