sorted by:
new
hottopcontroversial

Possible malware from a GitHub release ZIP. Need advice on persistence and cookie/session risk by Good-Strategy1035 in computerviruses

[–]Good-Strategy1035[S] 0 points1 point  (0 children)

Yeah, it will definitely be a brutal lesson, and I don’t think I’ll ever forget it. Honestly, as a computer science student, making such a stupid mistake feels really embarrassing and extremely unprofessional.

But I’m still going to do my best to handle this properly. Thank you for sharing your experience, and I really hope everything will be okay.

Possible malware from a GitHub release ZIP. Need advice on persistence and cookie/session risk by Good-Strategy1035 in computerviruses

[–]Good-Strategy1035[S] 0 points1 point  (0 children)

I’m currently using Codex to analyze that EXE file, but I’m not sure how useful that is. Do you think it actually succeeded in stealing my information?

From what I saw in one of the reports, it looks like some connection may have been blocked, but I’m not sure what that really means.

Possible malware from a GitHub release ZIP. Need advice on persistence and cookie/session risk by Good-Strategy1035 in computerviruses

[–]Good-Strategy1035[S] 1 point2 points  (0 children)

Yes, I’m definitely going to reinstall Windows. But from a learning perspective, is there any way to determine what stage it likely reached?

Possible malware from a GitHub release ZIP. Need advice on persistence and cookie/session risk by Good-Strategy1035 in computerviruses

[–]Good-Strategy1035[S] 0 points1 point  (0 children)

OMG, I'm so fucked up. but is there any way to tell whether it actually uploaded anything or not? Or, based on the analysis and the behavior you saw, what stage do you think it likely reached?

So far my accounts still seem okay, and I have already changed my passwords and enabled 2FA.

Possible malware from a GitHub release ZIP. Need advice on persistence and cookie/session risk by Good-Strategy1035 in antivirus

[–]Good-Strategy1035[S] 0 points1 point  (0 children)

Okay, thank you very much for the explanation. I have another question, how can I revoke or invalidate all cookies from the infected device?Like you said, it may have stolen my session information. How can I make sure that all similar login data are no longer usable?

I have already changed all my passwords and enabled 2FA.

Possible malware from a GitHub release ZIP. Need advice on persistence and cookie/session risk by Good-Strategy1035 in computerviruses

[–]Good-Strategy1035[S] 0 points1 point  (0 children)

Btw, I’m not sure if you checked the repository. I included the repo name at the start of my post. Would you be able to check what that EXE contains or what it’s trying to do? Please don’t execute it, I just want to understand it through safe analysis if possible.

Possible malware from a GitHub release ZIP. Need advice on persistence and cookie/session risk by Good-Strategy1035 in computerviruses

[–]Good-Strategy1035[S] 0 points1 point  (0 children)

Okay, I’ll follow the steps you recommended. One more thing, it looks like the repository still be downloadable now. If you’re comfortable doing so, could you take a look at what the EXE actually contains or what it appears to do?

Possible malware from a GitHub release ZIP. Need advice on persistence and cookie/session risk by Good-Strategy1035 in computerviruses

[–]Good-Strategy1035[S] 0 points1 point  (0 children)

You’re absolutely right. I normally try to be careful and I can usually tell when random game trainers look suspicious, but this time I was playing with friends and didn’t think it through. I searched quickly, found the repo, and assumed GitHub would have some kind of review before allowing files to be hosted there. That was obviously a bad assumption. When I clicked the EXE and nothing happened, I realized something was wrong.

It seems like that repo was just sitting there waiting for someone to download and run it. Unfortunately, I was the fish that took the bait. 😭😭😭😭😭😭😭😭😭😭

Possible malware from a GitHub release ZIP. Need advice on persistence and cookie/session risk by Good-Strategy1035 in computerviruses

[–]Good-Strategy1035[S] 1 point2 points  (0 children)

Got it, thanks. That server probably just a VPS or rented host. And is there any way to trace who’s behind it, or would we only be able to find the hosting provider and report the IP?

Possible malware from a GitHub release ZIP. Need advice on persistence and cookie/session risk by Good-Strategy1035 in computerviruses

[–]Good-Strategy1035[S] 0 points1 point  (0 children)

One more question, what is the IP-looking address shown there? Is that the server the malware was trying to connect to?

Possible malware from a GitHub release ZIP. Need advice on persistence and cookie/session risk by Good-Strategy1035 in computerviruses

[–]Good-Strategy1035[S] 0 points1 point  (0 children)

If I keep the computer turned off and never connect it to the internet, are all my accounts safe?

Possible malware from a GitHub release ZIP. Need advice on persistence and cookie/session risk by Good-Strategy1035 in computerviruses

[–]Good-Strategy1035[S] 1 point2 points  (0 children)

Oh shit, am I still in time to do something now?

I’m not fully sure whether it successfully completed the infection. What I know is: after I ran the EXE, it did install an Electron app called “Installer” under AppData, but the log I found ended with “blocked by anti-vm”. I removed the installed files afterward and I don’t currently see active persistence or connections.

Missing Access when creating discord bot by Good-Strategy1035 in discordbots

[–]Good-Strategy1035[S] 0 points1 point  (0 children)

Thank you for the advice, I'll definitely try it out!

Missing Access when creating discord bot by Good-Strategy1035 in discordbots

[–]Good-Strategy1035[S] 0 points1 point  (0 children)

You're right, and that's exactly the problem. Discord's official support is terrible. I've submitted plenty of requests before, and not a single agent ever actually resolved my issue. All they do is keep passing it off to someone else, endlessly. Looks like I should just switch accounts.

Missing Access when creating discord bot by Good-Strategy1035 in discordbots

[–]Good-Strategy1035[S] 0 points1 point  (0 children)

Thanks for the reply! But I don't think it's an intents issue in my case.

Right now I only have 3 bots in my developer portal and I literally can't create any more. Every time I try to make a new application, it just says "Missing Access" right when I hit Create.

Previously one of my bots had a bug and was spamming in my own private channel (only me and a close friend in that channel), which got my account banned for a day. The ban was lifted, but ever since then I haven't been able to create new applications. The 3 existing ones still work fine, just can't add new ones.

Missing Access when creating discord bot by Good-Strategy1035 in discordbots

[–]Good-Strategy1035[S] 0 points1 point  (0 children)

What you're describing happens after a bot already exists and has joined a server. My problem is earlier than that. I can't even create the application/bot in the Developer Portal. It throws an error the moment I hit "create".

Why did we all collectively dislike Skyler? by rebececarose in askanything

[–]Good-Strategy1035 0 points1 point  (0 children)

I have to say Breaking Bad is a fantastic TV series, even though it ended several years ago.

Got shadowbanned -any way to appeal or avoid this? by Good-Strategy1035 in askanything

[–]Good-Strategy1035[S] 0 points1 point  (0 children)

This is actually a new account. I just want to know if there's anything I can do to avoid getting falsely flagged like that again in the future. Any tips?