Walmart Photo Keychain Comes Preloaded With Malware

Blowit writes "With the Christmas holidays just past and opening up your electronic presents may get you all excited, but not for a selected lot of people who got the Mercury 1.5" Digital Photo Frame from Walmart (or other stores). My father-in-law attached the device to his computer and his Trend Micro Anti-virus screamed that a virus is on the device. I scanned the one I have and AVAST did not find any virus ... So I went to Virscan.org to see which vendors found what, and the results are here and here." Update: 12/29 05:44 GMT by T : The joy is even more widespread; MojoKid points out that some larger digital photo frames have been delivered similarly infected this year, specifically Samsung's SPF-85H 8-inch digital photo frame, sold through Amazon among other vendors, which arrived with "W32.Sality.AE worm on the installation disc for Samsung Frame Manager XP Version 1.08, which is needed for using the SPF-85H as a USB monitor." Though Amazon was honest enough to issue an alert, that alert offers no reason to think that only Amazon's stock was affected.

Were they made by Sony?

[Zymergy]

I have read about Sony adding Malware (and Rootkits) to their consumer USB removable devices before...

I also wonder if these files "DPFMate.exe" and "FEnCodeUnicode.dll" are something someone post-production put on the devices or if these files are some intended application?
Never using a digital photo frame before, I assume one simply copies image files into a mounted USB attached drive letter folder? (similar to how USB drives mount as a removable drive letter folder in Windows)

Another conspiracy!

[fortapocalypse]

And Walmart employees also cough on the their real photos. Double virus score!

Can't seem to run the virus on my mac

[exabrial]

Sigh, still no cross-platform support for Malware!

Re:Can't seem to run the virus on my mac

[WTF Chuck]

And when the hell are the malware writers going to start open sourcing their code? They do everything they can to push their pre-compiled binaries onto people's machines, why not the source as well?

Re:Can't seem to run the virus on my mac

[Yvan256]

http://www.vmware.com/products/fusion/ [vmware.com]

Re:Were they made by Sony?

[stonedcat]

Sony disagrees with you there pal.

I mean shit, you wouldn't want people putting DRM protected pictures on their digital photo-whatsits.

Re:Disassembled?

[Anonymous Coward]

Funny thing though--it didn't run under Linux.

Does anything run under Linux? If only Linux could correctly run even a virus!

Wine...

[someone1234]

Another proof that Wine is not yet fully compatible :D

Re:Note that none of the major commercial scanners

[OneSmartFellow]

I have trouble believing there's any significant malware that is generally known to the AV industry

You must be joking, they know about all the viruses, they write them.

Re:Packer

[Anonymous Coward]

It twas I, Peter Piper that purchased the picture peeper with a packer.

2 for 1

[Storydor]

It's just another 2 for 1 offer!

Re:Packer

[Opportunist]

What I meant is that hiding trojans behind executable packers is quite 2006'y. They don't really do that anymore, or at least more out of habit rather than actually hoping it would accomplish anything, since most of the better AV suits can unwrap even the most esotheric exepackers by now.

That's the burden of the AV writer. Whenever you want to lean back because you finally accomplished something (like, say, implementing an unpacker for every packer out there), they change the playfield and all you did was for /dev/null. :(

Re:Old news

[Anonymous Coward]

Well! You used "couldn't care less" instead of "could care less", so that means you are my new hero!

Re:Packer

[Beat The Odds]

Interesting. What packer would that be?

I believe it would be the Green Bay Packer. (GBP for short).

Re:Disassembled?

[GPLDAN]

It was compiled from a program called "poorwhitetrash.c"

Re:Packer

[GPLDAN]

Being that this is Wal-Mart, it's called the "Deliverance Gee Your Mouth is Purty" Packer.