Question If the site contains malware, should frontline page be blocked

Please provide comments and solutions that are helpful to the author of this topic.
Status
Not open for further replies.
I'm not even going to mention the risks of accessing these pirate sites, because you know that already
No significant risk if you properly select suitable websites, and being cautious while using.
Peopole here fight daily for food, medications, and essential stuff; I bandwidth is piratable, it would be pirated. Welcome to the third-world
Tuesday Giving GIF by INTO ACTION
 
  • HaHa
Reactions: piquiteco
Yes, it is a Java app (like an archive). Users without the Java platform installed cannot run this malware.
OK, I understand. Do banks still use Java for internet banking when accessed via a browser?
Java is an object oriented programming language and as such, it revolves around classes. In addition the classes, inside the JAR there is metadata and manifest, resources for the app (audio, video, images), third party libraries imported and potentially static content for web apps.
Yes, that's right, and I believe you obtain the rights from Oracle Corporation? I checked in K in the history that this .Jar file is a Trojan horse. BTW, thanks for the information about Java, I was forgetting. (y)
 
  • +Reputation
Reactions: Trident
OK, I understand. Do banks still use Java for internet banking when accessed via a browser?
I am not aware of any banks using Java. Unless we are talking about JavaScript, which is totally different. It is a language that allows adding logics to a website (in an app-like way).
Any loops, if-then-else and so on in a website/web app will be JavaScript.
Yes, that's right, and I believe you obtain the rights from Oracle Corporation? I checked in K in the history that this .Jar file is a Trojan horse. BTW, thanks for the information about Java, I was forgetting.
It is a trojan horse, it is an infostealer. There are many java stealers, in general java malware is more difficult to detect.
Users who don’t need Java should either not install/uninstall or at the very least, can block javaw.exe from accessing the web.

In general, the Java Virtual Machine is a sandbox that somewhat restricts Java Apps. But it’s not impossible to use Runtime.getRuntime().exec() to execute commands and various LOLBins. There is also ProcessBuilder, which is a bit more modern.

They will spawn the LOLBin as child process of Java.
 
It is a trojan horse, it is an infostealer. There are many java stealers, in general java malware is more difficult to detect.
Users who don’t need Java should either not install/uninstall or at the very least, can block javaw.exe from accessing the web.
It's scary just thinking about it. I don't know if they target companies or any domestic users. Infostealer is quite dangerous. 😲
In general, the Java Virtual Machine is a sandbox that somewhat restricts Java Apps. But it’s not impossible to use Runtime.getRuntime().exec() to execute commands and various LOLBins. There is also ProcessBuilder, which is a bit more modern.
Wow, you have so much information, I don't understand why people argue with you. Just following your posts is like taking a class. 💯
They will spawn the LOLBin as child process of Java.
Wow, so your data is exfiltrated to the attacker. :)
 
I've written a detailed analysis on this malware, post is waiting for approval:

 
Peopole here fight daily for food, medications, and essential stuff; I bandwidth is piratable, it would be pirated. Welcome to the third-world
You're a comedian.🤭 You have to laugh. Are you the only one who has expenses for medicines and essential services, and other people don't? Are you the only one who lives in a third world country? Everyone here in MT also has expenses for food, bills to pay, etc., and many other things, and they don't complain about it. Now, you reminded me of the conversation you had with @TairikuOkami in another thread when you complained about your problems. :)
 
  • Hundred Points
Reactions: ForgottenSeer 94738
You're a comedian.🤭 You have to laugh. Are you the only one who has expenses for medicines and essential services, and other people don't? Are you the only one who lives in a third world country? Everyone here in MT also has expenses for food, bills to pay, etc., and many other things, and they don't complain about it. Now, you reminded me of the conversation you had with @TairikuOkami in another thread when you complained about your problems. :)
Very kind of you.
 
  • Like
Reactions: Trident
Patents from, no doubt, the same person who, together with his team, created and developed that antimalware engine that is that poor:
Joe Jaroch Inventions, Patents and Patent Applications - Justia Patents Search
Joseph Jaroch Inventions, Patents and Patent Applications - Justia Patents Search
Yeah, don’t get me wrong, I never said “Webroot is amazing, let’s everyone install Webroot”. The user asked why Webroot has better web blocking than anti malware and the answer is in the real time analysis that was implemented.

For the rest… we all know.
 
1755327737212.png


They probably noticed the '' campaign'' against them and went after other closed private server name. To be honest this happened faster than thought. Probably sama jar file theyre offering, but i have to check it


1755328086386.png
 
View attachment 290217

They probably noticed the '' campaign'' against them and went after other closed private server name. To be honest this happened faster than thought. Probably sama jar file theyre offering, but i have to check it


View attachment 290218
It’s another JAR file here, much newer. It appears to have been compiled 3 days ago. McAfee detects and removes the file.

Upon analysis, file is 99% identical to the other one and the websites are highly similar too.

1755342429151.png
1755342458268.png
 
Last edited:
Coming back to my two posts from last Friday. I fear that I was being over-subtle in the way I expressed myself, and as a result people missed my point. My point being that it doesn't make sense to praise Webroot's webpage blocker for being "so good" while denigrating its antimalware engine for being "that poor".

@Trident do you have any idea why is webroot so good blocking malicious pages, when its antimalware engine is that poor meanwhile?

Because they have several patents on real time analysis and reputation analysis. They’ve been doing it for around 2 years now.

The reason it doesn't make sense is that the person who, working together with his software team, conceived, wrote and patented those webpage-blocking processes, is the very same person who built his entire programming reputation through his single-handed creation of the antimalware engine that Webroot acquired and now uses:

Patents from, no doubt, the same person who, together with his team, created and developed that antimalware engine that is that poor:
Joe Jaroch Inventions, Patents and Patent Applications - Justia Patents Search
Joseph Jaroch Inventions, Patents and Patent Applications - Justia Patents Search


It would, to say the least, be paradoxical that the person who has devised and written those webpage blocking codes, if they really are "so good", built his programming reputation and career on the creation of an antimalware engine that is "so poor".

I hope that clarifies what I was trying to say.
 
Last edited:
Coming back to my two posts from last Friday. I fear that I was being over-subtle in the way I expressed myself, and as a result people missed my point. My point being that it doesn't make sense to praise Webroot's webpage blocker for being "so good" while denigrating its antimalware engine for being "that poor".
Why doesn't it make sense? One component can be good and another bad. As a long time Webroot user surely you should be aware that the antimalware engine was designed to be bad, in the sense that its designed to do poorly at detecting malware initially and rather to detect malware after a computer is infected, by monitoring the system for suspicious behaviour. If it detects malicious behaviour, in theory at least, it can remove the malware and rollback any malicious things it did. This approach is different to the approach other antiviruses take, where they try to block the malware before it infects the system. Although Kaspersky and Bitdefender (and maybe some other antiviruses too) also have the ability to rollback changes made to the system by malware. Anyone can look at test results and judge for themselves how well, or poorly Webroot does at this and form their own opinions about how well it does.
 
Sorry, but you have a very flawed undetstanding of how Webroot works.
Oh yes, the usual statement made by Webroot fanboys when someone criticises it. Even when it's totally objective criticism, like in this case. Note that I did not say anything bad about it. I just explained how it works. It's seems from your posts you have absolutely no clue as to how it works, other than that "it works for you." Anyway, it's why Webroot rarely participates in professional testing and make the ridiculous claim that tests don't matter.

It seems that PC Mag (although hardly the most trustworthy source), also doesn't understand how it works.
Antivirus programs have many ways to identify malicious programs, from simple signature-based detection of known threats to intricate behavior-based detection systems. Webroot Essentials takes advantage of these techniques when appropriate but focuses mainly on behavior patterns. Unknown programs run in probationary status, barred from making permanent changes to the protected PC, while Webroot’s cloud-based brain considers their fate. If a thumbs-down is the verdict, the local Webroot app eliminates the threat and reverses all its actions. This unusual style results in a tiny local app. It doesn’t fit well with some automated lab tests, but it earned top scores in our hands-on tests.

It actually did well in that test. But I guess that means nothing when tests don't matter. If both myself and PC Mag are wrong, I'm happy to be corrected. So I eagerly await your explanation of how Webroot works.
 
  • +Reputation
Reactions: Trident
Status
Not open for further replies.