Miao Posted December 15, 2016 ID:1080688 Share Posted December 15, 2016 (edited) Hello,I'm the owner of desu.sh, a file sharing website, i have noticed on VirusTotal report (https:// virustotal. com/pt/url/a36e2e9dfb762323a7871cc6e679131e23a7ad268b1bf2282859c2d0aa6368c2/analysis/1481817025/) that a. desu .sh has been detected as a malware website.I would like to know what files were detected as malicious so i can remove them and for any further malware detected at desu.sh to be sent to admin @ desu .sh or abuse @ desu .shThank you,Miao~Desu.sh Owner Edited December 15, 2016 by Zynthesist remove links Link to post Share on other sites More sharing options...
Staff Zynthesist Posted December 15, 2016 Staff ID:1080698 Share Posted December 15, 2016 Hello, I will have a look and update the thread when I have the details. Also, could you please not post live links. Link to post Share on other sites More sharing options...
Staff Zynthesist Posted December 15, 2016 Staff ID:1080704 Share Posted December 15, 2016 Can you please have a look at this: hxxps:/ /a . desu . sh/amhwlg.scr Link to post Share on other sites More sharing options...
Miao Posted December 15, 2016 Author ID:1080797 Share Posted December 15, 2016 The file doesnt seem to be accesible so it has probably already been removed by the virus scanner. Link to post Share on other sites More sharing options...
Miao Posted December 17, 2016 Author ID:1081366 Share Posted December 17, 2016 On 15/12/2016 at 4:33 PM, Zynthesist said: Can you please have a look at this: hxxps:/ /a . desu . sh/amhwlg.scr Any updates? Link to post Share on other sites More sharing options...
Miao Posted December 21, 2016 Author ID:1082772 Share Posted December 21, 2016 On 15/12/2016 at 4:33 PM, Zynthesist said: Can you please have a look at this: hxxps:/ /a . desu . sh/amhwlg.scr Would really apreciate a reply ASAP Link to post Share on other sites More sharing options...
Staff Zynthesist Posted December 21, 2016 Staff ID:1082808 Share Posted December 21, 2016 The block will remain in place and a block is being placed on files[.]desu[.]sh for the following: hxxp://files[.]desu[.]sh/hsdetu.rar We will re-evaluate the block once we see there is no more malicious content associated with the domain or sub-domains. Link to post Share on other sites More sharing options...
Miao Posted December 22, 2016 Author ID:1083001 Share Posted December 22, 2016 17 hours ago, Zynthesist said: The block will remain in place and a block is being placed on files[.]desu[.]sh for the following: hxxp://files[.]desu[.]sh/hsdetu.rar We will re-evaluate the block once we see there is no more malicious content associated with the domain or sub-domains. I would appreciate all the files to be sent at once, files.desu.sh should be deleted already but it might take a few hours because of cache for the file to be removed from a.desu.sh Link to post Share on other sites More sharing options...
Miao Posted December 23, 2016 Author ID:1083211 Share Posted December 23, 2016 On 21/12/2016 at 11:29 PM, Zynthesist said: The block will remain in place and a block is being placed on files[.]desu[.]sh for the following: hxxp://files[.]desu[.]sh/hsdetu.rar We will re-evaluate the block once we see there is no more malicious content associated with the domain or sub-domains. I have a malware log detected by the virus scanner at https://transparency.desu.sh/2016/12/ Link to post Share on other sites More sharing options...
Miao Posted December 30, 2016 Author ID:1085079 Share Posted December 30, 2016 On 21/12/2016 at 11:29 PM, Zynthesist said: The block will remain in place and a block is being placed on files[.]desu[.]sh for the following: hxxp://files[.]desu[.]sh/hsdetu.rar We will re-evaluate the block once we see there is no more malicious content associated with the domain or sub-domains. Would apreciate faster replies. Link to post Share on other sites More sharing options...
Staff Zynthesist Posted January 3, 2017 Staff ID:1086288 Share Posted January 3, 2017 Like I previously stated, we will be re-evaluating the block over time. Recently on 29 Dec 2016 there was another malicious file (Trojan) on: a[.]desu[.]sh/kkrdev.zip MD5: dd1639c71aac4d17a7c6d775e58f0cb0 Link to post Share on other sites More sharing options...
Miao Posted January 3, 2017 Author ID:1086367 Share Posted January 3, 2017 4 hours ago, Zynthesist said: Like I previously stated, we will be re-evaluating the block over time. Recently on 29 Dec 2016 there was another malicious file (Trojan) on: a[.]desu[.]sh/kkrdev.zip MD5: dd1639c71aac4d17a7c6d775e58f0cb0 Which has already been removed before i even checked by our automated virus scanner. Link to post Share on other sites More sharing options...
Recommended Posts