VISimulator.com has been comprimised
I’m an old vi hound, so I turned on the VISimulator plugin. Actually, I’m older than that, I’m used to the line addressing in vi that is based on ed and sed. So I thought to try a few global replacements from the old days -
and got nowhere.
So then I tried
for the heck of it, and find that reliably calls a trojan popup in Chrome.
With the new Malwarebytes running, it’s showing that I’m redirected to http://VISimulator.com and that in turn is calling a round-robin of nasties adaptively as I block them.
Both 32 and 64 bit version are provided.
It’s not a trojan but simply tried to open it’s abandoned website for online help
(I too an old school ever wrote script/batch with edlin)
I recently install ViSimulator for Notepad++ a new one, ver-17.12.17 (2017),
Information got from it’s about box (the file dll property/detail don’t even show anything):
I tried first with a simple command: G1G (move to end, move to start) -> it doesn’t do anything
Then tried another simple command: x10p (cut char, paste 10 times) -> still doesn’t do anything
If you a vi user, DO NOT install that new plugin (with the same name: visimulator.dll)
Instead keep the old one, ver-0.4.0.xxx, 2014 by Simon HE (shown in it’s file property).
It’s website link is broken (visimulator.com), but I don’t really care to update,
the plugin is working fine, I made it read-only to prevent overwritten by a new, stupid one.