Possible Malware

Caring1 · Apr 22, 2016

I'm not saying TPU is the cause of an attempted infection I noticed when I booted my system up today, BUT, the only thing I have downloaded over the last two days was Futuremark 3DMark from this site.
Malwarebytes pulled 101 PuP's from Conduit from my system.
That shit is hard to remove once it gets it's hooks in.
Just wanted to mention it as the downloaded Zip was empty anyway even though it took half an hour to download the 2.1Gb.

MrGenius · Apr 22, 2016

Ahh...so it wasn't just on my end(the empty folder part at least). Looks like I'll be running some AVs on a couple of my machines immediately. Hopefully I'm not too screwed.

jboydgolfer · Apr 22, 2016

oh shit. i downloaded that File to see if MrGenius was the only one having trouble...but mine wasnt empty. shit.

Im jot sure it matters ,but do either of you @Caring1 , or @MrGenius remember which server you downliaded from?

I can recall the US server wad @95%load, but i still used it.

I didnt install mine either, just verified it wasnt empty...
Im scanning with mbam now. If i find pup,or anything,ill notify a mod or w1zard

ne6togadno · Apr 22, 2016

jboydgolfer said:
oh shit. i downloaded that File to see if MrGenius was the only one having trouble...but mine wasnt empty. shit.

Im jot sure it matters ,but do either of you @Caring1 , or @MrGenius remember which server you downliaded from?

I can recall the US server wad @95%load, but i still used it.

I didnt install mine either, just verified it wasnt empty...
Im scanning with mbam now. If i find pup,or anything,ill notify a mod or w1zard

better contact @W1zzard now cause he might have some advance tools that will do better job with finding virus/malware then free avs we typically use.

MrGenius · Apr 22, 2016

It looks like I tried both US servers on both computers I used. I'm not coming up with any malware so far. But I'm nowhere near done checking.

R-T-B · Apr 22, 2016

Embedding malware in an empty zip is pretty tricky, unless it's an exe designed to look like a zip or something. I'm tempted to call false alarm, but being vigilant is always good. Let us know those scan results.

jboydgolfer · Apr 22, 2016

ne6togadno said:
better contact @W1zzard now cause he might have some advance tools that will do better job with finding virus/malware then free avs we typically use.

i own mbam, it found nothing.
luckily i am on ALL ssd system.

ne6togadno · Apr 22, 2016

jboydgolfer said:
i own mbam, it found nothing.

and you scaned file on all mirrors? :slap:

also i doubt even premium mbam can do it better then enterprice solutions.
its better to have it double/triple checked then TPU to be pointed as malware source in whole interwebz

R-T-B · Apr 22, 2016

ne6togadno said:
and you scaned file on all mirrors?

I don't think he was dismissing your call to action for W1zzard as much as reporting in.

Caring1 · Apr 22, 2016

jboydgolfer said:
Im jot sure it matters ,but do either of you @Caring1 , or @MrGenius remember which server you downliaded from?

I can recall the US server wad @95%load, but i still used it.

I downloaded from the first listed US server as it said it was the closest.
The download probably isn't responsible but I just thought I would mention it as it was odd it was empty after downloading.
Not sure how else I would have got that many infections though.

Ferrum Master · Apr 22, 2016

Darn... that's why I use german server lol.

I guess I will need a scan too... just to be sure.

W1zzard · Apr 22, 2016

I reinstalled some of our mirrors in the last few days, so files were unavailable and being in-transfer. I don't think that's the cause for your problems. The files were always on a secondary mirror and then synced from there after reinstall

TheMailMan78 · Apr 22, 2016

ne6togadno said:
and you scaned file on all mirrors?
also i doubt even premium mbam can do it better then enterprice solutions.
its better to have it double/triple checked then TPU to be pointed as malware source in whole interwebz

WTF are you talking about enterprise solutions? They all pretty much use the same heuristic as consumer editions. To top it off malwarebytes is a secondary/backup solution to normal protection. All W1zz has is the same things you can DL yourself from any respective AV company.

@caring sounds like you may have been hit with a drive by malicious ad OR you've had the infection for a while and just discovered it after you're install of 3dmark. I would download Kaspersky Rescue Disk and follow the directions. http://support.kaspersky.com/us/viruses/rescuedisk

PM me if you have any questions or concerns.

Jetster · Apr 22, 2016

You don't have to download anything to get malware. It can come from a Hosting Script on a website. Sits there until you reboot

Caring1 · Apr 22, 2016

TheMailMan78 said:
@caring sounds like you may have been hit with a drive by malicious ad OR you've had the infection for a while and just discovered it after you're install of 3dmark. I would download Kaspersky Rescue Disk and follow the directions. http://support.kaspersky.com/us/viruses/rescuedisk

PM me if you have any questions or concerns.

Thanks, it's all good now, I use adblocker so wasn't a driveby and didn't actually get to install 3dmark as the zip folder was empty.
Scans are all clear now.
I'm pretty much a creature of habit and stick to regular sites and don't download from sites I don't trust, so was sure TPU wouldn't be the cause, but that leaves me wondering where it came from.
Conduit is a browser highjacker and a real PITA.

rtwjunkie · Apr 22, 2016

Jetster said:
You don't have to download anything to get malware. It can come from a Hosting Script on a website. Sits there until you reboot

This is what aggravates me about the people who piously proclaim you just have to be careful about going to only known safe websites. These drive-bys are found everywhere, not just dodgy websites.

Caring1 · Apr 22, 2016

rtwjunkie said:
This is what aggravates me about the people who piously proclaim you just have to be careful about going to only known safe websites. These drive-bys are found everywhere, not just dodgy websites.

Thank you, that just reminded me that a news site I read had something like that happen to them not long ago and people were infected by clicking on articles. I had thought they would be more careful, but at least I have an idea how or where I got it from.

TheMailMan78 · Apr 22, 2016

Caring1 said:
Thanks, it's all good now, I use adblocker so wasn't a driveby and didn't actually get to install 3dmark as the zip folder was empty.
Scans are all clear now.
I'm pretty much a creature of habit and stick to regular sites and don't download from sites I don't trust, so was sure TPU wouldn't be the cause, but that leaves me wondering where it came from.
Conduit is a browser highjacker and a real PITA.

FYI adblocker doesn't stop drive bys.

Jetster · Apr 22, 2016

Caring1 said:
Thank you, that just reminded me that a news site I read had something like that happen to them not long ago and people were infected by clicking on articles. I had thought they would be more careful, but at least I have an idea how or where I got it from.

Keep Java updated at all times. Or turn it off

W1zzard · Apr 22, 2016

Jetster said:
Keep Java updated at all times. Or turn it off

Turn the Java browser plugin off, and while you are at it, turn off Flash, too.

rtwjunkie · Apr 22, 2016

Jetster said:
Keep Java updated at all times. Or turn it off

Since I went W10 I have been java free and flash has been off! So far I've not found any websites needing it.

jsfitz54 · Apr 22, 2016

rtwjunkie said:
Since I went W10 I have been java free and flash has been off! So far I've not found any websites needing it.

Q?: Have you tried financial sites like E-TRADE, with W10 without JAVA?

jboydgolfer · Apr 22, 2016

Ive done a FULL scan with multiple AV's, and im clean...just finished running Malwarebytes antiRootKit, just to be safe, all is good. But for Me, the folder Was NOT empty, so my situation MAY be different.
best of Luck to those affected.

Shou Miko · Apr 22, 2016

W1zzard said:
Turn the Java browser plugin off, and while you are at it, turn off Flash, too.

Who uses any of these two today? srsly? :laugh:

I don't since yt moved on to HTML5 I haven't had Flash player installed really and java not even banking system for private ppl uses that in my country anymore so it's nice to get rid of it all :toast:

rtwjunkie · Apr 22, 2016

jsfitz54 said:
Q?: Have you tried financial sites like E-TRADE, with W10 without JAVA?

Only my bank site so far, and it has been fine.

System Name	Black Box
Processor	Intel Xeon E3-1260L v5
Motherboard	MSI E3 KRAIT Gaming v5
Cooling	Tt tower + 120mm Tt fan
Memory	G.Skill 16GB 3600 C18
Video Card(s)	Asus GTX 970 Mini
Storage	Kingston A2000 512Gb NVME
Display(s)	AOC 24" Freesync 1m.s. 75Hz
Case	Corsair 450D High Air Flow.
Audio Device(s)	No need.
Power Supply	FSP Aurum 650W
Mouse	Yes
Keyboard	Of course
Software	W10 Pro 64 bit

System Name	Americas cure is the death of Social Justice & Political Correctness
Processor	i7-11700K
Motherboard	Asrock Z590 Extreme wifi 6E
Cooling	Noctua NH-U12A
Memory	32GB Corsair RGB fancy boi 5000
Video Card(s)	RTX 3090 Reference
Storage	Samsung 970 Evo 1Tb + Samsung 970 Evo 500Gb
Display(s)	Dell - 27" LED QHD G-SYNC x2
Case	Fractal Design Meshify-C
Audio Device(s)	on board
Power Supply	Seasonic Focus+ Gold 1000 Watt
Mouse	Logitech G502 spectrum
Keyboard	AZIO MGK-1 RGB (Kaith Blue)
Software	Win 10 Professional 64 bit
Benchmark Scores	the MLGeesiest

System Name	Red Radiance l under construction
Processor	5800x
Motherboard	x470 taichi
Cooling	stock wrath
Memory	TridentZ Neo rgb 3600mhz (2x8 kit)
Video Card(s)	Sapphire Vega 64 nitro+
Storage	970 evo nvme
Display(s)	lc27g75tq
Case	tt core x5 tge
Audio Device(s)	sennheiser's pc323d usb soundcard
Power Supply	corsair AX860i
Mouse	roccat burst pro
Keyboard	roccat ryos mk fx
Software	windows 10

System Name	Pioneer
Processor	Ryzen R9 7950X
Motherboard	GIGABYTE Aorus Elite X670 AX
Cooling	Noctua NH-D15 + A whole lotta Sunon and Corsair Maglev blower fans...
Memory	64GB (4x 16GB) G.Skill Flare X5 @ DDR5-6000 CL30
Video Card(s)	XFX RX 7900 XTX Speedster Merc 310
Storage	2x Crucial P5 Plus 2TB PCIe 4.0 NVMe SSDs
Display(s)	55" LG 55" B9 OLED 4K Display
Case	Thermaltake Core X31
Audio Device(s)	TOSLINK->Schiit Modi MB->Asgard 2 DAC Amp->AKG Pro K712 Headphones or HDMI->B9 OLED
Power Supply	FSP Hydro Ti Pro 850W
Mouse	Logitech G305 Lightspeed Wireless
Keyboard	WASD Code v3 with Cherry Green keyswitches + PBT DS keycaps
Software	Gentoo Linux x64

System Name	Americas cure is the death of Social Justice & Political Correctness
Processor	i7-11700K
Motherboard	Asrock Z590 Extreme wifi 6E
Cooling	Noctua NH-U12A
Memory	32GB Corsair RGB fancy boi 5000
Video Card(s)	RTX 3090 Reference
Storage	Samsung 970 Evo 1Tb + Samsung 970 Evo 500Gb
Display(s)	Dell - 27" LED QHD G-SYNC x2
Case	Fractal Design Meshify-C
Audio Device(s)	on board
Power Supply	Seasonic Focus+ Gold 1000 Watt
Mouse	Logitech G502 spectrum
Keyboard	AZIO MGK-1 RGB (Kaith Blue)
Software	Win 10 Professional 64 bit
Benchmark Scores	the MLGeesiest

Possible Malware

Caring1

MrGenius

jboydgolfer

ne6togadno

MrGenius

R-T-B

jboydgolfer

ne6togadno

R-T-B

Caring1

Ferrum Master

W1zzard

Administrator

TheMailMan78

Big Member

Jetster

Caring1

rtwjunkie

PC Gaming Enthusiast

Caring1

TheMailMan78

Big Member

Jetster

W1zzard

Administrator

rtwjunkie

PC Gaming Enthusiast

jsfitz54

jboydgolfer

Shou Miko

rtwjunkie

PC Gaming Enthusiast

System Name	HELLSTAR
Processor	AMD RYZEN 9 5950X
Motherboard	ASUS Strix X570-E
Cooling	2x 360 + 280 rads. 3x Gentle Typhoons, 3x Phanteks T30, 2x TT T140 . EK-Quantum Momentum Monoblock.
Memory	4x8GB G.SKILL Trident Z RGB F4-4133C19D-16GTZR 14-16-12-30-44
Video Card(s)	Sapphire Pulse RX 7900XTX + under waterblock.
Storage	Optane 900P[W11] + WD BLACK SN850X 4TB + 750 EVO 500GB + 1TB 980PRO[FEDORA]
Display(s)	Philips PHL BDM3270 + Acer XV242Y
Case	Lian Li O11 Dynamic EVO
Audio Device(s)	Sound Blaster ZxR
Power Supply	Fractal Design Newton R3 1000W
Mouse	Razer Basilisk
Keyboard	Razer BlackWidow V3 - Yellow Switch
Software	FEDORA 39 / Windows 11 insider

Processor	Ryzen 7 5700X
Memory	48 GB
Video Card(s)	RTX 4080
Storage	2x HDD RAID 1, 3x M.2 NVMe
Display(s)	30" 2560x1600 + 19" 1280x1024
Software	Windows 10 64-bit

System Name	TheMailbox 5.0 / The Mailbox 4.5
Processor	RYZEN 1700X / Intel i7 2600k @ 4.2GHz
Motherboard	Fatal1ty X370 Gaming K4 / Gigabyte Z77X-UP5 TH Intel LGA 1155
Cooling	MasterLiquid PRO 280 / Scythe Katana 4
Memory	ADATA RGB 16GB DDR4 2666 16-16-16-39 / G.SKILL Sniper Series 16GB DDR3 1866: 9-9-9-24
Video Card(s)	MSI 1080 "Duke" with 8Gb of RAM. Boost Clock 1847 MHz / ASUS 780ti
Storage	256Gb M4 SSD / 128Gb Agelity 4 SSD , 500Gb WD (7200)
Display(s)	LG 29" Class 21:9 UltraWide® IPS LED Monitor 2560 x 1080 / Dell 27"
Case	Cooler Master MASTERBOX 5t / Cooler Master 922 HAF
Audio Device(s)	Realtek ALC1220 Audio Codec / SupremeFX X-Fi with Bose Companion 2 speakers.
Power Supply	Seasonic FOCUS Plus Series SSR-750PX 750W Platinum / SeaSonic X Series X650 Gold
Mouse	SteelSeries Sensei (RAW) / Logitech G5
Keyboard	Razer BlackWidow / Logitech (Unknown)
Software	Windows 10 Pro (64-bit)
Benchmark Scores	Benching is for bitches.

System Name	Juliette // HTPC
Processor	Intel i7 9700K // AMD Ryzen 5 5600G
Motherboard	ASUS Prime Z390X-A // ASRock B550 ITX-AC
Cooling	Noctua NH-U12 Black // Stock
Memory	Corsair DDR4 3600 32gb //G.SKILL Trident Z Royal Series 16GB (2 x 8GB) 3600
Video Card(s)	ASUS RTX4070 OC// GTX 1650
Storage	Samsung 970 EVO NVMe 1Tb, Intel 665p Series M.2 2280 1TB // Samsung 1Tb SSD
Display(s)	ASUS VP348QGL 34" Quad HD 3440 x 1440 // 55" LG 4K SK8000 Series
Case	Seasonic SYNCRO Q7// Silverstone Granada GD05
Audio Device(s)	Focusrite Scarlett 4i4 // HDMI to Samsung HW-R650 sound bar
Power Supply	Seasonic SYNCRO 750 W // CORSAIR Vengeance 650M
Mouse	Cooler Master MM710 53G
Keyboard	Logitech 920-009300 G512 SE
Software	Windows 10 Pro // Windows 10 Pro

System Name	Bayou Phantom
Processor	Core i7-8700k 4.4Ghz @ 1.18v
Motherboard	ASRock Z390 Phantom Gaming 6
Cooling	All air: 2x140mm Fractal exhaust; 3x 140mm Cougar Intake; Enermax T40F Black CPU cooler
Memory	2x 16GB Mushkin Redline DDR-4 3200
Video Card(s)	EVGA RTX 2080 Ti Xc
Storage	1x 500 MX500 SSD; 2x 6TB WD Black; 1x 4TB WD Black; 1x400GB VelRptr; 1x 4TB WD Blue storage (eSATA)
Display(s)	HP 27q 27" IPS @ 2560 x 1440
Case	Fractal Design Define R4 Black w/Titanium front -windowed
Audio Device(s)	Soundblaster Z
Power Supply	Seasonic X-850
Mouse	Coolermaster Sentinel III (large palm grip!)
Keyboard	Logitech G610 Orion mechanical (Cherry Brown switches)
Software	Windows 10 Pro 64-bit (Start10 & Fences 3.0 installed)

Processor	Intel i7 970 // Intel i7 2600K
Motherboard	Asus Rampage III Formula // Asus P8P67 Deluxe
Cooling	Zalman CNPS9900MaxB // Zalman CNPS11X
Memory	GSkill 2133 12GB // Corsair V 2400 32GB
Video Card(s)	ASUS GTX1080 // MSI GTX1070
Storage	Samsung 870EVO // Samsung 840P
Display(s)	HP w2207h
Case	CoolerMaster Stacker 830se // Lian Li PC-9F
Audio Device(s)	onboard
Power Supply	Seasonic X 850w Gold // EVGA 850w G2
Mouse	Logitech G502SE HERO, G9
Keyboard	Dell
Software	W10 Pro 22H2

System Name	Lynni PS \ Lenowo TwinkPad T480
Processor	AMD Ryzen 7 7700 Raphael \ i7-8550U Kaby Lake-R
Motherboard	ASRock B650M PG Riptide Bios v. 2.02 AMD AGESA 1.1.0.0 \ Lenowo 20L60036MX Bios 1.47
Cooling	Noctua NH-D15 Chromax.Black (Only middle fan) \ Lenowo WN-2
Memory	G.Skill Flare X5 2x16GB DDR5 6000MHZ CL36-36-36-96 AMD EXPO \ Willk Elektronik 2x16GB 2666MHZ CL17
Video Card(s)	Asus GeForce RTX™ 4070 Dual OC GPU: 2325-2355 MEM: 1462\| Nvidia GeForce MX™ 150 2GB GDDR5 Micron
Storage	Gigabyte M30 1TB\|Sabrent Rocket 2TB\| HDD: 10TB\|1TB \ SKHynix 256GB 2242 3x2 \| WD SN700 1TB
Display(s)	LG UltraGear 27GP850-B 1440p@165Hz \| LG 48CX OLED 4K HDR \| AUO 14" 1440p IPS
Case	Asus Prime AP201 White Mesh \| Lenowo T480 chassis
Audio Device(s)	Steelseries Arctis Pro Wireless
Power Supply	Be Quiet! Pure Power 12 M 750W Goldie \| 65W
Mouse	Logitech G305 Lightspeedy Wireless \| Lenowo TouchPad & Logitech G305
Keyboard	Akko 3108 DS Horizon V2 Cream Yellow \| T480 UK Lumi
Software	Win11 Pro 23H2 UK
Benchmark Scores	3DMARK: https://www.3dmark.com/3dm/89434432? GPU-Z: https://www.techpowerup.com/gpuz/details/v3zbr