40
How to validate a large torrented file is clean? (lemmy.dbzer0.com)
submitted 1 year ago by to c/piracy@lemmy.dbzer0.com
27 comments fedilink hide all child comments
 

How do you validate that what you torrented is clean/no malware/spyware? Specifically, I torrented two things:

  • Astute Graphics Plug-ins Elite Bundle 3.9.1.7z from teamos. *It is 678MB so I can't upload to Virustotal
  • Master Collection 2025 from uztracker (which is listed on monkrus's website's list of trackers). It is 37.5GB so I can't upload to Virustotal.

I'm not sure what I should to do to be honest.

Edit: Would splitting the 37.5GB file into 650MB pieces and then scanning with virustotal help? Not sure if downloaded files need to be whole for it to work properly.

This is the results from virustotal (I could only scan 4 files in the master collection without running the iso)

Thank you.

you are viewing a single comment's thread
view the rest of the comments
[–] [S] 2 points 1 year ago (4 children)

Hey thank you for the info. Which VM do you use? How do you disable the various types of sharing with the host? Also, how do you validate? Sorry for all the questions, but that seems like it may be my only option

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 4 child comments
    •
  • [+] 3 points 1 year ago* (4 children)
    [deleted]
  • permalink
  • fedilink
  • source
  • parent
  • hideshow 4 child comments
    •
  • [–] 5 points 1 year ago (1 child)

    Note that sophisticated malware [attempts to] identify whether it is running in a VM / testbed / analysis scenario and may behave and look different between that runtime scenario and "normal use".

    Analysis in a VM may not be sufficient to determine whether it is safe outside of it.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] [S] 1 point 1 year ago (1 child)

    Thank you for the detailed response. Just to confirm, is Hyper-V your sandbox VM? I used ESET to scan the files I torrented, but they look very suspicious from virustotal, but I don't really know how to parse the info - knowing if it is a false positive/etc.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
    • load more comments (-1 replies)
    • load more comments (-1 replies)