This channel was not hacked. I NEED HELP. My channel is about to get terminated. I can't upload any videos for a week. Here's the overview of the situation from my second channel:
https://www.youtube.com/watch?v=AZfNtTLnFtk
Youtube took the explanation video down. I know that now your channel may not be at risk, but it is SOO annoying that they just take it down for no reason.
Enderman, i am gonna upload the video to my channel, Please allow me copyright... it won't lemme because its copyright, allow me so i can help you as much as i can, i've been your fan for years now
@@Yarpopcat08 ironically they care about destroying channels that are actually trying to mess with bots and viruses, just remember his "TrustedNOTInstaller"
I Really Hope It Doesn't Get Terminated Because This Chanel Helped Me With A Lot Of Things And It's Just Fun To Watch, But BTW How Did You Upload This Video If You Cant Upload Any Videos For A Week
@@Yarpopcat08they do care about scams but they don't put enough effort into it, i reported one and it was gone in a day but that was one out of the millions of scam channels
Damn, I YouTube doesn't care a bout bots and scamming, but it cares about destroying channels. I hope everything will be good with Your channel. Good luck
The face might not be deepfaked but the voice yes. I never heard the CEO talk so I cannot confirm if the voice has been AI modified but for the lipsynch, it looks like something like wav2lip. But yeah, this fake video is poorly made.
If Google/YouTube officially released new change on terms, policy and rules, pretty sure their videos about it are 100% set for public instead of being privated/unlisted
I don't need to watch the fake video to notice of fake everything it is. The email itself and the video description already can make your common sense alarms go haywire.
Hi ThioJoe. And well.. the email itself is already very sus by the way it's written. Looks like it was written by a teenager or something. Also having attachments... Makes it way more sus. I know official YouTube emails and they never attach files or warn about limitations. Also what if you try to run this on a Linux or Mac system? I bet the scammers think that everyone runs windows, which is false.
It's actually not a keystroke logger. When you run the file, it steals the browser cookies that keep you logged into YouTube. Once the scammers have the cookies, they can put them into their browser and have access to your account without a password or 2FA. They then change the password and 2FA, and you have lost your account. It's quite effective once the victim falls for the scam.
basically if you fall for this trick the only way to save your account is deleting all cookies and deleting every trace of the program and then running a virus scan, THEN logging back in
@@__Razer If the password is stored on autofill, they can use inspct elements to make the password visible, or just copy the text and paste on any text editor, if the site doesnt stop you from copying passwords
@@raaymonf ur crazy if u think youtube is all they get access to. if u have sessions for a crypto exchange, ur email, or a bank they can waltz right in to those without logging in.
That’s pretty understandable that they try to steal a cookie session but how do they change the password without access to the old password? When you try to change your Google Account Password, you’ll first be prompted to enter your old password. Oh shit, wait! If they could access Gmail from the cookie, then they could reset your password without the old one 👀
I don't know how that works in the US, but at least in Europe, I always had to prove my identity by inputting my password for stuff like changing password, so that wouldn't really work for me being European. Anyway, I know that this isn't how it works and the title clearly says "shares a video with you" - YouTube would never put something like this in a video with Google CEO (if anything, YouTube CEO would make much more sense). Knowing corporate shit, changes to corporation user policies happen more in a stealthy manner, where they silently update the policies page and then just send out emails prompting users to take a look at the new updated policies (which most people won't even do). They don't even conveniently link to the policies, just "search it up" (why make it convenient, right?). So scams like this would NEVER really work for someone who is familiar with policy updates from corporations like YouTube. Plus, this is the first time I see they forgot to remove the access to the video (so you can't just flag and report it as a scam to YouTube - because even if you set the video as private, it is still subject for community guidelines and if it violates them, then it doesn't matter the video is private, it can still be reported and removed for guidelines violation - although even if the video access is removed, the URL isn't, and you can report the URL to YouTube, so in its way it achieves nothing, just a mild inconveniece). They remove the access to the video once the email is sent (i.e. the user is notified), so the video is inaccessible, but the email is still there, including the full video description, which pretends to be an official message.
Some different variations don't steal your browser history or any of that. They steal your cookies and session key, which lets them login even if the password gets changed.
Not clicking links or opening attachments is good practice. When I order stuff online, I always log into my account at the shop and download the receipt there.
I would find it odd that the CEO of Google and Alphabet reaching out to their creators. Pretty sure Sundar Pichai would have more important things than to make this video. However, CEO of YouTube is currently Neal Mohan. It would be Neal's responsibility for overseeing YouTube.
Yeah, I Am A Really Nerdy Person And These Videos Inspired Me To Be, They Were Funny And I Liked Learning About New Stuff Every Day He Uploaded A VIdeo
(1:19) I remember seeing a similar thing happen where Google Drive was being abused instead of YouTube. Gmall were smart enough to file those as junk mail as they were sent to many random Gmail addresses.
I'm sorry about it. I have been watching your videos for 3 years or so since the COVID-19 lockdown, your videos were really entertaining and educational at the same time. Due to college tests starting from next Saturday, I haven't watched your videos for a while. I hope it will be resolved.
@@Endermanch Of topic and I'm not syaing I'm expert, but most Linux channels when they analyses these files they just eith use head command / pipe to cut the file to the level where it garbage data started .
@@Endermanch Random bytes are not compressible at all because their entropy would be near infinite. But you have seen 7z had less than 1% of the file left when compressing. So it's some pattern that's just repeating over and over again being compressed away using the dictionary of LZMA2.
You can't, it's garbage data in there. I specifically said it was garbage, not null padding since it could be an embedded resource which you wouldn't be able to safely remove using HxD.
@@THE-X-Force man me too, I just trying to find a biofuel quote and google showed it as the first then BOOM. Microsoft scam security. Terrible afternoon
They even use similar looking characters called "cyrillic characters" to impersonate official e-mail addresses, so most people couldn't spot any difference unless they do some checking using the "unicode identifier"
11:45 also deactivate from any other login session using the non-infected device (a phone for eg). The stealer uploads session cookies which works in some site even after password change.
Я не могу не пожелать тебе удачи выжить в этом недоразумении Ютуба. Ты стал жертвой людей, которые ради своей забавы хотят удалить все твои каналы, думая, что они всесильные. Справедливость должна восторжествовать, и я надеюсь, что этой ситуации дадут больше внимания.
How are they sending emails from the YouTube domain? Also, so much for the "Scanned by Gmail" feature doing absolutely nothing regarding this. With a company as large as Google you'd think they could run a virus check for larger files. Of course though scammers will just artificially increase the file size even more to combat that.
@@papajohnscookie yes, it's automatic: if you share a legit Drive link, Gmail will also show it as an attachment to easily download it without going on Drive - so this email is "legit", it's the video they shared that contained malware and with that video and that crafted description they basically exploited the Gmail automation
@@realcomputerdude100 I think gmail will attach google drive files to the e-mail if there is a link to the file somewhere within the e-mail? I could be wrong though
@@Endermanch Unless I'm oblivious I only hear it mentioned once and not brought into any further detail outside of 'it's unfortunate that sharing videos with others is similar to YouTube creator notifications', something along the lines of that.
"Hi John, they used a share function in Youtube. So they have a private video, so you can't see it, but the thing with private videos is that you can give access to someone. So they add your and other youtubers emails, so you would get this email from youtube, stating that this and this channel shared a video with you. In the email you can see description and title of the video. Once you receive that email - the scammers just remove access so you can't see it, that's why it says the video is private, but you got email from official youtube domain."
You might also want to pin a comment with the video here. If that's even possible... I'm not sure abt the editing rights, but you could also add a "showcasing purposes only" disclaimer into every description, maybe that influences the algorithm. Good luck, let's hope there will be a real human looking over it before they can terminate you and your communication attempts are more than speaking to a wall.
Stupid me downloaded the thing because I was scared of loosing monetization ( I know im stupid). I opened the zip but did not touch the document in it. My question now, am I safe or did it already infest my system?
I would love to see the OSFirstTimer guy try the latter! After all, he did respond to phone-based tech support scams that say his Windows computer has a virus, saying "Sorry, I use Ubuntu".
ayo! nice video. i miss sometimes old video type like showing how virus works (like petya). i still like this type but would be cool to see more malware videos!
We should be able to set an anti-phishing code/passphrase on sites, so that when a real email comes from the company it contains this code. If it does not contain the passphrase we set, it should ring a bell that it’s a phishing/scam email.
I noticed after a while that I hadn't gotten any notifications from Youtube about you uploading. That alone had me a little bummed. But when i saw the title to this video. My heart truly started to melt. I absolutely love your videos and simply the thought of your channel being terminated brings a tear to my eye. Hope you get through this with your channel still in tack. I wish only the best for you Andrew 🙏
It's time for a class action lawsuit against YouTube/Google. No mentally stable person would share a video using the share function via email. This makes no sense. Yes it's a feature from the late 2000s but still... This really feels like negligence. Why did this not have been removed years ago?
BTW if You look at the subscriber count, and see that it's fake. Also I don't know they would private the video, they have them public and I would also compare the name (not the display name but the name with the @) with the real and fake YouTube channel.
The scammer created a channel called YouTube Team and uploaded a deepfake AI video with the text of the email in the video description. Then they use the share function from YouTube to send it to their possible victims. That's why the sender looks legit because it comes from YouTube itself. The email contains the text of the video description and the layout YouTube uses is the same layout they use for official emails. To me, this looks like negligence from Google/YouTube and they should be sued for this.
i mean it's only really viable for memes and stuff apart from this, but if you have a keen eye, you would see that the channel isn't official either way
Wouldn't mind proposing a new notification format for private video sharing to YouTube so it differs from the official messages a lot (this way you can clearly distinguish a video share at a first glance). I am pretty skilled with basic HTML/CSS, so I can compose a new email layout for this.
i might be thinking too simple about this, but can't MS just warn users like if theres a . followed by 3 letters in the name before the actual extention?
If you listen and look closer at the last bit of the video of the CEO of Google, you can tell it was a voice over the original. His mouth movement and what is said in audio doesn't match.
When some russian guy (probably with one of his arms broken) has to tell you not to execute files from e-mails, there is something wrong you had just done.
One way to prevent getting tricked by this type of scam is changing the way .scr files are opened. Create a new action for the scr and set it as default. For me, i created action 'open2' and set it to open 'notepad.exe "c:\Users\Public\screensaver_warning.txt"'. Windows will still launch screen savers normally, just the user will not. Also by right clicking it, you can still launch it using 'Test' action.
Hey Enderman, I have a idea. Making an Windows based OS that just launches a program and that's it, and you cant do anything else. We will use Windows PE For this process, I have tried so many times but i get the same error or just bigger errors and i don't have enough brain for it. This is how i imagined: Windows PE Launches from ISO/any boot-able Source, Installs necessary files as like system32 and the libraries, Installs some drivers for the program to run at all, Restarts. Launches the Program and that's it. Could please do a topic on This?
I was listening to one of my playlists on spotify, and I heard your intro music! Is it Drive Slow - Windows 96? Anyways, I love your videos and they have inspired me when creating code. I hope to keep watching your vids. <3
So, basically, the entire premise of this scam consists of assuming that the file is a PDF file, just because it comes packaged with a PDF icon in the executable. This is combined with completely ignoring the simple fact that this so called "PDF" file just happens to have a .scr extension.
Big companys like google, youtube(owned by google), amazon, facebook, ... should really just sign their outgoing email using SSL certificates, that user can just look for the little checkmark (or however the users email program/website/app shows it) to see wheter or not the email is real or fake, just like the litle padlock in the browser. But for some reason nobody using SSL email certificates. Wouldn't help in this case but it would help against some types of email spoofing (where they just change the sender adress)
is this right? generate me 30 sets of strings in the form of "xxxyy-OEM-NNNNNNN-zzzzz" where "xxx" is day of the year between 001 and 366 (for example, 192 = 10th july) and "yy" is the year (for example, 94=1994). your range is from the first day of 1995 to the last day of 2003. "OEM" mus remain intact the "NNNNNNN" segment consist of digits and must start with 2 zeroes. the rest of the numbers can be anything as long as their sum is divisible by 7 with no remainder. the last segment "zzzzz" should consist of random numbers. "z" representing a number.
I wouldn't click on a google drive link that contains export=download&confirm= no_antivirus Like bruh, what would you think that a link with "no_antivirus" would do??
Hii sir i have already double click scr file received in mail now my pc restarting problem every 5 min.i run all type scan Malwarebytes or windows defender but not threats detection so now what can i do? Can i find where is scr virus installed in my folder?? Help me
If not for the 380mb pdf (hahah just why?), I would not notice this is a scam at all. MIGHT have been easier just to put an URL to a malicious website that redirects you to a real pdf anyways. Honestly, this just feels like something someone was paid for to target a certain person.
Something I’ve always wondered, well actually 2 things related to malware. Number 1. Why do some pieces of malware have anti VM in place? Whats even the purpose? 2. Not mentioned in the video, but I heard it somewhere. Apparently, there’s a select number of pieces of ransomware that have a kill switch, be run on a computer in Russia. Usually done by seeing if Russian is an installed language. While it’s great to have such a thing, why does it even exist? Ok, this one has nothing to do with the video, but I still want to know. If anyone has answers for either one, then let me know plz. Thanks.
vm (mostly) allow the file to be executed in sandbox environment. They can analyze its behavior and allow it to infect a virtual os without exposing their real OS. This way any gathered data of the malware behavior will remain intact even if the virtual system is corrupted and destroyed. And they can use the gathered data for better security improvements, better database for anitivrus and patch fixes by exposing vulnerabilities. So if a malware wont run in VM, it makes it difficult analyzing its behavior but also running batches of testing.
anti-vm/sandbox is so that people can't analyze it (just use an old airgapped pc/maybe kvm if so), and the 2nd could be personal transgressions or simply targeting a specific country, like how virus sites give specific ips specific payloads
As for your first question; What is the point of a VM? VM is short for Virtual Machine. It's a way to run a program that usually you have made for testing it out. You as the developer of this software don't want to accidentally kill your box so you run a VM. It will kill the VM instead if you screwed up your code somewhere. Same goes for malware; Run it in a VM and your box is UN-affected. If it's destroying your VM you can always reset it back to it's known good state. Malware is designed to either make you pay for something you will never receive or just be mean and destroy your PC. Some are called Ransomware. Those as the name implies encrypts your files and the person who did it has the ability to decrypt them if you pay them a lump sum of money. Lately it's in Bitcoin or some other crypto-currency. But in this video the YouTube scam is to hack into as many accounts as possible and lock them down. Most likely for money. Install this little bit of Malware; run it and in the background it's tracking everything from your screen to what key's your using on your keyboard. That's how Linus got hacked. An employee of his opened up of these emails thinking it was a real sponsorship deal they had to read the terms of and next thing you know they got into his YT account.
1. So the malware has a higher chance of infecting an actual machine. Alongside preventing channels like Enderman from showcasing them, making removal videos etc. (That's a guess, so take that info with a bit of salt) 2. I would assume that its because the creators of malware don't want the viruses to run on certain devices. Let's take your Russian example:
If a Russian malware developer were to make malware that is supposed to inconvenience the western countries, the developer wouldn't want it to backfire against its own country so they code a kill-switch in to prevent it.
For the first one I think it is to prevent the malware from being analized by an organization or individual, and also to motivate users to run it on their actual machine
Hello, I have vmware workstation 17.1, when I turn on the virtual machine, the vmware logo does not appear when I press the esc key to go to BIOS, that is, I installed Windows XP, the Windows logo does not appear, the welcome message appears directly.
This scam had more red-flags than a construction site. 😒
🚩 Even non-native English-speakers can recognize the terrible language in the email (even in this version which is different from an earlier version which was even worse such as saying "getting monetization" and having dashes on the list of restrictions). 🚩 The deep-fake is terrible. That was NOT Sundar Pichai's voice; he has an Indian accent because he grew up in India and only went to the US as an adult, the deep-fake voice sounded robo-American with hints of British. 🤨 🤦 🚩 YOUTUBE/GOOGLE has a video that tops out at 720p? 😂 🚩 Why would Sundar handle YouTube stuff? He deals with Alphabet stuff and to a lesser degree, Google stuff. He leaves most YT stuff to the YT CEO. He just handed it off to a fellow Indian guy (like most American companies), so why would he do it himself? 🙄 🚩 So… they used the SAME PASSWORD for EVERY file and then put the password in clear-text in the description of a YT video? And that makes sense to people? 🤨 🚩 Google knows everything about you, they have ALL your data. They wouldn't send an English email to everybody, they'd send one in the language you specified is your native language. Enderman would get a Russian email, not an English one (if it was actually from Google). 🚩 The drastic difference in filesize with compressed size means either the dev was so incompetent, they bloated it beyond even the laziest game-developer's abilities, or it's artificially padded with lots of nulls. (To be fair, that could actually be the work of YouTube since they're so garbage at their jobs.) 🚩 WTF has ever seen a 700mb PDF file? 🙄 🚩 Overly-large files can't get scanned by cloud anti-virus but CAN be scanned by local AV programs.
I'd like to think that even non-tech-savvy people would notice at least one of the red-flags, but alas, I know better. 🤦
How did the dropper put files under the Windows directory without elevation? 🤨 This is partly on Microsoft, a fresh Windows install should never have new accounts running with admin privileges, they should always default to user-accounts. Duh. 😒
I am probably one of the few people who has worked with legitimate pdfs that large. A high-resolution full-color 700 page scan of sheet music I’ve seen came out to 1.3 GB!
Windows 1 + Windows 2 + Windows 3.0 + Windows 95 + Windows 98 + Windows 2000 + Windows ME + Windows XP + Windows longhorn + Windows Vista + Windows 7 + Windows 8 + Windows 8.1 + Windows 10 + Windows 10X + Windows 11
yo enderman can you make a tutorial how to use vmware and how to install it? (i dont trust others, im also subscribed and i trust you and also if you already made one then im sorry for wasting your time and also link the video below this comment)
@@HaRsH-GoR The scammer created a channel called YouTube Team and uploaded a deepfake AI video with the text of the email in the video description. Then they use the share function from YouTube to send it to their possible victims. That's why the sender looks legit because it comes from YouTube itself. The email contains the text of the video description and the layout YouTube uses is the same layout they use for official emails. Gmail automatically adds Drive links as a "pseudo attachment". It just opens the Drive link in your browser for you to download the attachment.
omg so that's what is happening about .scr files. I got caught on this once in playing Minecraft with Skype times, like, in 2012? The "screensaver" was sent via Skype chat from one of my internet friends' account, and it looked like a picture and I wanted to open and see it. The first thing I did after realizing was turning off not the PC, but the router, so that the virus didn't spread itself further. After clearing things I turned it back on. After that I lost my belief in antiviruses, lol
Thank you endermanch i knew it was a scam i am only saying thank you cause my brother destoryed my xp old pc because he really hated your videos and he bought me a new gaming setup to teach me a lesson i shoyld never watch your channel again
What you could have additionally shown is how the file looks in hex editor, more specifically how long is the longest stream of hexadecimal zeroes. The working code of this piece of malware is megabytes at most, and cutting out these excess bytes lets the executable get tested on virustotal to show what exactly is hidden inside the .scr file.
Bro can you make a video on hacking windows 8.1 metro apps to run in a window please in the memory of windows 8.1 please please i would appreciate that
You mean dualbooted? Well nothing wrong will happen it's just that you'll need 2 seperate drives for that and install win11 to one and win8 to the other and boom you have dualboot!
6:07 He isn't pronounced this way. He is pronounced as "Suundar Pechaae" (spelt as: Sundar Pichai) . Lol he would never pronounce himself this way 🤣🤣🤣🤣
This is why you never use anything video related as proof of anything anymore. unless the video is proven to be from an indivual thats a reliable source, (even then they can still be doctured). You should always ask someone to analyze the video if it has been tampered with in any way. For example the "sundar" video sounded very robotic like if you ever used an ai imitating a famous persons voice itd sound exactly like that vid.
Enderman. My dad forces me to use norton... If he dosen't see norton on my pc. He installs it right away. Is malware bytes better then norton (i think it is better). And how I can convice my dad to stop paying for this shit. help
is it just me who thinks this looks so fake and couldn't fall for it, because: 1) the video is low-quality and lacks grammar and would have definitely been done better by the youtube team.. who literally own youtube lol 2) youtube channel with 700 subscribers, sus 3) google drive link, which also has "no-antivirus" in it's link, sus 4) the mail looks strange in some way idk 5) the file is very big, sus
This actually is from the real youtube. These people are just making the video private then sharing it with other big youtubers. The text just has the description from the video.
@@GavAttackO I'm saying the message is from the real youtube. thats a real youtube email. you get this email when someone shares a private video with you.
How to stop getting your channel terminated. 1. delete videos that ambush people. 2. unsubscribe hackers that ambush you. 3. remove posts that ambush people. 4. do not make videos scammers can watch or else you will be scammed.
Fuck youtube. What is wrong with you. We love this guy. FOR FUCKS SAKE DONT BAN THIS GUY. DO NOT BAN THIS GUY. WE WATCH HIS CONTENT, HE HAS DONE NOTHING FUCKING WRONG.
We want you to feel safe while using YouTube. If you don't want to see certain content, you can block comments or users. Review resources for policies and tools to keep you safe on YouTube.
Thanks, YouTube Team Bu kaynak metin hakkında daha fazla bilgiEk çeviri bilgileri için kaynak metin gerekli Geri bildirim gönder Yan paneller
First red flag: Download something. It's almost 100% that YouTube or any other company won't ask You to download anything.
Second red flag: Language. I would really be alarmed by that.
Third red flag: YouTube wouldn't send a Google Drive link. it would be a link directly from YouTube domain. Yes, YouTube has been bought by Google. But it doesn't matter. They wouldn't send a link on Google Drive.
The two former flags could be ignored, because people don't read that. I wouldn't.
Also fourth flag: 7 days? No, it doesn't like that. You get specific date and description that "the new rules would be coming into effect from [insert date here]. Actually in most cases not removing Your account means You accept the rules. And I think they have to notify You 14 days or a month before it will come into effect. Though, people may not know this. Although if only big channels have been hacked, then I can't understand why Linus don't know this.
It's as You say. No company would ask you to download files. That's a big red flag already. And that's something that is often discussed too. This is as obvious as "[Company] won't ask for Your password". That's the very same thing.
I also received similar .scr file to my email last week. basically the hacker pretended to be my client offering a freelance job, they send me an attachment detail etc etc. at first i didn't feel sus at all because it came from ArtStation DM.
but I usually never extract .ZIP file, so I just check the content, and inside it, it has .jpg file and .scr file that weights around 1GB with extremely high compression ratio. at that point I knew this is a scam lmao.
you get born, you see the new world, you see your father and your mother you say the first words you chose to be a doctor you graduate and your parents are proud of you! you did it!
unfortunately, you ruined your life "MONEY MONEY MONEY" you scam people out of their banks and accounts you get jailed, hated and doxxed on internet. all just for little money.
"Scanned by gmail" 😬Google is definitely not scanning password protected zip files so they should definitely warn the user about it and not say they have!
Look, I'm no security expert and I'm not the brightest bulb on the christmas tree, but that really has got phishing scam written all over it. Apart from everything else you've covered, just a badly-worded mildly threatening email with a deadline and a link is enough to have me clicking on the View Message Source button to look for the originating email and/or ip address. The link itself is to a Google drive, another red flag. A 700MB download for a single document is also a no-no. At that point I'd be googling "changes in Youtube rules and policies". It has to be said that's a very amateurish scam from start to finish. I'd have a hard time finding sympathy for anyone who fell for it.
One of the biggest channels on YouTube got hacked with this method which is the 3rd biggest channel in YouTube which is called SET India, they do really need to improve security as their account turned into a Tesla scam stream account it was fixed a few hours later.
This is a redline stealer variant. It steals the session keys that let you log into websites without entering your username/email and password. There is a video about this made by thiojoe.
7:50 It seems like you haven't grasped what actually happened. What the scammers did is that they created an account called YT Team, uploaded a private video, and used YT's own feature of sharing private videos with pther Google accounts. Note that it's labeled "Private" by YT, not "Unlisted". This means that only specific Google accounts that the scammer shared the video to can view the video. As a result, the sender of the email is actually YT. The "design" of the email is not controlled by the scammers, because it's literally YT's own feature of sharing private videos to other people. Try it yourself: click "share" on one of your private videos and choose another Google account, and see what the email looks like. You said the scammers failed by choosing the wrong email address to send this email to. But the reality is, this is the only email address that they could target, because it's the email address associated with your channel. They only chose your channel when sharing the private video; they don't even need to know what your email address is. You also made the mistake of assuming that it's a lookalike when it's actually a deepfake. It's easy to spot: the voice is weirdly flat, and the bottom edge of his beard disappears into thin air when the mouth is open big. But you did say that you noticed while editing so I guess you noticed these too. You knew it's a scam from the start, and thus assumed that everything is fake. Just like people that fell for the scam assumed it's real from the start and thus assumed that everything is real. This assumption is what made people prone to fall for scams.
Edit: And you also assumed that Sundar Pichai is not actually the CEO of Google when he actually is. That's another of your wrong assumptions. Not to mention, how can you not know that already?
VirusTotal will not flag it as a Zip-Bomb if you go into HxD and remove all the "Null_Byte" Padding in the File, because the "Archive" Type makes it appear as a Zip-Bomb even if the real threat is a Stealer... so next time, just use HxD to remove all 00-Bytes at the end of the file (until you only have one single line of 00-Bytes left, then save it and upload it to VT, i promise you, the result will be much different
It would be nicer if you would had used a program like "Farbar Recovery Scan Tool" to create log files before and after running the malware - could have been interesting.🙂
This channel was not hacked. I NEED HELP. My channel is about to get terminated. I can't upload any videos for a week. Here's the overview of the situation from my second channel:
198 likeshttps://www.youtube.com/watch?v=AZfNtTLnFtk
Replies (31)
Youtube took the explanation video down. I know that now your channel may not be at risk, but it is SOO annoying that they just take it down for no reason.
0 likesHi
0 likesI wanted to see the second channel video but instead it said “This video has been removed for violating YouTube’s Terms of Service”😭
0 likesIt got removed
0 likeshey the video got tooken down for violating the rules
0 likesWhat's your second channel? The video is gone.
0 likesBut the video is removed! Why?!
0 likesCanadadrew 3mil subs got hacked and has a livestream about peepeecoin
0 likesim watching many of these vids bc im gonna miss u
0 likesIt got removed!
0 likes@@BeatBoandDJStar2010 gg, youtube removed that video TOO
1 like@@hgijhsjos6288 Or 80% would become like me by uploading bad things
0 likesAaaa shit here we go agine
0 likesI seen that video
0 likesI'm so sorry that YouTube removed your video
Enderman, i am gonna upload the video to my channel, Please allow me copyright... it won't lemme because its copyright, allow me so i can help you as much as i can, i've been your fan for years now
0 likes@@JacksonGaming092 Aight, do your thing. I should not too off topic.
0 likessad
0 likes@@sneakytanklol he already has a backup
0 likes@@dark-mode. it's because maybe I don't care about doing every single thing right
0 likes@@JacksonGaming092 You capitalized every word, alright.
0 likes@@dark-mode. What Do You Even Mean
0 likes@@JacksonGaming092 Can You Stop Doing This. But like seriously though, its stupid.
0 likes@@Yarpopcat08 ironically they care about destroying channels that are actually trying to mess with bots and viruses, just remember his "TrustedNOTInstaller"
4 likesyoutube be like
0 likesyeah let's just be Solaris and remove every YouTube channel that has a letter in the name
I Really Hope It Doesn't Get Terminated Because This Chanel Helped Me With A Lot Of Things And It's Just Fun To Watch, But BTW How Did You Upload This Video If You Cant Upload Any Videos For A Week
1 likesmart of you to rename the video title
0 likesWelp, this happened to other yt creators before, you're not the only one who is having problems in the ytverse.
0 likes@@Yarpopcat08they do care about scams but they don't put enough effort into it, i reported one and it was gone in a day but that was one out of the millions of scam channels
2 likesWell, R.I.P to this channel, it was a good run
2 likesDamn, I YouTube doesn't care a bout bots and scamming, but it cares about destroying channels. I hope everything will be good with Your channel. Good luck
6 likesi swear youtubes getting worse and worse... by 2030 there would be no channel on youtube xd
17 likesPretty sure they literally deepfaked Sundar there
1456 likesReplies (63)
get off youtube
0 likesscammer here
0 likes💀
0 likes2 legends.
1 likeHi ThioJoe
0 likesHah
0 likesCommenting on a video with thousands of subs must be hell
0 likesIk i almost got scammed by that
0 likesHoly shot it’s Sherlock Holmes 💀💀
0 likesNo shot
@@Endermanch I agree as I get spammed alot
0 likesThio!!!
0 likesHello!
1 likeThousandth guy to like the comment :)
0 likes@@JustinAdslol I found you here
0 likesTHIOJOEEE
0 likesThe face might not be deepfaked but the voice yes. I never heard the CEO talk so I cannot confirm if the voice has been AI modified but for the lipsynch, it looks like something like wav2lip. But yeah, this fake video is poorly made.
0 likes@@Endermanch ThioJoe gave you a nice shout-out (and link) in his video on this. It's the reason I'm here, and I'm sure I'm not the only one.
1 likeJoeThio
1 likeno sh
1 likeYeah they did. watch his lips and the voice. it doesn't match sometimes. anyway, everything on this video screams red flags
1 likeOh, hi Joe
1 likeHI
1 likethiojoe
1 likeEven so, this is actually pretty bad. I fear the worst.
1 likeDidn't expect you here.
1 likearen't you the guy who literally scammed your viewers by making up shtty lies?
1 likeHoly moly its you
1 likeBruh wtf you doing here
1 likehello thiojoe
1 likehi ThioJoe
1 likehi thiojoe
1 likeLol
1 likeTHIO
1 likeA
0 likesAlso 1 more red flag that was already noticeable:
2 likesIf Google/YouTube officially released new change on terms, policy and rules, pretty sure their videos about it are 100% set for public instead of being privated/unlisted
It sounds so real though...
2 likesYeah, it was literally a deepfake. They probably deepfaked the deepfake to make it more real.
1 likeomg thiojoe watches endermanch?!??
2 likesthey did, at 5:55 his mouth looks very weird, and the overall movements are pretty obviously deepfaked
0 likesYep, his body moves like jello.
2 likesYeah Joe
0 likesLarge channel I've never seen comment before actually comments on a smaller channel within 2 hrs of upload.
3 likesThat's really cool
D: drive
2 likesHi thiojoe D:\Windows\System32
2 likesYeah🐶🦉
1 likekey thing. when there are pauses in the speech, he continues talking so I think that the recording is from an older video
1 likeNo shoot Sherlock thio Joe
2 likesYeah, exactly
1 likeDo you watch this channel ThioJoe?
1 like@ThioJoe Btw, glad Linus Sebastian and co gave you credit for the scam video. You deserve it.
1 likeI don't need to watch the fake video to notice of fake everything it is. The email itself and the video description already can make your common sense alarms go haywire.
0 likesHi ThioJoe. And well.. the email itself is already very sus by the way it's written. Looks like it was written by a teenager or something. Also having attachments... Makes it way more sus. I know official YouTube emails and they never attach files or warn about limitations. Also what if you try to run this on a Linux or Mac system? I bet the scammers think that everyone runs windows, which is false.
5 likesthey did
2 likes15th
3 likes@@Endermanch wassup, been subbed for a few weeks. i like your geometry dash music taste lol
7 likesDidnt expect you here! Hi ThioJoe :D
10 likesThey 100% did, if you look closer the lips at times look incorrect, but it's very well concealed with low quality
335 likestrue
7 likesO
5 likesTrue. It looks like the deepfake's lips don't even sync to the audio, and even then, the audio is quite not very natural.
52 likesok
10 likesHi thiojoe 😎
30 likesI'm guessing so.
26 likesIt's actually not a keystroke logger. When you run the file, it steals the browser cookies that keep you logged into YouTube. Once the scammers have the cookies, they can put them into their browser and have access to your account without a password or 2FA. They then change the password and 2FA, and you have lost your account. It's quite effective once the victim falls for the scam.
806 likesReplies (25)
@@ql440same, but even if someone reads email whos going to run a suspicious, 680mb file, and marked as "pdf" when its .scr
0 likes@@actuallypositival_ if you change your Google/YouTube password it will log you out of your other devices.
0 likesI recently got got by one of these, luckily they did not change the password or 2FA, which is how I'm still here today.
1 likeSomething similar is going around on discord, but with an actual keylogger
0 likesbasically if you fall for this trick the only way to save your account is deleting all cookies and deleting every trace of the program and then running a virus scan, THEN logging back in
0 likesTldr: Why can't they bind the cookie to IP address...
0 likesand/or User Agent? If both change, the cookie is invalidated, but if one changes, it might or might not be, depending on security policy.
@@ql440 same
0 likes@@raaymonf it s targeting 1k+ people
0 likes@@__Razer If the password is stored on autofill, they can use inspct elements to make the password visible, or just copy the text and paste on any text editor, if the site doesnt stop you from copying passwords
0 likesSo that's how they stole people channels by sending the file to scam them!
0 likesHow do they change the password with only cookies? YouTube requires the old password to change the password even once you're logged in.
2 likes@@raaymonf ur crazy if u think youtube is all they get access to. if u have sessions for a crypto exchange, ur email, or a bank they can waltz right in to those without logging in.
2 likesThey can't change the password and 2FA
1 likeThat’s pretty understandable that they try to steal a cookie session but how do they change the password without access to the old password? When you try to change your Google Account Password, you’ll first be prompted to enter your old password. Oh shit, wait! If they could access Gmail from the cookie, then they could reset your password without the old one 👀
1 likeI don't know how that works in the US, but at least in Europe, I always had to prove my identity by inputting my password for stuff like changing password, so that wouldn't really work for me being European. Anyway, I know that this isn't how it works and the title clearly says "shares a video with you" - YouTube would never put something like this in a video with Google CEO (if anything, YouTube CEO would make much more sense). Knowing corporate shit, changes to corporation user policies happen more in a stealthy manner, where they silently update the policies page and then just send out emails prompting users to take a look at the new updated policies (which most people won't even do). They don't even conveniently link to the policies, just "search it up" (why make it convenient, right?). So scams like this would NEVER really work for someone who is familiar with policy updates from corporations like YouTube. Plus, this is the first time I see they forgot to remove the access to the video (so you can't just flag and report it as a scam to YouTube - because even if you set the video as private, it is still subject for community guidelines and if it violates them, then it doesn't matter the video is private, it can still be reported and removed for guidelines violation - although even if the video access is removed, the URL isn't, and you can report the URL to YouTube, so in its way it achieves nothing, just a mild inconveniece). They remove the access to the video once the email is sent (i.e. the user is notified), so the video is inaccessible, but the email is still there, including the full video description, which pretends to be an official message.
1 like@@patrickboyd8937 what virus?
1 like@@patrickboyd8937 only way is to never click on "Remeber me", that's it.
1 likeExactly what I thought after seeing this while before linus got hacked channels
2 likes@@ql440 the virus
3 likes@@TheBedLump_Sans i dont even read my mails
7 likesNo matter the variations what the scammers are trying to get at is a session token/key for your account; that is how they would bypass the 2fa.
13 likes@@patrickboyd8937 Cookies?
4 likes@@tubbunny so how do you get rid of it?
5 likesIt's basically a YouTube cookie logger. I am safe, I don't use YouTube enough.
14 likesSome different variations don't steal your browser history or any of that. They steal your cookies and session key, which lets them login even if the password gets changed.
47 likesWe need a petition to make a major policy to never open email files unless requested on most sites.
354 likesReplies (3)
Not clicking links or opening attachments is good practice. When I order stuff online, I always log into my account at the shop and download the receipt there.
8 likesYeah, good luck.
1 likeyes
5 likesYouTube. Stop striking Enderman.
49 likesI would find it odd that the CEO of Google and Alphabet reaching out to their creators. Pretty sure Sundar Pichai would have more important things than to make this video. However, CEO of YouTube is currently Neal Mohan. It would be Neal's responsibility for overseeing YouTube.
97 likesReplies (6)
@@sofiaknyazeva CEO isn't the only person who does things and comes up with ideas at a company you know?
1 likeNo he didn't. Dislikes were been removed earlier when Susan was the CEO.
0 likes@@user-ck1rx1yn7n she stepped down and now we have the person who got dislikes removed and pushed for nfts on youtube as ceo
14 likes@@user-ck1rx1yn7n Since about a month ago.
6 likes@@user-ck1rx1yn7n New enemy basically.
5 likesWait, it's not Susan anymore?
6 likesI REALLY HOPE YOUR CHANNEL DOESN’T GET TAKEN DOWN I’VE LEARNED SO MUCH😭😭😭🥺🥺
77 likesReplies (3)
I would cry non-stop if Enderman was banned
1 likeYeah, I Am A Really Nerdy Person And These Videos Inspired Me To Be, They Were Funny And I Liked Learning About New Stuff Every Day He Uploaded A VIdeo
0 likesIt would just be very sad if they took his channel down like that..
5 likesWow the CEO himself made a video about the monetization policy change. What a dedicated man.
52 likesReplies (2)
@@Sunny_chips fr
2 likeslol if that actually was legit it would be put on godly rarity
4 likes(1:19) I remember seeing a similar thing happen where Google Drive was being abused instead of YouTube. Gmall were smart enough to file those as junk mail as they were sent to many random Gmail addresses.
82 likesReplies (5)
@@catminer7436 oh, how {boring}
0 likes@@funduck2015 let's say it was some NSFW things
0 likes@@catminer7436 hey, a fellow [big shot]
0 likeswhat exactly is [in there]
I get some [REDACTED] pdfs files, of certain things for no reasons in my email
4 likesi still get them lol
1 likeI'm sorry about it. I have been watching your videos for 3 years or so since the COVID-19 lockdown, your videos were really entertaining and educational at the same time. Due to college tests starting from next Saturday, I haven't watched your videos for a while. I hope it will be resolved.
36 likesTheir deepfake of Sundar changes from a British accent to an American accent halfway through
43 likesReplies (1)
Such scams feel so legitimate and well as long as they don't screw up over small things like theze
3 likesEverybody: fears that their channel could get hacked
123 likesEnderman: AHH YES, FINALLY, A SCAM MAIL!
Replies (1)
https://www.youtube.com/watch?v=AZfNtTLnFtk
0 likesThe scammers did know the time that he was going to be striked.
"Download document for Windows"
23 likesPeople that have Linux: 0:19
Replies (1)
definitely the based moment of all time
2 likes14:00 You can likely use a Hex Editor like HxD instead to remove a bunch of empty bytes (assuming that's what is inflating the file size).
221 likesReplies (11)
@@Endermanch Of topic and I'm not syaing I'm expert, but most Linux channels when they analyses these files they just eith use head command / pipe to cut the file to the level where it garbage data started .
0 likes@@Endermanch Doesn't usually the PE header give a clue where the executable ends? Maybe you are safe to remove the last 30 MByte.
2 likesIt actually IS the reason why it's so big (that's what she said)
0 likes@@kyoudaiken that's what I meant. But it's hard to understand where that pattern starts in the hex editor
33 likes@@Endermanch Random bytes are not compressible at all because their entropy would be near infinite. But you have seen 7z had less than 1% of the file left when compressing. So it's some pattern that's just repeating over and over again being compressed away using the dictionary of LZMA2.
37 likesYou can't, it's garbage data in there. I specifically said it was garbage, not null padding since it could be an embedded resource which you wouldn't be able to safely remove using HxD.
68 likesthis is actually helpful information thanks
6 likesok
2 likesok thank you information that we totally needed to know 100%
2 likesok
2 likesok
5 likesIt's actually pretty scary to see what hackers/scammers can do these days, wow...
93 likesReplies (8)
Yes
1 like@@THE-X-Force man me too, I just trying to find a biofuel quote and google showed it as the first then BOOM. Microsoft scam security. Terrible afternoon
0 likesIt's going to get exponentially worse, and soon. I feel bad for all of the average people out there who aren't very tech-literate.
1 likeThey even use similar looking characters called "cyrillic characters" to impersonate official e-mail addresses, so most people couldn't spot any difference unless they do some checking using the "unicode identifier"
6 likesLike girls on instagram >D
1 likeyes
1 like@@UCyAn7sD-VHF2H9KDasGpUng i would definitely believe that
2 likesThis isn't that well set up but yeah -- they could've done better
12 likesI hate it when cybercriminals try to impersonate a real company
171 likesReplies (13)
fr
0 likesSomeone had impersonated me on YouTube
0 likesBut I reported him and he got terminated
the chain of fr is broken again
0 likesfr
0 likesI hate it when cybercriminals
2 likesWhat's your preferred method of getting scammed?
8 likesfr
0 likesfr
0 likesfr
0 likesOng
0 likesfr
0 likesfr
0 likesfr
8 likes11:45 also deactivate from any other login session using the non-infected device (a phone for eg). The stealer uploads session cookies which works in some site even after password change.
9 likesЯ не могу не пожелать тебе удачи выжить в этом недоразумении Ютуба. Ты стал жертвой людей, которые ради своей забавы хотят удалить все твои каналы, думая, что они всесильные. Справедливость должна восторжествовать, и я надеюсь, что
22 likesэтой ситуации дадут больше внимания.
How are they sending emails from the YouTube domain? Also, so much for the "Scanned by Gmail" feature doing absolutely nothing regarding this. With a company as large as Google you'd think they could run a virus check for larger files. Of course though scammers will just artificially increase the file size even more to combat that.
47 likesReplies (17)
@@papajohnscookie I think you are right. But only for Google drive files since Google can actually access them.
0 likesGmail is NOT safe they sell your data to scammers.
0 likes@@Rikysonic thank you for the explanation!
0 likes@@HaRsH-GoR They put file on google drive. File is encrypted so it can't check it.
1 like@@papajohnscookie yes, it's automatic: if you share a legit Drive link, Gmail will also show it as an attachment to easily download it without going on Drive - so this email is "legit", it's the video they shared that contained malware and with that video and that crafted description they basically exploited the Gmail automation
4 likes@@papajohnscookie that was the only other possibility I could think of, some kinda automation there.
1 like@@realcomputerdude100 I think gmail will attach google drive files to the e-mail if there is a link to the file somewhere within the e-mail? I could be wrong though
3 likes@@GavAttackO I'm glad I'm not alone, I thought I was losing it! 🤣
0 likes@@GavAttackO True, I could've explained it better. I thought it was obvious, my bad
17 likes@@Endermanch Unless I'm oblivious I only hear it mentioned once and not brought into any further detail outside of 'it's unfortunate that sharing videos with others is similar to YouTube creator notifications', something along the lines of that.
10 likes@@Endermanch i still no get it sir,, like how they can attach that file with mail
2 likesI explained that in the video...
16 likes@@amongsussyballs I've never heard of being able to attach a file inside the description of a YouTube video.
0 likesA link to the file, I could understand. But the file was attached in the e-mail.
@@realcomputerdude100 its in the description of the video?
0 likes@@GavAttackO but then how would the archive get attached to that e-mail?
2 likes"Hi John, they used a share function in Youtube. So they have a private video, so you can't see it, but the thing with private videos is that you can give access to someone. So they add your and other youtubers emails, so you would get this email from youtube, stating that this and this channel shared a video with you. In the email you can see description and title of the video. Once you receive that email - the scammers just remove access so you can't see it, that's why it says the video is private, but you got email from official youtube domain."
30 likesI actually found the answer to this question from a comment in another video. I'll copy and paste it here for convivence.
8 likesOriginal Commenter: Ignelis
Comment Source: "The Latest YouTube Malware Scam" from John Hammond
(Slow clapping)
31 likesWay to go, scammers.
Works this virus file on IOS? Or only windows?
0 likesYou might also want to pin a comment with the video here. If that's even possible...
4 likesI'm not sure abt the editing rights, but you could also add a "showcasing purposes only" disclaimer into every description, maybe that influences the algorithm.
Good luck, let's hope there will be a real human looking over it before they can terminate you and your communication attempts are more than speaking to a wall.
5:22 no way the "youtube team" would have only 700 subs
3 likesReplies (1)
tbh the scariest part is that 700 people were tricked into thinking it's real and subbing to it, or it could be botted
0 likesStupid me downloaded the thing because I was scared of loosing monetization ( I know im stupid). I opened the zip but did not touch the document in it. My question now, am I safe or did it already infest my system?
2 likesReplies (3)
@@PaddyPatrone Did you open it. If not, you we're completely fine.
0 likes@@violentvincentplus Just changed all my passwords on another computer. Hope that helps.
1 likeHopefully ur safe
3 likesWe need Linus Sebastian and LMG to watch this now.
39 likesBtw, run it on a Linux or Mac system with wine to see what it can do.
Replies (7)
@@hunterzone4846 perhaps. But i would still like to see what it can do. Someone managed to run memz on wine and something happened
0 likesIt probably won't do anything. Highly doubt the malware is designed to work on wine.
2 likesyou can do the same in a VM
0 likes@@yliassloudtech348 i can't as I don't have windows and I wouldn't as ik what it does.
0 likesRun ît on a Windows computer
0 likesI would love to see the OSFirstTimer guy try the latter! After all, he did respond to phone-based tech support scams that say his Windows computer has a virus, saying "Sorry, I use Ubuntu".
12 likes"hey, if you do not sign the document you are banned from Youtube, also we do not have a linux/mac version"
16 likesSomehow this isn’t official, it’s a fake message which is a scam.
13 likesI wonder if they shared a private video with the description as the scam message. Would make sense why it says Shared a video with you
3 likesayo! nice video. i miss sometimes old video type like showing how virus works (like petya).
4 likesi still like this type but would be cool to see more malware videos!
We should be able to set an anti-phishing code/passphrase on sites, so that when a real email comes from the company it contains this code. If it does not contain the passphrase we set, it should ring a bell that it’s a phishing/scam email.
4 likesReplies (1)
This isn't anything private, but usually, that would be your YouTube channel name in this case, to at least prove its for you and not just spam.
0 likes.scr also prevents window's smartscreen from coming up when running it.
4 likesReplies (1)
Time to make this extension non-executable in the registry.
0 likesI noticed after a while that I hadn't gotten any notifications from Youtube about you uploading. That alone had me a little bummed. But when i saw the title to this video. My heart truly started to melt. I absolutely love your videos and simply the thought of your channel being terminated brings a tear to my eye. Hope you get through this with your channel still in tack. I wish only the best for you Andrew 🙏
7 likesNotice the "confirm=no_antivirus" in the URL. Wonder what that does 🤔.
7 likesReplies (2)
@@yotoprules9361 I know what it does… I was making a joke.
0 likesit skips the antivirus prompt that google drive has
5 likesStarting to think YouTube should move communications to YouTube studio
2 likesJust a note, the email is actually from YouTube, it's using the share feature to send a video containing that malicious link
13 likesReplies (1)
Ahh.
1 likeIt's time for a class action lawsuit against YouTube/Google. No mentally stable person would share a video using the share function via email. This makes no sense. Yes it's a feature from the late 2000s but still... This really feels like negligence. Why did this not have been removed years ago?
1 likeThat's some next-level trickery right there
5 likeshey enderman i noticed this youtube team account only has 719 subscribers
4 likesThe "Anti-anti VM" i didnt expected that XD
2 likesBTW if You look at the subscriber count, and see that it's fake. Also I don't know they would private the video, they have them public and I would also compare the name (not the display name but the name with the @) with the real and fake YouTube channel.
1 likeScreensaver? For me those are AutoCAD scripts. 😉
12 likeshey everyone he has 1 strike WE NED TO HELP HIM NOW
5 likespls if u can pin it
I witnessed something similar back in February 22 of that year. This time, it's with Playrix's job inquiry through DeviantArt's Chat.
0 likesi'd like to see the malware! (also i thought you used chrome not edge lol)
3 likesBut HOW? Google doesn't let you make an account with the same email as another account! How did they bypass this?
4 likesReplies (1)
The scammer created a channel called YouTube Team and uploaded a deepfake AI video with the text of the email in the video description. Then they use the share function from YouTube to send it to their possible victims. That's why the sender looks legit because it comes from YouTube itself. The email contains the text of the video description and the layout YouTube uses is the same layout they use for official emails. To me, this looks like negligence from Google/YouTube and they should be sued for this.
0 likesWhy does Windows never show extensions by default
1 likeThat's why do I think that LTTs rented out their account.
2 likesEnderman's the type of guy to install windows 11 on a potato
4 likesReplies (1)
tbh that's exactly 1gb windows
0 likesThe deep-faking levels here are scary. I think deep-fakes should be illegal.
5 likesReplies (5)
I AGREE 100%
0 likesAI generated videos and pictures absolutely creep me out, no matter how perfect they may be.
I can see the channel’s fake, but the deepfake is scarily fake.
0 likesi mean it's only really viable for memes and stuff apart from this, but if you have a keen eye, you would see that the channel isn't official either way
3 likesAnd I like making SpongeBob say the n word
4 likesNah it's fun
3 likesWouldn't mind proposing a new notification format for private video sharing to YouTube so it differs from the official messages a lot (this way you can clearly distinguish a video share at a first glance). I am pretty skilled with basic HTML/CSS, so I can compose a new email layout for this.
2 likesThat's why all my friends in youtube has a backup channel in odysee, rumble and tilvids
1 likeI already saw something wrong as the file protected as said in the email. Just a rules and policies document why they need to encrypt it
3 likesReplies (1)
Well, that's called common sense, you got the common sense that it automatically flagged your suspicion into a big BS alarm
0 likesWhen YOU don't TUBE the YOUTUBE, you get scammed. Stay safe guys.
6 likesthere is "no_antivirus" in the link LOL
7 likesJust noticed, HE WAS USING EDGE OMG
2 likesi might be thinking too simple about this, but can't MS just warn users like if theres a . followed by 3 letters in the name before the actual extention?
1 likeThis is why I watch out.
5 likesAh yes, I love when YouTube Team shares a video with me on YouTube.
2 likesThis video's good to make me forget about polynomials assignment I've got to do.
If the ceo of Google sent me a video about the policies of YouTube changing I wouldn't believe that in the first place
0 likesProbably a variant of Redline
2 likesHow did you not instantly notice it was a deepfake bruh
17 likesReplies (3)
fr lol
0 likesNot even a good quality one, the voice sounds so robotic.
6 likesI didn't either on first watch, I wasn't really paying close attention but looking back you can notice
4 likesHave you uploaded it to the github repository? i'd like to take a look at it.
0 likes"no ones gonna run this file"
2 likesi wonder to what happend to linus drop tips
If you listen and look closer at the last bit of the video of the CEO of Google, you can tell it was a voice over the original. His mouth movement and what is said in audio doesn't match.
1 likeReplies (1)
heck yeah i realized it
0 likes5:10 if you pay attention to the guy's lips you can see that its not syncing with the voice. giant red flag
0 likesCool video. I had a video idea that is impossible. Install windows on a hdmi cord
0 likesI don't understand how almost every scam has bad grammar which gives it away.
1 likeReplies (1)
It is Google Translate
0 likesNext video pls! Downloading malware on MacBook
1 likeFinally a chad who has the taskbar on the top
15 likesReplies (1)
Have it too lol
1 likeNow we gotta develop a scanner that can scan files that are under 1GB in size.
3 likesReplies (1)
Or a 1 Exabyte size file
0 likesWhen some russian guy (probably with one of his arms broken) has to tell you not to execute files from e-mails, there is something wrong you had just done.
2 likesSilver Chariot Requiem is always a problem 😂
1 likeOne way to prevent getting tricked by this type of scam is changing the way .scr files are opened. Create a new action for the scr and set it as default. For me, i created action 'open2' and set it to open 'notepad.exe "c:\Users\Public\screensaver_warning.txt"'. Windows will still launch screen savers normally, just the user will not. Also by right clicking it, you can still launch it using 'Test' action.
1 likeI see what they did. They shared a video via email.
0 likesEven since I haven't got anything, looks like I'm good for a moment. Thanks for alerting us!
1 likeHey Enderman, I have a idea. Making an Windows based OS that just launches a program and that's it, and you cant do anything else. We will use Windows PE For this process, I have tried so many times but i get the same error or just bigger errors and i don't have enough brain for it. This is how i imagined: Windows PE Launches from ISO/any boot-able Source, Installs necessary files as like system32 and the libraries, Installs some drivers for the program to run at all, Restarts. Launches the Program and that's it. Could please do a topic on This?
0 likesmrbeast, e-mails, deepfakes, youtube scammers find every possible way to scam
3 likesrandom question but do you think you'll ever make merch?
0 likesdannggggg they tried to hide that harddddd
0 likesHello which software you use to trace that file exicutive location plz tell i mean which software you use to find that virus location
0 likesI was listening to one of my playlists on spotify, and I heard your intro music! Is it Drive Slow - Windows 96? Anyways, I love your videos and they have inspired me when creating code. I hope to keep watching your vids. <3
0 likesSo, basically, the entire premise of this scam consists of assuming that the file is a PDF file, just because it comes packaged with a PDF icon in the executable. This is combined with completely ignoring the simple fact that this so called "PDF" file just happens to have a .scr extension.
0 likesReplies (1)
Most pc noobs have file extensions off
0 likes😱
5 likesReplies (1)
😨
0 likesRIP Andrew!
2 likesI just noticed that Enderman is using edge 🧐
1 likeReplies (1)
the moment of all time
0 likesBig companys like google, youtube(owned by google), amazon, facebook, ... should really just sign their outgoing email using SSL certificates, that user can just look for the little checkmark (or however the users email program/website/app shows it) to see wheter or not the email is real or fake, just like the litle padlock in the browser. But for some reason nobody using SSL email certificates. Wouldn't help in this case but it would help against some types of email spoofing (where they just change the sender adress)
0 likesCan you do "Upgrading" from Windows Longhorn to Windows XP?
0 likes(it requires a special application called "Application Verifier")
notice how the description is unupdated that’s great.
0 likesThe download link from Drive has "no_antivirus"... Is it the imposter?
1 likeI remember GroovyDominoes52 being scammed by a similar scam.
1 likeBTW, I'm using Windows 10 22H2, an OS I highly regret using.
Replies (2)
@@SkyKrye lol
0 likesthat's a funny way to spell spyware
0 likesYouTube if you see this, Dont terminate Enderman. (pin this)
2 likesWhatever his mouth moves separate to his voice sounds
3 likes12:46 thats .NET framework (it is just launching that because that scr was a .NET app)
0 likesDid receive one of these scam emails though, but I knew those were not real because they are sending a file... Youtube dont do that...
3 likesReplies (2)
@@thisusernameistaken. True
1 likeyes , unless if we ask for it , as what he said
0 likesWhere do you get your MP3’s from?
0 likesrip
1 likei love your channel, I hope you don't get taken down
1 likeAmazing work to disclose the work of these bad people!
2 likesThat was such an ai voice in Sundar lol 7:11
0 likesEnderman my brother, you need more information to really get what was going on. But you did partially correct
2 likesBruhhhh he dubbed the clipped, Listen to the Audio and watch his lips. Scammers tried to lipsync his short clip
1 likeAh, a YouTuber I watch, The Bread Pirate, recently fell for this one. His channel was FOX News for a little while.
0 likesWhat VMware version do you use?
0 likesReplies (1)
16
0 likesthese scammers always thinks that they can get away with their actions lol
3 likesReplies (1)
They do
0 likesis this right? generate me 30 sets of strings in the form of "xxxyy-OEM-NNNNNNN-zzzzz" where "xxx" is day of the year between 001 and 366 (for example, 192 = 10th july) and "yy" is the year (for example, 94=1994). your range is from the first day of 1995 to the last day of 2003. "OEM" mus remain intact the "NNNNNNN" segment consist of digits and must start with 2 zeroes. the rest of the numbers can be anything as long as their sum is divisible by 7 with no remainder. the last segment "zzzzz" should consist of random numbers. "z" representing a number.
0 likeswhat happened to your "limbo free download" video?
0 likesReplies (1)
Same question here
0 likes"720p can't see crap"
0 likeshappily watches in 144p, since my internet is too slow for anything higher
Replies (1)
I have full ram and BOINC on all cores and gpu, so when youtube unswaps, it reduces quality.
0 likesHe is right be aware on what you do on the internet
1 likeI wouldn't click on a google drive link that contains export=download&confirm= no_antivirus
0 likesLike bruh, what would you think that a link with "no_antivirus" would do??
well in this cakes, i shall rename the cookies into pancakes
0 likesnow that's a pastry joke my friends
pretty sure the YouTube Team channel is not verified too also.
0 likesFirstly: WHAT YOUTUBE😡!!!!!!. Secondly: why is this happening!😮
0 likesI think it's the RedLine trojan.
0 likesSo did he trashed that phishing e-mail or not?! (I also got a phishing e-mail on my Gmail too yesterday!)
0 likesI’d definitely get scammed if i received it
1 likeReplies (1)
So you admit to being an idiot
0 likesNaming a Youtube channel Youtube should not be permitted in the first place
0 likesEverybody gangsta until Enderman starts using MS Edge.
0 likesReplies (1)
He is to lazy to install another browser on a vm.
0 likesLinux and Mac users left the chat
0 likesHii sir i have already double click scr file received in mail now my pc restarting problem every 5 min.i run all type scan Malwarebytes or windows defender but not threats detection so now what can i do?
0 likesCan i find where is scr virus installed in my folder??
Help me
Replies (1)
Reset Windows, my dude.
0 likesHow they are faking the YouTube mail address
0 likesthere is no validation on the email
1 likeReplies (1)
"the verified logo is not here"
0 likeslinus tech tips got hacked like that like 12 days ago
0 likesyou are now using edge as your browser???
0 likesWill you update to Windows 11 and what do you think of it?
0 likesReplies (1)
He did, but uninstalled it and his thinks its shi-
0 likesIf not for the 380mb pdf (hahah just why?), I would not notice this is a scam at all.
1 likeMIGHT have been easier just to put an URL to a malicious website that redirects you to a real pdf anyways.
Honestly, this just feels like something someone was paid for to target a certain person.
Endermanch did you downgrade to edge?
0 likesI have a question:
0 likesIf I download a virus that steals my data and uploads it to the user and run the virus, will it work if my internet is disconnected?
Replies (1)
You mean "If my internet is disconnected, the attacker will be able to steal my data". If you mean that, the answer is no.
0 likesreal
6 likesReplies (3)
yes hi it is me from the live chat the code is not finished (for the project i accidentally pasted)
0 likesyes
0 likesyes
1 likeSomething I’ve always wondered, well actually 2 things related to malware. Number 1. Why do some pieces of malware have anti VM in place? Whats even the purpose? 2. Not mentioned in the video, but I heard it somewhere. Apparently, there’s a select number of pieces of ransomware that have a kill switch, be run on a computer in Russia. Usually done by seeing if Russian is an installed language. While it’s great to have such a thing, why does it even exist? Ok, this one has nothing to do with the video, but I still want to know. If anyone has answers for either one, then let me know plz. Thanks.
5 likesReplies (5)
vm (mostly) allow the file to be executed in sandbox environment. They can analyze its behavior and allow it to infect a virtual os without exposing their real OS. This way any gathered data of the malware behavior will remain intact even if the virtual system is corrupted and destroyed. And they can use the gathered data for better security improvements, better database for anitivrus and patch fixes by exposing vulnerabilities.
0 likesSo if a malware wont run in VM, it makes it difficult analyzing its behavior but also running batches of testing.
anti-vm/sandbox is so that people can't analyze it (just use an old airgapped pc/maybe kvm if so), and the 2nd could be personal transgressions or simply targeting a specific country, like how virus sites give specific ips specific payloads
0 likesAs for your first question; What is the point of a VM? VM is short for Virtual Machine. It's a way to run a program that usually you have made for testing it out. You as the developer of this software don't want to accidentally kill your box so you run a VM. It will kill the VM instead if you screwed up your code somewhere. Same goes for malware; Run it in a VM and your box is UN-affected. If it's destroying your VM you can always reset it back to it's known good state. Malware is designed to either make you pay for something you will never receive or just be mean and destroy your PC. Some are called Ransomware. Those as the name implies encrypts your files and the person who did it has the ability to decrypt them if you pay them a lump sum of money. Lately it's in Bitcoin or some other crypto-currency. But in this video the YouTube scam is to hack into as many accounts as possible and lock them down. Most likely for money. Install this little bit of Malware; run it and in the background it's tracking everything from your screen to what key's your using on your keyboard. That's how Linus got hacked. An employee of his opened up of these emails thinking it was a real sponsorship deal they had to read the terms of and next thing you know they got into his YT account.
1 like1. So the malware has a higher chance of infecting an actual machine. Alongside preventing channels like Enderman from showcasing them, making removal videos etc. (That's a guess, so take that info with a bit of salt) 2. I would assume that its because the creators of malware don't want the viruses to run on certain devices. Let's take your Russian example:
5 likesIf a Russian malware developer were to make malware that is supposed to inconvenience the western countries, the developer wouldn't want it to backfire against its own country so they code a kill-switch in to prevent it.
For the first one I think it is to prevent the malware from being analized by an organization or individual, and also to motivate users to run it on their actual machine
3 likesamazingly, none of my ~500 subscriptions has been hacked and name changed to Tesla
1 like0 comments
2 likesthe comments: 1M
Plot twist: you dont have a browser
0 likesDo you use edge as your personal browser?
0 likesHow to deal with scammers:😂 don't anwser
0 likesI got that email. Glad I don't read them, unless I know I did something to get the email.
0 likesЭндермен пошел в гдшерство!!!! Вернам гордится им
0 likes8:37 I will boot my anti-anti-VM machine.
0 likesHello, I have vmware workstation 17.1, when I turn on the virtual machine, the vmware logo does not appear when I press the esc key to go to BIOS, that is, I installed Windows XP, the Windows logo does not appear, the welcome message appears directly.
0 likesI love my pdf screensaver files
0 likesТвои видео очень хороши, я буду смотреть каждое из них :D
3 likesi am learning russian so some letters may be misspelled or inaccurate
Replies (1)
According to Google translate your Russian is fine! Good luck on your journey learning it!
0 likesYouTube Channel Hacks Are Everywhere
1 likeyou were absolutely hating microsoft edge and now you are using it. why?
1 likei also saw a small korean channel get hacked too 😥
0 likesDo more appeal requests so they can see it
1 likethank god I was lazy to open it!
0 likesRun every virus. And chilled windows
1 likeHim: Edge sucks!
1 likeAlso him: Uses Edge in the Video.
Me: Bruh?!
Replies (2)
* confusion *
0 likesI was wondering the same thing.
0 likesWhat about the mrbeast 1000$ scam ad that has been going for years on youtube.
1 likeHave you tried oddessy
1 likeReplies (1)
the bad thing is it doesnt have mobile app (play store one is just webbrowser)
1 likeinstalling windows 8 on a hammer
0 likesCan you use Nk-Classical this music in next video?
1 likeErpic failed against Harmony Endpoint lol
0 likeswhat is sim.exe on your desktop?
0 likesWhat is your computer ram ,, and what your CPU ,,
0 likesHey Enderman! How about tweaking a Windows 11 Home Edition to Pro edition as your next video?
0 likesWAIT, DONT YOU HATE EDGE?
0 likesThis scam had more red-flags than a construction site. 😒
3 likes🚩 Even non-native English-speakers can recognize the terrible language in the email (even in this version which is different from an earlier version which was even worse such as saying "getting monetization" and having dashes on the list of restrictions).
🚩 The deep-fake is terrible. That was NOT Sundar Pichai's voice; he has an Indian accent because he grew up in India and only went to the US as an adult, the deep-fake voice sounded robo-American with hints of British. 🤨 🤦
🚩 YOUTUBE/GOOGLE has a video that tops out at 720p? 😂
🚩 Why would Sundar handle YouTube stuff? He deals with Alphabet stuff and to a lesser degree, Google stuff. He leaves most YT stuff to the YT CEO. He just handed it off to a fellow Indian guy (like most American companies), so why would he do it himself? 🙄
🚩 So… they used the SAME PASSWORD for EVERY file and then put the password in clear-text in the description of a YT video? And that makes sense to people? 🤨
🚩 Google knows everything about you, they have ALL your data. They wouldn't send an English email to everybody, they'd send one in the language you specified is your native language. Enderman would get a Russian email, not an English one (if it was actually from Google).
🚩 The drastic difference in filesize with compressed size means either the dev was so incompetent, they bloated it beyond even the laziest game-developer's abilities, or it's artificially padded with lots of nulls. (To be fair, that could actually be the work of YouTube since they're so garbage at their jobs.)
🚩 WTF has ever seen a 700mb PDF file? 🙄
🚩 Overly-large files can't get scanned by cloud anti-virus but CAN be scanned by local AV programs.
I'd like to think that even non-tech-savvy people would notice at least one of the red-flags, but alas, I know better. 🤦
How did the dropper put files under the Windows directory without elevation? 🤨 This is partly on Microsoft, a fresh Windows install should never have new accounts running with admin privileges, they should always default to user-accounts. Duh. 😒
Replies (2)
More red flags than a communist parade
0 likesI am probably one of the few people who has worked with legitimate pdfs that large. A high-resolution full-color 700 page scan of sheet music I’ve seen came out to 1.3 GB!
0 likeshow inconsiderate of these scammers not to include a Linux version 2:25
1 like5:16 I did not even know what you said
0 likesit looks like the og youtube emails this it's super obvious its a scam
0 likesReplies (1)
your only fans is a scam
0 likesWindows 1 + Windows 2 + Windows 3.0 + Windows 95 + Windows 98 + Windows 2000 + Windows ME + Windows XP + Windows longhorn + Windows Vista + Windows 7 + Windows 8 + Windows 8.1 + Windows 10 + Windows 10X + Windows 11
0 likesTry It.....
Replies (1)
Windows 10X and Windows XP and down is going to be extremely hard.
0 likesyo enderman can you make a tutorial how to use vmware and how to install it? (i dont trust others, im also subscribed and i trust you and also if you already made one then im sorry for wasting your time and also link the video below this comment)
0 likes#SAVEENDERMANCH
1 likeReplies (1)
no.. is #saveendermanch but still 😭😭😭😭😭
0 likesThanks, Enderman!
0 likeswhat if you run the windows installer while windows is installed
0 likesReplies (1)
you reinstall it, if you continue
0 likes👍Thanks.
0 likesYes, Thats true
0 likesbro he use setoolkit😂😂😂😂
1 likeWhat was that video? Limbo free download????
2 likesReplies (6)
@@TheMetalGuy what
0 likes@@kapix4023 but he made a video on a common youtube hack, we're in its comment section
0 likesit seems like a lot of youtubers have been getting hacked recently
0 likesHe is Geometry Dash player
1 likefr
0 likesthats what im saying
1 likecan you make another video of it and reverse it? what was the inside that sussy file?
0 likesinteresting...
0 likesYeah the video is AI generated for sure, Sundar doesn't speak like that
0 likesThe voice of Sundar was generated thru AI lol
0 likesMost likely voice generative one, but there're plenty out there.
I swear his voice changed like 2 times in the scam video
0 likesCan you share your Anti vm vm?
0 likeshello! im really trying to find a good virtual machine. do you have a link to download one?
0 likesReplies (3)
@WinDev101 I agree.
0 likes@@dark-mode. whatever allows you to run viruses and shit without it harming your actual computer
0 likesSoftware, or what?
0 likesI heard some of these things are full of zero-padding, so you might want to grab a hex editor.
0 likesOkay This Looks Like A Real YouTube Email
0 likesReplies (1)
@Coccocoa Helper I Used To Type Like This When I Was Younger Lmao
0 likesI never gotten this email at all! it might have been booted to my spam folder
0 likesReplies (1)
Same
0 likesif you are a scammer u cant try to scam enderman or he will roast u
0 likesThe video that scams people that yt channel wasn't have the small check (verify icon)
0 likesEverything in the message is a red flag, good lord! Hell, even the deep fake's a dead giveaway!
0 likesBtw how those scammers got ur email? That's strange
0 likes🤔🤔
Replies (1)
the about section. theres a contact
0 likesAt least Kaspersky and f-secure detect it! (I use Kaspersky).
2 likesReplies (4)
@@Proferk That is true, an antivirus should always be your second line of defense.
0 likeshaving the knowledge on how to catch scams and not running random executables from the internet is always safer than relying on antimalware
0 likes@@hunterzone4846 I agree, enderman should use it. Kaspersky's system watcher and intrusion prevention are very OP
0 likesKaspersky is great
0 likesthats a nice way of getting people to notice that youtube is coming for your soul (not like you already sold it to youtube)
8 likesyou can deleted This PC?
0 likeswait a min... ENDERMAN IS USING EDGE. wha-? doesn't enderman HATE edge?!
0 likesDid anyone realise that he is using microsoft edge?!
1 likeReplies (1)
I thought be HATED that
0 likes6:49 hmm "Youtube Team" is quite unpopular with only 719 subs..hmmm...hmmmmmmmmmmmmmm
0 likesenderman. i had last work for discord server. Bye. Thank You
1 likeThis is the first time I've heard your voiceover
0 likesReplies (1)
actually he been doing this like last year bro
0 likesIts just used an Ai that they maded a video of sunder pichai talk 😂
0 likesYouTube seemed to stop giving a damn about security and only cared about screwing content creators.
0 likesReplies (1)
Google titan security keys:eh
0 likesOh my god that deepfake video is so bad 😂
0 likeshow they can mail as no-reply@youtube ?
1 likeReplies (3)
@@HaRsH-GoR The scammer created a channel called YouTube Team and uploaded a deepfake AI video with the text of the email in the video description. Then they use the share function from YouTube to send it to their possible victims. That's why the sender looks legit because it comes from YouTube itself. The email contains the text of the video description and the layout YouTube uses is the same layout they use for official emails. Gmail automatically adds Drive links as a "pseudo attachment". It just opens the Drive link in your browser for you to download the attachment.
0 likes@@masdisini ye but how they attach that file with ?
0 likesIt's actually the private video sharing notification, the content of mail is just full of that private video description
0 likes.scr = silver chariot requiem
0 likesThe emailed link:
0 likes&confirm=no_antivirus
🤔🤔🤔
omg so that's what is happening about .scr files.
0 likesI got caught on this once in playing Minecraft with Skype times, like, in 2012? The "screensaver" was sent via Skype chat from one of my internet friends' account, and it looked like a picture and I wanted to open and see it. The first thing I did after realizing was turning off not the PC, but the router, so that the virus didn't spread itself further. After clearing things I turned it back on.
After that I lost my belief in antiviruses, lol
TBH the hack is a Tier 1 hack
0 likes#endermanch on the top!
0 likesI mean you didn't do something wrong
But now , Is YouTube trying to scam you? / like linus got hacked but he still posting?
12:46 thats .NET framework (it is just launching that because that scr was a .NET app)
0 likesit steals cookie, not a keylogger
0 likesHi, Enderman!
0 likesMan can you destroy Windows 10 S Mode with virusses ???
0 likesReplies (2)
@@dark-mode. :/
0 likesIts the same result if you did it on any other 10 type.
0 likesMay be an unpopular opinion, but I do prefer the videos with talking instead of text.
0 likesI Love your YouTube Channel and Hope IT will be resolved but If Not i Hope you will continue in odessy......
0 likesEnderman uses ms egde??????
0 likesThank you endermanch i knew it was a scam i am only saying thank you cause my brother destoryed my xp old pc because he really hated your videos and he bought me a new gaming setup to teach me a lesson i shoyld never watch your channel again
2 likesReplies (3)
@@dark-mode. yeah bro, what kind of substances was his brother on💀💀
0 likes@@SkyKrye TRUE
1 likewtf get your brother therapy💀
1 likeWhat you could have additionally shown is how the file looks in hex editor, more specifically how long is the longest stream of hexadecimal zeroes. The working code of this piece of malware is megabytes at most, and cutting out these excess bytes lets the executable get tested on virustotal to show what exactly is hidden inside the .scr file.
1 likeThanks!!!
0 likesКогда русские субтитры? :(
1 likeWhen rus sub? :(
Great to see you uploading again!
1 likeBe careful of scam
0 likesThis looks like program, who hacked Linus Tech Tips
0 likesIt’s sad, he can’t upload for two weeks☹️
1 likeJesus christ they're starting to use the ai voices and faces now
0 likesThat is VERY scary and concerning
Nooooooooo
0 likesBro can you make a video on hacking windows 8.1 metro apps to run in a window please in the memory of windows 8.1 please please i would appreciate that
0 likesI have 2 of 3 the copyright strike (I created this channel for get banned)
0 likesNah ill wipe the drive and load an image backup
0 likesnoooo your the best youtuber in the world
0 likesThis is scam is nasty but kinda mediocre in some aspects lmao
1 likethanks
0 likesWow bad
1 likeWhat if windows 8 and windows 11 are combined what will happen 💀
1 likeReplies (5)
@@dark-mode. oh well that's something I've never thought about before, it would definitely be ultra buggy
0 likes@@SkyKrye Yes, I do mean that.
1 like@@dark-mode. by hybrid you mean merging drives containing both the OSes? idk how that would work but itd be pretty interesting
0 likes@@SkyKrye He means a hybrid. Ethier way, everyone knows its just gonna be buggy.
1 likeYou mean dualbooted? Well nothing wrong will happen it's just that you'll need 2 seperate drives for that and install win11 to one and win8 to the other and boom you have dualboot!
1 likeREACH SUBS TO 300K
0 likesTrash scam
0 likeswhy edge?
0 likesIt's obvious it's fake because the official YouTube Team channel would have a lot more subscribers
0 likes11:31 dude i love your accent so much
0 likesFace reval?😵
1 likeyo
1 likeIF YOUTUBE TERMINATE THIS CHANNEL LIKING TERMINATED AIDHYSHI HE WILL BACK GETS HATED
0 likes6:15 Why do you need to censor the results 😰
0 likesReplies (2)
@@DaxyGamer Its quick links, I use edge.
0 likesit's bing news, not results
0 likeshello
0 likesyay
0 likesEnderman you should start a Patreon
0 likesMany of these viruses escape VMs, so you should change your password to be safe, unless you were using your Arch PC.
3 likesReplies (1)
he used his anti vm vm so he should be safe
2 likes6:07 He isn't pronounced this way. He is pronounced as "Suundar Pechaae" (spelt as: Sundar Pichai) . Lol he would never pronounce himself this way 🤣🤣🤣🤣
0 likesoh no
0 likesBro lol down at the video says: CEO google and "alphabet"
0 likesThis is not new its happened before. While the way they trick you is new, the malware itself isent
0 likesWow
0 likesi got a glock in my rari
0 likes17 shots no 38
I don't sure youtube demonitise this
0 likesI know this scam in other version (not youtube & malware packed in rat)
0 likesis jokes allowed in the comments section, I'm asking just to try to find out weather jokes are civil or not.
0 likesThis is why you never use anything video related as proof of anything anymore. unless the video is proven to be from an indivual thats a reliable source, (even then they can still be doctured). You should always ask someone to analyze the video if it has been tampered with in any way. For example the "sundar" video sounded very robotic like if you ever used an ai imitating a famous persons voice itd sound exactly like that vid.
0 likesSAVE ENDERMAN
1 likeReplies (2)
#saveendermanch i watch him 4 years, and if they delete him, i will make protest to google.. i will stay up, to safe him..
2 likesWe need to save enderman
1 likeAm I the only one who noticed that his pronounciation was really good compared to his real-life one? lol
0 likesi love your videos
0 likesayo bro please make a video were you install windows on btrfs
0 likesdamn
1 likeEnderman. My dad forces me to use norton... If he dosen't see norton on my pc. He installs it right away. Is malware bytes better then norton (i think it is better). And how I can convice my dad to stop paying for this shit. help
0 likesThe edge guy
0 likesI love you and all of you're videos ❤. I leant so much, love you and I am so sad😢
0 likesGood luck🍀,
I will miss you❤
And
We will miss you ❤
Sent from mail for Windows 11
Rip Enderman
We will miss you❤😢
Wait is this Redline Stealer If Yes Sooo.... i got it in my f-ing computer and thank Norton That Save'd me from that shit if no then no.
0 likesBro lol down at the vidio says: CEO google and "alphabet"
0 likesNo way that’s a deepfake
0 likesyou will be banned for scamming
0 likesoff youtube
0 likesI don’t read
0 likesE m a i l s
That looks old..
0 likesThe bread pirate!
0 likesVoice reveal bro
1 likeReplies (3)
@@dark-mode. what
0 likes@@SkyKrye Nahh, more.
1 likeHe did that like a year ago lmao
0 likesYay a new Enderman Video :D
2 likesЯ тоже из Калуги)
0 likesThey can't even copy youtube email to make it look modern
1 likeI can't be the only one watching the deepfake video thinking "man his mouth is not attached to the rest of his head"
0 likesDUDE maybe they asking for your password and email just to hack you
0 likesI hate scam is bad i dont want to hacked my channel
1 likeThe fact you used Edge. I’m disappointed.
0 likeso
0 likesТут есть русские?
1 likeaint no way this actually a screensaver
0 likesReplies (1)
@@daneo12 Huh, did not know that, thank you for informing me!
0 likesmade in python 100%
0 likesMy bro (Sunder) never speaks fast... xD
0 likesHi
0 likesWow
0 likesПривет ты же помнишь свое-го друга? Daniel Myslivets
0 likesfirst thing i saw on that youtube vid, deepfake, it just looks so fake
0 likes6.1 LIKE !!
0 likes🇮🇳
0 likesWait... I thought you hate edge
0 likesHi You can do a video installing "dx9ware cracked" pls
0 likesDo mobile malware
0 likesIs this scam?
0 likesReplies (1)
no ofc
0 likeswhy do you sound like gabe follower
0 likesLinus got it also like this 😂😂
0 likesi will help you bro !
0 likesi commented on a virtual machine
0 likesReplies (1)
ok?
0 likesВведите комментарий
0 likesisnt this A VIRUS?
0 likesNow it's betterwhen you speak
0 likesOo pretty smart of you to change the title and add a comment since you cant post
0 likesMight be better to talk about the problem in the comments instead, no one goes to the description
1 likeno one scams enderman
0 likesBro this is sad i loved your content :(
0 likes0 likes
scammer
0 likesis this the same virus that got linus tech tips?
0 likesReplies (2)
Possibly, but the LTT one was a fake sponsor agreement.
0 likesProbably, since the malware that got them was also disguised as a PDF
1 likeOk
0 likeswho are you to judge in bad english
0 likeshi
0 likesPlz doest steal My diamonds blocks 🥺🥺🥺🥺
0 likes???
0 likesI hope you didn't lost your channel
1 likeя тоже русский
0 likesDO NOT UPLOAD AGAIN FOR 90 DAYS. You can possibly be safe from having your channel deleted.
0 likesReplies (1)
too late, youtube will find the oldest video and the stupidest reason to remove and strike his chanel
3 likesSup guys
0 likesis it just me who thinks this looks so fake and couldn't fall for it, because:
0 likes1) the video is low-quality and lacks grammar and would have definitely been done better by the youtube team.. who literally own youtube lol
2) youtube channel with 700 subscribers, sus
3) google drive link, which also has "no-antivirus" in it's link, sus
4) the mail looks strange in some way idk
5) the file is very big, sus
Ed
0 likesi love your vids
0 likesyou can scan it if you compress it to zip and then upload it 13:36
1 likeHello enderman
0 likesMake an video about Windows CE
0 likesNice video
0 likesyou can install my Os?
0 likesI am early?
3 likesReplies (1)
Did you read his community guidelines, it says no spamming or self promoting aka first
0 likesя офигел
0 likesVery nice
0 likesI love your russian accent at times lmao
0 likesI was the 5,000th like!
1 likevideo idea: makeing the windows 7 installer a working system
0 likesyou are scam
1 likelove ur voice
0 likesThis actually is from the real youtube. These people are just making the video private then sharing it with other big youtubers. The text just has the description from the video.
0 likesReplies (2)
@@GavAttackO I'm saying the message is from the real youtube. thats a real youtube email. you get this email when someone shares a private video with you.
0 likesAh yes... the real YouTube using a 700 subscriber account with the title "YouTube Team" using a deep faked video. This is not from "the real YouTube"
1 likeALRIGHT, im switching to linux
0 likesReplies (1)
- Dumbledore said calmly
1 likeFirst! It's going to be a good video :)
0 likesReplies (3)
@@BecksAngelic No I didn't, thanks for the comment (enven if it's 1 month later lol)
0 likesDid you read his community guidelines, it says no spamming or self promoting aka first
0 likesActually, third
0 likes10th
0 likesReplies (2)
@@BecksAngelic that aint spamming or self promoting, its just a message
0 likesDid you read his community guidelines, it says no spamming or self promoting aka first
0 likes1st😊
0 likesReplies (1)
Did you read his community guidelines, it says no spamming or self promoting aka first
0 likesits kinda sus ... 100k views for 1 month the video is up ... WITH 5k likes .... AND 300k subs .... sus
1 likeReplies (2)
-👶🏻📲
0 likes"sus"🤖
3 likeshttps://www.youtube.com/watch?v=Ebcll7nG8YI it's private now lol
0 likesHow to stop getting your channel terminated.
0 likes1. delete videos that ambush people.
2. unsubscribe hackers that ambush you.
3. remove posts that ambush people.
4. do not make videos scammers can watch or else you will be scammed.
sad😔 he can't upload videos 2 months https://www.youtube.com/watch?v=AZfNtTLnFtk
0 likesMicrosoft Doesn't Even Give A Crap About Quote Unquote "Pirating" Windows 95 Or Any Other Versions Of Windows WTF Its Open Source!
0 likesFuck youtube. What is wrong with you. We love this guy. FOR FUCKS SAKE DONT BAN THIS GUY. DO NOT BAN THIS GUY. WE WATCH HIS CONTENT, HE HAS DONE NOTHING FUCKING WRONG.
3 likesi actually learned a lot from his videos. he didnt deserve any of this bs. fuck youtube
3 likesI got a message like this Hello yasin
0 likesNext steps
As a result of the review, we can:
Notice number: 45208082-677d-4b83-9c2c-15a7b1bb9528.
Your security on YouTube
We want you to feel safe while using YouTube. If you don't want to see certain content, you can block comments or users. Review resources for policies and tools to keep you safe on YouTube.
Thanks,
YouTube Team
Bu kaynak metin hakkında daha fazla bilgiEk çeviri bilgileri için kaynak metin gerekli
Geri bildirim gönder
Yan paneller
https://youtube.com/shorts/EekyHAXNSDE?feature=share
0 likesReplies (1)
everyone is laughing, right
0 likesYour channel sucks ass
0 likesMother Fucker I'm cheater
0 likespdf files cannot weigh 600 megabytes. Definitely a virus.
1 likeFirst of all find the idiot that did It , and report this YouTube video that YouTube should have already taken down
1 likeit's not only the bots anymore, now it's the deep fake people too.
0 likesgrate job YouTube.
Replies (1)
Deep fake people are probably unconscious twits
0 likesHave you seen the new ransomware they're using? or STOP/DJVU
0 likesI dare you to make a NoEscape.exe Clone or review Clones of the virus
0 likesFirst red flag: Download something. It's almost 100% that YouTube or any other company won't ask You to download anything.
0 likesSecond red flag: Language. I would really be alarmed by that.
Third red flag: YouTube wouldn't send a Google Drive link. it would be a link directly from YouTube domain. Yes, YouTube has been bought by Google. But it doesn't matter. They wouldn't send a link on Google Drive.
The two former flags could be ignored, because people don't read that. I wouldn't.
Also fourth flag: 7 days? No, it doesn't like that. You get specific date and description that "the new rules would be coming into effect from [insert date here]. Actually in most cases not removing Your account means You accept the rules. And I think they have to notify You 14 days or a month before it will come into effect. Though, people may not know this. Although if only big channels have been hacked, then I can't understand why Linus don't know this.
It's as You say. No company would ask you to download files. That's a big red flag already. And that's something that is often discussed too. This is as obvious as "[Company] won't ask for Your password". That's the very same thing.
I also received similar .scr file to my email last week.
0 likesbasically the hacker pretended to be my client offering a freelance job,
they send me an attachment detail etc etc.
at first i didn't feel sus at all because it came from ArtStation DM.
but I usually never extract .ZIP file, so I just check the content, and inside it,
it has .jpg file and .scr file that weights around 1GB with extremely high compression ratio.
at that point I knew this is a scam lmao.
Life :D
1 likeyou get born, you see the new world, you see your father and your mother
you say the first words
you chose to be a doctor
you graduate and your parents are proud of you! you did it!
unfortunately, you ruined your life
"MONEY MONEY MONEY"
you scam people out of their banks and accounts
you get jailed, hated and doxxed on internet. all just for little money.
I got the same email and made a video the other day. https://youtu.be/5SQ4pY5wCQM
0 likes"Scanned by gmail" 😬Google is definitely not scanning password protected zip files so they should definitely warn the user about it and not say they have!
0 likesLook, I'm no security expert and I'm not the brightest bulb on the christmas tree, but that really has got phishing scam written all over it. Apart from everything else you've covered, just a badly-worded mildly threatening email with a deadline and a link is enough to have me clicking on the View Message Source button to look for the originating email and/or ip address. The link itself is to a Google drive, another red flag. A 700MB download for a single document is also a no-no. At that point I'd be googling "changes in Youtube rules and policies". It has to be said that's a very amateurish scam from start to finish. I'd have a hard time finding sympathy for anyone who fell for it.
0 likesOne of the biggest channels on YouTube got hacked with this method which is the 3rd biggest channel in YouTube which is called SET India, they do really need to improve security as their account turned into a Tesla scam stream account it was fixed a few hours later.
1 likeSundar Pichai - Indian. Gosh, I hate Indian Foreigner-Scammers!
0 likesThis is a redline stealer variant. It steals the session keys that let you log into websites without entering your username/email and password. There is a video about this made by thiojoe.
0 likesThis is such an OBVIOUS AI deep fake. Just look at AI asmongold or AI XQC show. You can see that this is just and deep fake.
0 likeswow a scam that uses deepfake!
0 likes7:50 It seems like you haven't grasped what actually happened.
0 likesWhat the scammers did is that they created an account called YT Team, uploaded a private video, and used YT's own feature of sharing private videos with pther Google accounts. Note that it's labeled "Private" by YT, not "Unlisted". This means that only specific Google accounts that the scammer shared the video to can view the video. As a result, the sender of the email is actually YT. The "design" of the email is not controlled by the scammers, because it's literally YT's own feature of sharing private videos to other people. Try it yourself: click "share" on one of your private videos and choose another Google account, and see what the email looks like.
You said the scammers failed by choosing the wrong email address to send this email to. But the reality is, this is the only email address that they could target, because it's the email address associated with your channel. They only chose your channel when sharing the private video; they don't even need to know what your email address is.
You also made the mistake of assuming that it's a lookalike when it's actually a deepfake. It's easy to spot: the voice is weirdly flat, and the bottom edge of his beard disappears into thin air when the mouth is open big. But you did say that you noticed while editing so I guess you noticed these too.
You knew it's a scam from the start, and thus assumed that everything is fake. Just like people that fell for the scam assumed it's real from the start and thus assumed that everything is real. This assumption is what made people prone to fall for scams.
Edit: And you also assumed that Sundar Pichai is not actually the CEO of Google when he actually is. That's another of your wrong assumptions. Not to mention, how can you not know that already?
I’m pretty sure shady files use a password that they give to you simply to avoid detection by AV as it is harder to detect an encrypted file.
0 likesVirusTotal will not flag it as a Zip-Bomb if you go into HxD and remove all the "Null_Byte" Padding in the File, because the "Archive" Type makes it appear as a Zip-Bomb even if the real threat is a Stealer... so next time, just use HxD to remove all 00-Bytes at the end of the file (until you only have one single line of 00-Bytes left, then save it and upload it to VT, i promise you, the result will be much different
0 likesIt would be nicer if you would had used a program like "Farbar Recovery Scan Tool" to create log files before and after running the malware - could have been interesting.🙂
0 likes