Backdoor in MASM 9.0 installer?

[hutch--]

jj,

There is only one place to get the masm32 project, www.masm32.com and the sites it links to, anything else is dangerous. They are all properly secured sites and they all get the same installation. It appears some sh*tbox modified a copy and attached a trojan to it.

[Ghirai]

@jj2007:
Yea, there's no doubt that you got the malware from somewhere else.
I don't know the guy, but opensc.ws is a popular place for script kiddies and the like.

@Hutch, maybe it would be a good idea to post sha-256 checksums (NOT md5 since it's broken) on the main site, right before the mirror list, and make a small note to ask people to verify the hash of the downloaded file.
It's common practice for popular files, and it helps prevent users from running stuff got off rogue mirrors, infected files downloaded from random places on the net, etc.