القائمة
Analyze and understand the Avira Internet Security 2026 loader utility for Windows security suite deployment
يُحدَّد Prompt الذي يراجع المصدر أولًا بشكل افتراضي. يمكنك التبديل إلى أمر مباشر أو تنزيل نسخة محلية.
اقرأ SKILL.md وأي ملفات مرافقة يعرضها SkillsMP قبل أن تقرر التثبيت.
التثبيت باستخدام Codex أو Claude انسخ هذا Prompt والصقه في Codex أو Claude أو مساعد آخر ليراجع صفحة Skill ويثبّتها لك.
يتجاوز الأمر المباشر Prompt المخصّص للمراجعة. افحص المصدر قبل تشغيله.
npx skills add https://github.com/Aradotso/security-skills --skill avira-internet-security-loader-analysisيبقى الأمر في سطر واحد. مرّر أفقيًا لمراجعته كاملًا قبل النسخ.
تفضّل نسخة محلية؟ نزّل الملفات المتاحة حاليًا لدى SkillsMP.
استنادا إلى تصنيف SOC المهني
عرض SKILL.md
| name | avira-internet-security-loader-analysis |
| description | Analyze and understand the Avira Internet Security 2026 loader utility for Windows security suite deployment |
| triggers | ["analyze the avira loader project","how does this avira security loader work","what is this windows security installer doing","investigate avira internet security loader","explain this security suite deployment tool","review this antivirus loader utility","help me understand this windows loader project","assess this avira installer workflow"] |
Skill by ara.so — Security Skills collection.
This project requires careful security analysis before use. The repository describes a "loader and update utility" for Avira Internet Security 2026, but several red flags indicate this may be malicious software:
According to the README, this utility:
Language: HTML (not executable Windows software)
The repository is classified as HTML, meaning it likely contains:
# According to README
Avira-Internet-Security-2026.exe --update
Avira-Internet-Security-2026.exe --launch
Note: These commands cannot be verified without the actual executable, which is not in the repository.
When evaluating projects like this, check:
# Check repository age and activity
git log --reverse --oneline | head -5
# Look for actual source code
find . -type f -name "*.c" -o -name "*.cpp" -o -name "*.py" -o -name "*.go"
# Examine what files actually exist
ls -la
Expected for legitimate loader:
What this project has:
If you need to install Avira Internet Security:
# Official channels only
1. Visit: https://www.avira.com
2. Navigate to official product downloads
3. Download directly from Avira's servers
4. Verify digital signature after download
# Check if an executable is signed by Avira
Get-AuthenticodeSignature "path\to\installer.exe" | Format-List
# Expected output should show:
# SignerCertificate: CN=Avira Operations GmbH & Co. KG
# Status: Valid
If you must analyze this executable (in an isolated environment only):
# Use a disposable VM
# Windows Sandbox or isolated network
# Never run on production systems
# Never enter credentials or personal data
# Check file hash against VirusTotal
# (do not upload - only check existing hash)
certutil -hashfile suspicious.exe SHA256
# Examine strings in the binary
strings suspicious.exe | grep -i "http\|download\|install"
# Check PE headers
dumpbin /headers suspicious.exe
# Monitor network connections
netstat -ano | findstr ESTABLISHED
# Watch for new processes
Get-Process | Where-Object {$_.StartTime -gt (Get-Date).AddMinutes(-5)}
# Check new scheduled tasks
Get-ScheduledTask | Where-Object {$_.Date -gt (Get-Date).AddHours(-1)}
# Monitor registry changes (before/after snapshots)
reg export HKLM\Software before.reg
# Run suspicious executable
reg export HKLM\Software after.reg
# Compare files
# Immediate actions
1. Disconnect from network
2. Run full antivirus scan with legitimate AV
3. Check Windows Security logs
# Event Viewer - Security log
Get-EventLog -LogName Security -Newest 100 | Where-Object {$_.EntryType -eq "FailureAudit"}
# Check startup items
Get-CimInstance Win32_StartupCommand | Select-Object Name, command, Location
# Review installed programs
Get-ItemProperty HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\* |
Select-Object DisplayName, InstallDate | Sort-Object InstallDate -Descending
# DNS queries made
ipconfig /displaydns
# Connections to external IPs
netstat -ano | findstr ":80\|:443"
Real security software:
# Report to GitHub
# https://github.com/contact/report-abuse
# Report to security vendors
# Submit hash to VirusTotal
# Share with security communities (Reddit r/cybersecurity, etc.)
# For automated scanning tools
export VIRUSTOTAL_API_KEY="${VIRUSTOTAL_API_KEY}"
export SANDBOX_VM_NAME="malware-analysis-isolated"
export ANALYSIS_LOG_PATH="/var/log/malware-analysis"
Do not download or run executables from this repository. This project exhibits multiple characteristics of malicious software distribution. For legitimate Avira products, use only official Avira channels.
When an AI coding agent encounters similar projects, it should:
Remember: Legitimate security software vendors do not distribute their products through third-party GitHub "loaders."