McDonalds Japan Distributes Infected MP3 Players

Tamas Feher from Hungary writes, "Finnish antivirus vendor F-Secure reports that Mcdonalds in Japan distributed 10,000 infected MP3 players as customer prizes in a promotion with Coca-Cola. The USB sticks contained 10 free songs plus the QQPass Trojan, which is intended to steal login data. F-Secure reports that they have heard, but cannot confirm, that simply plugging the USB device into a Windows PC is sufficient to get infected. Investigation is still going on, but the mishap apparently happened in Hong Kong. Patrons nationwide are urged to quickly return their M-logoed sticks for replacement or call a 24hr hotline, if unsure." Here is the Mcdonalds Japan announcement (in Japanese, but Babelfish at Altavista handles it well).

Re:different kinds

[Anonymous Coward]

Since when is Japan part of China?

De-Zero Wingiffying

[Jarjarthejedi]

*Stretches out* Okay, here goes nothing... 2006 October 13th In regard to our company MR3 player prize virus infection The Mcdonald's Co., Ltd. corporation August's recent prize promotion contained a virus in the MP3 player. It is possible that users could be infection just by connecting the prize to their PC. Therefore we ask that customers do not connect their prize MP3 player to their PC. In order to minimize customer annoyance we recommend you report the prize to us as soon as possible. 1. Summary of the Virus A Trojan Horse virus/worm/spyware was discovered on the MP3 Players. When connected to the PC the virus will cause "the Chinese memo pad stands up" (???), a message that the virus has inspected your computer and so on. 7 cases have been recieved of this virus infecting computers in the 12 days since the MP3 Players were given out. 2. Customer correspondence (1) We are informing our customers of the issue via direct calls to their homes, our companies home page, signs at our many locations and via local newspapers. (2) There is a possibility that connecting the MP3 to your computer alone is enough to cause infection, therefore we advise winners to not connect the Player to their PC.as for this virus there is a possibility of being infected by the fact that this prize is connected to the personal computer. We have also created an anti-virus and put it on our site in the downloads section. (3) concerning the MP3 player of the prize, making all item collect rapidly, as soon as to receive, be able to prepare you exchange with the new item. MP3 inquiry Executive Office Presently TEL. 03 - 5148 - 509924 hour systems October 14th (Saturday) 9:00AM - TEL. 0120 - 221 - 04724 hour systems (October 22nd (day) to) TEL. 0120 - 221 - 0479: 00 - 21: 00 (October 23rd (month) from) MacDonald Home page Http: //www.mcdonalds.co.jp/ 3. Infection route of virus and cause of infection The marketing store branch of McDonalds in Hong Kong apologizes for the infection. Concerning it's cause we are currently investigating that. We apologize again for any trouble, in the future we will strengthen our internal security so this doesn't happen again. MP3 campaign summary Of period: August 4th (gold) - 31 days (wood) [ prize dispatch target date: September 29th (gold) ] Prize item: Original music entering MP3 player The number of successful candidates: 10,000 people Application method: At the private portable campaign sight it inputs the serial number which is stated in the drink of L size during period, challenges in the game. (???) As you can tell I had some problems in two areas, I honestly have no idea what in the world those are supposed to mean. This is a very rough translation, coming from basicly translating a bad translation, but it's better than nothing...

Automatic infection may be possible

[_xeno_]

According to the Microsoft USB FAQ [microsoft.com], it is possible to create a USB device which Windows will Autorun. Since Microsoft doesn't include anchors within the document to allow me to link directly to the question, it is:

Q: What must I do to trigger Autorun on my USB storage device?
The Autorun capabilities are restricted to CD-ROM drives and fixed disk drives. If you need to make a USB storage device perform Autorun, the device must not be marked as a removable media device and the device must contain an Autorun.inf file and a startup application.

So, yes, it is possible to make a USB storage device trigger Autorun and run a trojan. I don't know if it's possible in this case, but it is theoretically possible to do with a USB device.

Re:De-Zero Wingiffying - formated

[mike2R]

If you're going to take the trouble, we might as well see the line breaks:

-----------
*Stretches out* Okay, here goes nothing...

2006 October 13th

In regard to our company MR3 player prize virus infection

The Mcdonald's Co., Ltd. corporation August's recent prize promotion contained a virus in the MP3 player. It is possible that users could be infection just by connecting the prize to their PC. Therefore we ask that customers do not connect their prize MP3 player to their PC. In order to minimize customer annoyance we recommend you report the prize to us as soon as possible.

1. Summary of the Virus
A Trojan Horse virus/worm/spyware was discovered on the MP3 Players. When connected to the PC the virus will cause "the Chinese memo pad stands up" (???), a message that the virus has inspected your computer and so on. 7 cases have been recieved of this virus infecting computers in the 12 days since the MP3 Players were given out.

2. Customer correspondence
(1) We are informing our customers of the issue via direct calls to their homes, our companies home page, signs at our many locations and via local newspapers.
(2) There is a possibility that connecting the MP3 to your computer alone is enough to cause infection, therefore we advise winners to not connect the Player to their PC.as for this virus there is a possibility of being infected by the fact that this prize is connected to the personal computer. We have also created an anti-virus and put it on our site in the downloads section.
(3) concerning the MP3 player of the prize, making all item collect rapidly, as soon as to receive, be able to prepare you exchange with the new item.

MP3 inquiry Executive Office
Presently TEL. 03 - 5148 - 509924 hour systems
October 14th (Saturday) 9:00AM - TEL. 0120 - 221 - 04724 hour systems (October 22nd (day) to) TEL. 0120 - 221 - 0479: 00 - 21: 00 (October 23rd (month) from)
MacDonald
Home page Http: //www.mcdonalds.co.jp/

3. Infection route of virus and cause of infection
The marketing store branch of McDonalds in Hong Kong apologizes for the infection. Concerning it's cause we are currently investigating that. We apologize again for any trouble, in the future we will strengthen our internal security so this doesn't happen again.

MP3 campaign summary
Of period: August 4th (gold) - 31 days (wood) [ prize dispatch target date: September 29th (gold) ]
Prize item: Original music entering MP3 player
The number of successful candidates: 10,000 people
Application method: At the private portable campaign sight it inputs the serial number which is stated in the drink of L size during period, challenges in the game. (???)

As you can tell I had some problems in two areas, I honestly have no idea what in the world those are supposed to mean. This is a very rough translation, coming from basicly translating a bad translation, but it's better than nothing...

Re:What you say?

[brusk]

Actually it's a pretty remarkable error: it misparses a verb ending -ta (to itta, "that said") and puts the last syllable with the prefix go (from "gorenraku", "your communications") so that they together become the word "tago," a rare term for a wooden water pail.

Something is seriously wrong with Babelfish here (Google gets this passage righter): the English translation has a Hiragana "little tsu" in it, indicating that the translation system is not recognizing it as Japanese at all. Or something. Oops.

Re:Automatic infection may be possible

[Aqua_boy17]

It is possible. If you've bought a SanDisk stick lately, they started put all these stupid 'bonus' utilities on the stick that auto-launch whenever you connect it. I found this extremely annoying and was surprised that they'd do this to their customers. I did finally find a post where someone had found a removal tool on the SanDisk site (it's near impossible to remove on your own - stuff is cached and keeps re-installing) and cleared it that way. That will be the last thing I buy from this company as I no longer trust them.

Re:Uh Oh!

[h2g2bob]

Watch this:
http://en.wikipedia.org/wiki/Image:AllYourBaseAnim ated.gif [wikipedia.org]
and all will become clear