29 replies to this topic

[MageUK]

In this topic you can post links to topics that you believe may be dangerous, for them to be checked.

Please do NOT post direct links to the downloads in the topic, as this could be misconstrued as you posting the link yourself, and action could be taken against your account.

Topics can be seen by myself even after they are removed, so don't worry about a Mod getting to them before I do.

Also, please note that the usual forum rules against spamming and the like still apply, if you spam this topic with useless links, then you will be treated as if you were spamming any other forum.

Finally, please only post suspicious links, nothing that is obviously not going to be infected.  If the file is a AVI/WMV/MPG etc, they are most likely not infected with anything, so don't just report every topic in the Graveyard for example.

[Bobbington]

http://forum.tip.it/...ic.php?t=700889



New user linking to calculators..... seems dodgy!

[Errdoth]

bobbington2 said:

http://forum.tip.it/...ic.php?t=700889



New user linking to calculators..... seems dodgy!

I would second that. I would hope people would have enough common sense to see that it wouldn't work because they don't have php installed on their system, or that the TO says "No exe's here", and you open the zip folder to find that that it is an exe >_>

[MageUK]

Checked and posting now, keylogger for sure.

[Errdoth]

Pure_MageUK said:

Checked and posting now, keylogger for sure.

Are you like running these on an old machine with a process-watch or something? I'm curious to see how you find the reg values and stuff.

[MageUK]

Errdoth said:

Pure_MageUK said:

Checked and posting now, keylogger for sure.

Are you like running these on an old machine with a process-watch or something? I'm curious to see how you find the reg values and stuff.

I'd prefer not to disclose exact details of how as this could allow it to be circumvented but it involves a virtual machine and some useful tools, and just a FYI, most of these loggers don't drop any registry values in.

[Errdoth]

Pure_MageUK said:

Errdoth said:

Pure_MageUK said:

Checked and posting now, keylogger for sure.

Are you like running these on an old machine with a process-watch or something? I'm curious to see how you find the reg values and stuff.

I'd prefer not to disclose exact details of how as this could allow it to be circumvented but it involves a virtual machine and some useful tools, and just a FYI, most of these loggers don't drop any registry values in.

Trade secret, eh  

[mchainmail]

http://forum.tip.it/...ic.php?t=703195

[yaff2]

This guy is going around saying "you got owned in this video" then links to this: please check it!



xxxx

[Mamong]

yaff2 said:

This guy is going around saying "you got owned in this video" then links to this: please check it!



xxxx

Yes, I received this myself earlier today. Since I am retired from RS and my Tip.It password is different to RS, I download the "Shockwave Player" that I needed.



Well, good old Kaspersky picked it up straight away and had no problems deleting it.







So, stay clear and don't download anything from this link.

[MageUK]

Mamong said:

yaff2 said:

This guy is going around saying "you got owned in this video" then links to this: please check it!



xxx

Yes, I received this myself earlier today. Since I am retired from RS and my Tip.It password is different to RS, I download the "Shockwave Player" that I needed.



Well, good old Kaspersky picked it up straight away and had no problems deleting it.







So, stay clear and don't download anything from this link.

Definitely a keylogger, and a clever way to get users to download it.  But also one of the most stupidly easy to remove.  Edited your posts to remove the link, in future guys, please post links to the topics or PM me them if they're sent via PM to you. Don't want people/staff thinking you're the one spreading it.



http://forum.tip.it/...5338534#5338534

[mugged99]

me too..

a person named

assassin1357

send me a pm saying "you got owned in this vid" and then types some url...

it says [censoredurl] though so i cant follow the link,

[Bac_Talan]

Confirmed as a keylogger already. That's why the link is censored.

[PuppyKing]

The down load on this page?

http://www.runefx.co... ... tools.html

[Wizz]

http://forum.tip.it/...10789&start=340

accidently scrolled clicked it >.>.

im not logging in until i get a response  



its the comment dwarfpope made

[PuppyKing]

wizzkid785 said:

http://forum.tip.it/...10789&start=340

accidently scrolled clicked it >.>.

im not logging in until i get a response  



its the comment dwarfpope made

Yea, it will be awile, I clicked the link and watched the video, and nothing has blown up, but better safe than sorry.

[MageUK]

wizzkid785 said:

http://forum.tip.it/...10789&start=340

accidently scrolled clicked it >.>.

im not logging in until i get a response  



its the comment dwarfpope made

Not a keylogger, just a streaming video.

[SubtleKilling]

http://forum.tip.it/...ic.php?t=714550

[Bac_Talan]

http://forum.tip.it/...4592&highlight=

http://forum.tip.it/...4593&highlight=



Both the same, picked up as a Trojan by almost every A/V program.

[PuppyKing]

My old "friend" told me his aim name, and then on aim, he sent me this link. I know its fake, but did I get a key logger from it?

http://www.quittingrs.co.nr/