Malware

[HUNDO123]

Hi

Just want to let you guys know that I got hit by a malware today from SpotX. My antivirus defended it. I don't know if other people have been going through the same. Did you just keep using SpotX? I uninstalled it as of right now..

[omartitouhi]

can you provide more information with the file that your antivirus detect it as a malware

[HUNDO123]

Sure. I took screenshots

[PickleOnAString]

this real?

[ArgentKiEn]

Hi

Just want to let you guys know that I got hit by a malware today from SpotX. My antivirus defended it. I don't know if other people have been going through the same. Did you just keep using SpotX? I uninstalled it as of right now..

same. bitdefender doesnt like it. idk why but im not gonna trust it until im reassured

[MatadorProBr]

Don't trust on a open source software 💀

[ArgentKiEn]

Don't trust on a open source software 💀

Android is open source and I trust it. I guess you use Apple then? Apple sucks ass.

[MatadorProBr]

???
I didn't say anything about OS for phones, I'm talking (using sarcasm if you don't know) about you not trusting on a open source software, SpotX is open source and you can just check the code if you think it's a virus.

[ArgentKiEn]

yea, i didn't know you were using /s cos there wasn't an indication but im with ya now. yea i opened it in np but my av makes it a pain in the ass to keep this installed without issues. even after adding exceptions. o well. i said android as a quick example of open source betting better than an the alternative and not just phones but other systems like raspberry pi can use Android. anyway. have a good one.

[CatUnderInfluence]

You haven't been "hit with a malware".

You downloaded and ran an installer (SpotX) that uses a powerful system interpreter (Powershell) to modifiy an application (Spotify). Your antivirus decided that it was "suspicious behavior" and flagged the whole operation as malware but in the end it's just an "unauthorized mechanic" getting its hands on the engine.

If your computer knowledge is in between running an administrator level program and not knowing what it implies security-wise, probably better ASK what's happening than crying "Malware" wolf because your antivirus told you so while you were tampering with the system.

[ArgentKiEn]

We are stating the fact that antivirus picked it up. Good for you, play with spotX if you want to but I'm gonna add some lines in hosts file that equate to basically the same thing that spotX does but "suspious behaviour" free. I applaud the author for their work but it isn't for me.

As for the OP of this thread, he probably isn't the most tech savvy or maybe he isn't confident in what he's doing, either way you sound rude and he sounds like an end user thats playing it safe. If you want to help, be nicer about it.

[PickleOnAString]

I'm gonna add some lines in hosts file that equate to basically the same thing that spotX does but "suspious behaviour"

how do you do that?

can i do the same? my antivirus being annoying

@ArgentKiEn

[amd64fox]

You guys have a good time here 🤣

[NeuroCPP]

😂 showing "sarcasm" to each other on github

[TranHuuTam94]

I use the copyright Windows 10 with Defender by Microsoft. Run SpotX without turn off Defender.
All working well recently, cause the last PC I used SpotX for test (from company) with hang Spotify while playing without reason.
We have to thanks SpotX author & it's community whose building it.
Even if it's unauthorize copyright with Spotify (I guess), it's still great with me right now.
Any complaints, I thought the better way is let's pay for Spotify's service and it's artist eco-system. All worked hard to creative. So, now if we - the Spotify user, or the developer want to save money for specific purpose, then priority not for something like music.

Isn't the world want to share everything on internet?
So, enjoy. When you ready to pay, then do it. Even contribute money to SpotX (or other value).

[medtty]

[MatadorProBr]

OH GOD, DON'T TELL ME A BAT SCRIPT FILE RUNNED A POWERSHELL SCRIPT???
NOW WHAT DO WE DO ABOUT IT?
MY HOUSE IS GONNA BLOW BECAUSE OF THAT????????

[Staffed]

Lmao

[exveasy]

report.pdf

bro...

[CatUnderInfluence]

"Version downgrade": the script is written for Powershell 1.0 and requires that version to avoid syntax changes, which triggers the warning. Big deal, "bro".

Same for the "possible malicious IEX blah blah". Basically what your AV is saying is "Warning, this script tells Powershell to 'do something'!". Yeah well, that's how you install files.

Maybe don't "brosplain" people when you cannot even read the line to see what's going on, that might be above your paygrade. Just be panicked and pay Spotify.

[Staffed]

This is a false positive. Spotx pisses off the anti-virus because Spotx is changing the files for Spotify.

Edit: spitx changed to Spotx.

[ghost]

Its not false positive anymore for your information my account got stealed.

[CatUnderInfluence]

1. You suspect this install script because the way it is written triggers some false positives from your antivirus. What your antivirus is saying is basically "OMG it can modify some files, it must be DANGEROUS!!"

2. Yet you fail to decipher this install script to point out where the "nasty bits" are.

I'll help you out: there are no nasty bits. It just shows the limits of your tech knowledge. And with such limited tech knowledge there are MANY other reasons for your "account being 'stealed'". Those pirated games you downloaded from a fake Codex site for instance, that "0-day crack" or "stutter fix" (which masqueraded as a DirectX install) you downloaded from some random youtube video, that "coupon redeem" or "age verification" on some shady site, or just your habit of using the same dumb password on 50 sites for 3 years. Among others.

But I guess it's rather convenient to find an easy scapegoat to blame because your antivirus "racially profiled" SpotX.

Meanwhile I strongly encourage you to point out where exactly the script does something malevolent. Again, I'll help you (less snarkily this time) by explaining "in layman terms" what it ACTUALLY does:

1. When you run one of the two BAT files to install SpotX, it downloads the most recent "run .ps1" Powershell script from this Github repository (the same run.ps1 you can find here on the "code" tab); it then executes this script.

2. What the script does is, basically:
   2.1: Look for some necessary context (OS and Spotify version, system language)
   2.2: Eventually install latest Spotify version, from the official Spotify repository
   2.3: Modify the Spotify executable, using the file "patches.json" as a roadmap. This file is also available on this Github repository in the /patches/ directory (or "folder")
   2.4: It also modifies the "xpui.spa" file to circumvent Spotify from using the "official" web player. The "hosts" system file is also modified to derail update and validity checks (which is the point of SpotX, right?)

And that's it. There is NO "shady redirection stealing your data", NO "installation of some malware or data miner", no nasty bit. It patches the Spotify executable and makes it so it runs clean and unbothered by unattended updates or using the Spotify web player from your browser. Period.

But I'm just another stranger on the internet so I don't ask you to believe me. Just read the code files on this github, the source is thoroughly commented and everything I stated here can be verified. That's the beauty of open source. Peers can review - based on the actual work, not on some AV freaking out because their heuristics see evil in every attempt to modify something.

Now it's up to you. On one hand you have some antivirus programs that will freak out (as well as your own security issues and an easy scapegoat), on the other you have a peer review and the source files. Do your homework... or not but please don't put the blame on something you barely understand.

Have a nice day.

[Pav308]

Hey, I am also trying to figure out if SpotX is actually safe, for that I used a website called Triage to test out the .bat file. This is the link report, may you look at it and get back on why it has a score of 8/10 (possibly malware)? https://tria.ge/240820-wmdzwswbne/behavioral2

[Staffed]

What happens is when you use Spotx, you're allowing the bat file to make changes to the Spotify files. This could irritate Windows Defender or whatever anti-virus you are using. I have been using Spotx for almost a year now and I can confirm that nothing has happened to my computer. Both on Windows and on Linux. Hope this helped.

[marcoperinidev]

Hey, I am also trying to figure out if SpotX is actually safe, for that I used a website called Triage to test out the .bat file. This is the link report, may you look at it and get back on why it has a score of 8/10 (possibly malware)? https://tria.ge/240820-wmdzwswbne/behavioral2

If you look at some "details" you can see:
Legitimate hosting services abused for malware hosting/C2 raw.githubusercontent.com
It flags "raw.githubusercontent.com" as C2.
Idk man...

[xanderusa]

Not only Malwarebytes but also virustotal flagged the The "install.bat" file. So not sure if it is still a "false positive".

[Staffed]

Spotx is changing the Spotify files. Windows and anti viruses do not like when this happens, so they block the threat.