BREAKING NEWS: TSR INSTALLS SPYWARE!

[jriggs]

THey never really knew for sure which is what makes their behavior so much worse.  All they had to do was suspect that you might be sharing a file that they decided shouldn't be shared and that was enough to make all the other things they did to people ok in their minds. 

[smashthecat]

Thanks for the heads up on TSR. Some at TSR are such lowly creatures. I feel so lowly myself each time I take there booty,NOT !!!

[uknortherner]

I don't even bother with the Booty. As far as I'm concerned, if it's payshit, it doesn't go into my game.

[Nightmare]

For what it's worth, I ran some tests on the latest TSRW.exe 07/24/09
MD5:521605E8B73BA0BD98AD72CFF3AD14D0
CRC-32: A3952AF2

I get an entirely different md5sum, 51e41f48f7aceef99c3ed57f0e072e2c for TSRW.exe, meaning your version is newer and has been altered, probably to better hide the evidence now that they know they have been caught. They are probably using a new trick that fools your particular scanner.

PEs, provide an scientifical way of reproducing your input, otherwise I´ll have to discard this news as false. I will feel backstabbed, as I´ve trust you many times and now I feel there´s no scientifical substance here.

I'm not exactly sure what you want. You want me to provide a demonstration of steganographically concealed transmissions in innocuous data? Just look at the Splotch Creatures. They are PNG files. Totally harmless PNG files. If you examined them, you would find harmless PNGyness. But they contain DATA in them and can be used to reconstruct a Splotch critter. Admittedly, this is a completely benign implementation done for reasons unrelated to nefariousness, and the fact that it is not nefarious is why we know of it, as the game never really attempts to conceal this fact from us. TSR, however, is known to be a nefarious operator: They have acquired and then misused or released to third parties personal information from users in the past. It is reasonable to say that they do so regularly and there is absolutely no physical reason why they would have stopped, and therefore, there is every reason to believe the practice continues. In fact, on PMBD, Johan himself came over to gloat about how undetectable his new system was, because he just couldn't resist the temptation to brag and gloat smugly.

What I was asking is what I did:

http://www.the-prism.com/index.php?topic=3225.msg39307#new

You have to use an VMware clean machine and Trend Internet Security Pro 2009

Step by step:

1 Install WinXP SP 2 Pro. on Vmware 6.5....
2. Install NET framework 3.5
3. Install Trend Micro
4. Install TSR workshop
5. See what happens 

Pes, if you want to remain credible, you have to provide ways to the Averages Joes. Relying on word and screenshots still leaves place for doubt.

Thanks to Shanow
Special thanks to Paden

[Nightmare]

There´s even more stuff

[AmyLuthien]

Figures they'd pull some crap like this - but then, is anyone actually surprised that they would?

[wes_h]

Their programmer has been made aware of the issue. It is a keyboard hook, used because they failed to find the simple way to tell if the ALT key is down when the mouse is moved (for the 3D preview). Examples of how to do this were provided.

While I am inclined to believe them, as their explanation after they discovered they really do set off alerts from AV programs seemed credible, others may not. But the alert is from a keystroke hook, which certainly CAN be abused and is totally unnecessary for any application to do, unless it is some hot-key activated tool (like fraps). When you are the currently active application, you get all the keystrokes from your window port, When you are not, you shouldn't need to see them.

[J. M. Pescado]

Their programmer has been made aware of the issue. It is a keyboard hook, used because they failed to find the simple way to tell if the ALT key is down when the mouse is moved (for the 3D preview). Examples of how to do this were provided.

Haha. This is a joke, right? I see this as nothing more than a transparent ploy to hide a keylogger. Because you can't trap ONE keydown message using the standard Windoze API, you write and install an ENTIRE KEYLOGGER SYSTEM for this? You do realize this "explanation" insults your intelligence, right?

While I am inclined to believe them, as their explanation after they discovered they really do set off alerts from AV programs seemed credible, others may not. But the alert is from a keystroke hook, which certainly CAN be abused and is totally unnecessary for any application to do, unless it is some hot-key activated tool (like fraps). When you are the currently active application, you get all the keystrokes from your window port, When you are not, you shouldn't need to see them.

See? I told you this was a keylogger. They're trying to steal user passwords, just like they did last time. Once a crook, always a crook.

[wes_h]

You do realize this "explanation" insults your intelligence, right?

Now I was in the conversation. I said I was inclined to believe their explanation, based on how it played out, but I am not inclined enough to test the program myself. Anyway, I am busy making my own set of tools, and do not need them to provide the research for my work.

[J. M. Pescado]

Yes, but keep in mind that they would be saying things that would make you WANT to believe it. You can't listen to what they say about it afterwards, you have to assess things based on their actual capabilities and known behaviors. Never listen to what people say, only to what they do.

[Marhis]

Wow. So, in TSR is either unrepentant bad faith or utter incompetence. Not to mention the fact that it could also be BOTH.
Way to go, guys!

[SkittlezYo]

That explains why I was always getting viruses a year ago. I was always downloading stuff from there for my sims 2 game.

[novastar]

That explains why I was always getting viruses a year ago. I was always downloading stuff from there for my sims 2 game.

If you actually lurked around here moar you would know you shouldn't touch a thing from there, tard.

[Maximillian]

That explains why I was always getting viruses a year ago. I was always downloading stuff from there for my sims 2 game.

If you actually lurked around here moar you would know you shouldn't touch a thing from there, tard.

You know, I'm positive SkittlezYo was around here a year ago, what with the post count of one and all.

Give the bloke some credit--think of his posting as a rebirth, or a Second Coming or whatnot.

[Nin_the_Destroyer]

Do you only get this Spyware installed if you pay for something there? Or does this apply to the free stuff as well? Because I downloaded a bunch of their free stuff. 

[Motoki]

Do you only get this Spyware installed if you pay for something there? Or does this apply to the free stuff as well? Because I downloaded a bunch of their free stuff. 

That would be the worst marketing plan in history. Infect your paying customers while leaving those who leech off of you completely free and immune.

[Nin_the_Destroyer]

So, I'm infected. What should I do?

[Zazazu]

Think, McFly. Or better yet, read. We are discussing a specific case with a specific tool given out by TSR. Do you have it? If so, the best way to lessen your risk is just to uninstall it. It's not the type of spyware you are thinking of.

[Nin_the_Destroyer]

Ah, ok. So, Spyware is only is this particular tool and not anything else on the site?

[Sanyia]

I had no idea TSR was doing these despicable practices. Thankfully, I've never downloaded their workshop and never paid for a subscription. I also never click on their ads, learned that lesson that hard way many years ago. I'm so glad I found MATY, better to learn of their deceit now. Now being the paranoid soul that I am, I'm off to run Spybot just in case. 

[jriggs]

. I also never click on their ads, learned that lesson that hard way many years ago.

Just so you are clear, you don't have to actually click the ads there to get into trouble.  Just viewing their pages made my computer go crazy and I ended up with a Vundo virus and I have never clicked on any ad.  I was one of the people that was told it was my responsibility to report their bad ads to their advertisers, not to them.  I was also told that to avoid this problem I should just get a subscription so I wouldn't have to worry about the ads anymore.

[Sanyia]

Just so you are clear, you don't have to actually click the ads there to get into trouble.  Just viewing their pages made my computer go crazy and I ended up with a Vundo virus and I have never clicked on any ad.  I was one of the people that was told it was my responsibility to report their bad ads to their advertisers, not to them.  I was also told that to avoid this problem I should just get a subscription so I wouldn't have to worry about the ads anymore.

I never had a problem with their ads causing my computer to go haywire, probably because I can't see them. I have the AdBlock Plus add-on installed in Firefox. I can't stand websites that bombard me with ads, so I solved my problem by making them invisible. What a bunch of asshats for telling you it wasn't their responsibility they have bad ads on their page, that is a load of bull in my opinion.

[TwoToot]

Noscript, use it.

[Leticron]

Better yet Noscript AND Adblock Plus

Just don't forget, if Noscripts constant updates notification starts to bother you (opening its webpage after each update) go to about:config and set
noscript.firstRunRedirection to false

[Krib]

Yeah, adblock extension or privoxy running the background if you're not using Firefox. You almost have to these days.