VISimulator.com has been comprimised



  • I’m an old vi hound, so I turned on the VISimulator plugin. Actually, I’m older than that, I’m used to the line addressing in vi that is based on ed and sed. So I thought to try a few global replacements from the old days -

    :1,$s/Pattern/replacement

    and got nowhere.

    So then I tried

    ESC
    :help

    for the heck of it, and find that reliably calls a trojan popup in Chrome.

    With the new Malwarebytes running, it’s showing that I’m redirected to http://VISimulator.com and that in turn is calling a round-robin of nasties adaptively as I block them.

    Beware!



  • New version of ViSimulator
    https://bycn82.github.io/visimulator/
    https://github.com/bycn82/visimulator

    Both 32 and 64 bit version are provided.



  • It’s not a trojan but simply tried to open it’s abandoned website for online help
    (I too an old school ever wrote script/batch with edlin)

    I recently install ViSimulator for Notepad++ a new one, ver-17.12.17 (2017),
    Information got from it’s about box (the file dll property/detail don’t even show anything):
    https://github.com/bycn82/visimulator/issues
    bycn82
    2017-12-17

    I tried first with a simple command: G1G (move to end, move to start) -> it doesn’t do anything
    Then tried another simple command: x10p (cut char, paste 10 times) -> still doesn’t do anything

    If you a vi user, DO NOT install that new plugin (with the same name: visimulator.dll)
    Instead keep the old one, ver-0.4.0.xxx, 2014 by Simon HE (shown in it’s file property).
    It’s website link is broken (visimulator.com), but I don’t really care to update,
    the plugin is working fine, I made it read-only to prevent overwritten by a new, stupid one.



  • @asz said:

    It’s not a trojan but simply tried to open it’s abandoned website for online help
    (I too an old school ever wrote script/batch with edlin)

    I recently install ViSimulator for Notepad++ a new one, ver-17.12.17 (2017),
    Information got from it’s about box (the file dll property/detail don’t even show anything):
    https://github.com/bycn82/visimulator/issues
    bycn82
    2017-12-17

    I tried first with a simple command: G1G (move to end, move to start) -> it doesn’t do anything
    Then tried another simple command: x10p (cut char, paste 10 times) -> still doesn’t do anything

    If you a vi user, DO NOT install that new plugin (with the same name: visimulator.dll)
    Instead keep the old one, ver-0.4.0.xxx, 2014 by Simon HE (shown in it’s file property).
    It’s website link is broken (visimulator.com), but I don’t really care to update,
    the plugin is working fine, I made it read-only to prevent overwritten by a new, stupid one.

    Could you please post the old version somewhere? The new one is total crap(


Log in to reply