Newbie Spellweaver
- Joined
- Jan 10, 2023
- Messages
- 98
- Reaction score
- 73
so why would it attempt to download a file from some shady website? i ran the website if its a safe website and it got flagged immediately, i also didnt have this issue previously with the other server i ran
the powershell command, sends out a request to download some JPG that is not an image, rather some virus that installs a exe called TQ_CLR.exe and tells it to run it, this is not a false positive
ive looked on the internet this link, it seems to be a real malware, someone else ran it through virus total, had similar powershell execution commands to this website.I'm pretty sure that this is a false positve btw, as expected from a private server
can you even read dude? look at the images, im not talking about media fire, im talking about thisShady website? man........ I've been using MediaFire for years (from around ~2009) and everything is fine with this site... Just u need to know when specific file has false positive and when it is an actual virus and in this case is everything normal.
Chill...
alright so i looked through eventviewer, and it seems like someone from Indonesia was attempting to brute force the password into my sql server, im not sure if its any of the guys who uploaded the files here, but he managed to bruteforce it (due to the simple password i put) and managed to execute the powershell, good thing my windows defender caught it, i scanned the files multiple times, and nothing popped up, my firewall was off for the port forwarding, and it could be that someone caught it, either way, im not sure but i would be wary.ive looked on the internet this link, it seems to be a real malware, someone else ran it through virus total, had similar powershell execution commands to this website.
can you even read dude? look at the images, im not talking about media fire, im talking about this![]()
it probably isnt an issue with the files, its most likely some bots that automatically search for these types of sql servers and break in them, i suggest using a much stronger password and a different username, so this doesnt happen, the files are probably legit.
Attachments
Last edited:

