Possible Malware

[Caring1]

I'm not saying TPU is the cause of an attempted infection I noticed when I booted my system up today, BUT, the only thing I have downloaded over the last two days was Futuremark 3DMark from this site.
Malwarebytes pulled 101 PuP's from Conduit from my system.
That shit is hard to remove once it gets it's hooks in.
Just wanted to mention it as the downloaded Zip was empty anyway even though it took half an hour to download the 2.1Gb.

 

[MrGenius]

Ahh...so it wasn't just on my end(the empty folder part at least). Looks like I'll be running some AVs on a couple of my machines immediately. Hopefully I'm not too screwed.

 

[jboydgolfer]

oh shit. i downloaded that File to see if MrGenius was the only one having trouble...but mine wasnt empty. shit.

Im jot sure it matters ,but do either of you @Caring1 , or @MrGenius remember which server you downliaded from?

I can recall the US server wad @95%load, but i still used it.

I didnt install mine either, just verified it wasnt empty...
Im scanning with mbam now. If i find pup,or anything,ill notify a mod or w1zard

 

[ne6togadno]

oh shit. i downloaded that File to see if MrGenius was the only one having trouble...but mine wasnt empty. shit.

Im jot sure it matters ,but do either of you @Caring1 , or @MrGenius remember which server you downliaded from?

I can recall the US server wad @95%load, but i still used it.

I didnt install mine either, just verified it wasnt empty...
Im scanning with mbam now. If i find pup,or anything,ill notify a mod or w1zard

better contact @W1zzard now cause he might have some advance tools that will do better job with finding virus/malware then free avs we typically use.

 

[MrGenius]

It looks like I tried both US servers on both computers I used. I'm not coming up with any malware so far. But I'm nowhere near done checking.

 

[R-T-B]

Embedding malware in an empty zip is pretty tricky, unless it's an exe designed to look like a zip or something. I'm tempted to call false alarm, but being vigilant is always good. Let us know those scan results.

 

[jboydgolfer]

better contact @W1zzard now cause he might have some advance tools that will do better job with finding virus/malware then free avs we typically use.

i own mbam, it found nothing.
luckily i am on ALL ssd system.

 

[ne6togadno]

i own mbam, it found nothing.

and you scaned file on all mirrors?
also i doubt even premium mbam can do it better then enterprice solutions.
its better to have it double/triple checked then TPU to be pointed as malware source in whole interwebz

 

[R-T-B]

and you scaned file on all mirrors?

I don't think he was dismissing your call to action for W1zzard as much as reporting in.

 

[Caring1]

Im jot sure it matters ,but do either of you @Caring1 , or @MrGenius remember which server you downliaded from?

I can recall the US server wad @95%load, but i still used it.

I downloaded from the first listed US server as it said it was the closest.
The download probably isn't responsible but I just thought I would mention it as it was odd it was empty after downloading.
Not sure how else I would have got that many infections though.

 

[Ferrum Master]

Darn... that's why I use german server lol.

I guess I will need a scan too... just to be sure.

 

[W1zzard]

I reinstalled some of our mirrors in the last few days, so files were unavailable and being in-transfer. I don't think that's the cause for your problems. The files were always on a secondary mirror and then synced from there after reinstall

 

[TheMailMan78]

and you scaned file on all mirrors?
also i doubt even premium mbam can do it better then enterprice solutions.
its better to have it double/triple checked then TPU to be pointed as malware source in whole interwebz

WTF are you talking about enterprise solutions? They all pretty much use the same heuristic as consumer editions. To top it off malwarebytes is a secondary/backup solution to normal protection. All W1zz has is the same things you can DL yourself from any respective AV company.

@caring sounds like you may have been hit with a drive by malicious ad OR you've had the infection for a while and just discovered it after you're install of 3dmark. I would download Kaspersky Rescue Disk and follow the directions. http://support.kaspersky.com/us/viruses/rescuedisk

PM me if you have any questions or concerns.

 

[Jetster]

You don't have to download anything to get malware. It can come from a Hosting Script on a website. Sits there until you reboot

 

[Caring1]

@caring sounds like you may have been hit with a drive by malicious ad OR you've had the infection for a while and just discovered it after you're install of 3dmark. I would download Kaspersky Rescue Disk and follow the directions. http://support.kaspersky.com/us/viruses/rescuedisk

PM me if you have any questions or concerns.

Thanks, it's all good now, I use adblocker so wasn't a driveby and didn't actually get to install 3dmark as the zip folder was empty.
Scans are all clear now.
I'm pretty much a creature of habit and stick to regular sites and don't download from sites I don't trust, so was sure TPU wouldn't be the cause, but that leaves me wondering where it came from.
Conduit is a browser highjacker and a real PITA.

 

[rtwjunkie]

You don't have to download anything to get malware. It can come from a Hosting Script on a website. Sits there until you reboot

This is what aggravates me about the people who piously proclaim you just have to be careful about going to only known safe websites. These drive-bys are found everywhere, not just dodgy websites.

 

[Caring1]

This is what aggravates me about the people who piously proclaim you just have to be careful about going to only known safe websites. These drive-bys are found everywhere, not just dodgy websites.

Thank you, that just reminded me that a news site I read had something like that happen to them not long ago and people were infected by clicking on articles. I had thought they would be more careful, but at least I have an idea how or where I got it from.

 

[TheMailMan78]

Thanks, it's all good now, I use adblocker so wasn't a driveby and didn't actually get to install 3dmark as the zip folder was empty.
Scans are all clear now.
I'm pretty much a creature of habit and stick to regular sites and don't download from sites I don't trust, so was sure TPU wouldn't be the cause, but that leaves me wondering where it came from.
Conduit is a browser highjacker and a real PITA.

FYI adblocker doesn't stop drive bys.

 

[Jetster]

Thank you, that just reminded me that a news site I read had something like that happen to them not long ago and people were infected by clicking on articles. I had thought they would be more careful, but at least I have an idea how or where I got it from.

Keep Java updated at all times. Or turn it off

 

[W1zzard]

Keep Java updated at all times. Or turn it off

Turn the Java browser plugin off, and while you are at it, turn off Flash, too.

 

[rtwjunkie]

Keep Java updated at all times. Or turn it off

Since I went W10 I have been java free and flash has been off! So far I've not found any websites needing it.

 

[jsfitz54]

Since I went W10 I have been java free and flash has been off! So far I've not found any websites needing it.

Q?: Have you tried financial sites like E-TRADE, with W10 without JAVA?

 

[jboydgolfer]

Ive done a FULL scan with multiple AV's, and im clean...just finished running Malwarebytes antiRootKit, just to be safe, all is good. But for Me, the folder Was NOT empty, so my situation MAY be different.
best of Luck to those affected.

 

[Shou Miko]

Turn the Java browser plugin off, and while you are at it, turn off Flash, too.

Who uses any of these two today? srsly?

I don't since yt moved on to HTML5 I haven't had Flash player installed really and java not even banking system for private ppl uses that in my country anymore so it's nice to get rid of it all

 

[rtwjunkie]

Q?: Have you tried financial sites like E-TRADE, with W10 without JAVA?

Only my bank site so far, and it has been fine.