Tag Info

New answers tagged

1

Although it looks like a nice feature to have, such kill-switch is not actually useful for common users. Most of the times you won't even notice the exploit happening and even if you detected something strange, its too late to stop it from running. And if you have such a kill-switch, how can you know for sure you stopped it in time? So, such feature can ...


3

I don't think what you are experiencing is the result of malware; it looks like the legitimate effect of the end of support for Windows XP (which came out 15 years ago, so by all means it is an obsolete product). If you really want to continue using Windows XP you should install a third-party antivirus to replace MSE. Just be aware that you won't be ...


10

The main reason malware can't evade AV this way is because the on-access scanner will catch that. From the AV point of view, malware moving to different files is the same problem as new files being created during the scan. A very simple solution is for the AV to keep track of new files being created (which includes current files being renamed). This is done ...


9

"Hide and seek" scenario Some AV perform "linear search" scans whereas others do it randomly (e.g.: AVG). But hiding a virus with such a hide and seek strategy is not the best approach since it would bring too much complexity to its development. There are some categories of virus such as stealth (intercepting calls from the OS and returning bogus or invalid ...


3

This is entirely possible, although the virus would need to have some way of telling what the AV scanner is doing (since many run constantly, whether or not they're scanning). It'd be unreliable, especially in comparison to other techniques such as concealment of the executable. A rootkit can completely hide itself from the infected operating system - as ...


0

I wrote a tool (in C# and powershell using reflection) that walks thread stacks and reports where the function calls are loading from using GetMappedFile. Shows where all functions are executing from (i.e. which dll and where on disk) if the MappedFile property is blank, most likely reflectively loaded ;) https://github.com/secabstraction/PowerWalker


1

If the ransomware developers have used the crypto wrong, or if they have made other implementation errors then there might be a big advantage for the person doing the recovery. One example is torrentlocker, that used stream ciphers with the same key for every file. This made it extremely simple to recover from the malware as all files could be recovered if ...


2

Given that the term ransomware applies to an entire class of malicious software and not code from a single entity with a single algorithm anything is possible but it is highly unlikely. The scenario you describe is called a known plaintext attack and it was useful in breaking WWII (1940s) era cryptography but it is something that modern ciphers are ...


3

I'm sure there are tools out there to assist in the process, but I can't think of any off of the top of my head. The "attack" you would use to break the encryption would be a known plain text attack since you have an unencrypted (plaintext) and an encrypted (ciphertext) version of the same file. If you could change the plaintext and reencrypt it you could ...



Top 50 recent answers are included