[Hackers]

Don't like reading? Just try it. Upload any program - is it truly CLEAN?



^^ Click to Scan FREE on VirusTotal.com ^^

---

If you need help checking if an encrypted program is infected or clean then this method is for you. If you are a dev, VT is for you too. It's the best runtime scanner with sharable results!

The reason this is important is because you never know what's encrypted inside of a binary. Receive a builder tool? Scan it. Receive a tool? Scan it. Build something you are wanting to share on HF? Scan it.

---

It's important foster a community of cyber defense & safety. If someone says a program is 100% CLEAN, you should scan it.
I am not sure if everyone knows about VirusTotal, so I want to help make sure people know about it. It's the best way to scan a program that could be packaging malware to infect you to see if its clean before you use it. Stay safe.

---

Whether you bought it private, used a public crypt, or made one, this is the best runtime scanner in the game. You won't find another site or platform that is able to give you so many results at once.

https://virustotal.com

They have 70+ AVs for you to test the program against to make sure it is truly clean.

---

With full runtime analysis, you can see exactly what the program is doing, whether it's yours, something you bought, downloaded from the internet, or a program found on HF.

For best results, upload multiple times after changes or after re-compiles, to make sure you are still clean.
re-upload after you change it in any way to test again.

---

The reason I say that devs should do this too is because of a simple math equation:
> You could remake a program faster than you could setup all 70 runtime AVs like VT has

To truly learn more about cybersecurity defense, VT is great. You can't get nearly as much insight into computer security when you use 1 scanner, or static scans. This is why VirusTotal is OP (overpowered) for becoming a better dev and learning more.

---

NOTE: Do not violate HF contracts if you have agreed to specific terms.

[InspectorGadget]

Wouldn't it be better to use a version that doesn't distribute your sample to every AV provider?

Isn't that why most crypting services prefer you to use a scanner that doesn't distribute the sample?

[Hackers]

Wouldn't it be better to use a version that doesn't distribute your sample to every AV provider?

Isn't that why most crypting services prefer you to use a scanner that doesn't distribute the sample?

for best results, it's best to distribute

that way you know if you truly clean, and make sure you test on all

[InspectorGadget]

for best results, it's best to distribute

that way you know if you true FUD or not :)

Fair, I guess so from the perspective of a crypter dev. Maybe less so if you're paying for a 1 off crypt.

I haven't needed anything FUD for years, so just pure curiosity on my part.

[socks4]

uploading a crypt on a scanning website that distributes the sample to every major av? this is a troll post surely.

[grendal]

If you make something FUD, avoid uploading it to virustotal and avoid scanning it locally while having "upload to cloud" option active, because they will take it and run it in multiple sandboxes to detonate it inside and detect if it's malicious, then share the result with vendors which will soon enough flag it as malicious when they update their databases.Your FUD malware will get detected soon after it is scanned by those companies (virustotal and so..) since they perform further research on it.
There are providers called No Distribute Scanners.
They have a lot of AVs installed in their servers which they pass your file to, get scanned and give you the result. The file doesn't go anywhere else

https://websec.net/tools/malware-scanner

[Hackers]

If you make something FUD, avoid uploading it to virustotal and avoid scanning it locally while having "upload to cloud" option active, because they will take it and run it in multiple sandboxes to detonate it inside and detect if it's malicious, then share the result with vendors which will soon enough flag it as malicious when they update their databases.Your FUD malware will get detected soon after it is scanned by those companies (virustotal and so..) since they perform further research on it.
There are providers called No Distribute Scanners.
They have a lot of AVs installed in their servers which they pass your file to, get scanned and give you the result. The file doesn't go anywhere else

https://websec.net/tools/malware-scanner

Sir, we're talking about the best way to verify that something is clean or not

Websec is just a kleenscan API. It looks like Websec is yet another scantime scanner.

VirusTotal is the best way to check if a program is clean in runtime.

The sharable results are great, I love how they have so many AVs so you can run through each one, in 1 upload. So quick

If anyone is unhappy about a program they received, or are unsure if it's clean, they should upload to Virustotal.com and check it.

---

uploading a crypt on a scanning website that distributes the sample to every major av? this is a troll post surely.

Not a troll, this is a guide on how to check for packaged malware, encrypted programs, and see if a program is clean before you use it.

virustotal.com is the best way to truly check what a program is doing, if it's clean or not.

[possessed-client]

uploading a crypt on a scanning website that distributes the sample to every major av? this is a troll post surely.

nodes is very insistent on his whitehat spiel cover story, so not exactly a troll.

Sir, we're talking about the best way to verify that something is clean or not

Websec is just a kleenscan API. It looks like Websec is yet another scantime scanner.

VirusTotal is the best way to check if a program is clean in runtime.

The sharable results are great, I love how they have so many AVs so you can run through each one, in 1 upload. So quick

If anyone is unhappy about a program they received, or are unsure if it's clean, they should upload to Virustotal.com and check it.

---

Not a troll, this is a guide on how to check for packaged malware, encrypted programs, and see if a program is clean before you use it.

virustotal.com is the best way to truly check what a program is doing, if it's clean or not.

Is the main 70+ engine scan runtime too, always thought it's only scantime. The in-depth sandbox analysis output is good on VT (don't know if some other site might be even deeper with a single sandbox like any.run etc.). Kleenscan still has a pretty good runtime scan, too, with many AV/EDR.

[DramaKing]

Fair, I guess so from the perspective of a crypter dev. Maybe less so if you're paying for a 1 off crypt.

I haven't needed anything FUD for years, so just pure curiosity on my part.

I think that nodes doesn't have crypters in mind. If you download something suspicious, you wouldn't want the file to remain undetected if it's infected.

[Hackers]

I think that nodes doesn't have crypters in mind. If you download something suspicious, you wouldn't want the file to remain undetected if it's infected.

Correct, the best way to check if someone's claim that a program is 100% clean and 0% infected is to send their program right to VirusTotal and verify that.
Of course, if a contract says you cannot, you should not. In all other cases, I think it's a great idea, and it helps keep the world safe.
I hope people click my signature or this thread and scan all their programs

However... Crypters benefit from VT too. I think people should definitely upload their crypts.
When I was making crypts for research & learning, I used VT all the time and consistently got back to 0-4/70+ with re-compiles because of my memory method. I think VT was instrumental in helping me learn how the software worked and being a better dev.

---

nodes is very insistent on his whitehat spiel cover story, so not exactly a troll.

Not a cover story, I'm 100% whitehat with golden handcuffs
I'm not commiting crimes over here, if the feds come i'm not doing time for fucking anyone here because I am not a criminal.
I've always been clear about this, idk why people think I am a blackhat

I like learning, chatting, and trying new things in development, that's all. Nothing I've ever done on this site has been for illegal gains. I don't sell anything close to greyhat, I don't use my own tools for nefarious reasons, etc.

I wish people knew I'm 100% serious when I say I am a whitehat. I don't touch shit. I've turned down thousands of dollars on this site in offers from people who want me to go against my ethics. I will not do it.

[socks4]

shouldn't this be posted in the whitehat section?

since you're discussing it as a topic for scanning for malware in tools or stuff you may come across, not as a service to check crypt results which this subforum would be for

f you are a dev, VT is for you too. It's the best runtime scanner with sharable results!

is what threw me off

[Hackers]

shouldn't this be posted in the whitehat section?

since you're discussing it as a topic for scanning for malware in tools or stuff you may come across, not as a service to check crypt results which this subforum would be for

is what threw me off

Not sure, I think this is the right section for checking if encrypted payloads are embedded in your program for what VT detects.

I don't care if people don't like VT, I hope new users check it out and upload everything to it for testing, staying safe, and verifying that what they received is what was advertised.

It can be used for testing crypt results for sure.

It's weird that so many crypters use scantime scanners like non-runtime scans and then say they have a 100% clean program.
how would we know?

VT is the best way to specifically test if your crypt is clean or not :D

Also this isn't a crypter-only section. This is a section about encryption, decryption, and cryptography.
VT is great at detecting encrypted payloads.

FUD or un-FUD, VT is the best for finding out what you are working with.

[Just4kickz]

It's an excellent way of testing your injection methods, I managed to get detection down from 43 to 3.

[possessed-client]

Btw, according to Gemini 3.0 Pro, the Detection tab with the many engines does scantime (plus whatever emulation each engine has, but it's not a full VM with file execution like Kleenscan runtime scan has), while the Behaviour tab sandboxes do execute the file. So for targeting a specific EDR, VT is not a replacement for an actual VM.

[Hackers]

Btw, according to Gemini 3.0 Pro, the Detection tab with the many engines does scantime (plus whatever emulation each engine has, but it's not a full VM with file execution like Kleenscan runtime scan has), while the Behaviour tab sandboxes do execute the file. So for targeting a specific EDR, VT is not a replacement for an actual VM.

Gemini is wrong. VirusTotal does have a ton of scantime scans, but they also have virtual sandboxed envs for full runtime analysis in the Behavior tab.
I've also found that VT's scantime scans are more reliable across the board than other platforms.

I get what you are saying with a dedicated VM vs sandbox, and runtime vs scantime, but I do not think that Kleenscan is as good as VT for detecting, and if people want to check if a program is clean, VT is a clear winner.

---

If anyone is interested in running their own custom scanner, I built AVScan. It's a web platform, fully hosted & ready to go. It has ClamAV but with custom scripts to fetch new signatures, YARA rules, and custom configurations to increase detections. It uses a credits system (10 credits per new scan) so you can invite users and give them a limited number of scans. It's 100% scantime, static, no security risks with runtime.

https://hackforums.net/showthread.php?tid=6314357