Cybersecurity basics
I originally made this because I was dissatisfied how careless even IT people near me are. I will discuss common misconceptions and other things you can do to be smarter and more careful. Each section will cover a common misconception about common IT security measures. Mind that I have somewhat 10+ years experience in penetration testing and malware analysis so take my word what its worth, altough it may not be the best.
I won't click sites I don't know because I will get a virus
This is the most common thing I see and it is mostly valid BUT only for people who use very old OS-es. We don't live in the era of peak goggle com typosquatter and the YouAreAnIdiot website because to some extent in the old era of the internet this was a possibility but now it is different. Generally speaking if you use up to date OS-es you won't get any malware. There are 3 exceptions to this. The first is if you have an outdated OS, a known exploit may be present which allows a malicious site to download files to your PC. The lesson of this is keep your shit up to date. The second exception is a very real problem but will unlikely to hit you. It is possible for some attacker to set up a website that abuses a 0-day exploit to download malware. 0-day exploits generally speaking are exploits which are not yet discovered by the majority of the cybersec scene but they are also extremely rare and they can be sold for $100ks or even millions depending on severity. It is highly unlikely that a person who has a 0-day will "waste" it on normal users like you so if you are not a diplomat or a high ranking official you should be fine. (Note that there were mass abuse of 0-days which also hit normal people but you really can't do anything against that). The third risk is when you visit a site is really your actions. Visiting a site by default won't give you much malware but it really depends what you do on that site. For example, the site may display malicious download links disguised as geniune and you download and run files from said links. Or the site "mimics" a bank login form and it tries to fool you to give up your credentials to an attacker. It is extremely important to be on guard but when a friend sends a link to his indie website that is most likely secure.
I ran a suspected malware, there is nothing I can do.
That is also a large misconception. Depending on what you ran you must identify and isolate the threat. If you suspect you ran an infostealer, turn on 2FA as quick as you can. This applies for discord account stealer. You can also upload the file to virustotal to check if it really was a malware (I will talk about this in lengths later). Run your antivirus scan and initiate a full-scan (altough it will do little if it did not protect you in the first place). Next thing, you can look and find the payload of the malware if it was that kind. Look for .exe, .jar, .dll, .bat, .vbs, .ps1, .cmd files in your %temp% folder. Check regedit for strange entries (I suggest searching this up at youtube as this is a very large topic by itself but all you need to know, that if you press Win+R, then type: "regedit" you can open the registry. There, you can search for HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run , HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run and HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce , suspicious entries here can also be deleted). You can use netstat to check for abnormal connections by opening a cmd window and typing "netstat -ano". This might also give a clue. Check for unlikely addresses. Check your %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup and (Global startup) %ProgramData%\Microsoft\Windows\Start Menu\Programs\Startup folders and look for hidden files. If you got a keylogger, the chance is high that you may find it here. If you suspect the address of a malicious server which the malware may communicate to, you can block it by configuring the C:\Windows\System32\drivers\etc\hosts file (a tutorial on this is also needed but if you want to block something, add a line like this in a new line: "0.0.0.0 something.malicioussitename.com"). You can also check the process explorer or task manager for suspicious processes. Remember, fully resetting your PC is (almost, sometimes rootkits require special care, but those are rare) always a solution to get rid of malware BUT we want to avoid that. That is the barbarian way. After you are somewhat sure you got rid of malware you may set new passwords whenever you can. I say "somewhat sure" because even these methods don't guarantee 100% detection but they provide enough. Detecting malware is hard, if possible, seek a professional if you suspect infection.
A 0/70 virustotal scan means the file is safe.
No! This is not at all true. New malware sometimes because of the obfuscation will not be detected by virustotal up to months or even years if the file is not frequently encountered. The 0/70 number will not tell you anthing or at least, don't thank that as a confirmation. Instead, I tell you what to look for. First of all, look for comments and user reviews. If that is generally positive, then the chances for malware are lower. Look at the interesting strings. Now, this by itself is a rabbit hole, but look for strange contacted sites, strange artifacts in case of .jar files like "/a/a/a/a/a" or obfuscated strings. Also look for https and http connections. Try to understand the anysis and keep in minds that sandbox runs mostly do little for .jars and .dll-s. For example, minecraft mods get flagged by obfuscation and sandbox evasion because by default they need the minecraft jar too.
An X/70 virustotal scan means the file is DEFINETLY malicious.
No! This is the inverse of the previous misconception. An X/70 means as little by itself as a 0/70 detection, altough you should definetly be suspicious. If some no-name virus scanners flag it those may be false flags. But sometimes game mods also get flagget as "riskware" because it uses DLL injections or some other stupid shit.
An no-name scanner FLAGGED IT AS 10/10 means the file is DEFINETLY malicious.
Okay, that CAN mean something but first, test it against virustotal. If virustotal also states it is malicious, then it really is but in general, don't trust these "specialized scanners" because they don't have that rigor. And besides that, those are probably unreliable. Detecting malware correctly is hard. Leave this to enterprise software.
Virustotal can classify all things 100% correctly.
Not true, see my 3 previous arguments. You can decompile the jar/exe and check for malicious strings. You can make a heuristic script like this for example for Minecraft mods:
import os
import re
# Comprehensive pattern dictionary for static inspection of decompiled code
PATTERNS = {
#Obfuscation & Dynamic Code Execution
"Base64 Decoding": re.compile(
r"(Base64\.getDecoder|Base64\.getMimeDecoder|parseBase64Binary)",
re.IGNORECASE,
),
"Cryptographic Operations": re.compile(
r"(Cipher\.getInstance|SecretKeySpec|MessageDigest\.getInstance)",
re.IGNORECASE,
),
"Process Execution / Shelling": re.compile(
r"(Runtime\.getRuntime\(\)\.exec|ProcessBuilder|cmd\.exe|powershell|bash|sh\b)",
re.IGNORECASE,
),
"Dynamic Class Loading & Reflection": re.compile(
r"(Class\.forName|getDeclaredMethod|getMethod|invoke\b|MethodHandles|ClassLoader\.defineClass)",
re.IGNORECASE,
),
#Network & Exfiltration Endpoints
"Discord Webhook Exfiltration": re.compile(
r"(discord\.com/api/webhooks|discordapp\.com/api/webhooks)",
re.IGNORECASE,
),
"Network / Socket Connection": re.compile(
r"(new\s+Socket\(|HttpURLConnection|HttpClient|URL\.openConnection)",
re.IGNORECASE,
),
"File Download / Stream Transfer": re.compile(
r"(Channels\.newChannel|FileUtils\.copyURLToFile|InputStream\.transferTo)",
re.IGNORECASE,
),
#Minecraft Token & Profile Harvesting
"Minecraft Launcher Artifacts": re.compile(
r"(launcher_profiles\.json|usercache\.json|launcher_accounts\.json|profile\.json)",
re.IGNORECASE,
),
"Minecraft Session / Auth Access": re.compile(
r"(getSession\(\)\.getToken|getAccessToken|field_71449_j|func_148254_d)",
re.IGNORECASE,
),
#Browser & Discord Token Stealing Indicators
"Discord LocalStorage / Tokens": re.compile(
r"(discord.*Local Storage|leveldb|[\w-]{24}\.[\w-]{6}\.[\w-]{27}|mfa\.[\w-]{84})",
re.IGNORECASE,
),
"Browser Credential Harvesting": re.compile(
r"(Login Data|Local State|Cookies|Web Data|CryptUnprotectData)",
re.IGNORECASE,
),
#Environment & Directory Enumeration
"Sensitive OS Path Querying": re.compile(
r"(APPDATA|LOCALAPPDATA|user\.home|System\.getenv|System\.getProperty)",
re.IGNORECASE,
),
}
def scan_directory(target_dir):
print(f"Scanning directory: {target_dir}\n" + "=" * 60)
matches_found = 0
for root, _, files in os.walk(target_dir):
for file in files:
# Check decompiled text sources or class metadata
if file.endswith((".java", ".txt", ".class")):
file_path = os.path.join(root, file)
try:
with open(
file_path, "r", encoding="utf-8", errors="ignore"
) as f:
lines = f.readlines()
for line_num, line in enumerate(lines, 1):
for label, pattern in PATTERNS.items():
match = pattern.search(line)
if match:
rel_path = os.path.relpath(
file_path, target_dir
)
print(
f"[{label}] -> {rel_path}:{line_num}"
)
print(f" Line: {line.strip()}\n")
matches_found += 1
except Exception as e:
print(f"Could not read {file_path}: {e}")
print("=" * 60)
print(f"Scan complete. Total findings: {matches_found}")
if __name__ == "__main__":
import sys
if len(sys.argv) > 1:
scan_directory(sys.argv[1])
else:
path = input("Enter path to decompiled directory: ").strip('"')
if os.path.exists(path):
scan_directory(path)
else:
print("Invalid path provided.")
While this can help you debug and give you the interesting parts, if you are not a professional do not rely on yourself because you may not correctly identify the function of those snippets. This is more like an example for tech-savvier people. The key takeaway: if you suspect something malicious SEEK A PROFESSIONAL. If you don't understand what are you doing, you should as a professional. With this in mind, I hope you found something useful here still. This is not an exhaustive list, this is just the most common misconceptions I hear.