/g/ - Technology » Thread #17255555

[65 / 11 / ?]

88KiB, 384x494, unknown.jpg

Anonymous Sun 01 May 2011 19:39:00 No.17255555 View View Reply Original Report

>> browse /s/
>> download rar
>> jpgs and a mp4 inside
>> open mp4
>> Security essentials reports Win32/Rebhip.A
>> No suspicious processes or startup entries
>> mfw

What do?

Anonymous

View Same Google ImgOps iqdb SauceNAO unknown.jpg, 12KiB, 300x300

Anonymous Sun 01 May 2011 19:40:00 No.17255565 Report

Quoted By: >>17255599

>downloading files provided by Anonymous

Nigga u dum?

Anonymous

Anonymous Sun 01 May 2011 19:41:00 No.17255571 Report

Quoted By:

sledgehammer that shit

Anonymous

View Same Google ImgOps iqdb SauceNAO unknown.jpg, 27KiB, 311x311

Anonymous Sun 01 May 2011 19:42:00 No.17255585 Report

Quoted By: >>17256403

Anonymous

Anonymous Sun 01 May 2011 19:42:00 No.17255599 Report

Quoted By:

>>17255565
I thought "It's a fucking mp4, what's the worst that could happen?"
I checked the extensions too.
The thing is, it failed to infect me. I'll try running it in a virtual machine

Anonymous

Anonymous Sun 01 May 2011 19:44:00 No.17255612 Report

Quoted By: >>17255644

>>17255555
Viruses can be embedded into practically any file type, including images. Also five fives? Impressive!

Anonymous

Anonymous Sun 01 May 2011 19:48:00 No.17255644 Report

Quoted By: >>17255661 >>17256235

>>17255612
Well , fuck. Turns out it was a .scr , but looks like a mp4.
The name was "vibrate ?4pm.scr" but appears as "Vibrate ?."4pm.scr

Anonymous

Anonymous Sun 01 May 2011 19:49:00 No.17255661 Report

Quoted By: >>17255694

>>17255644
Make sure you leave file extension visibility turned on in the future.

Anonymous

Anonymous Sun 01 May 2011 19:52:00 No.17255694 Report

Quoted By: >>17255711 >>17256021

>>17255661
It is turned on, that's the thing, all extensions are visible, it's the file name that breaks it. I was going to check the name using the command prompt, didn't bother. Meh.

What I don't get is why it fails to infect me.

Anonymous

Anonymous Sun 01 May 2011 19:52:00 No.17255700 Report

Quoted By: >>17255718

>My face when.jpg you did not manually open the video with right click and "open with" vlc or thekmplayer or anyother player lul

Anonymous

Anonymous Sun 01 May 2011 19:53:00 No.17255711 Report

Quoted By:

>>17255694
Because your antivirus picked it up.

Anonymous

Anonymous Sun 01 May 2011 19:54:00 No.17255718 Report

Quoted By: >>17255744

>>17255700
Yeah, my face exactly.

I'm running it now in a vm. Let's see what happens.

Anonymous

View Same Google ImgOps iqdb SauceNAO unknown.jpg, 14KiB, 551x551

Anonymous Sun 01 May 2011 19:57:00 No.17255744 Report

Quoted By: >>17255772

>>17255718
>Knows it contains a virus
>Whats to try and watch it anyway

Anonymous

Anonymous Sun 01 May 2011 20:00:00 No.17255772 Report

Quoted By:

>>17255744
I want to be sure that the absence of signs of infection mean I'm not infected. Doubt it's that sophisticated, but I want to see what happens when it actually manages to run.

Anonymous

View Same Google ImgOps iqdb SauceNAO unknown.jpg, 227KiB, 648x303

Anonymous Sun 01 May 2011 20:02:00 No.17255809 Report

Quoted By: >>17255847

>MFW You actually downloaded something from /s/
>MFW You're too dumb to realize that board is NOTHING BUT SPAM AND DODGY LINKS.
>MFW You're the reason spammers come to 4chan

Anonymous

Anonymous Sun 01 May 2011 20:06:00 No.17255847 Report

Quoted By: >>17255871

>>17255809
Yeah, I failed I guess.

Also,
>> mfw it doesn't run in xp

Anonymous

Anonymous Sun 01 May 2011 20:08:00 No.17255871 Report

Quoted By: >>17255898 >>17255962 >>17255979

>>17255847
>MFW you think because you have no rogue processes and no weird shit is happening, that your computer is not compromised.

The goal of any virus these days is invisibility. They pre-load before Windows, and the only way to be sure you're rid of them is to reformat, not preserving any data. (Or, slightly less safe, but you get to keep your shit, copy your necessary documents into Linux, scan them, and then copy them back to a new Windows install)

Anonymous

Anonymous Sun 01 May 2011 20:11:00 No.17255898 Report

Quoted By: >>17255960

>>17255871
That's why I'm trying to confirm that I'm not infected. I don't want to bother with formatting right now.

Anonymous

Anonymous Sun 01 May 2011 20:16:00 No.17255960 Report

Quoted By:

>>17255898

You could run wireshark and see if there is any suspicious network traffic.

Anonymous

Anonymous Sun 01 May 2011 20:16:00 No.17255962 Report

Quoted By: >>17255999

>>17255871
What about scanning your pc in safe mode or mounting the windows install in linux and scanning it with something like Clam.

Anonymous

Anonymous Sun 01 May 2011 20:17:00 No.17255979 Report

Quoted By:

>>17255871
Goddammit, now you've made me paranoid.

Anonymous

Anonymous Sun 01 May 2011 20:19:00 No.17255999 Report

Quoted By:

>>17255962
That's what I'm going to do. I'll share the drive and scan it from a remote windows machine.

Anonymous

Anonymous Sun 01 May 2011 20:20:00 No.17256013 Report

Quoted By: >>17256073 >>17256086 >>17256127

>http://www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Worm:Win32/Rebhip.A

Isn't even that bad. It's just a babbys first virus.

Anonymous

Anonymous Sun 01 May 2011 20:21:00 No.17256021 Report

Quoted By: >>17256127 >>17256235

>>17255694
now that is fucking awesome never have I thought of using the right left override in a file name.

Anonymous

View Same Google ImgOps iqdb SauceNAO unknown.jpg, 9KiB, 344x341

Anonymous Sun 01 May 2011 20:23:00 No.17256045 Report

Quoted By: >>17256085 >>17256140

Malware can exist in virtually any file, even images, thanks to Microsoft which made sure that an exploit in the rendering engine allows it to take full control of your computer.

In fact, I once found malware in an image downloaded from>>>/wg/

Anonymous

Anonymous Sun 01 May 2011 20:25:00 No.17256073 Report

Quoted By:

>>17256013
Take the following steps to help prevent infection on your computer:

* Enable a firewall on your computer.
* Get the latest computer updates for all your installed software.
* Use up-to-date antivirus software.
* Limit user privileges on the computer.
* Use caution when opening attachments and accepting file transfers.
* Use caution when clicking on links to web pages.
* Avoid downloading pirated software.
* Protect yourself against social engineering attacks.
* Use strong passwords.

Best advice ever!

Anonymous

Anonymous Sun 01 May 2011 20:26:00 No.17256085 Report

Quoted By: >>17256102

>>17256045
Wow! Now that does suprise me! What gave it away?

!TIvoFfGlIs

!TIvoFfGlIs Sun 01 May 2011 20:27:00 No.17256086 Report

Quoted By:

>>17256013
Looks more like a spyware.

Anonymous

Anonymous Sun 01 May 2011 20:28:00 No.17256102 Report

Quoted By:

>>17256085
MSE found it when I was restoring my backups, including wallpapers, after a format.

Anonymous

Anonymous Sun 01 May 2011 20:31:00 No.17256127 Report

Quoted By: >>17256167 >>17256175

.>>17256013
I know, seems like it. That is, if it really is just rebhip.a.
This is what virustotal reports
http://www.virustotal.com/file-scan/report.html?id=8c13bb415d6884a32074a1acc3d39cf74b85f1e57012da4ae
8b192da57e92a1e-1304059918

>>17256021
I knew of such tricks, but I thought ms had them resolved by now, seeing as how I'm running w7, the LATEST FUCKING OS.

Anonymous

Anonymous Sun 01 May 2011 20:32:00 No.17256140 Report

Quoted By:

>>17256045
Not so much, you can append a virus to anything but that doesn't mean it's executed when the file is run, that only occurs through exploits or "insecure" formats (tiff exe scr bat ect)

Anonymous

Anonymous Sun 01 May 2011 20:32:00 No.17256143 Report

Quoted By:

http://technet.microsoft.com/en-us/library/cc512587.aspx

Straight from the horse's mouth as it were.

Also, let's bear in mind, there's no such thing as 100% detection. The best any antivirus can hope to claim is around 90%, and it's only security through numbers. If you happen to be one of the first to be infected by a new piece of malware, or one from a source that's not blatantly self-spreading (like something from an image posted on 4chan or a music file), it's extremely unlikely the antivirus companies would ever pick it up and manage to scan for it.

This, I feel, makes running an antivirus redundant and possibly LESS safe, since it gives you that false sense of security.

Anonymous

Anonymous Sun 01 May 2011 20:33:00 No.17256151 Report

Quoted By:

>* Use strong passwords.
Yeah, even gmail is so easy Brute-force

Anonymous

Anonymous Sun 01 May 2011 20:34:00 No.17256167 Report

Quoted By: >>17256244 >>17256259

>>17256127
>Implying Microsoft don't purposely leave security holes in the OS in accordance with their deals with the antivirus companies.

Come on, if you don't have antivirus software installed, Windows SCREAMS at you to buy some.

It hasn't occurred to anyone that the OS should either not need it to begin with, or that it should come with some system level protection to begin with?

Anonymous

Anonymous Sun 01 May 2011 20:35:00 No.17256175 Report

Quoted By:

>>17256127
It's a feature not a bug herp derp; anyway thank you OP had I not seen this thread I probably would have fallen into this trap at some point.

Anonymous

View Same Google ImgOps iqdb SauceNAO unknown.jpg, 3KiB, 607x84

Anonymous Sun 01 May 2011 20:40:00 No.17256235 Report

Quoted By:

>>17255644
>>17256021
>mfw this actually works

Anonymous

Anonymous Sun 01 May 2011 20:40:00 No.17256242 Report

Quoted By: >>17256282

WINDOWS, IT JUST WERKZ

Also, RUNNING OS WITH EVALUATED PRIVILEGES

Have fun with your formats

Anonymous

Anonymous Sun 01 May 2011 20:41:00 No.17256244 Report

Quoted By:

>>17256167
Oh come on, do you really think the programmers at MS could think of every way someone might try misuse features that have been implemented into Windows.

If what your saying was the case they wouldn't have released their own set of security tools. Also why the hell do you think MS releases security updates and patches.

Anonymous

Anonymous Sun 01 May 2011 20:41:00 No.17256256 Report

Quoted By:

I uploaded the actual exe
http://www.virustotal.com/file-scan/report.html?id=4679fcd132609246b30c6b37a76672c7d1ccf4889780befd2
bc15f72bd805e63-1304253375

apparently, when the .scr is run, it extracts a svchost.exe to appdata\temp, and the actual vid, and runs them both. Despite my best efforts to run it, it either spits a .net error (an actual error) or simply sits idle (in sandboxie).

Anonymous

Anonymous Sun 01 May 2011 20:41:00 No.17256259 Report

Quoted By: >>17256307

>>17256167

Ehh...

MSE itself is one of the better (if that term is even applicable in this case) anti-virus programs, and it's from Microsoft + free.

Anonymous

Anonymous Sun 01 May 2011 20:43:00 No.17256282 Report

Quoted By: >>17256303

>>17256242
Elevated.

Evaluated privileges would be a good thing.

Anonymous

Anonymous Sun 01 May 2011 20:45:00 No.17256303 Report

Quoted By:

>>17256282
Yes

Anonymous

View Same Google ImgOps iqdb SauceNAO unknown.jpg, 199KiB, 443x461

Anonymous Sun 01 May 2011 20:46:00 No.17256307 Report

Quoted By: >>17256325 >>17256334 >>17256337

>>17256259
They made MSE to shut that argument up, but notice they don't publicise it, and they don't box it in with Windows.

This is because of the bullshit deals they made with antivirus companies in the name of 'competition practice'. Basically MS agreed to make a broken OS so as to protect the interests of the companies that make security software.

>MFW Recaptcha has started double-overlaying it's captcha word so it's almost totally unreadable.

Anonymous

Anonymous Sun 01 May 2011 20:48:00 No.17256325 Report

Quoted By:

>>17256307
>implying the overlay captcha isn't easy as fuck.
Every real board has been attacked by spambots because it's so easy for comp to read it.

Anonymous

Anonymous Sun 01 May 2011 20:48:00 No.17256334 Report

Quoted By:

>>17256307
That sounds quite delicious, but could you please cite your sources so I can quote that reliably?

Anonymous

Anonymous Sun 01 May 2011 20:49:00 No.17256337 Report

Quoted By:

>>17256307
They actually made a big deal of it when it was first released, just not much since then.

Not to mention if they packaged it with Windows, they would never hear the end of unfair competition practices.

Anonymous

Anonymous Sun 01 May 2011 20:50:00 No.17256350 Report

Quoted By:

Well, I know this shit's not that sophisticated, but at the same time I know formatting is the only proper option.

Can't get it to run in sandboxie. I wish it would just do what it's supposed to do so I could confirm that it's a piece of shit which copies itself everywhere with random file names and has a bunch of processes running.

Anonymous

Anonymous Sun 01 May 2011 20:50:00 No.17256357 Report

Quoted By:

this is why people say

>using windows for anything but games
>2011

Anonymous

Anonymous Sun 01 May 2011 20:51:00 No.17256363 Report

Quoted By:

>using DDLs
Oh you.

Anonymous

View Same Google ImgOps iqdb SauceNAO unknown.jpg, 265KiB, 580x400

Anonymous Sun 01 May 2011 20:54:00 No.17256403 Report

Quoted By: >>17256490 >>17256502

>>17255585
The fuck?

Anonymous

Anonymous Sun 01 May 2011 20:57:00 No.17256431 Report

Quoted By:

Here's the link btw if you want to poke it with sticks

http://www.megaupload.com/?d=DZHQ1HT6

Anonymous

Anonymous Sun 01 May 2011 20:58:00 No.17256436 Report

Quoted By:

fuck fuck fuck. I have downloaded shit from /wg/ and now i am paranoid. God damnit, full scan with mse. I am in the middle of installing debian too.

Anonymous

Anonymous Sun 01 May 2011 20:59:00 No.17256451 Report

Quoted By: >>17256529

>Windows
LOL'd hard.

Anonymous

Anonymous Sun 01 May 2011 21:04:00 No.17256490 Report

Quoted By: >>17256508

>>17256403

You must be new here.

Anonymous

Anonymous Sun 01 May 2011 21:04:00 No.17256502 Report

Quoted By:

>>17256403
Picture say's it all. It's pretty easy to do with a minimal knowledge about viruses.

Anonymous

Anonymous Sun 01 May 2011 21:05:00 No.17256508 Report

Quoted By:

>>17256490
Teach me.

Anonymous

Anonymous Sun 01 May 2011 21:06:00 No.17256517 Report

Quoted By: >>17256615

>browse /rs/
>download rar
>extract it to a folder
>all the same pics and a text file
>text file says I'm dum and I have been infected for being a silly nigger
>I ain't opening no .jpgs
>MSE does nothing
>I see no changes

Fuck. How do I know...?!

Anonymous

Anonymous Sun 01 May 2011 21:08:00 No.17256529 Report

Quoted By:

>>17256451
Go back to bed, WorldHatesWinFags

Anonymous

View Same Google ImgOps iqdb SauceNAO unknown.jpg, 479KiB, 449x401

Anonymous Sun 01 May 2011 21:08:00 No.17256531 Report

Quoted By: >>17256536

>Windows

Anonymous

View Same Google ImgOps iqdb SauceNAO unknown.jpg, 72KiB, 594x406

Anonymous Sun 01 May 2011 21:08:00 No.17256536 Report

Quoted By:

>>17256531
Windows.

Anonymous

Anonymous Sun 01 May 2011 21:17:00 No.17256615 Report

Quoted By: >>17256669

>>17256517
It's either a hoax, or you clicked on an executable masked as a binary file.

Btw, can you guys name any really sophisticated hard to detect malware?

Anonymous

Anonymous Sun 01 May 2011 21:23:00 No.17256669 Report

Quoted By: >>17256719

>>17256615
All I know is that all those jpg files were the same, and were called something like "I'm a big faggot-1, 2, 3"

It didn't look suspicious at all. I could do that in a minute by just grabbing some picture from the internet, renaming it and copying it 30 times, but damn, I still think that could have done something. MSE reported nothing on that rar, nor the files.

Anonymous

Anonymous Sun 01 May 2011 21:28:00 No.17256719 Report

Quoted By: >>17256776

>>17256669
Extract the rar somewhere else, and check the extensions using the command prompt. If it's something like .jpg.exe or .txt.exe , it's malware.

Anonymous

Anonymous Sun 01 May 2011 21:30:00 No.17256739 Report

Quoted By:

OP here, I checked the rar again, winrar lists the scr as a mp4, even though in the type tab it says screensaver. That's what fooled me.

Anonymous

Anonymous Sun 01 May 2011 21:35:00 No.17256776 Report

Quoted By:

>>17256719
Damn, I didn't even bother. That was a week ago, and I deleted the file.

Capcode	All Only User Posts Only Verified Posts Only Moderator Posts Only Manager Posts Only Admin Posts Only Developer Posts Only Founder Posts
Show Posts	All Only With Images Only Without Images Only Spoiler Images Only Non-Spoiler Images
Deleted Posts	All Only Deleted Posts Only Non-Deleted Posts
Ghost Posts	All Only Ghost Posts Only Non-Ghost Posts
Post Type	All Only Sticky Threads Only Opening Posts Only Reply Posts
Results	All Grouped By Threads
Order	Latest Posts First Oldest Posts First

On these archives

Your latest searches