2 ms·

Found these two forks which are still accessible (and are supposedly up to date with the upstream repo (linked in the comment above) which is not accessible any

Found these two forks which are still accessible (and are supposedly up to date with the upstream repo (linked in the comment above) which is not accessible anymore): https://github.com/bb33bb/getsymbol https://github.com/bb33bb/getsymbol https://github.com/clayne/win-getsymbol https://github.com/clayne/win-getsymbol here is the same link as in the comment above from one of the forks: https://github.com/bb33bb/getsymbol/blob/main/GetSymbol/CMainDlg.cpp https://github.com/bb33bb/getsymbol/blob/main/GetSymbol/CMai... the code fetches from `UPDATE_CHECK_URL`, which is hardcoded as: https://dbgsymbol.com/version https://dbgsymbol.com/version which as of the time of this posting, returns: "GetSymbol 2.0.3|https://dbgsymbol.com/downloads/2.0.3/GetSymbol.exe https://dbgsymbol.com/downloads/2.0.3/GetSymbol.exe" the GetSymbol.exe file (which is downloadable right now) being presumably the infected file being discussed..!

gregsadetsky 3y ago
wow! all mirror repos (I found 5) have since been disabled :-) you can still see cached bits of the code via github search -> https://github.com/search?q=path%3AGetSymbol%2FCMainDlg.cpp+%3B&type=code https://github.com/search?q=path%3AGetSymbol%2FCMainDlg.cpp+... and a tiny bit of the repo's main page in google's cache: http://webcache.googleusercontent.com/search?q=cache%3Ahttps%3A%2F%2Fgithub.com%2Fdbgsymbol%2Fgetsymbol&oq=cache%3Ahttps%3A%2F%2Fgithub.com%2Fdbgsymbol%2Fgetsymbol&gs_lcrp=EgZjaHJvbWUyBggAEEUYOTIGCAEQRRg60gEHNzA5ajBqN6gCALACAA&sourceid=chrome&ie=UTF-8 http://webcache.googleusercontent.com/search?q=cache%3Ahttps... and the user's github profile, again from google's cache: https://webcache.googleusercontent.com/search?q=cache:JXXyoVWn_JgJ:https://github.com/dbgsymbol&cd=13&hl=en&ct=clnk&gl=us https://webcache.googleusercontent.com/search?q=cache:JXXyoV... the dbgsymbol.com links above still work, obviously.
- account42 3y ago
  Github just erasing a repo and forks from existence is scarier than any potential malware that could have been included there. Not the first time they have done this - usually based on copyright accusations, but the reason does not matter - if you must use ShitHub, at least mirror your projects elsewhere folks.

gregsadetsky 3y ago

wow! all mirror repos (I found 5) have since been disabled :-) you can still see cached bits of the code via github search -> https://github.com/search?q=path%3AGetSymbol%2FCMainDlg.cpp+%3B&type=code https://github.com/search?q=path%3AGetSymbol%2FCMainDlg.cpp+... and a tiny bit of the repo's main page in google's cache: http://webcache.googleusercontent.com/search?q=cache%3Ahttps%3A%2F%2Fgithub.com%2Fdbgsymbol%2Fgetsymbol&oq=cache%3Ahttps%3A%2F%2Fgithub.com%2Fdbgsymbol%2Fgetsymbol&gs_lcrp=EgZjaHJvbWUyBggAEEUYOTIGCAEQRRg60gEHNzA5ajBqN6gCALACAA&sourceid=chrome&ie=UTF-8 http://webcache.googleusercontent.com/search?q=cache%3Ahttps... and the user's github profile, again from google's cache: https://webcache.googleusercontent.com/search?q=cache:JXXyoVWn_JgJ:https://github.com/dbgsymbol&cd=13&hl=en&ct=clnk&gl=us https://webcache.googleusercontent.com/search?q=cache:JXXyoV... the dbgsymbol.com links above still work, obviously.

account42 3y ago
Github just erasing a repo and forks from existence is scarier than any potential malware that could have been included there. Not the first time they have done this - usually based on copyright accusations, but the reason does not matter - if you must use ShitHub, at least mirror your projects elsewhere folks.