Hot answers tagged

131

Hibernate the computer If the ransomware is encrypting the files, the key it is using for encryption is somewhere in memory. It would be preferable to get a memory dump, but you are unlikely to have the appropriate hardware for that readily available. Dumping just the right process should also work, but finding out which one may not be trivial (eg. the ...


53

What I would do: Suspend the proces. Don't kill it, just pause it. Look in the process tree if there are any parents that might need suspending as well. Pull the network cable and/or turn off WiFi (and if you're paranoid, Bluetooth too). Check open files by those processes to see which one it is currently encrypting. If it's a particularly important one, ...


51

Ransom-ware (or any encryption software for that matter) will not encrypt the file in-place, because the encrypted filesize will not match the unencrypted filesize bit-for-bit (unless it's just an xor shuffle, in which case it's not really encryption). More importantly, a spontaneous abortion of the encryption process (due to a shutdown, running out of ...


44

Your website www.sheba.xyz is hosted on a shared system together with lots of others. This means that all use the same IP address, 166.62.28.88. Unfortunately, not all of the sites on this IP address play nice, which means that this IP address got reported as a cause of trouble. Unfortunately it is not only Checkpoint which reports this site as bad, but ...


31

Why not just send the URL to Virustotal? Accessing a malicious website can be tricky. Using curl, wget, links -dump can be tricky depending on how the malicious content is served up. For example: <IfModule mod_rewrite.c> RewriteEngine On RewriteCond %{HTTP_USER_AGENT} RewriteCond %{HTTP_USER_AGENT} ^.*(winhttp|libwww\-perl|curl|wget).* [NC] ...


23

How deep down the rabbit hole do you want to go? For OS level malware: Sure, wiping the hard drive is fine. To be extra sure, overwrite the entire hard drive with 0s manually using a secure erase tool. For hardware/firmware level malware: Well... no. These things live in the actual firmware of your PC and will reinfect your hard drive every time. For ...


13

In addition to Angel's response, As seen in the popular ransomware variations that you mentioned, the encryption is done on a file by file basis where one file is encrypted and then the plain-text version of the file is removed, then the ransomware moves to the next file. It may start parallel threads to encrypt several files but the outcome is the same for ...


12

Visiting a malicious site is often a hit or miss because you're talking to THEIR software that THEY control. You have no real control over it no matter what you do. It could appear non malicious for a long time, and then hit you. It could try to hit you as soon as you visit it. It could... Because there are literally infinite possibilities of how a site ...


10

They will mostly be file-by-file. Thus, if you are “lucky”, you may find yourself with only some folders infected. There are several reasons for this: Easy to code. Just iterate through every file repeating an encryption routine. Suitable for external programs. Sometimes the ransomware is using a third-party program that works on files for performing the ...


9

It seems to me that Skype is using the areyouahuman.com ad tech to only deliver their ads to "humans". Why it wants to download the file? If you see at "Type" it says: Undecided. Which could be a bug in the areyouahuman server which failed to set the content-type header. In the case of browsers, they normally display the "download file" pop-up when the ...


9

[Mod Note: This answer is receiving a lot of flags, but is not worthy of deletion. This is a potentially valid course of action, though risky and potentially illegal in some jurisdictions. From a technical standpoint, this has a chance of being a way to preserve the data. Please see Meta for further discussion.] The best thing to do is nothing. Doing ...


8

As far as I know, you don't "circumvent" the false positives, you have to contact Check Point and let them know who you are and work with them to get the false positive fixed, maybe they know something you don't, or you know something they don't.


7

In addition to the shutdown & copy approach others have mentioned there's another factor: The ransomware wants to hide what's going on until it's finished it's evil--thus the encrypted files are usually still readable as if they weren't encrypted until it's ready to demand it's ransom. Once you have located the files that matter and are encrypted put ...


6

Could malware interfere with the wiping process? If there is malware present on the system, then yes, it will be able to interfere with the memory wiping process. If a malicious process spawns many copies of itself in memory, it can prevent the processes which initiate memory wiping from executing, essentially causing the computer to hang. This is an ...


6

Shut the computer down immediately. Provided you're not about to pay the ransom, any data that the virus is processing is lost anyway. So just push down the power button and hold it, or unplug the wire. Install Ubuntu or another portable Linux distribution onto your USB stick. Last time I did this it did fit on 2GB stick. I was cloning my HDD to SSD with ...


4

An increasingly common attack is to use your Google Play Store credentials to force apps onto the device via the web page for the app. If you are seeing apps install automatically this is the likely source. In any event if you got malware on your phone, you really need to change your Google credentials and reset any 2fa tokens or app-specific passwords ...


3

It's hard to inspect websites by analyzing their source code, because some sites have hidden codes in it. You might want to try reputation based analysis. You can add an add-on to your browser to analyze the site before you click it. Example of it is wot, a plug-in (web of trust). https://www.mywot.com/ You can also send the URL to a free URL Scanner. ...


3

malware that is able to "read" someone's screen or take screenshots of it, making even the usage of multifactor authentication vulnerable. There is a wide variety of legal and illegal remote access software which enable the attacker to fully control the system, see the remote desktop etc. Some banking trojans integrate this facility to work around ...


3

Wireshark is a complex beast and often bugs in the various protocol specific dissectors can be found which also might lead to remote code execution, see Dissecting Wireshark: I Know What You Captured Last Summer. But while this might cause code execution when using a pcap from an untrusted source or with malformed protocol data in it, a well formed pcap ...


2

I have heard that the full disk encryption helps protect against malware threats, specifically in this case a malware which could programmatically copy the information while it was temporarily saved on the servers. Full disk encryption does not protect against anything that uses the OS interfaces to read and write to the device in question while the ...


2

What steps should I take next to protect myself in case? If you're really concerned that someone might be using your google account on a different Chrome (which would result in Chrome syncing their autofills to your Chrome), make sure you have 2-Factor Authentication enabled for your Google account. You can also set a "Sync Pass-phrase" for your Chrome ...


2

If you have your system set up so that only connections to your bank (eg. www.bank.com and www.bankcompany.net IPs) were possible, a redirect to a third site wouldn't load. The exploiit would need to be hosted on the same site as your bank (which is admittedly rare). As with many security solutions, it's possible that some bank update makes the website not ...


2

I recently reviewed a student's homework assignment that was written in Python, that: Creates a new temporary directory/folder Does some stuff in that folder Moves the output file to the parent directory/folder Deletes the temporary folder Well at least thats what he thought it did. It actually deletes whatever the current directory is, including the ...


2

I've taken a look at the website and I couldn't find any evidence that it has been hacked - however, this does not necessarily mean that the site is clean. Norton claims that your site is a Web Attack: Mass Injection Website and has therefore put the site on a blacklist. This blacklist seems to be used by other services (like sucuri and maybe the company ...


2

There are different ways to approach this, including: Mitigation of the infection Filtering emails better Educating users As your question regards the mitigation of a infection, I will keep the other parts short. Filtering emails The problem are not only attachments but also html emails that could directly attack the email client - or contain ...


1

Question is strange, but here is an alternative approach. Sure you can keep your machine clean 100% of the time. Create a virtualized hardened host, take a snapshot, do your work, send your work, close virtualized host. Never use the host for ANYONE, not even connecting to the Internet, you could save your work on a USB send it from another machine. When you ...


1

The malware genome project manages a huge amount of malware samles that is also categorized. If combined with your data set, you might as well be able to identify authors. You can request access here. Other resources for malware samples are contagio malware dump - http://contagiodump.blogspot.ca/ M0Droid - http://m0droid.netai.net/modroid/


1

Even if Skype can run JavaScript, it's not necessarily the end of the world. I agree it is bad, as it greatly increases functionality ads can access. But don't forget there is the https://en.m.wikipedia.org/wiki/Same-origin_policy thing going on. So saying "because someone can execute JavaScript on your client means you are completely owned" is like saying ...



Only top voted, non community-wiki answers of a minimum length are eligible