@SmokeDetector tpu I’m going tpu for the excessive rant, but not going to R/A flag it as there is a bit of real answer there, but it needs an edit to get it into shape
@tripleee That pattern looks like it's already caught by Potentially bad keyword in body and Potentially bad keyword in answer Append -force to the command word(s) if you really want to add the pattern you provided.
@SmokeDetector I edited to disable the malware link but I fortunately don't have a Windows system to explore whether the instruction in fact makes any sense at all. Would not disabling Windows Update entirely be a problem? Could this be a prank post?
@SmokeDetector The first sentence is a violation of the CoC, so just straight R/A is OK here. Yes, there's an answer which is recoverable, but a significant portion of the post directly attacks defames a group of people.
they seem to register new domains aggressively; all the recent ones have a single post, and they all have different Cloudflare name servers (having the same Cloudflare name server pair has otherwise been a good way to find connected domains with little else in common)
and the older ones also seem to be capped to three posts per domain maximum
@SmokeDetector f but flagging for mod attention for the user name
I went through and tagged #voip all the recent ones, the dominant theme in these is domain names like "hot reviews", "good social content", "best free blogs and articles" metasmoke.erwaysoftware.com/domains/tags/197
(it would be nice to be able to sort the tag by recent posts)
[ SmokeDetector | MS ] Blacklisted website in body, potentially bad ip for hostname in body, potentially bad ns for domain in body, potentially bad keyword in body (101): Frontend & UI/UX design by Jason Roy on ux.SE
(it indirectly is; it's apparently sorted by the domain's ID in metasmoke, so fresh ones are at the end of the list, but you can't see whether some of the older ones have also been used recently)
[ SmokeDetector | MS ] Potentially bad asn for hostname in answer, potentially bad ip for hostname in answer, potentially bad ns for domain in answer (3): Questionable blog "content" by abbyves1 on meta.SE (@Ollie)
@tripleee I think it is legit. VBA (incorrectly called VBE here ) is often used by some malware on Windows, and run keys are a way to get a program to launch automatically. They may have gotten malware that added a Run key to autorun Chrome and go to a malware site.
Also, it hiding itself under something called Windows Updates Files isn't absurd, especially considering I couldn't find that autorun key nor that folder in my (non-infected) Windows system, indicating that it isn't a proper folder created by the real Windows Update. IMO, it is a legit user that happened to not know to not include the malware link.
There are a few small errors though (Ctrl + R should be Win + R, for one), but other than that, it seems legit as far as I can tell. Ideally they would have mentioned Sysinternals Autoruns (a Microsoft program to detect programs that autorun), butI don't think there was bad intent. Of course, I could be totally wrong, but that is my instinct here
I don't think that actually disables Windows Update, I think it is a program pretending to be that. All that said, I'm not a Windows expert (although I do have a bunch of experiance with it), so I could be wrong, but I don't think I am
@cocomac thanks for investigating, my question was really whether there should be more guardrails against disabling the legitimate Windows Update functionality but I guess not
@tripleee Sorry, I misunderstood. By as far as I can tel, it doesn’t disable any updates, the folder is made to look like it is for updates but is just for the malware
### ErrorReturnCode_128 on teward/Osiris at 2022-08-18T06:48:51Z:
RAN: /usr/bin/git push origin master
STDOUT:
STDERR: ssh: Could not resolve hostname github.com: Temporary failure in name resolution fatal: Could not read from remote repository.
Please make sure you have the correct access rights and the repository exists.
File "/home/smokey/SmokeDetector/gitmanager.py", line 187, in add_to_blacklist git.push(origin_or_auth, "master") File "/home/smokey/.local/lib/python3.8/site-packages/sh.py", line 1566, in __call__
Plagiarized from accepted answer (incompetently) with spam link added (previously spammed during the last couple of days across Stack Exchange); please flag accordingly. — tripleee11 secs ago
@tripleee A normalized version, {{'02839505060'}}, of that pattern is already on the number watchlist. You can use !!/bisect-number 028.39505060 to determine which entries on the number lists match that pattern, which would tell you: Matched by 028 39505060 on line 3105 of watched_numbers.txt: 02839505060 found normalized
[ SmokeDetector | MS ] Bad keyword in body, bad pattern in url body, blacklisted website in body, pattern-matching product name in body, pattern-matching website in body, +4 more (473): SonoVive Reviews - Customer Reviews by Sonovive on stackoverflow.com
@tripleee That pattern looks like it's already caught by Potentially bad keyword in answer and Potentially bad keyword in body Append -force to the command word(s) if you really want to add the pattern you provided.
