Welcome to the official Lemmy.world Support community! Post your issues or questions about Lemmy.world here.
This community is for issues related to the Lemmy World instance only. For Lemmy software requests or bug reports, please go to the Lemmy github page.
This community is subject to the rules defined here for lemmy.world.
To open a support ticket
You can also DM https://lemmy.world/u/lwreport or email [email protected] (PGP Supported) if you need to reach our directly to the admin team.
I've gotten this message from Malwarebytes quite a lot these few days. Is this just a false positive?
Keep getting false positives on AVG from lemmy.world communities pages for derp.foo
When people name their web assets the same as known viruses, hacks, and malware, because they think it's just the funniest thingever, this shit is going to continue to happen.
Your antivirus is working perfectly, and doing exactly what is should be doing.
Yeah I figured it was something like that.. It's better to be safe than to be sorry in my book either way!
yep always
Itβs catching the hit on the IP
https://www.virustotal.com/gui/ip-address/80.78.22.88/community
The hit is 4 months old though and likely shutdown by the provider at the time.
Nice, good find.
VirusTotal doesn't show any infections for that url.
I've seen a few false positives with BitDefender for random Lemmy instances too. It might be the heuristics being triggered by the random URL names, but it's also possible there were random exploits like the XSS vulnerability that were caught by some antivirus apps. Considering Lemmy is still a juicy target for bad actors, some precaution is probably warranted.
In general I'd look closely at the specific detection to make sure it's not flagging a suspicious JS file, etc.
Because the site is behind a login, you would have to upload the JS files individually to virustotal. However, there are no trojans that can affect you from visiting a website. Browsers have sanboxing to prevent that. What web threats usually do is steal keystrokes, serve ads, phish banking sites etc. To get infected by a trojan you would have to download a file and execute it.
Actually drive by JS attacks and JavaScript engine exploits happen occasionally and have known to bypass browser sandboxes. In these cases the infection is completely invisible to the user and requires no downloads or execution of files.
Yeah you're right. But browser zero days are usually targeted attacks not casting a large net like the usual web threat. Thanks for the link, it was interesting to learn some more techniques that are used in developing those. In this case the threat detected was Go based ransomware.
The Trojan mention is worrying, though. Does it provide any more details about what it's flagging?
