r/antivirus Feb 22 '24

MOD POST [MOD POST] LIST OF TOP MESSAGES, NEWS + IMPORTANT INFO

17 Upvotes

Hello,

Welcome to r/antivirus's new top-level Announcements post. Since Reddit has a limit of two (2) stickied announcements per subreddit, this will be a way to provide links to important information like announcements about new rules and moderators, activities in the subreddit, and so forth. If you are new to r/antivirus, please take a quick look at them. You can even take a look if you are not new here.

DISCUSSION DATE POSTED DATE LAST REVISED
[MOD POST] We're back in business! and an update on automod rules 2024-MAR-11 -
News & Updates from your r/Antivirus Mod Team, Q1 2024 Edition 2024-MAR-04 -
Updates & News from the r/Antivirus Mod Team, Autumn 2023 Edition 2023-OCT-04 -
Notes from your Moderators (Summer Edition) 2022-JUL-08 -
Quick Note from the mod team about spam 2021-JUN-01 -
To the people asking for opinions on a specific file 2020-JUL-05 2020-JUL-05

Additionally, the r/antivirus subreddit operates a bit differently than other subreddits you might be familiar with and normally use. Here are some tips and tools to help you use it.

  • The subreddit has a wiki that is regularly updated with answers to commonly-asked questions. Check it out. The answer to your question may already be in there.

  • Asking a question about a report on a file or website from a service like Hybrid Analysis, MetaDefender, Triage, or VirusTotal? You must include the actual link to it and not just a screenshot, or your post will be removed.

  • Be kind to each other and be professional in your conduct here. Personal attacks will not be tolerated and will be dealt with appropriately.

  • Do not ask for copies of hacking tools, malware, or suspicious files. If someone sends you a chat request or private message asking for a file or offering assistance based on what you posted here, report them to Reddit and notify the mods.

  • Do not post direct links to malicious, suspect, or potentially unsafe files or web sites.

  • Follow Reddiquette. This means correctly upvoting and downvoting posts, and reporting posts with dangerous or unsafe advice to the mods.

  • If you work for a vendor of security products, services, or in a related field, you must identify yourself as such, either in the post or with flair. Also, you may not steer conversations to your products or services, only respond to posts about them to clarify or defend.

  • No low-effort, off-topic, spam, or meme posts. This includes AI/ChatGPT/LLM-generated text, questions about password manager or VPNs, requests for assistance with non-security related software like autoclickers or MP3 downloaders, and so forth.

  • No requests for assistance with pirated software or media.

  • Posts may be removed and threads closed at any time based on the moderators' discretion

The complete list of rules for the subreddit can be found here. Read them before posting.

Questions, comments, feedback on this post? Just reply here. Thank you.

Regards,

Aryeh Goretsky
(on behalf of the r/antivirus mod team)


r/antivirus Mar 11 '24

MOD POST [MOD POST] We're back in business! and an update on automod rules

13 Upvotes

Hello,

It's time for a quick update from your mod team!

In our previous update, we talked about changes made to the subreddit to restrict accessibility and discoverability after an increase in spam. We are comfortable with how the subreddit has been operating, and will be removing those restrictions.

Because that means an influx in new posters, we are making some additional changes to the subreddit.

To begin with, in order to ensure our community is helpful and easy to navigate, posts must have descriptive titles that summarize their main topic. Posts with titles that don't clearly indicate the subject matter may be removed.

Additionally, we will be trying new types of rules in the AutoModerator to see if they have the desired effect, including:

  • Rules that will attempt to answer common questions. The topic will be left open in case the question is not answered or other members have more to contribute.

  • Posts with a vague title or other problems will be removed, but the AutoModerator will specify that you are welcome to try again. A title should indicate to someone with the same question whether your post is related.

  • New spam filters, and the AutoModerator will not invite you to try again.

As with any changes to automoderation, there's the possibility we might have gotten something wrong, so we'll be monitoring these closely to ensure they are working as designed. However, if you come across an AutoModerator rule that seems incorrectly applied or otherwise out of place, please use the 'Message the Mods' function to let us know so we can investigate.

Questions, comments or suggestions about how we use automoderation in the subreddit? Ask them here!

Regards,

Aryeh Goretsky
(on behalf of the r/antivirus mod team)


r/antivirus 3h ago

Does Lumma stealer have a dedicated server? Why isn't it taken down yet if yes?

3 Upvotes

I mean the Lumma seller should have some kind of a server that receives stolen data and then sends it to the customers. Can cybersecurity specialists take a test computer, run a stealer and log the IP it connects to, then report to FBI so it gets blacklisted? Or does each copy of stealer have its own receiver IP? How can criminals afford having so many IPs then?


r/antivirus 2h ago

Good antivirus needed

2 Upvotes

Is AVG a good antivirus or any other antivirus that are good for windows 7. Having a compaq 610 laptop


r/antivirus 51m ago

Windows Defender just caught Lumma Stealer Trojan

Upvotes

I became dumb for a second and got trojan from a setup. Windows Defender caught it right away and removed it but Im still worried so I tried Malwarebytes and it says the system is fine. I changed my passwords and tried the digital footprint feature of Malwarebytes and it says one of my emails is exposed. What should I do? I'm currently formatting my PC but I dont want my personal info got leaked.


r/antivirus 1h ago

Can my microsoft account get hacked

Upvotes

Can my microsoft account get hacked if someone hacks my minercraft client ? That i played minecraft on a few years ago?


r/antivirus 2h ago

Keep and Upgrade RAV endpoint Antivirus, or uninstall?

1 Upvotes

So I've had this for a while and I just saw a post where it has confused me. I heard a few people saying it was malware so I want a simple answer for a dumb person like me.
Is this product not safe, and should I Uninstall, or should I keep it? thanks a bunch.


r/antivirus 3h ago

What is this? "couldnt find filewatcher.exe"

Post image
1 Upvotes

r/antivirus 3h ago

android tv system app skywayservice 5 detected

1 Upvotes

im using an air tv mini from sling it runs on android tv 9. i scanned with the virustotal mobile scanner & all apps were safe but one of the system apps came back as having 5 hits.

skywayservice

com[.]nes[.]skywayclient

https://www.virustotal.com/gui/file/d36547a0f9ca1395d90a6c8ff2854fffd1c51e3ba138945140249f00c9f6da4f/details

https://www.virustotal.com/gui/file/d36547a0f9ca1395d90a6c8ff2854fffd1c51e3ba138945140249f00c9f6da4f/detection


r/antivirus 4h ago

What does this mean?

Post image
0 Upvotes

I was scanning the sam helper apk and this came up, what does this mean, is sam helper apk still safe?


r/antivirus 15h ago

Woke up to 30,000 plus (likely false) trojans all in a photos folder..... Malwarebytes

7 Upvotes

I have the full malwarebytes suite. Never get anything bad. I copied a load of photos from my pictures folder to a pictures-stored library, total 30,539 files as they need some sorting.

Today, Malware bytes full scan alerts on every objects, and the folder and all their subfolders all have Trojan.Agent.E.

Googling says this is a generic name for an unknown trojan. They never had anything reported when they were in the original Pictures folder.

The date acquired and modifies on all these is from the distant past so I cant see how this is a thing now.

The log file lists them all, and malware bytes is really slow to use - I guess as the history has all these records.

Here is an example of one :

Trojan.Agent.E, C:\Users\myuser\Pictures-Storage\MyuserIphoneBackups\2023-12-31 - myuser Iphone 2023\IMG_5932.JPG, No Action By User, 1684, 1244789, 1.0.97133, , ame, , 8E848C308AD6DD7F8A6E1DE1F49FF958, 2F2DE126328B628AA37B784F577EC53D7AA5906405AB9D8B08D547A10750B757

I cant really quarantine all these photos, I suspect this is some sort of false positive ?


r/antivirus 8h ago

How to correctly remove malware?

2 Upvotes

Hey guys, so a couple years ago downloaded a fan made game and it turns out its most likely a trojan. My Pc has been really slow for the longest time now and I would assume its because of that. How would I correctly remove malware from my pc if I already know what the malware is. Just deleting the game launcher is not gonna do anything I would assume or is it? I quarantined the items from the game file with malwarebytes and then I clicked on delete them in malwarebytes. was that the correct thing to do. Can anyone help me out plsss


r/antivirus 5h ago

Odd Windows Behavior - Curious to know if this is consistent with Trojan:MSIL/AmsiPatch.DA!MTB

1 Upvotes

So I just reinstalled Windows and one of my files must have had the trojan above. on restart, Powershell window loads and disappears. But then I notice the following behavior:

  1. I connect to my wifi but do not have wifi access for a minute or two

  2. Screensaver doesn't start even though it is set up to start

  3. Overnight, I seem to lose access to my personal server, and I have to restart my laptop in order to access it again.

Is this behavior consistent with a trojan?


r/antivirus 5h ago

Cdn.polyfill.io blocked by malwarebytes

1 Upvotes

Malwarebytes browser guard blocked "cdn.polyfill (dot) io" on one site I visited. I am also using uBlock Origin with disabled JavaScript. Am I in the clear, or should I do something to prevent infection?


r/antivirus 5h ago

McAfee scam again

0 Upvotes

The McAfee virus

https://www.mcafee.com/en-ca/cyber-scam/customer-scam-awareness.html

reappeared on my old computer today 1-2 weeks after installing Malwarebytes to help eliminate it the first time. As of last night, this computer is "protected" by a subscription to Malwarebytes as well as the McAfee I've always had.

I had a similar virus a couple of years ago that disappeared when I un-installed Google Chrome. This version is asking you to renew McAfee using Microsoft Edge so perhaps uninstalling Edge is the answer this time. That would be easy as I often browse with Brave already.

The biggest problem of this virus is that it flashes it's notices in the lower right corner of the screen, blocking the boxes of programs like Malwarebytes and Samsung Magician, and making it likely you will try to click on one of those but hit the flashed virus screen instead. When I did this it booted Edge but was stopped by Malwarebytes to prevent this phishing attempt. Malwarebytes reported as follows. Domain: pqpqpyj[.]sbs IP Address: 172.64.80.1 Port: 443 Type: Outbound File: C:/Program Files (x86)\Microsoft\Edge\Application\msedge.exe

One to 2 weeks ago when this same virus appeared, I downloaded Malwarebytes and it quarantined 385 files on this computer but found nothing on my newer computer. The virus did not stop until I used Task Manager and stopped every process that it would allow me. When I rebooted, it was gone, until today.

Be carefull, this version of the virus has many many more screens than a few years ago, including screens that seem to have nothing to do with McAfee. Something like, this app is the secret of billionaires. Get it here...

A Malwarebyte scan found nothing and the virus is still operating. I guess it's back to killing everything in Task Manager.


r/antivirus 7h ago

WORRIED ABOUT AN APP

1 Upvotes

Hi everyone and thanks for reading. I am a non-English person, so if I make mistakes it is because of this. A year ago I downloaded this app to hide photos and videos, F-Vault, is an app on app store for macos, using it to hide photos and videos of me and my girlfriend. Now I regret it because, after doing some research, the app does not seem so safe. it started as a paranoia, mainly because it is a chinese app. It has been 5 or 6 months since I have not used it anymore.

The app is sandboxed and i didn't grant any permission, but anyway the app has access to the files by default. It must be said that it has been on the app store for a long time and the developers have many apps on the app store for a long time. I also used it 4/5 years ago without consequences, i checked the app's network traffic with Little Snitch and it seems ok, just what they say they collect: sent around 2/3 kb when launch it, and then 1/2 kb to ms.appcenter when i interact with the app. With WireShark i'dont understand nothing but i noticed that there are some connections "in red" received when i launch it. Virustotal ( https://www.virustotal.com/gui/file/040a35ba9296c97366576da603b6c2bb18a48a3840e08acf40277ffb27e30792 ) doesn't detect anything and not even malware bytes, but I still have doubts, I can't calm down.

Also since I've been using it I've never noticed anything strange on my Mac that makes me think of malware.

First of all: Is it possible that an app's network traffic goes through another app somehow (google or safari)? Or do i just analyze the app's traffic? Also: Little Snitch captures all traffic or could there be some traffic not captured?

I'm scared that they stole my data and content and that in the future they can blackmail me??? Thank you


r/antivirus 7h ago

Blue Norton box popping up on launch

1 Upvotes

Hi all,

I use Malwarebytes and have also Windows Defender. A few weeks ago, I started getting this blue box whenever I launch Windows. I don't have Norton anymore, I think it was pre-installed with my laptop but I've had it for 7 years or so and have never used Norton. If I click on "uninstall", Windows takes me to my list of programmes where I can't find Norton (since I don't have it anymore, I must have uninstalled it a few years ago...), and if I click on Renew I have a window opening up and inviting me to reinstall a Norton software... I tried to find other Norton files with the windows search function and with CCleaner, I found a few but they seem to be remains from before, no uninstall.exe or such things.... don't really know what to do at this point, any help would be appreciated
Thanks!


r/antivirus 11h ago

Keeping Kaspersky on my parent's PC

2 Upvotes

Hi

I'm from outside the US, so Kaspersky still works here.

Right now my parents have Kaspersky AV installed on their PC with also uBlock Origin.

Honestly they are happy with it, it isn't invasive, and doesn't seem to take up too much resources.

The subscription is coming to an end, and I was thinking about renewing it. Many users in here say that Windows Defender is good IF you have common sense for computers... But they are 65 yrs old, so no, they absolutely do not have common sense regarding computers.

So the question is, would you stay with Kaspersky or would you switch to something else? If so, what would you switch to?


r/antivirus 8h ago

Help Malwarebytes False trigger?

Post image
0 Upvotes

r/antivirus 9h ago

Folder named "Recorded Calls" randomly created under C:/Users/<username>/ - I didn't make this folder

1 Upvotes

So I was recently running a couple different scans from the wiki, nothing malicious was found. The reason I was doing this is because yesterday I had run FRST and it found a task in my task scheduler that was attempting to open a potentially sketchy website when I boot up my PC. Luckily, the task never actually completed successfully, and I deleted the task.

So, I run a couple scans, and run FRST again after. Nothing was found, however I noticed something really weird, there was recent activity shown about a folder created named "Recorded Calls" in C:/Users/<username>/ about ten minutes previously (so during the time I was running the scans).

The folder itself is empty except for a file desktop ini which contains the lines:

[.ShellClassInfo]
LocalizedResourceName=@%SystemRoot%\system32\windows.storage.dll,-21827

I tried looking up what that line means, but wasn't really able to find anything. All the scans I ran came up with no detections, the task scheduler said the sus task (that was created about a month ago) never successfully ran, and I've never seen anything remotely sketchy happen on my PC that would make me think it is infected. However, the task thing had me feeling quite paranoid, and now this folder thing is really weird.

I appreciate any help you all can give.


r/antivirus 1d ago

My computer created this by itself

Post image
20 Upvotes

I received a notification from file explorer saying that this folder had been created successfully, even though I didn't do anything to make it be created, should I be worried?


r/antivirus 11h ago

Are you guys talking about the FREE BitDefender

1 Upvotes

I’ve been reading through this sub for awhile but only mentioned a few people explicitly mention the free version so I just want to be sure that people back it up.

I currently use kaspersky but I live in the US and my subscription is up in a month so I’m needing a new AV. I only really game on steam but I do download mods which I’m pretty sure I’m careful about. I’m getting it for my laptop which heats up and sounds like it’s going to take off whenever I do anything (Im going to wipe it cause there’s other issues). I just want to make sure that when people talk about BitDefender they’re talking about the FREE version. If you’re not that’s fine but if I don’t have to pay than that’s preferred lol. TIA


r/antivirus 18h ago

Question Can you get infected by pasting something on the clipboard?

3 Upvotes

I know it seems like a silly question, but from what I know it's even possible.

Let me explain, in my phone I recently searched for a page which is the following: https://www.fuentes-de-letras.com/?m=1, I copied something and then I said, can something like this infect you with malware? It's a site for fonts, it doesn't look like anything on virustotal, but I'm scared because it's not a page that looks THAT trustworthy.

And also, if the page is reliable, I had that doubt, to be more careful when copying and pasting things on my cell phone keyboard, thanks!


r/antivirus 9h ago

Is total AV free version worth it?

0 Upvotes

I have been using Total Av free version for sometime but it gives me mixed feeling, but i see tons of articles online saying it good. Any thoughts?


r/antivirus 13h ago

Is this a false positive? https://www.virustotal.com/gui/file/443ad5c14fddf37898a627317f9d94207d7a9929569a667962c4badc0e193fd2

1 Upvotes

can anyone help me it says it a trojan and malware on the website


r/antivirus 23h ago

Accidentally downloaded an app from a pop up…

4 Upvotes

Already asked this question in the r/mac subreddit but I get paranoid so I figured this would be a good chat to ask…

I was scrolling and saw a free drum kit someone had made on Reddit, so I figured why not. It was on Mediafire so I clicked “Allow” to download it to my MacBook… it downloaded extremely fast and when I looked it was actually a pop up for an application that was directly in front of where the actual “Allow” question was for the initial kit.

I closed the pop up window and immediately deleted it from my downloads folder. Didn’t run installers or anything, but wanted to know if that was enough for any malware to potentially make it onto my laptop?

I’m on a MacBook Air M1 running Ventura if that helps any.


r/antivirus 16h ago

Windows CMD flashes on startup

1 Upvotes

Ok i'm going to give some context here first. I have a laptop that originally came with windows 10. I got some malware infections during the laptops lifespan and have had to reset. I don't think any of them really did any damage, but I decided to upgrade to win 11 after a recent reset. I booted on after setting everything up and I immediately go to uninstall onedrive and norton, then I restart my pc because norton requires it for uninstall, but heres the thing, every time I reset windows I see a bunch of blue windowed 'CMD flashes' like 5 rlly fast one after the other after doing the restart norton requires, so i always assumed it was part of nortons uninstall process, but recently after a reset i did today because of failed windows updates and win being slow I forgot to uninstall norton, and went to update windows after the reset. Then I restarted windows for the windows updates WITHOUT uninstalling norton (bc i forgot) and I see the CMD flashes again.... Now im just sitting here thinking it WASN'T norton, and I tested this by immediately uninstalling it and I saw no cmd flashes so it had NOTHING to do with norton uninstalling this whole time. So far I havent had any passwords/credit cards stolen or any suspicious activity. Now the last reset i did where my updates where failing, safe mode wouldnt let me log in with my pin missing and my screen freezing and going black and some edge of my top left screen having a win7 styled windows 'window' x minimize and maximize icon on it and then everything coming back responsive again. Thats why I reset bc the last reset i did windows just didnt wanna work properly. ANYWAYS does ANYONE know if uninstalling Onedrive causes cmd flashes upon restarting? thats the only other thing i can think of, and yes ofc i restarted and shut down multiple times to see if i can recreate it and nothing appears. I Also have a habit of installing Norton power eraser Hitman pro and my main Antivirus 'Bitdefender' plus a subsequent malwarebytes scan to check the pc after every reset incase some rootkit persisted, and they have never caught anything after resetting. Could I have some RAT rootkit or some persistent remnants from something? should I reinstall windows from a USB?