r/computerviruses • u/Coldcoat0_0 • May 19 '26
File / URL Check Does this file has virus ? Really Interesting one.
So I was searching for some books to download and then came across a pdf on Google drive . It had a link to a downloader site https://pulse(dot)datastreamforge5(dot)cyou/nirali+prakashan+books+pdf+free+download.zip? . So clicked on it and it downloaded a 7z file. As I wasn't able to unzip it using inbuilt archiver,so installed 7z and extracted it. So usually here I'm bit cautious so I check the files in it without extracting it but I wasn't able to view it.
Then I uploaded the zip to virustotal , but wasn't able to check it as it has 3mb limit for archived files with password. So instead I just went ahead and extracted it , and then automatically got this prompted on my screen.
So apparently windows stopped it from executing but I don't know yet if it has caused any damage.Please let me know if it's safe or not and what should I do?
Edit: So I just extracted the .7z file in my mobile and zipped it again without password (as the unzipped version is around 800mb exe file) so zipped it without password and uploaded it to to virustotal. The virustotal analysis - https://www.virustotal.com/gui/file/7af47fffc2014f6f72981dc9860cb6048ba1bcd09f15ff2786a3bf1a0c87a0d0/summary
Edit 2: Just for everyone to know I didn't ran the exe file explicitly, the popup appeared just after I extracted the .7z using 7-zip.I didn't knew it had exe file in it untill I extracted it and the popup appeared.I mostly use virustotal to scan the downloaded files which are suspicious, and this time too I used it but virustotal don't support password protected archives more than 3mb, thus here I am in this subreddit.
Btw it's clarified by now it's a virus.So thanks for helping me out guys.
Note: The image I have attached resembles to the popup I got I can't remember it exactly but i remember it had don't run button below :)
27
u/Wevvie May 19 '26
Hint: .rar and .zip files with a password makes them unable to be scanned by your browser/Antivirus, since the contents inside are encrypted.
Once you decrypt them with the password and unzip them, be careful. You're hoping your Antivirus can detect it's a Virus by either Static (instant, good news) or Heuristic analysis (takes a few seconds, but some harm might've been done)
So, never trust password-protected .zip files UNLESS there's a really good reason.
2
u/HEYO19191 May 19 '26
Just unzipping them shouldn't run anything, though? You're decompressing the data, not executing it.
6
u/Wevvie May 19 '26 edited May 19 '26
Yes, but your AV scans whatever you're doing and unpacking by default. That's why you can get defender pop-ups by merely looking at a folders' contents.
It doesn't mean it ran. Your AV either scans for known virus signatures or runs it in a sandbox to determine if the file is malicious.
1
u/Coldcoat0_0 May 19 '26
Wondering how did it ran automatically? Btw as far as I could remember the popup came within ~1-2 sec of extracting , I didn't even clicked on exe file. How can we still identify if it's static or heuristic and what harm can it cause?
5
u/Wevvie May 19 '26
Don't worry, It didn't execute, rather, your AV scanned it automatically.
Your Antivirus is running and searching for threats in the background constantly, especially on tasks you're actively engaging with. When you opened a window with the unpacked files, your AV scanned it and flagged it as dangerous.
2
1
6
u/Weak_Incident_3484 May 19 '26
"[nirali prakashan books pdf free download.exe.zip]()
" yeah bro if you trust that its your stupidity
2
u/Coldcoat0_0 May 20 '26
It wasn't exe.zip it was free download.7z with password I just unpacked it and zipped to upload it to virustotal.
12
u/AlexiaTheTechGirl May 19 '26
Any archive with a password is a massive red flag
3
5
u/MegStuff May 19 '26
Not all, an example is files from sites like ryuugames, they're actual visual novels without malware, unless it has a name like "free download files password (...)"
3
u/araidai May 19 '26
Oh I mean yeah, not every password protected archive is a virus, but they already are significantly more sketchy given it’s a tactic to hide from detection
5
u/rifteyy_ Malware Removal Expert May 19 '26
The TLD is cyou (pobably the worst quality domain safety-wise) and the site is a MEGA look-a-like but the URL is datastreamforge[.]cyou.
I think it may be safer for you if you do not look for free books to download anymore. If you can't recognize as obvious malware delivery site as is this, it will be safer if you avoid all sorts of grayware behaviour.
If you did not run it, you are safe. If you did, according to AnyRun it would have stole all your passwords -> https://app.any.run/tasks/8bccaba6-acf3-49b3-8a26-a1d12557617d (the smartscreen popup means it stopped it from executing)
1
u/Coldcoat0_0 May 19 '26
I could have enabled cloudflare dns filtering but it sometimes block useful sites, usually I don't download something sketchy like this from such sites, I searched a lot for those books but didn't found any. Even if I download them I scan them with virustotal.
The thing that I was intrigued with was that how did the file tried to execute it without me opening the .exe file , but yeah that's my fault :(
Could you try it on windows 11 as after extracting using 7zip , the popup came automatically I didn't opened the .exe file.
1
3
u/Coldcoat0_0 May 19 '26
Could anyone provide frst support?
first keyword : opal-loader
second keyword : lush-acorn
3
u/rifteyy_ Malware Removal Expert May 19 '26
Your logs are clear, the malware did not execute according to the smartscreen popup and your logs
3
3
2
u/ExacoCGI May 20 '26
So apparently windows stopped it from executing but I don't know yet if it has caused any damage.
No, the file wasn't executed and you should be safe, unless it has some sort of SmartScreen bypass, but in that case it would've opened up whatever it was.
The only concern would be that you had an idea to even download and try to run it in first place so who knows what you could've caught in the past.
99% of the downloaders and other apps to download and install stuff especially when you're trying to download something simple and small size are malware or best case scenario bundleware that installs extra crap like McAfee and various PC Cleaner garbage.
Make sure you use uBlock Origin or other decent AdBlocker in your browser.
1
1
u/Mundane_Rock8220 May 20 '26
If it is actually an 800 mb exe file.. what? I'm not sure if it's the ebook itself your getting to play inside of the exe, or if that's just a virus. And even then, even most games moved away from only having an exe in it. So, im half sure that's a virus.
1
u/Coldcoat0_0 May 20 '26
Refer the ( Edit 2 ) in the post.
No the .7z file was around 19mb named ( ..... free download.7z) . The virustotal analysis which everyone saw is the one , which I uploaded it after creating a .zip file without a password.
1
1
u/Classic_Aside_2107 May 21 '26
I'm pretty sure a red counterpart of this warning means a virus is here. But I recommend you run this thing through VirusTotal first
1
u/cryptoman May 21 '26 edited May 21 '26
Click more info and a addition run it will show up. Not all apps have virus some apps only do additional things the Microsoft thinks you should not install. You make your own decision not what Microsoft thinks.
Its not virys by the title of the file author of the book does want you you to download it without paying.
1
2
u/yensixteen May 22 '26
good you didn't run it ,but definitely don't run anything with over 3 detections unless you know 100 percent that its safe. 15 is crazy.
29
u/m4573rj May 19 '26
yes, virus 100%. There is 800+MB EXE file in the archive.