Reply to thread

Message

<blockquote data-quote="Wrecker4923" data-source="post: 1082694" data-attributes="member: 110877">Adding to what the bot says, a file that has been around for a while is even likelier to be safe.&nbsp; In the VT&#039;s details tab, you can see the line, first submission or first seen in the wild date.&nbsp; I am not sure how long you should wait for the &quot;strike period&quot; to have passed, but maybe the supply-chain attack on 3CX might give some numbers ( <a href="https://www.virustotal.com/gui/file/aa124a4b4df12b34e74ee7f6c683b2ebec4ce9a8edcf9be345823b4fdcf5d868/details" target="_blank">VirusTotal</a> ) : exe signed: 2023-03-03, AV reportedly started flagging ( <a href="https://www.reversinglabs.com/blog/3cx-supply-chain-attack-targeted" target="_blank">The 3CX attack was targeted — but the plan was broader</a> ) and file submitted to VT:&nbsp; 2023-03-22 (which were taken by many as false positive), and then definitively reported and widely flagged as compromised: 2023-03-29.I personally think it feels safer if VT gives a total clear.&nbsp; It&#039;s usually the ones that have flags that never go away that are tough.&nbsp; 3CX&#039;s flag was believed to be false positive because it had always been flagged one way or another.&nbsp; Legitimate Tor is commonly tagged as suspicious.&nbsp; Some recommended OS software, like Picocrypt, can&#039;t seem to get rid of the flags.&nbsp; I think it is this kind that easier to fall into.</blockquote>

[QUOTE="Wrecker4923, post: 1082694, member: 110877"] Adding to what the bot says, a file that has been around for a while is even likelier to be safe. In the VT's details tab, you can see the line, first submission [I]or [/I]first seen in the wild date. I am not sure how long you should wait for the "strike period" to have passed, but maybe the supply-chain attack on 3CX might give some numbers ( [URL="https://www.virustotal.com/gui/file/aa124a4b4df12b34e74ee7f6c683b2ebec4ce9a8edcf9be345823b4fdcf5d868/details"]VirusTotal[/URL] ) : exe signed: 2023-03-03, AV reportedly started flagging ( [URL="https://www.reversinglabs.com/blog/3cx-supply-chain-attack-targeted"]The 3CX attack was targeted — but the plan was broader[/URL] ) and file submitted to VT: 2023-03-22 (which were taken by many as false positive), and then definitively reported and widely flagged as compromised: 2023-03-29. I personally think it feels safer if VT gives a total clear. It's usually the ones that have flags that never go away that are tough. 3CX's flag was believed to be false positive because it had always been flagged one way or another. Legitimate Tor is commonly tagged as suspicious. Some recommended OS software, like Picocrypt, can't seem to get rid of the flags. I think it is this kind that easier to fall into. [/QUOTE]

Verification