1

Suppose you get an error on your PC that shows up randomly, then you do a search on the internet for the error to find out how to fix it. Typically, you will get some sites that offer a solution, but some of those sites seem a bit sketchy, especially when they say to download this registry script or an executable tool to fix the problem. My question is: do these "fix-it" sites sometimes include malware with their supposed fix? If so, how should we properly resolve errors on our computers without exposing ourselves to such malware?

Example

Here is an example added for clarity... Let's say I keep getting a blue screen of death in Windows 10. I search on the internet for "blue screen of death Windows 10". The first site I come across is:

...windowsclub.com/blue-screen-death-windows-10

Note: I truncated to prevent people from clicking the link just in case it is malicious, and so I am not blasting a particular site.

Is it safe to "Click here to fix Windows errors..." in the website? I do not believe it is a Microsoft website.

Note: As a security professional, common security sense tells me something could be up here, and don't "click here". This may not be apparent to most users, or even some computer repair technicians though, and may or may not be a real threat.

Instead of "clicking here" what should I do so I don't expose myself to this possible threat, while still fixing the error?

closed as unclear what you're asking by Iszi, Matthew, Neil Smithline, Rory Alsop Feb 4 '16 at 17:27

Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 3
    Not sure if this makes for a quality question. You are basically answering your own question in the second paragraph. It's good advice, but maybe your advice would be better off in an answer? You can answer your own questions if you'd like. – Mark Buffalo Feb 4 '16 at 15:34
  • Do they "sometimes" contain malware? Yes? But I'm not sure what conclusions you can make from that. I'm not sure if this question is answerable. – schroeder Feb 4 '16 at 15:50
  • I want to thank you all for your answers, I wish I could "accept them all". I think each that I have seen so far brings in very good points to consider. Mark Buffalo provides great advice and considers the point of misdirection. Darkstar's answer, (which I finally chose to accept) is concise and to the point, and makes a good recommendation. RobM points out that there are reputable sites and not so reputable sites. Tikiman points out the importance of downloading reputable tools from the source, and verifying the hash. – Jonathan Feb 4 '16 at 17:30
  • 1
    The answer is "yes", but your question doesn't really ask anything actionable. Try rephrasing it to ask a bit more, like "how can I tell the difference?" or "how do I stop my family members from clicking on these links?" – John Deters Feb 4 '16 at 18:36
5

In my experience, though it is uncommon to find malware embedded in these fix it scripts and registry keys, it does happen.

As such, I would highly recommend most users getting these types of patches and assistance from the vendor directly.

An experienced security professional could download the fix it script or registry key, open it and view it first, before applying it, to determine its safety. But even then issues can be missed.

  • Thank you for your answer! With this in mind, I would recommend general computer users and computer repair professionals to first consult the vendor's website (e.g. if it is a Windows error, go to Microsoft's website), and be very wary of what other sites provide due to the threat of malware. The users should not download a "fix", tool or "registry hack", unless provided by the vendor. – Jonathan Feb 4 '16 at 17:10
3

Do technical advice sites often link to malware?

This seems very broad. How can we easily check the majority of these websites and find which advice is malicious, and which isn't? And then there's all the advertisements on the website.

They can if they want. Contributors can if they want to. A far better method of deceiving you is making you believe that a specific error or process is not malicious when it really is.

However, I think many of these websites aren't in the business of deceiving their users. They would lose huge ad-revenue streams. If they exist to provide an entry point to people's computers, then that's definitely possible, and something bad actors would do. However, I suspect this would be found out very quickly.


Malware might not be the point. It's purpose may be for misdirection.

Here's what some of those sites do: you google and type in, "is processname.exe safe?". Their website comes up in the search results, so you visit it.

The website reports the file as safe. If you were to dig deeper, you may find that the process is not safe at all, or that it gives you a false sense of security because you don't realize something could have easily hijacked that process.

Furthermore, you may wish to get a second opinion. Fortunately, at least a couple websites report the file as "safe," right? Digging deeper, you may even find out that many of these websites are owned by a single entity.


How can you minimize your risk while following technical advice?

Typically, you will get some sites that offer a solution, but some of those sites seem a bit sketchy, especially when they say to download this registry script or an executable tool to fix the problem.

It's important to understand what these registry fixes do. You can open .reg files in Notepad, or some kind of text editor, and see what it's doing. Is it disabling necessary security features? It's probably bad. You should try searching for what that particular registry change does.

When they attach a program to the forum post, do not download it. In fact, do not click any download links. It's far better to google the name of the product they're suggesting, and then downloading it through their official website, like you suggested. Many shysters want you to think you've finally solved your malware problem, but will secretly introduce more through these methods.

You should download all suggested files through their official website, if they exist. Otherwise, treat them with utmost suspicion.

3

I wouldn't expect a reputable security advice site to intentionally link to live malware or contain live malware.

There are plenty of sites out there that are less than reputable who will be visible in your search results if you do a search for "Halp, I'm infected with ABC" or "Is NotAVirusHonest.exe safe?". I'd be very careful about trusting both the quality of the advice and the quality of the site security on these kinds of site.

2

A simple short answer is that yes that does happen. A better answer is that before you download anything suspect you should really be verifying the source first. Lets say you have found a fixit tool for registry errors, lets call this tool "CCLeaner." Now, before I would consider downloading CCleaner from any source I would first google CCleaner to verify it is produced by a trusted source. Second I would look for an official download location for it over an unofficial source because those are more likely to package a legitimate tool with hidden malware. Last, regardless of the download source, always look for an official hash of the download file and verify that what you got matches. There are a lot of tools for hash verifying, but if you haven't done so before I recommend 7zip.

Not the answer you're looking for? Browse other questions tagged or ask your own question.