AlSky

Thank you very much for the answer, @itman Best regards.

Thank you very much, @itman My settings on Firefox were different, now I changed them for more safety. So I understand that the certificates like the one I donwloaded couldn't not be affected by any kind of malware, ¿right? Thanks in advance.

Thanks a lot, @itman. How do you have Firefox configured? My file downloads don't give me options to choose from except when, like May 22, it was detected as malicious or if the web tries to automatically download a file. Under normal conditions, if I click on download file, it's downloaded without asking if I want to continue with the download or not. That's why on May 23rd Firefox no longer gave me a choice, just downloaded it. English is not my mother tongue, so I have some difficulties in expressing myself or understanding technical issues in this language. Should I understand that the hacking of an Akamai server hosting Let's Encrypt certificates did not affect the certificates themselves and there is no danger even if these certificates could be downloaded to computers? Thank you in advance.

Hello @itman, thank you so much for answering. That is exactly what worries me, that the first time Firefox blocked the download of a file, giving me the options to continue the download or delete the file without completing the download (I chosed this last option), but the second time neither Firefox nor ESET blocked it and a 299 bites file ended up in my "My Downloads" folder, as I showed in a screenshot. In short, something was downloaded to my computer and I don't know if that something was harmless or not. That's what worries me. What do you think? Thanks in advance.

Hello. Virustotal.com today it keeps on marking x2.c.lencr.org like suspect of loading StealC and Lumma Infostealers https://www.virustotal.com/gui/url/d85ffc694e555ad7935df30fb361c401f747ebdf194596327df3e5e12b521fe0/detection Yesterday they considered it safe (CLEAN), today no longer as seen in the screenshot. Is that something we should worry about? You don't feel safe without knowing if there is any malware capable of stealing information (passwords, etc.) on your computer.

Thank you very much, @itman Best regards.

It was a mistake. I wanted to copy the link and accidentally clicked on it, it was not my intention to open it. Can that file contain malware or is it harmless? Please, answer what do you think. Thanks in advance.

Second time neither Firefox nor ESET stopped the download of the file from x2.c.lencr.org I mentioneed above. It is a 299 bites file. Is it safe or should I'll be worry about?

It happened. This time Firefox did not detect the file as malicious and downloaded it, a white file of 299 bites named qURnoJU9. What the hell is this? How can download something to the computer that url? Is this dangerous?

That's what happened to me, I accidentally clicked on the link and tried to download something, although Firefox apparently stopped it by detecting it as malicious.

Thank you so much for answering, @itman. I clicked on "delete the file without ending the download" since Firefox had warned me that it was a malicious file. The 0-bit file in the "My downloads" folder disappeared. Does that mean it couldn't download anything to my computer? In any case, how can a url that supposedly no longer works attempt to download something to the computer? And how is it possible that yesterday our computers tried to connect to that url without our active participation and we received ESET alert messages blocking the connection? This is how some malware works.

Error, it wasn't the message I wanted to quote.

Interesting what happened to me. I tried to edit my previous post so that the url was not visible as a link and, accidentally, I clicked on it. ESET didn't detect anything, but Firefox did, blocked the attempt to download a file from that link and gave me two options, complete the download or delete the file without ending the download (in the folder "My downloads" a 0-bit file had appeared). How is that possible? Did it really download something to my computer from that link?

Good evening. I have the same problem, but I didn't even open Firefox, I just started the computer, I opened Telegram desktop and... voilà! Two messages saying that process C :\Windows\System32\svchost.exe; and the user NT AUTHORITY\Network service were attempting to access hxxp://x2.c.lencr.org and had been blocked. I closed everything, restarted the computer, without opening any program a new warning that ESET had blocked the process C :\Windows\System32\svchost.exe; and user NT AUTHORITY\Network service attempt and the user from accessing http ://x2.c.lencr.org. I don't know whether to worry or not. Why is my computer trying to connect to that web site? Is infected by any malware? According to virustotal.com this web site is used to load StealC and Lumma Infostealers.

Good evening. I have the same problem, but I didn't even open Firefox, I just started the computer, I opened Telegram desktop and... voilà! Two messages saying that process C :\Windows\System32\svchost.exe; and the user NT AUTHORITY\Network service were attempting to access hxxp://x2.c.lencr.org and had been blocked. I closed everything, restarted the computer, without opening any program a new warning that ESET had blocked the process C :\Windows\System32\svchost.exe; and user NT AUTHORITY\Network service attempt and the user from accessing http ://x2.c.lencr.org. I don't know whether to worry or not. Why is my computer trying to connect to that web site? Is infected by any malware? According to virustotal.com this web site is used to load StealC and Lumma Infostealers.