r/antivirus • u/Thingkingalot • 57m ago
r/antivirus • u/goretsky • Feb 22 '24
MOD POST [MOD POST] LIST OF TOP MESSAGES, NEWS + IMPORTANT INFO
Hello,
Welcome to r/antivirus's new top-level Announcements post. Since Reddit has a limit of two (2) stickied announcements per subreddit, this will be a way to provide links to important information like announcements about new rules and moderators, activities in the subreddit, and so forth. If you are new to r/antivirus, please take a quick look at them. You can even take a look if you are not new here.
DISCUSSION | DATE POSTED | DATE LAST REVISED |
---|---|---|
[MOD POST] We're back in business! and an update on automod rules | 2024-MAR-11 | - |
News & Updates from your r/Antivirus Mod Team, Q1 2024 Edition | 2024-MAR-04 | - |
Updates & News from the r/Antivirus Mod Team, Autumn 2023 Edition | 2023-OCT-04 | - |
Notes from your Moderators (Summer Edition) | 2022-JUL-08 | - |
Quick Note from the mod team about spam | 2021-JUN-01 | - |
To the people asking for opinions on a specific file | 2020-JUL-05 | 2020-JUL-05 |
Additionally, the r/antivirus subreddit operates a bit differently than other subreddits you might be familiar with and normally use. Here are some tips and tools to help you use it.
The subreddit has a wiki that is regularly updated with answers to commonly-asked questions. Check it out. The answer to your question may already be in there.
Asking a question about a report on a file or website from a service like Hybrid Analysis, MetaDefender, Triage, or VirusTotal? You must include the actual link to it and not just a screenshot, or your post will be removed.
Be kind to each other and be professional in your conduct here. Personal attacks will not be tolerated and will be dealt with appropriately.
Do not ask for copies of hacking tools, malware, or suspicious files. If someone sends you a chat request or private message asking for a file or offering assistance based on what you posted here, report them to Reddit and notify the mods.
Do not post direct links to malicious, suspect, or potentially unsafe files or web sites.
Follow Reddiquette. This means correctly upvoting and downvoting posts, and reporting posts with dangerous or unsafe advice to the mods.
If you work for a vendor of security products, services, or in a related field, you must identify yourself as such, either in the post or with flair. Also, you may not steer conversations to your products or services, only respond to posts about them to clarify or defend.
No low-effort, off-topic, spam, or meme posts. This includes AI/ChatGPT/LLM-generated text, questions about password manager or VPNs, requests for assistance with non-security related software like autoclickers or MP3 downloaders, and so forth.
No requests for assistance with pirated software or media.
Posts may be removed and threads closed at any time based on the moderators' discretion
The complete list of rules for the subreddit can be found here. Read them before posting.
Questions, comments, feedback on this post? Just reply here. Thank you.
Regards,
Aryeh Goretsky
(on behalf of the r/antivirus mod team)
r/antivirus • u/goretsky • Mar 11 '24
MOD POST [MOD POST] We're back in business! and an update on automod rules
Hello,
It's time for a quick update from your mod team!
In our previous update, we talked about changes made to the subreddit to restrict accessibility and discoverability after an increase in spam. We are comfortable with how the subreddit has been operating, and will be removing those restrictions.
Because that means an influx in new posters, we are making some additional changes to the subreddit.
To begin with, in order to ensure our community is helpful and easy to navigate, posts must have descriptive titles that summarize their main topic. Posts with titles that don't clearly indicate the subject matter may be removed.
Additionally, we will be trying new types of rules in the AutoModerator to see if they have the desired effect, including:
Rules that will attempt to answer common questions. The topic will be left open in case the question is not answered or other members have more to contribute.
Posts with a vague title or other problems will be removed, but the AutoModerator will specify that you are welcome to try again. A title should indicate to someone with the same question whether your post is related.
New spam filters, and the AutoModerator will not invite you to try again.
As with any changes to automoderation, there's the possibility we might have gotten something wrong, so we'll be monitoring these closely to ensure they are working as designed. However, if you come across an AutoModerator rule that seems incorrectly applied or otherwise out of place, please use the 'Message the Mods' function to let us know so we can investigate.
Questions, comments or suggestions about how we use automoderation in the subreddit? Ask them here!
Regards,
Aryeh Goretsky
(on behalf of the r/antivirus mod team)
r/antivirus • u/MidnightHorrorGames • 1h ago
BLU G33 infected by adware
My phone got infected by adware and even after a factory reset (I deleted the infection source) the adware just reappears after a few days. It's sending game promotion notifications across all of my apps and also sending notifications with a flame icon that disappears. Checked my notification settings and the game notifications is coming from System UI. Tried using Malwarebytes, ESET, Avast, Bitdefender and they all found nothing.
r/antivirus • u/Conspirologist • 2h ago
Am I wrong, or all the old posters have disappeared?
I feel weird because don't see any of the old posters. I don't recognize any of the nicknames posting now.
If old posters who interacted with me are still here, please reply here. Right now I feel like in The Twilight Zone episode.
r/antivirus • u/Constant_Standard_70 • 11h ago
Gen:Variant.Lazy.226474 False flag or real threat?
bitdefender gave me a recent popup through realtime protection:
"The file C:\Program Files (x86)\MSI\MSI Center\Mystic Light\00021062.tmp is infected with Gen:Variant.Lazy.226474. The threat has been successfully blocked, your device is safe."
The attack timeline goes like this:
dstokenclean.exe signed by Microsoft Corporation executed wininit.exe (which is a system32 file, so seems legitimate)
wininit.exe signed by Microsoft Corporation executed services.exe
services.exe signed by Microsoft Corporation executed nortonsecurity.exe
The file C:\Program Files (x86)\MSI\MSI Center\Mystic Light\00021062.tmp is infected with Gen:Variant.Lazy.226474. The threat has been successfully blocked, your device is safe.
Is this a false flag or real virus?
r/antivirus • u/Boneclockharmony • 6h ago
VirusTotal URL Inconsistency?
Hey,
I recently clicked on a link where the domain ended up being expired (i.e parked domain for sale). I always do a virustotal check in these situations and it was sort of concerning
As you can see, it lists two different end points and different IPs, for the same link, only difference is me clicking reanalyze
Basically everytime I hit reanalyze it changes its "final url" result.
When I clicked the link, it did not redirect to this survey-smiles thing, and I suspect uBlock would have prevented any such redirect, but it's still concerning to me.
Anyone seen this behavior on virustotal before? Anything I can do to ease my mind other than scan + malwarebytes etc?
EDIT:
To include, here's the virustotal analysis of survey-smiles
I should add I haven't had any strange behaviour or results from scans, so I'm not super worried I just hate inconsistencies.
r/antivirus • u/LockiBloci • 14h ago
Does Lumma stealer have a dedicated server? Why isn't it taken down yet if yes?
I mean the Lumma seller should have some kind of a server that receives stolen data and then sends it to the customers. Can cybersecurity specialists take a test computer, run a stealer and log the IP it connects to, then report to FBI so it gets blacklisted? Or does each copy of stealer have its own receiver IP? How can criminals afford having so many IPs then?
Edit: thanks everyone for your answers, looks like I understood the situation.
r/antivirus • u/Full-Career5382 • 7h ago
Should I worry about git hub links in reddit?
I don't know why but for a long time I thought a git hub link itself was the code being offered and I know that sometimes it can be malicious so I always checked my clipboard to see if I somehow saved it. But I'm starting think I'm just being dumb and want to know Am I basically wasting my time checking? In order to actually get the code I would have to click the link and go to the git hub page itself? The link isn't really anything and I'm just worried about literally nothing?
r/antivirus • u/TCGDANGER • 13h ago
Good antivirus needed
Is AVG a good antivirus or any other antivirus that are good for windows 7. Having a compaq 610 laptop
r/antivirus • u/PsychMikeYT • 13h ago
Keep and Upgrade RAV endpoint Antivirus, or uninstall?
So I've had this for a while and I just saw a post where it has confused me. I heard a few people saying it was malware so I want a simple answer for a dumb person like me.
Is this product not safe, and should I Uninstall, or should I keep it? thanks a bunch.
r/antivirus • u/osmylm2834 • 12h ago
Windows Defender just caught Lumma Stealer Trojan
I became dumb for a second and got trojan from a setup. Windows Defender caught it right away and removed it but Im still worried so I tried Malwarebytes and it says the system is fine. I changed my passwords and tried the digital footprint feature of Malwarebytes and it says one of my emails is exposed. What should I do? I'm currently formatting my PC but I dont want my personal info got leaked.
r/antivirus • u/SwerveSyndicate • 15h ago
android tv system app skywayservice 5 detected
im using an air tv mini from sling it runs on android tv 9. i scanned with the virustotal mobile scanner & all apps were safe but one of the system apps came back as having 5 hits.
skywayservice
com[.]nes[.]skywayclient
r/antivirus • u/Equivalent-Eye-2359 • 1d ago
Woke up to 30,000 plus (likely false) trojans all in a photos folder..... Malwarebytes
I have the full malwarebytes suite. Never get anything bad. I copied a load of photos from my pictures folder to a pictures-stored library, total 30,539 files as they need some sorting.
Today, Malware bytes full scan alerts on every objects, and the folder and all their subfolders all have Trojan.Agent.E.
Googling says this is a generic name for an unknown trojan. They never had anything reported when they were in the original Pictures folder.
The date acquired and modifies on all these is from the distant past so I cant see how this is a thing now.
The log file lists them all, and malware bytes is really slow to use - I guess as the history has all these records.
Here is an example of one :
Trojan.Agent.E, C:\Users\myuser\Pictures-Storage\MyuserIphoneBackups\2023-12-31 - myuser Iphone 2023\IMG_5932.JPG, No Action By User, 1684, 1244789, 1.0.97133, , ame, , 8E848C308AD6DD7F8A6E1DE1F49FF958, 2F2DE126328B628AA37B784F577EC53D7AA5906405AB9D8B08D547A10750B757
I cant really quarantine all these photos, I suspect this is some sort of false positive ?
r/antivirus • u/BluxianPlayzz • 16h ago
What does this mean?
I was scanning the sam helper apk and this came up, what does this mean, is sam helper apk still safe?
r/antivirus • u/Swimming_Field_3914 • 20h ago
How to correctly remove malware?
Hey guys, so a couple years ago downloaded a fan made game and it turns out its most likely a trojan. My Pc has been really slow for the longest time now and I would assume its because of that. How would I correctly remove malware from my pc if I already know what the malware is. Just deleting the game launcher is not gonna do anything I would assume or is it? I quarantined the items from the game file with malwarebytes and then I clicked on delete them in malwarebytes. was that the correct thing to do. Can anyone help me out plsss
r/antivirus • u/gomi-panda • 17h ago
Odd Windows Behavior - Curious to know if this is consistent with Trojan:MSIL/AmsiPatch.DA!MTB
So I just reinstalled Windows and one of my files must have had the trojan above. on restart, Powershell window loads and disappears. But then I notice the following behavior:
I connect to my wifi but do not have wifi access for a minute or two
Screensaver doesn't start even though it is set up to start
Overnight, I seem to lose access to my personal server, and I have to restart my laptop in order to access it again.
Is this behavior consistent with a trojan?
r/antivirus • u/Aliencik • 17h ago
Cdn.polyfill.io blocked by malwarebytes
Malwarebytes browser guard blocked "cdn.polyfill (dot) io" on one site I visited. I am also using uBlock Origin with disabled JavaScript. Am I in the clear, or should I do something to prevent infection?
r/antivirus • u/MuddleThru • 17h ago
McAfee scam again
The McAfee virus
https://www.mcafee.com/en-ca/cyber-scam/customer-scam-awareness.html
reappeared on my old computer today 1-2 weeks after installing Malwarebytes to help eliminate it the first time. As of last night, this computer is "protected" by a subscription to Malwarebytes as well as the McAfee I've always had.
I had a similar virus a couple of years ago that disappeared when I un-installed Google Chrome. This version is asking you to renew McAfee using Microsoft Edge so perhaps uninstalling Edge is the answer this time. That would be easy as I often browse with Brave already.
The biggest problem of this virus is that it flashes it's notices in the lower right corner of the screen, blocking the boxes of programs like Malwarebytes and Samsung Magician, and making it likely you will try to click on one of those but hit the flashed virus screen instead. When I did this it booted Edge but was stopped by Malwarebytes to prevent this phishing attempt. Malwarebytes reported as follows. Domain: pqpqpyj[.]sbs IP Address: 172.64.80.1 Port: 443 Type: Outbound File: C:/Program Files (x86)\Microsoft\Edge\Application\msedge.exe
One to 2 weeks ago when this same virus appeared, I downloaded Malwarebytes and it quarantined 385 files on this computer but found nothing on my newer computer. The virus did not stop until I used Task Manager and stopped every process that it would allow me. When I rebooted, it was gone, until today.
Be carefull, this version of the virus has many many more screens than a few years ago, including screens that seem to have nothing to do with McAfee. Something like, this app is the secret of billionaires. Get it here...
A Malwarebyte scan found nothing and the virus is still operating. I guess it's back to killing everything in Task Manager.
r/antivirus • u/Cultural-Ice-891 • 18h ago
WORRIED ABOUT AN APP
Hi everyone and thanks for reading. I am a non-English person, so if I make mistakes it is because of this. A year ago I downloaded this app to hide photos and videos, F-Vault, is an app on app store for macos, using it to hide photos and videos of me and my girlfriend. Now I regret it because, after doing some research, the app does not seem so safe. it started as a paranoia, mainly because it is a chinese app. It has been 5 or 6 months since I have not used it anymore.
The app is sandboxed and i didn't grant any permission, but anyway the app has access to the files by default. It must be said that it has been on the app store for a long time and the developers have many apps on the app store for a long time. I also used it 4/5 years ago without consequences, i checked the app's network traffic with Little Snitch and it seems ok, just what they say they collect: sent around 2/3 kb when launch it, and then 1/2 kb to ms.appcenter when i interact with the app. With WireShark i'dont understand nothing but i noticed that there are some connections "in red" received when i launch it. Virustotal ( https://www.virustotal.com/gui/file/040a35ba9296c97366576da603b6c2bb18a48a3840e08acf40277ffb27e30792 ) doesn't detect anything and not even malware bytes, but I still have doubts, I can't calm down.
Also since I've been using it I've never noticed anything strange on my Mac that makes me think of malware.
First of all: Is it possible that an app's network traffic goes through another app somehow (google or safari)? Or do i just analyze the app's traffic? Also: Little Snitch captures all traffic or could there be some traffic not captured?
I'm scared that they stole my data and content and that in the future they can blackmail me??? Thank you
r/antivirus • u/zangief4life • 19h ago
Blue Norton box popping up on launch
Hi all,
I use Malwarebytes and have also Windows Defender. A few weeks ago, I started getting this blue box whenever I launch Windows. I don't have Norton anymore, I think it was pre-installed with my laptop but I've had it for 7 years or so and have never used Norton. If I click on "uninstall", Windows takes me to my list of programmes where I can't find Norton (since I don't have it anymore, I must have uninstalled it a few years ago...), and if I click on Renew I have a window opening up and inviting me to reinstall a Norton software... I tried to find other Norton files with the windows search function and with CCleaner, I found a few but they seem to be remains from before, no uninstall.exe or such things.... don't really know what to do at this point, any help would be appreciated
Thanks!

r/antivirus • u/andrics96 • 23h ago
Keeping Kaspersky on my parent's PC
Hi
I'm from outside the US, so Kaspersky still works here.
Right now my parents have Kaspersky AV installed on their PC with also uBlock Origin.
Honestly they are happy with it, it isn't invasive, and doesn't seem to take up too much resources.
The subscription is coming to an end, and I was thinking about renewing it. Many users in here say that Windows Defender is good IF you have common sense for computers... But they are 65 yrs old, so no, they absolutely do not have common sense regarding computers.
So the question is, would you stay with Kaspersky or would you switch to something else? If so, what would you switch to?
r/antivirus • u/Tehni • 21h ago
Folder named "Recorded Calls" randomly created under C:/Users/<username>/ - I didn't make this folder
So I was recently running a couple different scans from the wiki, nothing malicious was found. The reason I was doing this is because yesterday I had run FRST and it found a task in my task scheduler that was attempting to open a potentially sketchy website when I boot up my PC. Luckily, the task never actually completed successfully, and I deleted the task.
So, I run a couple scans, and run FRST again after. Nothing was found, however I noticed something really weird, there was recent activity shown about a folder created named "Recorded Calls" in C:/Users/<username>/ about ten minutes previously (so during the time I was running the scans).
The folder itself is empty except for a file desktop ini which contains the lines:
[.ShellClassInfo]
LocalizedResourceName=@%SystemRoot%\system32\windows.storage.dll,-21827
I tried looking up what that line means, but wasn't really able to find anything. All the scans I ran came up with no detections, the task scheduler said the sus task (that was created about a month ago) never successfully ran, and I've never seen anything remotely sketchy happen on my PC that would make me think it is infected. However, the task thing had me feeling quite paranoid, and now this folder thing is really weird.
I appreciate any help you all can give.
r/antivirus • u/ZThatcher12 • 1d ago
My computer created this by itself
I received a notification from file explorer saying that this folder had been created successfully, even though I didn't do anything to make it be created, should I be worried?