Deleting System32\curl.exe • Hacker News Board

Re: Deleting System32\curl.exe

#11

Post by tyingq » Mon, Apr 24, 2023, 11:00 AM UTC

Freak_NL wrote: post #7

tyingq wrote: post #4

Earlier quoted context omitted.

I'm guessing a common sequence is someone knowing what curl is, but not knowing that Windows ships with it. So, thinking that System32\curl.exe must have been put there by malware, or put there by someone installing optional software.

Microsoft should have renamed it to WINDLHLP.COM or something Windowsy like that, and none of these people would have dared touch it.

I noticed that "curl" in PowerShell is an alias, so you would have to deliberately say "curl.exe" to get System32\curl.exe

  C:\> alias curl

  CommandType     Name                                               Version    
  Source
  -----------     ----                                               -------    ------
  Alias           curl -> Invoke-WebRequest

Re: Deleting System32\curl.exe

#12

Post by kypro » Mon, Apr 24, 2023, 11:03 AM UTC

circuit10 wrote: post #6

Vodaphone blocks this site for being “18+ content”, I guess because of “hacking” or something? There’s no explanation or option to report a false positive and they want you to put in credit card details to confirm your age to unlock it (I don’t need tips to get around this or anything, I can just connect to another network or use a VPN)

Probably the xx in the domain.

In the UK where 20% of the internet is blocked – it's surprising you haven't experienced this before. Call your service provider and tell them you want access to adult material.

Re: Deleting System32\curl.exe

#13

Post by madeofpalk » Mon, Apr 24, 2023, 11:06 AM UTC

circuit10 wrote: post #6

Vodaphone blocks this site for being “18+ content”, I guess because of “hacking” or something? There’s no explanation or option to report a false positive and they want you to put in credit card details to confirm your age to unlock it (I don’t need tips to get around this or anything, I can just connect to another network or use a VPN)

You can't just disable this 'feature' from Vodafone? I'm in the UK and my ISP doesn't do this.

I'm not sure why you would want your ISP interfering with your traffic like this. To me, it seems like a dealbreaker.

Re: Deleting System32\curl.exe

#14

Post by Dalewyn » Mon, Apr 24, 2023, 11:06 AM UTC

>I just want to emphasize that if you install and run Windows, your friendly provider is Microsoft. You need to contact Microsoft for support and help with Windows related issues.

Worth remembering this is only the case if you buy a retail license.

If you cheaped out with an OEM license, you are your own customer support and Microsoft won't help you.

If you bought a laptop or pre-made desktop, you have an OEM license provided to you by whoever manufactured your computer and they are your customer support; Microsoft won't help you.

Re: Deleting System32\curl.exe

#15

Post by circuit10 » Mon, Apr 24, 2023, 11:07 AM UTC

kypro wrote: post #12

circuit10 wrote: post #6

Vodaphone blocks this site for being “18+ content”, I guess because of “hacking” or something? There’s no explanation or option to report a false positive and they want you to put in credit card details to confirm your age to unlock it (I don’t need tips to get around this or anything, I can just connect to another network or use a VPN)

Probably the xx in the domain. In the UK where 20% of the internet is blocked – it's surprising you haven't experienced this before. Call your service provider and tell them you want access to adult material.

> In the UK where 20% of the internet is blocked

That’s not true. I’ve experienced this once before that I can remember, on https://hackmii.com/ and it doesn’t happen on my home network except on actual scam sites which isn’t a government thing but an ISP feature that can probably be turned off. This is a Vodaphone thing, not a UK thing.

I don’t care that much about this specific site, I guess I just want to complain that they don’t have a way to report false positives which maybe isn’t the best reason to post a comment on an unrelated article but still

Re: Deleting System32\curl.exe

#16

Post by circuit10 » Mon, Apr 24, 2023, 11:08 AM UTC

Freak_NL wrote: post #9

circuit10 wrote: post #6

Vodaphone blocks this site for being “18+ content”, I guess because of “hacking” or something? There’s no explanation or option to report a false positive and they want you to put in credit card details to confirm your age to unlock it (I don’t need tips to get around this or anything, I can just connect to another network or use a VPN)

Two xx's. That's almost as bad as three, and surely heuristically naughty.

It could also be to do with the word “hack” because https://hackmii.com/ is blocked too

Re: Deleting System32\curl.exe

#17

Post by mysterydip » Mon, Apr 24, 2023, 11:09 AM UTC

Freak_NL wrote: post #9

circuit10 wrote: post #6

Vodaphone blocks this site for being “18+ content”, I guess because of “hacking” or something? There’s no explanation or option to report a false positive and they want you to put in credit card details to confirm your age to unlock it (I don’t need tips to get around this or anything, I can just connect to another network or use a VPN)

Two xx's. That's almost as bad as three, and surely heuristically naughty.

"heuristically naughty" may be my new favorite phrase.

Re: Deleting System32\curl.exe

#18

Post by circuit10 » Mon, Apr 24, 2023, 11:13 AM UTC

madeofpalk wrote: post #13

circuit10 wrote: post #6

Vodaphone blocks this site for being “18+ content”, I guess because of “hacking” or something? There’s no explanation or option to report a false positive and they want you to put in credit card details to confirm your age to unlock it (I don’t need tips to get around this or anything, I can just connect to another network or use a VPN)

You can't just disable this 'feature' from Vodafone? I'm in the UK and my ISP doesn't do this. I'm not sure why you would want your ISP interfering with your traffic like this. To me, it seems like a dealbreaker.

I can if I put in bank card details to confirm my age but it would be better if this didn’t happen in the first place unless there’s actually something 18+ on the site

Re: Deleting System32\curl.exe

#19

Post by concordDance » Mon, Apr 24, 2023, 11:15 AM UTC

madeofpalk wrote: post #13

circuit10 wrote: post #6

Vodaphone blocks this site for being “18+ content”, I guess because of “hacking” or something? There’s no explanation or option to report a false positive and they want you to put in credit card details to confirm your age to unlock it (I don’t need tips to get around this or anything, I can just connect to another network or use a VPN)

You can't just disable this 'feature' from Vodafone? I'm in the UK and my ISP doesn't do this. I'm not sure why you would want your ISP interfering with your traffic like this. To me, it seems like a dealbreaker.

All UK ISPs do. It's very annoying trying to access sci-hub

Re: Deleting System32\curl.exe

#20

Post by thaumasiotes » Mon, Apr 24, 2023, 11:18 AM UTC

blueflow wrote: post #2

People who delete system binaries due to whacky CVEs deserve a broken system. I don't even know who else to blame for this.

They deserve to not be allowed to restore their system to normal?

> The people who deleted or replaced the curl executable noticed that they cannot upgrade because the Windows update procedure detects that the Windows install has been tampered with and it refuses to continue.

This policy makes absolutely no sense.