why does the new version 8.1.3.0 exe. show like this?

[Clams]

The ping is resolving to the correct IP (now)
Also - the download link is delivering the correct download now.

@Ivan
"Please don't play with the download files, they are really dangerous!"

I'm the guy that RAN the bad download.
PLEASE Keep me posted as to what this "really dangerous" stuff is??
-W

 

[Ch3vr0n]

@Ivan
- yes
- yes, shenzhen ...
- dno the exact bytesize (where to see) but the HDD size is 13782kb or 13.45MB

 

[Clams]

Looks like DNS cache poisoning. Any of the folks consistently getting infected downloads using a common DNS server? 'nslookup' will indicate which server is providing resolution.

Default Server: rns02.charter.com
Address: 71.10.216.2

 

[clonedone]

FYI, First time posting but I'm having the same malware issues that others are having. Ping resolves to 93.170.13.21 for me as well. I use Chrome and went to the download originally straight from the desktop popup notification I received that a new version was available.

 

[Ch3vr0n]

@Clams your connection is hijacked then or it was. That's definitely NOT a redfox server. Charter.com seems to redirect in turn to spectrum.com an ISP for DTV, internet & phone

I'd recommend running malwarebytes to begin with

@clonedone i like that username lol

 

[Ivan]

@Ivan
- yes
- yes, shenzhen ...
- dno the exact bytesize (where to see) but the HDD size is 13782kb or 13.45MB

Thanks. byte size can be checked with file properties.

I already contacted the abuse department of the hoster where the fake RedFox website is hosted and asked them to take down the server. This was 40 Min ago. No reply yet.

 

[Clams]

What can I download for free to Scan my drive(s) for any installed malware?
(while I'm waiting for more info on the bad download)
-W

 

[RedFox 1]

https://redfox.bz/download/SetupAnyDVD.exe This is a clean link 13.4 mbs I ran it through Malwarebytes and Eset and Hitman Pro.

 

[d00zah]

Default Server: rns02.charter.com
Address: 71.10.216.2

If I hadn't run 'NanoBench' to get a list of the fastest (good), alternate DNS servers in my region, I imagine I'd be using the same ISP server(s)... but fortunately, I'm not. All lookups for me have been clean since these reports start flowing.

What can I download for free to Scan my drive(s) for any installed malware?
(while I'm waiting for more info on the bad download)
-W

The report link posted earlier include all tools that detect the infection...

https://www.virustotal.com/de/file/...9666bc0a8983bd5216f4e24059e389d382d/analysis/

Looks like TrendMicro detects it & has some free tools:

https://www.trendmicro.com/en_us/business/capabilities/solutions-for/ransomware/free-tools.html

 

[Clams]

https://redfox.bz/download/SetupAnyDVD.exe This is a clean link 13.4 mbs I ran it through Malwarebytes and Eset and Hitman Pro.

I don't think "your" links may have ever been "bad" - looks like some DNS lookup redirecting hacks might have been the issue.
We'll see. -W

 

[RedFox 1]

I don't think "your" links may have ever been "bad" - looks like some DNS lookup redirecting hacks might have been the issue.
We'll see. -W

You are correct Clams, the link I posted is clean. If you see the file in a Yellow and red container its bad.

 

[blank]

Spybot - Search & Destroy Portable
https://portableapps.com/apps/security/spybot_portable

ClamWin Portable
https://portableapps.com/apps/security/clamwin_portable

HijackThis Portable
https://portableapps.com/apps/security/hijackthis-portable

Build in Windows Defender

All other AVs need to reboot after setup (as far as I know)

----------------------------------------------
https://portableapps.com/apps/security

 

[Ch3vr0n]

@Ivan they may have acted on it though. the malicious server does not respond to a ping request. Timeout

Though for anyone worried the link in my post here https://forum.redfox.bz/threads/why...0-exe-show-like-this.72757/page-2#post-466927 contains 8130 and has been confirmed clean by users. It's located on my personal G-drive and will be for a couple days more

 

[Clams]

@Clams

I'd recommend running malwarebytes to begin with

OK, Installed Malwarebytes and did the best scan 0 threats found.

But then I manually scanned the bad AnyDVD.EXE file itself - and it didn't see that as a threat.
So something is off here.
-W

 

[Ch3vr0n]

then try spybot as blank suggested. At least the host of that malicious file got taken down

 

[Clams]

You are correct Clams, the link I posted is clean. If you see the file in a Yellow and red container its bad.

Yes, I ran the bad one over an hour ago... (sigh)
-W

 

[RedFox 1]

Yes, I ran the bad one over an hour ago... (sigh)
-W

I have Malwarebytes and Hitman Pro and Super-Antispyware + Eset Smart Security, all show clean on the 13.4 mb file. Malwarebytes picks up the bad file immediately if you have the Premium version.

 

[Ch3vr0n]

"IF you have the premium version"

They should be picking it up period, not just the premium version

 

[DrXenos]

Clams, I would check what processes and services are running on your machine. Also check what are set to autostart at boot or in the task scheduler. Microsoft has some awesome free tools for this. Check out autoruns and process explorer.

 

[Clams]

I have Malwarebytes and Hitman Pro and Super-Antispyware + Eset Smart Security, all show clean on the 13.4 mb file. Malwarebytes picks up the bad file immediately if you have the Premium version.

Malware bytes starts off with a free trial of premium anyway.
We all get that the 13.4mb file is clean - it always was clean.
It's not my problem - not even on my radar - LOL
It's the 13.9mb file from the bogus site that I ***ran*** - what's the "really bad stuff" in that file per Ivan??
Spybot portable does not include "extended virus check" in free version.
I ran it anyway.
-W