{"id":132,"date":"2011-01-06T18:03:01","date_gmt":"2011-01-06T18:03:01","guid":{"rendered":"http:\/\/www.seepyou.net\/blog\/?p=132"},"modified":"2014-07-30T16:08:26","modified_gmt":"2014-07-30T15:08:26","slug":"context-menu-platinum-popup","status":"publish","type":"post","link":"http:\/\/www.seepyou.net\/blog\/2011\/01\/06\/context-menu-platinum-popup\/","title":{"rendered":"Context Menu Platinum Popup"},"content":{"rendered":"

I met this little “gem” today and I was very surprised. It has been a long time since something snuck up on me like that. My detection tools are always updated and I’m very careful about handling downloads and attachments.<\/p>\n

The problem is that once infected (and yes, it is an infection) one can no longer use the start menu shortcuts of apps mostly used. One can still launch them from any shortcut on the desktop or from their proper group in start menu, however most of us just press Start and click on our favorite app. With this infection though a popup appears that requests a registration of the Context Menu Platinum program (that I never installed, nor read in any setup dialogue steps which, yes, I do read). The close window button does not work, the Register program closes the popup without launching the app but takes you to a web page that requests anywhere from $400 to $250. All of that of course is moot, because no one requested this program in the first place.<\/p>\n

Upon looking on the net, there are three most probable culprits; CompMgmtLauncher.exe, FILEminimizer and EmailOpenView. None of these were the cause in my system. Spent two hours trying to identify the problem using all kinds of tools and monitors etc.<\/p>\n

Finally I just did a simple sorting and eyball-1 (look for it with my eyes) on the directories inside Program Files. It turns out that of the four directories modified in the last two days, one was the freeware Movie Subtitle Searcher from opensubtitles.org. Inside that was a directory Application Data and inside that another called Opensubtitles-1.0_1_0_0_0<\/p>\n

Inside that was a program ShellMenu.exe with the same icon as the popup. It was of course being used by the system and could not be deleted, so reboot to command prompt, delete the file and all was well and good. After that I uninstalled the Movie Subtitles Searcher, just for the hell of it.<\/p>\n","protected":false},"excerpt":{"rendered":"

I met this little “gem” today and I was very surprised. It has been a long time since something snuck up on me like that. My detection tools are always updated and I’m very careful about handling downloads and attachments. The problem is that once infected (and yes, it is an infection) one can no … Continue reading Context Menu Platinum Popup<\/span> →<\/span><\/a><\/p>\n

<\/div>
<\/div>
 <\/span><\/svg><\/span><\/a> <\/span><\/path><\/rect><\/rect><\/svg><\/span><\/a> <\/span><\/path><\/svg><\/span><\/a> <\/span><\/path><\/svg><\/span><\/a> <\/span><\/path><\/svg><\/span><\/a> <\/span><\/path><\/svg><\/span><\/a> <\/span><\/svg><\/span><\/a> <\/span><\/path><\/path><\/path><\/svg><\/span><\/a> <\/span><\/svg><\/span><\/a> <\/span><\/g><\/svg><\/span><\/a> <\/span><\/path><\/ellipse><\/svg><\/span><\/a> <\/span><\/svg><\/span><\/a> <\/span><\/path><\/svg><\/span><\/a> <\/span><\/svg><\/span><\/a> <\/span>
<\/div><\/a><\/div><\/div>
<\/div>","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"om_disable_all_campaigns":false,"_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0,"footnotes":""},"categories":[11,13,21],"tags":[50,47,49,48],"class_list":["post-132","post","type-post","status-publish","format-standard","hentry","category-computers","category-internet","category-software","tag-context-menu-platinum","tag-freeware","tag-movie-subtitle-searcher","tag-stealth-program"],"aioseo_notices":[],"_links":{"self":[{"href":"http:\/\/www.seepyou.net\/blog\/wp-json\/wp\/v2\/posts\/132","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/www.seepyou.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/www.seepyou.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/www.seepyou.net\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/www.seepyou.net\/blog\/wp-json\/wp\/v2\/comments?post=132"}],"version-history":[{"count":5,"href":"http:\/\/www.seepyou.net\/blog\/wp-json\/wp\/v2\/posts\/132\/revisions"}],"predecessor-version":[{"id":361,"href":"http:\/\/www.seepyou.net\/blog\/wp-json\/wp\/v2\/posts\/132\/revisions\/361"}],"wp:attachment":[{"href":"http:\/\/www.seepyou.net\/blog\/wp-json\/wp\/v2\/media?parent=132"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/www.seepyou.net\/blog\/wp-json\/wp\/v2\/categories?post=132"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/www.seepyou.net\/blog\/wp-json\/wp\/v2\/tags?post=132"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}