# Any insight on this detected trojan inside the blobs? **URL:** \ **Category:** Node Operators\ **Created:** [April 8, 2020, 7:19am UTC](https://forum.storj.io/t/any-insight-on-this-detected-trojan-inside-the-blobs/5737 "2020-04-08T07:19:15Z")\ **Posts on this page:** 20\ **Page:** 2
**Author:** ![SGC](https://storj.bcdn.literatehosting.com/user_avatar/forum.storj.io/sgc/32/1132_2.png) [@SGC](https://forum.storj.io/u/SGC)\ **Post date:** [April 8, 2020, 3:32pm UTC](https://forum.storj.io/t/any-insight-on-this-detected-trojan-inside-the-blobs/5737/21 "2020-04-08T15:32:17Z")
yeah i really should make it a non executable folder also, it’s a decent safety measure when there isn’t anything that should run from there… anyways doubt it will ever save me from anything tho… but the future is a tricky beast. the auto updating containers is what gets me worried… sure its kinda isolated, but really it isn’t the advantages of paravirtualization is that it basically goes direct to hardware, and thus all of a sudden the VM / container is running directly next to your kernel… yay not like its worrying enough that somebody could replace the container or add some sort of hidden code inside it, giving them the ability to make a botnet or worse out of the entire storj network until discovered… O.o i know it’s an issue with most auto updated software, but storj is kinda new so it will be prone to make old mistakes the big older corps have learned the hard way and is mostly forgotten by now… ---
**Author:** ![BrightSilence](https://storj.bcdn.literatehosting.com/user_avatar/forum.storj.io/brightsilence/32/6048_2.png) [@BrightSilence](https://forum.storj.io/u/BrightSilence)\ **Post date:** [April 8, 2020, 3:32pm UTC](https://forum.storj.io/t/any-insight-on-this-detected-trojan-inside-the-blobs/5737/22 "2020-04-08T15:32:49Z")
It’s a challenge similar to illegal content on block chains that will reside on any full node. I’ve thought about this as well. At this point I don’t see a simple way to protect against it. Perhaps you could do something by measuring file entropy to detect whether it properly encrypted and reject pieces that fall below a certain threshold. But you obviously want to be very careful with that, since you don’t want to reject anything valid. ---
**Author:** ![SGC](https://storj.bcdn.literatehosting.com/user_avatar/forum.storj.io/sgc/32/1132_2.png) [@SGC](https://forum.storj.io/u/SGC)\ **Post date:** [April 8, 2020, 3:41pm UTC](https://forum.storj.io/t/any-insight-on-this-detected-trojan-inside-the-blobs/5737/23 "2020-04-08T15:41:02Z")
agreed, its doubtful that it can be prevented, it’s simply a fundamental about how it works… but one can make it very difficult for unrelated software to get access to it and execute it… the primary target of that code would in general be the container in which the storagenode runs… so from how i see it, then it would be about “containing” that no pun intended… but doing such things comes at a performance loss. maybe the storjlings should just add a big red button inside the container… if anyone gets into it, then they cannot resist pushing it and then that sets off the alarm … muahhaha my devious plans are taking form… ---
**Author:** ![anon27637763](https://storj.bcdn.literatehosting.com/letter_avatar/anon27637763/32/5_5575768a8748004e209b776fc1b2916d.png) [@anon27637763](https://forum.storj.io/u/anon27637763)\ **Post date:** [April 8, 2020, 3:43pm UTC](https://forum.storj.io/t/any-insight-on-this-detected-trojan-inside-the-blobs/5737/24 "2020-04-08T15:43:03Z")
> [@BrightSilence](#): > > But you obviously want to be very careful with that, since you don’t want to reject anything valid. I was thinking of something like public key validation of stored data. The Storj network could/should require that all data to be stored passes a public key validation procedure such that no unecrypted data would be accepted for Ingress to a node. ---
**Author:** ![deathlessdd](https://storj.bcdn.literatehosting.com/user_avatar/forum.storj.io/deathlessdd/32/6067_2.png) [@deathlessdd](https://forum.storj.io/u/deathlessdd)\ **Post date:** [April 8, 2020, 3:44pm UTC](https://forum.storj.io/t/any-insight-on-this-detected-trojan-inside-the-blobs/5737/25 "2020-04-08T15:44:37Z")
I do think the bigger storj gets the bigger the target for hackers get as well, So its probably better if were ahead of the curve then to be behind it and have them already planning a way to attack. Its just a matter of when and how at this point. ---
**Author:** ![cdhowie](https://storj.bcdn.literatehosting.com/user_avatar/forum.storj.io/cdhowie/32/60_2.png) [@cdhowie](https://forum.storj.io/u/cdhowie)\ **Post date:** [April 8, 2020, 4:16pm UTC](https://forum.storj.io/t/any-insight-on-this-detected-trojan-inside-the-blobs/5737/26 "2020-04-08T16:16:40Z")
> [@anon27637763](#): > > There needs to be a way to ensure that all customer data is stored encrypted and that the SNO does not have the key… and can prove that the SNO does not have the key. There might be a way to demonstrate to a reasonable level of certainty that this is the case, but you can’t definitively prove a negative. Ergo, you can’t prove that the SNO doesn’t have the key. The simplest counter-example is the case where the SNO _is_ the customer in the first place. ---
**Author:** ![anon27637763](https://storj.bcdn.literatehosting.com/letter_avatar/anon27637763/32/5_5575768a8748004e209b776fc1b2916d.png) [@anon27637763](https://forum.storj.io/u/anon27637763)\ **Post date:** [April 8, 2020, 4:30pm UTC](https://forum.storj.io/t/any-insight-on-this-detected-trojan-inside-the-blobs/5737/27 "2020-04-08T16:30:30Z")
> [@cdhowie](#): > > Ergo, you can’t prove that the SNO doesn’t have the key. One can prove that data file B is encrypted with public key Z … so the proof would come down to traceability and proof that a given public key was used by any customer (but not a particular customer). ---
**Author:** ![cdhowie](https://storj.bcdn.literatehosting.com/user_avatar/forum.storj.io/cdhowie/32/60_2.png) [@cdhowie](https://forum.storj.io/u/cdhowie)\ **Post date:** [April 8, 2020, 4:31pm UTC](https://forum.storj.io/t/any-insight-on-this-detected-trojan-inside-the-blobs/5737/28 "2020-04-08T16:31:21Z")
Indeed. But you can’t prove that the SNO is _not_ in possession of the corresponding private key. ---
**Author:** ![anon27637763](https://storj.bcdn.literatehosting.com/letter_avatar/anon27637763/32/5_5575768a8748004e209b776fc1b2916d.png) [@anon27637763](https://forum.storj.io/u/anon27637763)\ **Post date:** [April 8, 2020, 4:42pm UTC](https://forum.storj.io/t/any-insight-on-this-detected-trojan-inside-the-blobs/5737/29 "2020-04-08T16:42:57Z")
> [@cdhowie](#): > > SNO is _not_ in possession That’s immaterial to the data contained within the network. The problem with storing unencrypted data or even allowing unencrypted user data onto the network is accessibility of the unencrypted data via an external observer or eavesdropper. If all data on the network can be proven to be encrypted via public key validation and the network algorithm can be shown to not allow any unencrypted user data… then any unencrypted illegal content must have been placed there by “not the network” … and any encrypted illegal content found via exploration of customer end points must be both inaccessible to the SNO as well as not the network’s problem. ---
**Author:** ![cdhowie](https://storj.bcdn.literatehosting.com/user_avatar/forum.storj.io/cdhowie/32/60_2.png) [@cdhowie](https://forum.storj.io/u/cdhowie)\ **Post date:** [April 8, 2020, 5:39pm UTC](https://forum.storj.io/t/any-insight-on-this-detected-trojan-inside-the-blobs/5737/30 "2020-04-08T17:39:19Z")
With you up until here: > [@anon27637763](#): > > any encrypted illegal content found via exploration of customer end points must be both inaccessible to the SNO There’s no way to definitively _prove_ that the content is inaccessible to the SNO. We can conclude that it’s unlikely to be accessible, but not that it’s inaccessible. That’s my point. ---
**Author:** ![anon27637763](https://storj.bcdn.literatehosting.com/letter_avatar/anon27637763/32/5_5575768a8748004e209b776fc1b2916d.png) [@anon27637763](https://forum.storj.io/u/anon27637763)\ **Post date:** [April 8, 2020, 5:44pm UTC](https://forum.storj.io/t/any-insight-on-this-detected-trojan-inside-the-blobs/5737/31 "2020-04-08T17:44:35Z")
> [@cdhowie](#): > > There’s no way to definitively _prove_ that the content is inaccessible to the SNO. This is not the problem that my posts are addressing. ---
**Author:** ![direktorn](https://storj.bcdn.literatehosting.com/user_avatar/forum.storj.io/direktorn/32/69_2.png) [@direktorn](https://forum.storj.io/u/direktorn)\ **Post date:** [April 9, 2020, 7:27pm UTC](https://forum.storj.io/t/any-insight-on-this-detected-trojan-inside-the-blobs/5737/32 "2020-04-09T19:27:39Z")
Lol windows defender won’t defend any virus. The best cause of action is to disable it and replace it with a real anti-virus software. ---
**Author:** ![anon27637763](https://storj.bcdn.literatehosting.com/letter_avatar/anon27637763/32/5_5575768a8748004e209b776fc1b2916d.png) [@anon27637763](https://forum.storj.io/u/anon27637763)\ **Post date:** [April 9, 2020, 8:00pm UTC](https://forum.storj.io/t/any-insight-on-this-detected-trojan-inside-the-blobs/5737/33 "2020-04-09T20:00:52Z")
> [@direktorn](#): > > replace it with a real anti-virus software. I call that GNU/Linux. ---
**Author:** ![BrightSilence](https://storj.bcdn.literatehosting.com/user_avatar/forum.storj.io/brightsilence/32/6048_2.png) [@BrightSilence](https://forum.storj.io/u/BrightSilence)\ **Post date:** [April 9, 2020, 9:57pm UTC](https://forum.storj.io/t/any-insight-on-this-detected-trojan-inside-the-blobs/5737/34 "2020-04-09T21:57:14Z")
> [@direktorn](#): > > real anti-virus software These days it’s pretty hard to determine which those are. It’s a double edged sword. Many of the big names have had vulnerabilities that could be exploited to gain access to the underlying system. since anti-virus has the tendency to dig deep into the OS and get priority access to everything, when it’s compromised, the entire system is. Because of this I’m still opting for Microsoft Defender + good security practices. I think Microsoft Defender is underappreciated. It’s actually pretty good. AV-Test gives it highest marks on all but one category. > **[Test antivirus software for Windows 11 - October 2023](https://www.av-test.org/en/antivirus/home-windows/)** > > The current tests of antivirus software for Windows 11 from October 2023 of AV-TEST, the leading international and independent service provider for antivirus software and malware. Additionally they give it a top product label. It catches the most common viruses at 100% rates. The only downside is that MS is slightly slower on 0-day vulnerability protection. And it does this while impacting the system performance at half the rate of the average anti virus solution. In fact the best argument against using it is that you don’t want everyone relying on the same AV software as it would then become the target to test all your attacks against. This is a valid argument, though currently the stats say we don’t really have to worry about that just yet. ---
**Author:** ![direktorn](https://storj.bcdn.literatehosting.com/user_avatar/forum.storj.io/direktorn/32/69_2.png) [@direktorn](https://forum.storj.io/u/direktorn)\ **Post date:** [April 9, 2020, 10:36pm UTC](https://forum.storj.io/t/any-insight-on-this-detected-trojan-inside-the-blobs/5737/35 "2020-04-09T22:36:27Z")
Glad to hear you enjoy ms. I have been a ms partner for ten years. What you are saying is that you personally guarantee that ms will protect you ---
**Author:** ![deathlessdd](https://storj.bcdn.literatehosting.com/user_avatar/forum.storj.io/deathlessdd/32/6067_2.png) [@deathlessdd](https://forum.storj.io/u/deathlessdd)\ **Post date:** [April 9, 2020, 10:47pm UTC](https://forum.storj.io/t/any-insight-on-this-detected-trojan-inside-the-blobs/5737/36 "2020-04-09T22:47:16Z")
> [@direktorn](#): > > What you are saying is that you personally guarantee that ms will protect you I don’t think that’s what hes saying at all there is absolutely nothing that is guaranteed to protect you. For a virus scanner program that is free and it comes with Windows is better the most virus scanner programs that cost you money which doesn’t mean its better. ---
**Author:** ![BrightSilence](https://storj.bcdn.literatehosting.com/user_avatar/forum.storj.io/brightsilence/32/6048_2.png) [@BrightSilence](https://forum.storj.io/u/BrightSilence)\ **Post date:** [April 9, 2020, 11:43pm UTC](https://forum.storj.io/t/any-insight-on-this-detected-trojan-inside-the-blobs/5737/37 "2020-04-09T23:43:09Z")
I you disagree, may I suggest using a counter argument instead? ---
**Author:** ![kevink](https://storj.bcdn.literatehosting.com/user_avatar/forum.storj.io/kevink/32/6077_2.png) [@kevink](https://forum.storj.io/u/kevink)\ **Post date:** [April 10, 2020, 6:00am UTC](https://forum.storj.io/t/any-insight-on-this-detected-trojan-inside-the-blobs/5737/38 "2020-04-10T06:00:01Z")
Additionally you have no idea what other AVs are doing with your data. There have been reports of e.g. Avast collecting (basically unrelated) user data. Especially those free AVs might sell off data like browser history etc… I don’t want that. So I stick with MS and opt out of as much as I can. MS can already collect all my data no matter if I use their virus scanner or someone else’s. At the end of the day, the biggest security issue is me anyway… Clicking the wrong link, opening some stupid email, executing the wrong file. You can always hope that your AV protects you from those mistakes but no AV recognizes all viruses. ---
**Author:** ![SGC](https://storj.bcdn.literatehosting.com/user_avatar/forum.storj.io/sgc/32/1132_2.png) [@SGC](https://forum.storj.io/u/SGC)\ **Post date:** [April 10, 2020, 7:07am UTC](https://forum.storj.io/t/any-insight-on-this-detected-trojan-inside-the-blobs/5737/39 "2020-04-10T07:07:28Z")
i like how some antivirus software is like hold on this looks suspicious performing extra scans before you are allowed to run something. if nothing else it does give you a sense of it being good when literally taking 30 sec or so to scan one particular file. nothing with protect you against proper homebrew malware. ---
**Author:** ![BrightSilence](https://storj.bcdn.literatehosting.com/user_avatar/forum.storj.io/brightsilence/32/6048_2.png) [@BrightSilence](https://forum.storj.io/u/BrightSilence)\ **Post date:** [April 10, 2020, 10:13am UTC](https://forum.storj.io/t/any-insight-on-this-detected-trojan-inside-the-blobs/5737/40 "2020-04-10T10:13:17Z")
Most AV does that these days though and that includes Microsoft Defender. As for it taking time… is it being good or simply inefficient? There is a lot of AV software that doesn’t catch more than the average AV, but is a lot slower with scanning. I just like that with Defender being part of the OS, I’m not giving any additional party privileged access to my machine and it’s usually out of the way. Though I have seen the process go haywire from time to time and consume 30+% CPU over an extended period of time. It’s definitely not perfect, but what is…? [Previous page](https://forum.storj.io/t/any-insight-on-this-detected-trojan-inside-the-blobs/5737.md?page=1) [Next page](https://forum.storj.io/t/any-insight-on-this-detected-trojan-inside-the-blobs/5737.md?page=3)