scanner-c517d_2015.exe

I just received this in reply to my message to the New York Times:

Begin forwarded message:

From: Web Editor/NYT/NYTIMES <webeditor@nytimes.com>
Date: 13 September 2009 3:49:40 PM EDT
Subject: Re: Malware on nytimes.com?

Thank you for writing. We are aware of this issue and are attempting to track it down. We have posted the following note to readers:

Some NYTimes.com readers have seen a pop-up box warning them about a virus and directing them to a site that claims to offer antivirus software. We believe this was generated by an unauthorized advertisement and are working to prevent the problem from recurring. If you see such a warning, we suggest that you not click on it. Instead, quit and restart your Web browser. Questions and comments can be sent to adtraffic@nytimes.com .

Terrence Harvey wrote:
The page my wife saw has green progress bar as it "scans" your hard drive. This is fake, it is showing a fake list of Windows files. However, if you get the .exe file downloaded to your machine (which is real), just delete it, even though it is not dangerous to your mac.

I believe this is correct. No genuine scanning of your hard drive is taking place. What you see is simply an imitation of what some sort of scanning process on Windows might look like. And of course, the scan pretends to find all sorts of problems on your hard drive, so you are inclined to click some button and download the .exe file. Unless you have something like Wine or CrossOver installed, this .exe cannot be executed on your Mac. Just put it into the Trash and delete it.

By the way, has anyone scanned the .exe with actual AV software to determine if it contains a known virus? I scanned it with ClamXAV (with the latest virus definitions), but it was not labeled as dangerous. Maybe it's a new virus. I suppose someone will analyze it eventually and see what it actually does.

I just had a similar thing happen. Had a mix of NYTimes and other sites up but had just clicked on an article in the movie section. This is the url of the page that came up: http://sex-and-the-city.cn/go.php?id=2015&key=ace6725ec&p=1 it immediately started downloading something in spite of clicking cancel repeatedly. The file partially downloaded before I was able to get it to stop. It is Scanner-124_201.exe It freaked me out. I don't know a whole lot about computers so I was wondering if this was some sort of virus.

From Googling, I see similar reports about other news sites including USA Today, SFGate, Huffington Post, and unidentified links from Google News.

i just figured the problem out with the false popup. The thing took hold of the computer and wouldn't let go. From what everyone said am i to conclude that this nuisance will not hurt my mac?

There seems to be no actual threat from this as all the posts in various threads indicate. Soon as it pops up close the browser . . . don't click on anything just bail out to prevent the nuisance of empty files being placed in download or other folders. The ones that have popped up on The NY Times look like this:
http://picasaweb.google.com/larrymray/MiscPhotosAndGraphics#5380988351872150274
. . . they do nothing unless you click Cancel or OK. I just close the browser. Interestingly, later in the day on The NY Times this doesn't happen.
L

Message was edited by: LarsRaggio

Official explanation, from the NY Times:

http://gadgetwise.blogs.nytimes.com/2009/09/14/what-to-do-if-you-saw-an-antiviru s-pop-up-ad/?hp

There is an overview article on the whole ad scam operation in this morning's NY Times. It is a good and informative read that explains not only the what but the why behind the pop-up "virus software" ads that took over our screens.

http://www.nytimes.com/2009/09/15/technology/internet/15adco.html?_r=1&ref=techn ology

LR