Possible Trojan Worm via Intercasino Download?

[wyldchyld]

Casinomeister, I'm still a newbie at the casino side, but a veteran online poker player.

I noticed something extremely disturbing when I went to download, and install Intercasino's software on Sunday 7/24/05, and on a follow up Spybot scan Monday 7/25/05.

On 7/24/05, I opened my Interpoker software, and clikced on the "Play Casino" button to download and install the Intercasino software.

Now here's what link I got taken to when I clicked on the "PLAY CASINO" button on the Interpoker software to download the casino software:

Old / Expired Link

After going there, you see the main website, as well as an overlayed box on the left side of the screen advertising the "Millionaires Club" slots and $90 match bonus plus free spin. I would post a screen shot, but my computer is not letting me take any for some weird reason.

So I clicked on it, and began the download of the software. Then my Norton Anti-Virus 2005 pops up about half-way through the download, saying it caught a trojan worm in the installation setup software I downloaded from Intercasino.

According to Norton it is a:

Default Block Backdoor/SubSeven Trojan ho... (won't let me expand the window to read the rest)

Here's Symantec's page on it:

You do not have permission to view link Log in or register now.

"How does the Trojan get on the computer?
SubSeven is usually sent as a program that you think you want. It almost always has a .exe extension and it will often be disguised as an installation program, such as Setup.exe. When this program runs, it will usually return a "Failed" error message, but it can sometimes do something, such as play a game or appear to install the software. We strongly recommend that you only install programs received from trusted sources."

Unless somehow a hacker got through my firewall, and deliberately messed with my Interpoker software, then yes I downloaded the Intercasino software from the proper site.

I also e-mailed what happened to Intercasino support. I received the standard:

"Thank you very much for your recent email, we are currently experiencing a high volume of emails and therefore we may take a little longer than usual to reply to you. We will reply to you within the next 48 hours.

We apologise for any inconvenience this may have caused."

I un-installed the software off-line just to be safe.

Then doing routine computer clean-up, (Manual Virus scan, manual spyware scan, etc.) today, Monday 7/25/05, my Spybot software detected this:

Two pieces of spyware made a silent registry change to:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsfot\SecurityCenter\AntiVirusDisableNotify!=dword:0

and

HKEY_LOCAL_MACHINE\SOFTWARE\Microsfot\SecurityCenter\AntiVirusOverride!=dword:0

If I had not had Norton running as well, my Windows XP Pro anti-virus would've been

A Google search on both returned nothing. Thank goodness for symantec.

My question to you, is it likely that someone hacked the Intercasino website, and inserted this Trojan worm into the downloads? Also, is it safe to play there?

PLease forgive me if this was supposed to be posted in the online casino complaints forum, I was not sure if this rises to a casino complaint or not.

 

[The Dude]

Hi wyldchyld,

I'm moving this to the "Online Casinos" section, since a lot of tech heads peruse that area, and they are sometimes more in-tune to trojans/malware than I am.

My guess is that this may be coming from elsewhere, or that it's not really a trojan/malware, (Microgaming's malware reports for instance). As far as I know, Intercasino's software is clean. But let's find out what's up anyway. I'll PM their casino manager on this.

 

[wyldchyld]

Thanks for looking into this

 

[nafanny29]

There is NO way a virus/trojen is hidden in Intercasino's software. If it was one of THE biggest internet casinos would be finished overnight.

 

[wyldchyld]

Not the software, but one of the downloads from the website.

**UPDATED 6:58 PM EST 7/26/05***

I wondered if it would happen again by not clicking on the overlayed box that appears on the Intercasino website, and instead trying one of the other links to download their software on the main page.

So far so good. I installed it, and nothing popped up. So I'm thinking there may be an issue with the box that overlays itself on the Intercasino website.

 

[The Dude]

Just a heads up that their tech guys have been looking into this.

 

[ryan_hartley]

Hi wyldchyld,

I've had several people look into this very extensively on various levels, from our web guys, to our production team, to our database guys. We've come to the conclusion that there is definately no trojan/malware or anything of the sort that is related to our website or the software/download.

I suspect that it already existed on your computer and was somehow triggered by the download. This may explain why you had a pop-up/warning message on your computer.

Please note that we have thousands of downloads per day and have not received any other reports of trojans linked to InterCasino. If any other players have had issues of this nature, please feel free to contact me or post on this forum.

We've examined this before and have always established that the InterCasino software and website are entirely free of spyware, adware, malware, viruses, trojans or anything else undesirable of that nature. I'm certainly not an expert on this topic, but you may want to run a few scans and clean up your computer. Here are some links to free software you may want to explore:

You do not have permission to view link Log in or register now.

You do not have permission to view link Log in or register now.

Regards,
Ryan Hartley

 

[wyldchyld]

Thank you CasinoMeister and Ryan. I was pretty sure that it was not Intercasino's fault, but perhpas a hacker wishing to ruin the good name of the Intercasino company.

As I posted above, the other download link on the Intercasino website did not cause any problems.

I have since run several external website spyware/malware/adware scans and nothing has been discovered. My best guess is still that someone hacked into that "Overlayed box/window" on the Intercasino homepage that advertises the $90 monthly match bonus and a free spin on the Millionaire slots. One of my previous posts explains why, the information from Symatec's website says this type of worm is most often in downloaded programs.

Again, thank you for looking into this. I look forward to playing at Intercasino.

Casinomeister, thank you for helping a noobie on your site. You've cemeted your status as one of the best people in this business