Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

This strange site came up as the second result in a google search for itunes.

http://download-new.com/apple-itunes/

(Although the url in the result read itunes.download-new.com.)

Embarrassingly, I downloaded and ran the "iTunes_Setup.exe" from them (I was stupidly trying to work on two computers at once and was barely paying attention, okay >_< ).

I immediately noticed it looked weird, and hit "Decline" on a series of "Offers"...

appwiz.cpl says no programs were installed today, but...

I can't find any third-party information on them, and the result I got there from no longer shows up when I repeat the google search.

Do I have a problem here?

share|improve this question
1  
If you Google "is this website safe" you find many reputation checkers like safeweb.norton.com or secureurlchecker.appspot.com where you can enter the suspect URL. Read the results carefully - i.e. how these websites come to their safe/unsafe conclusions. –  Jan Doggen Aug 30 '13 at 9:27
2  
It would be best to format both computers. –  Simon Aug 30 '13 at 11:37
2  
Its what you suspect. A fake website that attempts to install ad-ware on your machine. –  Ramhound Aug 30 '13 at 11:57
    
This is what it looks like. In my experience, the linked installer installs at least 6 or 7 pieces of crapware. !enter image description here –  user34470 Nov 20 '13 at 19:55
    
from what i can see, its an advertisement, meaning it would appear first as they paid to have it on top –  user36428 Dec 28 '13 at 19:40

3 Answers 3

I uploaded the file to virustotal.com and found these results. The sha256 hash of this file is: 624daa053ff589285a939b1b4d8e28af8876581ba05e45a0decbca2a3783a1df.

One of the scanners found "Win32.SuspectCrc" which appears to be a trojan. And another scanner had found "a variant of Win32/Toolbar.MyWebSearch.S" which appears to be adware.

We probably don't need to look any further into this as these are a good indication of bad software. There is a potential that these results are a false positive.

It looks like a software which includes a bunch of adware to make money and sell statistics. Maybe not harmful, but you probably want to make sure you remove it.

share|improve this answer

First check whether your search is hijacked. I'm not seeing that result when I searched itunes.

Google search results for 'itunes'

share|improve this answer
7  
The fact that your search results are different doesn't say much nowadays. Google tailors search results to your geographical location and search history. –  Jan Doggen Aug 30 '13 at 8:57
2  
But apple.com is one of the top 50 websites in the world.So I dont think they will go down in ranking due to locality.Also I didn't heard about product itunes other than apple itunes. –  Harikrishnan Aug 30 '13 at 9:54

If you take a look at http://download-new.com/learn you see it is some "We have this great downloader" website that indeed packs browser add-ons (currently 4).

There's not much useful info to find in their terms of use or privacy statement. You need a fine comb to determine from these what they're up to or what they actually do.

I see their URL in cached search results (e.g. at reference.com), so they manage to end up in search results - but the high ranking you see remains strange.

share|improve this answer

protected by Community Dec 29 '13 at 0:13

Thank you for your interest in this question. Because it has attracted low-quality answers, posting an answer now requires 10 reputation on this site.

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.