Not sure who needs to know this, but if you download and install the Windows version of Rufus, the free software for writing ISO images to USB/CD-ROM, your PC will end up with about 100 trojans.

[csolisr@hub.azkware.net]

There's a good reason why I go with Ventoy nowadays. Besides of the "just drop the ISO and the USB will multiboot it" convenience

[kiwiapple87@mstdn.social]

@briankrebs @ajn142 @sindarina

I downloaded Rufus about a week and a half ago and I didn't notice anything suspicious, but do you know how I would check to see if I was compromised?

Thanks

[briankrebs@infosec.exchange]

@kiwiapple87 @ajn142 @sindarina You would likely notice on a recent model Windows PC b/c Windows Defender would go apeshit after you click yes to their prompt for installing more software.

[umby995@mastodon.social]

@snornik @snep @jordinki @briankrebs yeah that's my bad. i am confused because the text report from anyrun doesn't show any registry activity at all, but the more info section for the process in the full report does show 1347 registry events, which definitely seems suspicious.

[kiwiapple87@mstdn.social]

@briankrebs @ajn142 @sindarina

I don't recall any additional prompts. But I could be misremembering, and was hoping there is a process, file, or something that I can go look for that would tell me if I was compromised or not.

[snornik@techhub.social]

@RedOct @briankrebs lol etcher... well yes you could use a electron app and waste ram and resources or just dd it (even in wingw), if the iso is properly created

[bot4sale@fairdinkum.one]

@briankrebs Plot twist: Windoze IS the virus!

[vnangia@mastodon.social]

@briankrebs New Alanis lyrics just dropped.

[briankrebs@infosec.exchange]

@umby995 @snornik @snep @jordinki lol you said 1,347 registry events. queue the famous laughing Spanard

[swade2569@masto.swader.social]

@InvertedLina @briankrebs

Had to chime in since I used Rufus just last night myself. I did download the 4.15.2396 version from the rufus.ie site. I launched it once to build my bootable usb and closed it, but used the wrong image. I launched it a second time and didn't have anything odd happen. It is signed by Akeo Consulting with a signing time of 30 JUN 2026. I kept the file in case someone wants some details from it.

[snornik@techhub.social]

@briankrebs while i get that point.... without linux alot are not used to console/tui tools and need a gui. i dont think its funny cause as a nerd your probably overwrite the whole windows partition anyway, pretty soon. as a newcomer you want to try out linux on a 2nd device and then this is not as funny anymore.

[briankrebs@infosec.exchange]

@snornik 100 percent agree. I'm still fuming that we're at Windos 11 hundred and there is no obvious way to write an ISO to an external image. I credit that to Microsoft understanding this capability is a strong existential threat.

[snornik@techhub.social]

@briankrebs YES! Sadly true!

[glitterbean@wehavecookies.social]

@briankrebs dude you're still on that? lolz

[stevenally@mastodon.social]

@snornik @RedOct @briankrebs Ok. If not etcher, what?

[snornik@techhub.social]

@stevenally @RedOct @briankrebs

dd (easy if you already have a linux), if not, wsl or mingw

params are: if=inputPath of=outputPath status=progress (the last only needed if you want to see how long its gonna take)

"if" is the path to the iso
and "of" should be the device path not the partition mount point
and unmount all partitions before

Edit:
but yeah as a newcomer to linux just use etcher, just for the first time, if your stuck on win probably easier than learning the difference between mount point and device paths.
one time does not make a big difference that's more of a pro tip i guess. if you need to write more than one iso to a drive, or do it often.

[briankrebs@infosec.exchange]

I've been made aware of a post from someone representing Rufus who says I'm very confused about this post. I've reported that Windows Defender went bananas after I installed Rufus on a Windows 11 device. It immediately popped up warnings about hacktools and trojans being installed while it was installing. I wish I had a record of it but I nuked everything after the alerts.

https://github.com/pbatard/rufus/issues/3064

[xabean@infosec.exchange]

@briankrebs There are some rather ... possessive communities around USB boot image builders, I forget if it was rufus or ventoy or what, but long story short: if you badmouth the product, the sealions. Dear god, the sealions.

[wdormann@infosec.exchange]

@xabean @briankrebs
I remember reporting a vulnerability to the Rufus developer, and he was quite rude and condescending in response.

[paul_ipv6@infosec.exchange]

@briankrebs

windoze malware: "quick. we gotta infect this machine while we have the chance. once it's running linux, we're out of another home..."