CD's And Trojan Horses

Music
1

Hiya, I was ripping a Nightmares On Wax CD last night circa 2002, Disc 2 DJ mix. When suddenly my virus scanner (Windows Defender) started going nuts and said I have a Trojan horse and the location was the CD drive. I removed the disc and started to remove the virus which came up incomplete. I assume that was because I removed the disc. I know Sony were a bit dodgy in the past using Trojan type software to combat DRM and installed it without permission. I ran Defender and Malware Bytes and they found nothing. I’m now stuck wondering if it was a false positive, some dodgy but not entirely harmful app on the CD or the fact I do have a Trojan. Has anyone experienced this type of behaviour on an audio CD before.

Oh I forgot the Trojan was called “AlphaAudio\AlphaPlayer.exe” .

Any help would be appreciated before I wipe the whole drive.

Cheers Ian

2

Regardless of whether it’s a false positive, I suggest:

  1. Eject the CD from the CD drive
  2. Reboot Windows
  3. Scan your drives

Assuming it does not yield unexpected surprises, you don’t need to wipe the drive.

Then

  1. Turn off all kinds of AutoPlay in Windows (such that the AlphaPlayer.exe is not launched unintentionally)
  2. Ignore the trojan warning, and rip the CD to files

Prior discussions:

1 Like
3

Google is your friend here, AlphaPlayer is indeed a DRM/copy protection gem from the early 0ties. It’s not really a false positive as the executable has properties that trigger the scanner, probably down to installation without/little user permission. Unlikely a real cause for concern, @wklie’s advice is a sound way of proceeding.

3 Likes
4

I would also do a System Restore to the previous day. That can undo changes that might have been made to the registry. You will have to temporary disable Malwarebytes for it to revert back or perform the restore from Safe Mode.

–MD

1 Like
5

If you haven’t run the application that is on the CD you should be fine. Modern Windows devices should have autoplay turned off, so hopefully nothing ran. I also thought the Rootkit was blocked by Microsoft a long time ago.

I remember this being a Rootkit with some serious bugs in it and it was a pretty poor decision by Sony overall

1 Like