Jubilee Line on docklandslightrail.com contains malicious content

[466.networkers]

I have found out that the Jubilee Line from docklandslightrail.com is infected with adware and therefore should not be downloaded and/or installed.

***The new Jubilee Line available from BVE Routes and Trains is not affected in any way, this only applies to the route available from docklandslightrail.com***

Thanks
Ryan

Mod comment: We can confirm that this route contains malicious content and advise not to download it. Please see http://www.trainsimcentral.co.uk/phpBB3/viewtopic.php?f=1&t=2688 for further information

 

[nath9425]

Well to be honest - That really doesn't surprise me...and infact makes me think that could of been the virus I had just after I had installed the demo hock:

It was something to do with a lot of DLL's in the Windows\System32\ folder. So run a scan on these files. I had a major problem with a file called trz££.tmp The two pound signs relating to, every time I managed to delete it in Safe Mode - It went up a number from 1 to whatever...

But now they have all gone...so I blame DOCKLANDSLIGHTRAIL.COM for cocking up my PC.

Just leave us alone - Campaign To Shut Down The Site From Hosting BVE Content!

 

[Class315]

Lol, That's Funny.

Are You Being serious?

 

[Jordy]

The route does indeed contain malicious content.

This thread has been unlocked, however any further arguing, flaming or abusing of other members will result in infractions and locking of the thread as required.

Please behave

 

[D306]

TBH, i think this thread should be stickied for now

 

[466.networkers]

Good idea Mike.

I wonder if other downloads such as the 1996TS have been checked?
Cos if the Jubilee has any malicious code, is it there in any of the files that I have downloaded and installed, if that is so, then there's gonna be a hell of a lot of trouble.

 

[wishbone332]

Is this only the Jubilee Line, or is it the 1996 stock train as well?!

 

[466.networkers]

No-one knows yet, the only advice we can give now if do not download anything from docklandslightrailway.com and delete and files you may have downloaded and/or installed from your hard drive.

Hopefully someone will keep updating this thread as and when more information is known.

 

[class 313]

DISCLAIMER -

Although every effort goes into ensuring uploads to this website are free of anything that could harm your computer, the owner of this website (James Galbraith), and anyone else who's work is hosted here, will not take any responsibility for any damage to your PC or health from your use of this website and it's downloads.

 

[nath9425]

The 1996TS Seems clear to me.

It's funny how that disclaimer all of a sudden appears on this rather quickly designed website by the looks of things...

 

[Gavelex]

I certainly didn't put anything in... could it be the free clickteam thingy? only difference I can think of....

 

[5872]

Ok Handbag owners and Nath, Lets not go to conclusions.

It has to be something with the server, the waterloo n city is fine, I will be looking into this.

 

[Bighat]

The 1996TS Seems clear to me.

It's funny how that disclaimer all of a sudden appears on this rather quickly designed website by the looks of things...

Err....the disclaimer WAS there from the start. I looked at the file before it was uploaded for general use, or should I say, cruxifiction!
--- old post above --- --- new post below ---

Ok Handbag owners and Nath, Lets not go to conclusions.

It has to be something with the server, the waterloo n city is fine, I will be looking into this.

Well said Fred!

However, don't think you'll find a problem with the server either.

 

[FusionRail]

For a start clickteam wouldnt have put anything into it, and personally i wouldnt trust that site anyway. Nohtign is spetl rihgt.

 

[Turbostar]

 

[thefab444]

docklandslightrailway.com appears to be the official TfL DLR site?

 

[dan_atki]

docklandslightrailway.com appears to be the official TfL DLR site?

Yep - it does, I believe docklandslightrail.com is the intentional title URL...

 

[Turbostar]

No it doesn't, read post #17! :roll:

 

[dan_atki]

I assume you mean the deleted post before mine which had a TfL URL in it?

Typing docklandslightrailway.com into the address bar then pressing return funnily enough takes me to the official TfL DLR site. What happens when you type that address in?

 

[Jordy]

It should read docklandslightrail.com as dan_atki correctly states.

The title has been modified accordingly.

 

[Bill EWS]

I have been reading this thread with some interest as I downloaded the Jubilee Route when it was first published. I have checked my computer quite carefully and neither the AdAware, AOL Spware Protection or AGV programmes have found anything wrong. However, I have found a problem on my desktop, which I am note sure has anything to do with a virus or not! Over the last few days I have noticed that many of my files are showing with 'blue' text, while they should all be normal i.e. black! Does anyone know if this is a virus or if I may have changed something without realising it?

I have deleted the Jubilee Route from my hardrive and every file that I could find within the Route, Object and Sound folders that I think were related to that route. The blue text is still there.

Here is a screen grab of what I am getting. This is happeing with all folders on my computer.

I also found some 'sound' files, which I couldn't work out if they were part of the Jubilee route, or not. They are folders with just a letter e.g. A, B, C, D etc for a name and there a number of them. Here a screen grab (above). Does anyone rcognise these folders and to what the belong to? The above shows the folders within the 'F' folder. Notice that there are a few files still with black text.

Above: These are the folders I found and have cut and pasted into a separate folder, for this example. Interesting in that they seem to all be in black text when cutting & pasting them in to the new folder!

 

[Bayum]

Ouch - bad memories of this on my laptop...

In the end, I deleted the virus with my antivirus programme, and yeah. Computers now in the scrapheap...

 

[dan_atki]

Hmmm - under XP blue text for file/folder names suggested that the drive was compressed. Black and blue can be mixed if the option to compress existing files is not used.

Simple check you can do is to go into My Computer, right click on your hard drive and select Properties. Under the pie chart will be the compressed option and will show whether the drive contents are compressed.

Not sure if this option uses the 'dot in a checkbox' though as this would imply only some files/folders are compressed as is what you're experiencing. But if the checkbox is not completely blank then that is the cause of your blue files.

Whilst it may slow down opening some files a bit, it frees up quite a bit of space on the disk.

However, if the box is completely blank then something more sinister is at play, unfortunately.

 

[Bill EWS]

I just remembered! a few days back I cleaned the hardrive and I remember it asking if I wanted to 'compress' unused files. Could this have something to do with it and also, can the files be uncompressed?

 

[class 313]

Could this have something to do with it

Yes.

 

[Bill EWS]

Right! Thanks. But does that answer 'yes' it's files compressed or 'yes' I can uncompress them? If 'yes' to being able to uncompress the files, how do I do that?

Whatever, I have checked, particularily photo files and they have indeed been compressed somewhat, which proves all the other blue files are likewise. Luckily, I have lots of backup both on CD's and DVD data discs as well as my AOL XDrive Desktop so should be able to replace a fair amount of files. Another thing I can do, where I don't have backup is to open files in the graphic programme or MS Word or whatever and simply resave them by adding an a, or, b, etc to the filename and they will be resaved as normal. So, eventually I should be able to convert everything I feel is important enough to do so.

P.S. I checked the drive properties and the Compress box is clear (uncliked)

 

[mbonwick]

Bill,

The answer is yes to both.
To uncompress, highlight the file -->right click-->Properties --> Advanced --> Untick "Compress contents to save disk space"

 

[Gavelex]

http://www.virustotal.com/analisis/6d2ed832932117721ac425ed23075e6c

Just re-made the installer with winrar

 

[FusionRail]

Why make an installer with WinRar? Its easier for everyone to use the .exe files produced by say Clickteam and Nullsoft installer creators, providing you don't put viruses in them.

 

[Gavelex]

Why make an installer with WinRar? Its easier for everyone to use the .exe files produced by say Clickteam and Nullsoft installer creators, providing you don't put viruses in them.

But I dont. The link given by TC said "not a virus - adware bla bla bla" :roll:

The only clickteam installer on the site was the Jubilee demo, I remade it with winrar and it is clear! IMO that tells me somthing about clickteam. Wont be using them again.

Why dont you complain about BRT and TSC using WinRar? :roll: