hello world, again

docs/posts/filecr-malware.md

@@ -0,0 +1,48 @@
+---
+title: We Removed FileCR as we Found Malware
+description: Update on FileCR
+date: 2023-08-14
+next: false
+aside: left
+prev: false
+sidebar: false
+footer: true
+---
+
+<Post authors="['nbats']" />
+
+# FileCR Malware
+
+Note: The malware is not exclusive to FileCR and we don't have proof FileCR is
+intentionally hosting it, but they haven't removed it. Possible sources of the
+malware include some uploaders on sanet, but it seems to be coming from multiple
+sources.
+
+Since the malware has been found coming from multiple sources, info about the
+malware itself has moved to [here](https://rentry.co/big_load_malware). Check
+there for technical info or to check if you've been infected.
+
+So far, malware has been found in the following cracks, but it is likely it is
+undiscovered in many more downloads because of how large their catalog is.
+
+- https://filecr.com/windows/kms-matrix/
+- https://filecr.com/windows/windows-activator-by-goddy/
+- https://filecr.com/windows/stardock-start11
+- https://filecr.com/windows/malwarebytes-premium
+- https://filecr.com/windows/navicat-premium (Navicat Premium 16.2.3)
+- https://filecr.com/windows/outbyte-driver-updater
+- https://filecr.com/windows/jetbrains-pycharm (Premium release, you need
+  https://greasyfork.org/en/scripts/403170-bypass-filecrypt to access)
+- https://filecr.com/windows/avast-premier-antivirus
+
+So far FileCR has not responded at all, which is unusual as they are usually
+very active and have removed malware in the past as quickly as 6 hours. Because
+the malware is included in multiple unrelated cracks and because they have not
+responded at all to reports, they are likely to be in some way involved in
+spreading or creating the malware. Also, some of the malware had descriptions
+written just for FileCR, which is unusual, and the description for KMS matrix
+contains lies about the activation given by the software.
+
+## [Samples](https://rentry.co/big_load_malware#samples)
+
+## [Am I infected?](https://rentry.co/big_load_malware#am-i-infected)