Keep2Share Flat Out Malware Site

[a435843]

I would like to request that the mods remove k2s.cc as an allowed upload site here on VEF. Their recent actions have shown that they are strictly a malware site and I recommend that users avoid such files.

Right now, if you use an ad blocker, such as Adblocker Plus, the count down during the downloading process will not start. If one whitelists the domain, so as to allow the count down to start & finish, you, of course, get tons of pop ups, but the site also changes your browser settings, specifically the home page/tabs and search engine. This is malware activity. I thank the mods for any consideration you choose to give this matter.

[MrInBetween]

I searched the forum for 'Keep2Share' and found a link in the following post: http://vintage-erotica-forum.com/sho...2&postcount=72

2 links actually, I used the first one, and selected the low speed download option. It asked me to enter a verification code, and kept saying it was incorrect until I enabled cookies for the site. Then the countdown started and I was able to download the file. Nothing else happened.

I have Adblock Plus running but the site is not whitelisted. Do you find the same problem with the link I used?

[MrInBetween]

Just to make it interesting, I tried downloading again, this time in a clean Firefox (28) profile - ie no Adblock and just default settings. At first I found that I went to a page that I hadn't seen before, with a button to download, instead of just being given a link that says it will be available for five minutes. It still seemed to work without any trouble. I figured the new page was because I was still on the same IP address as earlier, so I changed that and this brought back the same behaviour as earlier - and yet another successful download.

The only difference in the clean profile is that a LiveJasmine-style popup did open, but my home page wasn't changed or anything else as far as I can see.

[a435843]

Personally, I tried with multiple browsers, with the same results. I'm not anxious to try their site again after my experience. It is possible, since I had been using the site previously, with no problems, that they're targeting IP's that have used the site in the past. However, if that's the case, that they're targeting non-one-time users for malware activity, that makes this site a big issue for VEF users.

MIB's experience is typical for a clean profile, namely, cam ads. It looks like that K2S is targeting different behavior, based on a number of factors, IP, cookies, etc., which is consistent with all of these file hosting sites, of course. The "download accelerator" continues to be a popular attack vector. But this is the first time I've seen browser settings changes, specific to file sharing sites. My situation with browser settings being changed was with a clean Chrome profile, Adblock Plus running only, no cookies stored, no third-party cookies allowed, in Incognito browsing. Fortunately, Chrome does not allow automatic browser setting changes by a site, and reports attempts to the user when entering the browser settings tab.

Ubu's experience is also typical, not being able to get the last part of a multi-part download, but my experience was with FileFactory.

[MrInBetween]

I just installed Chrome and tried to download in a clean profile, and had the same experience as I had in Firefox: countdown starts, popups, file downloads, nothing else. It does look as if someone has it in for you personally, but I wonder whether it is Keep2Share or someone else. What I don't understand is why a filehost would choose to target its regular users with malware while ignoring the casual ones.

[lagerlout]

Keep2Share at one stage was banning my IP when ever I attempted to use Jdownloader or MyDownloader

[a435843]

Originally Posted by MrInBetween

I just installed Chrome and tried to download in a clean profile, and had the same experience as I had in Firefox: countdown starts, popups, file downloads, nothing else. It does look as if someone has it in for you personally, but I wonder whether it is Keep2Share or someone else. What I don't understand is why a filehost would choose to target its regular users with malware while ignoring the casual ones.

I had been a user of the site about 3 times a week, though there was an occasion a few weeks ago where I used it more frequently for a couple of days, getting half-a-dozen or so downloads. They're still targeting ad blockers, though, clearly, but with malware in ads, it's a must.

It may be similar to the Google situation of several months ago, and still going on with some major sites, where some out-of-control advertisers are injecting malware with ads, even though Google is the conduit...a lack of "quality control", shall we say? Or perhaps non-occasional users are still considered as "fraudulent", as has been the case in the past?