Shop Mobile More Submit  Join Login
×




Details

Submitted on
May 2, 2011
File Size
1.2 MB
Link
Thumb
Embed

Stats

Views
10,500
Favourites
22 (who?)
Comments
111
Downloads
181
×
WARNING - INFECTED SKINS by karmat111 WARNING - INFECTED SKINS by karmat111
I'm posting a warning again because I noticed that people are still downloading the infected skins that are being uploaded to the main Rainmeter Gallery. And while dA is removing the reported ones, some of them have been in the rainmeter gallery for 2+ weeks. The 16 skins in the screenshot above are still in the gallery and ALL HAVE MALWARE!

The Rainmeter community is actively monitoring this situation and are testing every skin and reporting them to dA. We are trying to work with dA in resolving this situation, but it is difficult since it's not our website. And ultimately, it's not in our power to implement the changes we would like to see happen. We are also keeping a blog [link] updated with information on every infected skin as they are uploaded.

What to watch out for:
- they are fairly new to dA, just a couple of new skins
- their profile page is pretty bare, nothing personal
- comments are usually disabled or hidden
- we will place warnings on their profile page if it's not disabled
- they rip a skin/preview/description then upload it with malware or keyloggers
- downloads are zipped and have an .exe file which is the virus
- don't download files like Build.exe, Run.exe, Installer.exe, name.rmskin.exe

How to test each download for a virus:
- Right-click 'Download File' link, choose 'Copy Link Location'
- Go to VirusTotal at [link] and choose the Submit a Url tab
- Paste the link location in the 'Search Bar' and press 'Submit Url'
- Click on 'View downloaded file analysis'
- The results are 0 to 40 and viruses are listed in red on the right
- This service is free, but no guarantee that it catches all malware

On April 28, dA changed their Deviation Report to include Malware and Warez reports. It will hopefully speed up the removal of infected skins. They are also looking into including a virus-checker for submissions.

If you follow the tips above, scan the deviation before downloading it and scan your system regularly with antivirus and malware programs, you should be able to enjoy the legitimate rainmeter skins that are in the gallery.

Keep safe,
Karen

And remember, all those skins shown above have been stolen from the original skinners, uploaded here with malware using the skinner's code, preview and description. If there's a skin above that you would like, go to our blog [link] where I've included links to the stolen skin, original skinner and virus report.
Add a Comment:
 
:iconhacker-8:
Hacker-8 Featured By Owner Jul 12, 2013
hmmmmm, interesting.
Reply
:iconradtasticninjachick:
RadtasticNinjaChick Featured By Owner Jun 27, 2012
You, madam, are a gentlewoman. *salutes* Thank you very much!
Reply
:iconkarmat111:
karmat111 Featured By Owner Jun 28, 2012
:) thanks
Reply
:iconmaximathevaporeon:
maximathevaporeon Featured By Owner Jan 13, 2012  Student Traditional Artist
THANAX
Reply
:iconlablayers:
LabLayers Featured By Owner Nov 29, 2011  Student Interface Designer
This is a nice guide.
Reply
:iconkarmat111:
karmat111 Featured By Owner Nov 29, 2011
Thanks, it's not up-to-date anymore though. Check out my post that shows all the skins (some have been removed/some are still in the rainmeter gallery) [link]
Reply
:iconwhittlingdesigns:
WhittlingDesigns Featured By Owner Jul 2, 2011
Please help with this. When you DL a RM skin and it is a .rmskn file or whatever, it effectively installs on your PC. However there is no way to uninstall it. How do I go about removing/uninstalling these infected RM skins/suites? I currently have the Blue Vision HD Final. Thanks
Reply
:iconkarmat111:
karmat111 Featured By Owner Jul 2, 2011
To uninstall a skin, you just have to delete the folder from wherever it's filed. I'm on Windows7/64bit and my Rainmeter Skin Folder is filed in My Documents.

I'm no pro at getting rid of viruses, but I try to keep definitions updated and use Avast Free Antivirus and Malwarebytes and SuperAntiSpyware and do full scans with them. It's gotten rid of anything I've picked up, which isn't much as I've been very careful since this crap started happening here.

Once you've gotten rid of it, if you really liked that skin, you can get the original (without malware) at [link]
Reply
:iconwhittlingdesigns:
WhittlingDesigns Featured By Owner Jul 3, 2011
Alright, that's what I have done. The RainInstaller got me thinking I had to do more. Thanks for the help.
Reply
:iconkarmat111:
karmat111 Featured By Owner Jul 3, 2011
No problem, glad to know that you didn't have any serious problems!

If you want to know of any infected skins that are in the main Rainmeter gallery, read the blog that I keep updated [link]
Reply
:iconwhittlingdesigns:
WhittlingDesigns Featured By Owner Jul 3, 2011
Will do. Are there infected themes that are featured here on dA Rainmeter or are those filtered before they are accepted?
Reply
:iconkarmat111:
karmat111 Featured By Owner Jul 4, 2011
We test every skin before accepting into our gallery. I can't say it's 100% safe, but it's the safest you'll find anywhere. We can tell which ones are false positives.
Reply
:iconwhittlingdesigns:
WhittlingDesigns Featured By Owner Jul 4, 2011
Perfect. That's what I was hoping to hear. I know Vark by ~theumad is false positive. The dock creator, recycler and some other stuff in there make my AV go crazy.
Reply
:iconkarmat111:
karmat111 Featured By Owner Jul 4, 2011
Really, not for me, and I use Avast and Vark.
Reply
(1 Reply)
:icondoctorv23:
DoctorV23 Featured By Owner May 18, 2011
-sorry to say this, but dA is apparently not concerned with this mayhem, or their reputation. I also have been reporting these bad submissions in the hope that it would help. I've only received 2 replies so far out of numerous reports, each saying "This deviation has been voluntarily deleted by the artist prior to your report being reviewed by our staff so your report has been automatically closed"...which would tend to imply that these malicious users were not banned...
anyway, thank you again Karen for your ongoing efforts and nerves of steel.
Reply
:iconkarmat111:
karmat111 Featured By Owner May 18, 2011
I know, I am so thoroughly disappointed in dA's lack of action on this. But we're not giving up.

Though I really wish people would clue in and stop downloading deviations that have comments turned off! It makes no sense - skinners want feedback on their work, so it stands to reason that if comments are turned off - something's wrong!
Reply
:iconhantuchova:
Hantuchova Featured By Owner May 17, 2011
these people knowingly spread viruses..i think there should be criminal charges for this kind of stuff.Afterall they signed up,gave their e-mail adresses just to spread virus and cause damage to other people.Everyday some douchebag comes and uploads a skin which is stolen and packed with keyloggers and trojans and deviantart just gladly continues to share it..I've seen some people favourited the infected skins also.It's easy to tell if it's a virus but if you're a newbie without antivirus then it's a sad day for you because you might think a site like deviantart won't share viruses but it does..what a shame
Reply
:iconkarmat111:
karmat111 Featured By Owner May 18, 2011
dA definitely dropped the ball on this, but we'll keep reminding them!
Reply
:iconhantuchova:
Hantuchova Featured By Owner May 15, 2011
we have a new virus provider.~devartuser99
[link]
Reply
:iconkarmat111:
karmat111 Featured By Owner May 15, 2011
Thanks, we've reported both his uploads and updated the blog listing.
Reply
:iconburnsplayguitar:
burnsplayguitar Featured By Owner May 7, 2011  Hobbyist Interface Designer
Great, tnks
Reply
:iconkingreddark:
KingRedDark Featured By Owner May 7, 2011  Student Digital Artist
:O holy shit, i think i downloaded some of that stuff
Reply
:iconkarmat111:
karmat111 Featured By Owner May 7, 2011
scan with a good malware, be safe!
Reply
:iconkingreddark:
KingRedDark Featured By Owner May 8, 2011  Student Digital Artist
lucky i have a good Anti-virus software, so no wonder why some skins were remove when i download them lol
Reply
:iconazeez4u:
azeez4u Featured By Owner May 7, 2011  Hobbyist Interface Designer
damn! i have also downloaded some of this shit...
Reply
:iconkarmat111:
karmat111 Featured By Owner May 7, 2011
thankfully, you didn't! read the tips above and be forewarned.
Reply
:iconampangel:
ampangel Featured By Owner May 6, 2011  Hobbyist Interface Designer
Epic fail on their part. :(
Makes me sad we can't even download something from dA without some for of malware present in it.
Reply
:iconkarmat111:
karmat111 Featured By Owner May 7, 2011
I know, I used to think it was safe, luckily nothing ever happened to my computer.
Reply
:iconmustberesult:
MustBeResult Featured By Owner May 4, 2011   Interface Designer
That's what we're talking about! ;)
Helpful announce.
Reply
:iconkarmat111:
karmat111 Featured By Owner May 4, 2011
:)
Reply
:iconoycyll5355:
oycyll5355 Featured By Owner May 3, 2011
Thanks..^^
Reply
:iconsgtevmckay:
sgtevmckay Featured By Owner May 3, 2011
I think I love you :blowkiss:

Everyone should send Llamas, kisses and donations to Karen here.

"Hard Work" does not even begin to describe what she has done.
Nor does it do any justice to all the folks that are fighting back behind the scenes and the great efforts by those that are volunteering 100's of hours to keep all Rainmeter users and potential users informed.
Reply
:iconkarmat111:
karmat111 Featured By Owner May 3, 2011
Oh, Sarge, you make me :blush:
Reply
:icondoctorv23:
DoctorV23 Featured By Owner May 3, 2011
A limitation of Virustotal is a 20MB filesize... I see that the latest offense: [link] exploits this point as well.
Reply
:iconkarmat111:
karmat111 Featured By Owner May 3, 2011
Considering that the original Omnimo skins are 34.3mb, probably not. But at least with the new reporting process, we don't have to provide the proof anymore.
Reply
:iconamgdesign:
AMGDesign Featured By Owner May 3, 2011
Oh my God...Friday the 29th i have installed one of the Skins in Rainmeter :(
After some Hour i can't open my FREENET MAIL Accounts...Password is incorrect :( :(

In the same night i have formatted my C:\ HardDisk und made a complete new Installation without any Backups.
I have AVAST Antivir on my PC but no Warnings?!?

I have send a Mail to Freenet for change my Passwords, hope it is all OK. That was my Mail Acc for Paypal and Ebay :(

What can i do now? Is it all over or comes Problems again?
Sorry for my english.

AND BIG THANKS for reporting the Virus Alert.
Reply
:iconkarmat111:
karmat111 Featured By Owner May 3, 2011
Sorry to hear that you downloaded one of the bad ones, I hope that you get up and running again without too much trouble. Did you change your passwords with paypal and ebay? Which skin was it?

All I can say is read my tips above in the description and get some really good software. I use Avast and Malwarebytes, and I also do scans with Superantispyware and Glary Utilities and a few others.
Reply
:iconamgdesign:
AMGDesign Featured By Owner May 3, 2011
Hi and thanks for fast answer. The skin i used was Tabbar/skin and in there was a run or install.exe My Antivir does nothing... :(
I hope Freenet can change my Password and i becomes no Problems again.
Reply
:iconkarmat111:
karmat111 Featured By Owner May 3, 2011
along with using Avast, try Malwarebytes [link] and SuperAntispyware [link] they're all free
Reply
:iconamgdesign:
AMGDesign Featured By Owner May 4, 2011
Thank you, i'm going to install the other Tools :)

E-Bay is save by change the Password, PayPal says i must send a Mail with a Copy from my "Personalausweis"... Now i must change the Passwords from all the Forums i was a Member.
"Alles wird gut!"
Reply
:iconkarmat111:
karmat111 Featured By Owner May 4, 2011
Good luck!
Reply
:icon999r:
999R Featured By Owner May 3, 2011
Make sure to change your Paypal and Ebay passwords as well! Very important.
Reply
:iconpjdark:
pjdark Featured By Owner May 3, 2011
Good job on keeping people informed Karen. Keep up the great work! :)
Reply
:iconkarmat111:
karmat111 Featured By Owner May 3, 2011
Thanks PJ :)
Reply
:iconsierradesign:
SierraDesign Featured By Owner May 3, 2011   Interface Designer
At the end of the day, I never download from someone who creates an amazing deviation, that looks familiar, who doesn't even have an avatar. I mean, that's one of the first things people do.
Reply
:iconkarmat111:
karmat111 Featured By Owner May 3, 2011
I agree, it should be!
Reply
:iconsierradesign:
SierraDesign Featured By Owner May 3, 2011   Interface Designer
Great to see somethings being done. :)
Reply
:iconjazzilady:
jazzilady Featured By Owner May 3, 2011  Hobbyist Digital Artist
Thanks for the heads up! Very nice of you! :hug:
Reply
:iconkarmat111:
karmat111 Featured By Owner May 3, 2011
Thanks Jazz!
Reply
:iconpaulrokicki:
PaulRokicki Featured By Owner May 3, 2011
seeing something like this really makes me chuckle. I honestly think that anyone getting infected from these deserves it. with all the free and i might add excellent antivirus programs available there should not be anymore surprises. I mean come on, its not the early 90 when viruses started to be popular. its common sense to have an antivirus software installed and running on any pc now. maybe the creators of the rainmeter group should stress on the group page for everyone to install antivirus software before attempting to download anything from them and any other sites. I just looked on there and i don't see any links to antivirus software which is kind of surprising. wouldn't that make sense? i will message the group admin about doing that. although im not part of the group i feel that someone should do something to help the situation. putting up virus reports and the infected skins doesn't help if no one visits the group page. But don't get me wrong. Its good that you care enough to notify at least some people out there but i think the problem should be addressed in a better way at the source or at least dA source for rainmeter.
Reply
Add a Comment: