New answers tagged

0

You don't mention what phone it is, when the problem started or where you got it in the first place. I've found that some of the cheaper Android phones and tablets for sale on Amazon come with malware embedded in the firmware itself which installs all sorts of adware and helpful Chinese "utilities," even after deleting all the responsible apps and non-stock ...


3

An increasingly common attack is to use your Google Play Store credentials to force apps onto the device via the web page for the app. If you are seeing apps install automatically this is the likely source. In any event if you got malware on your phone, you really need to change your Google credentials and reset any 2fa tokens or app-specific passwords ...


0

I personally don't know much about malware analysis. Dynamically you'd be able to isolate and emulate it and inspecting network traffic for unexpected traffic. For static analysis I suppose it depends on the type of malware and the programming language it's written in. When you know the language (decompile if necessary/possible) with the related tools. Then ...


0

Tell management getting a virus is like getting an STD, and just running an antivirus program without fixing the damage is like just wearing condoms from then on.


0

Simple. YouTube has a comments section, description box, and in-video annotations. This means anyone can post URL's on YouTube so clicking the "wrong" URL posted by someone else can potentially lead to malware or a virus.


0

It depends on your definition of typical - that is a moving target. We have now seen the first instance of ransomware named Petya that, rather than encrypting the files, encrypts the Master File Table and the Master Boot Record (MBR). And the MFT essentially manages all file information. If you encrypt the MFT, you don't have to encrypt the files (much ...


44

Your website www.sheba.xyz is hosted on a shared system together with lots of others. This means that all use the same IP address, 166.62.28.88. Unfortunately, not all of the sites on this IP address play nice, which means that this IP address got reported as a cause of trouble. Unfortunately it is not only Checkpoint which reports this site as bad, but ...


8

As far as I know, you don't "circumvent" the false positives, you have to contact Check Point and let them know who you are and work with them to get the false positive fixed, maybe they know something you don't, or you know something they don't.


1

As far as I know typical ransomware, like the (in)famous Locky virus for example, encrypt files depending on their file extension and across all local and remote drives. To break it down: The ransomware will scan the system for Local drives (System drive, secondary drive, USB drive and so on) Remote drives (Network shares like samba, nfs and so on) Files ...


0

Think about the attack from an attacker's point of view. Should I only encrypt where they MIGHT store information, or should I encrypt everything but what I know takes to make the OS run? So the short of it is they encrypt all but certain locations, the known operating system folders. Since those are extremely well known of course, they can simply exclude ...


0

The malware content of the files themselves do not get executed, if that's what you are asking, so you will not be affected by the analysis of the malware traffic. Although, as @steffenullrich points out, it is possible to craft a malicious pcap file that is designed to exploit vulnerabilities in Wireshark or its plugins.


3

Wireshark is a complex beast and often bugs in the various protocol specific dissectors can be found which also might lead to remote code execution, see Dissecting Wireshark: I Know What You Captured Last Summer. But while this might cause code execution when using a pcap from an untrusted source or with malformed protocol data in it, a well formed pcap ...


13

In addition to Angel's response, As seen in the popular ransomware variations that you mentioned, the encryption is done on a file by file basis where one file is encrypted and then the plain-text version of the file is removed, then the ransomware moves to the next file. It may start parallel threads to encrypt several files but the outcome is the same for ...


0

Others mentioned that just retrieving a URL can provide crucial information to the host; usual the information is that you have read an email. That said, I assume that one option to inspect a web page securely which is not too uncomfortable or complicated is to open the URL in a text based browser like lynx (under Windows perhaps in a cygwin environment). ...


0

I like @Robert Mennell's answer, but I'll add that there is one way to see what the site is running, and that is to yank the disk and inspect it in another machine. That way, you're less likely to be impacted by a rootkit that's causing the OS to lie to you. Of course, the drive firmware could be lying to you, but that's a pretty specialized rootkit.


3

It's hard to inspect websites by analyzing their source code, because some sites have hidden codes in it. You might want to try reputation based analysis. You can add an add-on to your browser to analyze the site before you click it. Example of it is wot, a plug-in (web of trust). https://www.mywot.com/ You can also send the URL to a free URL Scanner. ...


12

Visiting a malicious site is often a hit or miss because you're talking to THEIR software that THEY control. You have no real control over it no matter what you do. It could appear non malicious for a long time, and then hit you. It could try to hit you as soon as you visit it. It could... Because there are literally infinite possibilities of how a site ...


31

Why not just send the URL to Virustotal? Accessing a malicious website can be tricky. Using curl, wget, links -dump can be tricky depending on how the malicious content is served up. For example: <IfModule mod_rewrite.c> RewriteEngine On RewriteCond %{HTTP_USER_AGENT} RewriteCond %{HTTP_USER_AGENT} ^.*(winhttp|libwww\-perl|curl|wget).* [NC] ...


0

From some casual research, it appears there are a couple of programs which use ffmpegsumo.dll, notably - Google Chrome, Google Chrome Frame and MathsBuster - GCSE Maths Higher Level. If you do not have and have never had these programs installed, it could be a problem or it could still be a false positive. As the other files you've detected look to be ...


2

I recently reviewed a student's homework assignment that was written in Python, that: Creates a new temporary directory/folder Does some stuff in that folder Moves the output file to the parent directory/folder Deletes the temporary folder Well at least thats what he thought it did. It actually deletes whatever the current directory is, including the ...


2

I've taken a look at the website and I couldn't find any evidence that it has been hacked - however, this does not necessarily mean that the site is clean. Norton claims that your site is a Web Attack: Mass Injection Website and has therefore put the site on a blacklist. This blacklist seems to be used by other services (like sucuri and maybe the company ...


0

I'm an expert on this particular issue and I can assure you that No, you do NOT need to worry about Skype compromising the security of your computer. Skype should be the LEAST of your worries. The most important thing to remember for the security of your computer is: Don't open any file attached to an email UNTIL you have verified who it came from, you know ...


10

They will mostly be file-by-file. Thus, if you are “lucky”, you may find yourself with only some folders infected. There are several reasons for this: Easy to code. Just iterate through every file repeating an encryption routine. Suitable for external programs. Sometimes the ransomware is using a third-party program that works on files for performing the ...


0

Yes this can be done in IPTables by blacklisting known bad addresses. See the following related post for more details: Blacklisting IP addresses -- when should we take action?


2

If you have your system set up so that only connections to your bank (eg. www.bank.com and www.bankcompany.net IPs) were possible, a redirect to a third site wouldn't load. The exploiit would need to be hosted on the same site as your bank (which is admittedly rare). As with many security solutions, it's possible that some bank update makes the website not ...


-1

I'll have a crack at this . . . just on the principle of it. Two possibilities: 1) you are wrong about this, or 2) somebody is targeting you. For 1), don't hesitate to take classes in computer security: network, firewalls, operating systems. For 2), get a secure computer, where you install a firewall before even connecting it to a network, and install ...


0

I'm not a malware author, but I assume it's because it's almost impossible, and it doesn't deliver a benefit. How can the malware 'validate itself' in any meaningful way? Malware is fully exposed to a researcher, who can know whatever the malware knows. It can't contain a secret code that a researcher can't also learn. Any researcher can spoof whatever the ...


-1

Maybe malware authors are lazy, or using strong cryptography would use up too much space. When creating a bot "stub" size is important. In order to remain less suspicious malware is as small as possible, so it can be "bound" with other software. A client to server connection already takes up a lot of the malware's room, adding strong encryption would make ...


1

The malware genome project manages a huge amount of malware samles that is also categorized. If combined with your data set, you might as well be able to identify authors. You can request access here. Other resources for malware samples are contagio malware dump - http://contagiodump.blogspot.ca/ M0Droid - http://m0droid.netai.net/modroid/


1

Even if Skype can run JavaScript, it's not necessarily the end of the world. I agree it is bad, as it greatly increases functionality ads can access. But don't forget there is the https://en.m.wikipedia.org/wiki/Same-origin_policy thing going on. So saying "because someone can execute JavaScript on your client means you are completely owned" is like saying ...


9

It seems to me that Skype is using the areyouahuman.com ad tech to only deliver their ads to "humans". Why it wants to download the file? If you see at "Type" it says: Undecided. Which could be a bug in the areyouahuman server which failed to set the content-type header. In the case of browsers, they normally display the "download file" pop-up when the ...


1

Ok so I eventually fixed the problem. I had to delete files under c:\Windows\System32\GroupPolicyUsers Checked all the files contained in GroupPolicyUsers and then deleted those that related to chrome and that was messing with my Registry. Restarted chrome and now all is fixed!


1

Ransomware is spreading just because people is paying it, questions and answers help getting Ransomware a reputation that is likely to make people paying. It is much better investing some money in a good anti-virus than having to pay later to recover your data. If interrupting the process in the middle may be harmful (because developers wanted you not try ...


0

I can see from your question that Windows is currently the dominant operating system used in your company. You can change to GNU/Linux as the running operating system on all of your companies computers. There is very little successful ransomware for GNU/Linux, and neither is it likely that there will be much of it in the future. The same goes for viruses ...


1

The standard solution to crypto ransomware on Windows (which is admittedly a PITA) is to block execution from the user %APPDATA% directory tree and system %TEMP% location by group policy (Software Restriction Policies or Applocker). After setting up a default deny rule, you'll need to whitelist legitimate apps in your environment that use these directories. ...


2

There are different ways to approach this, including: Mitigation of the infection Filtering emails better Educating users As your question regards the mitigation of a infection, I will keep the other parts short. Filtering emails The problem are not only attachments but also html emails that could directly attack the email client - or contain ...


1

Question is strange, but here is an alternative approach. Sure you can keep your machine clean 100% of the time. Create a virtualized hardened host, take a snapshot, do your work, send your work, close virtualized host. Never use the host for ANYONE, not even connecting to the Internet, you could save your work on a USB send it from another machine. When you ...


6

Shut the computer down immediately. Provided you're not about to pay the ransom, any data that the virus is processing is lost anyway. So just push down the power button and hold it, or unplug the wire. Install Ubuntu or another portable Linux distribution onto your USB stick. Last time I did this it did fit on 2GB stick. I was cloning my HDD to SSD with ...


0

Sandbox your web facing applications like your browser, email client, PDF reader, anything that opens and deals with files you work with online. When you have actually sandboxed these applications you can download and surf as much crap as you like. Yes you can even open downloaded malicious files (from email or browser or P2P, it does not matter where you ...


53

What I would do: Suspend the proces. Don't kill it, just pause it. Look in the process tree if there are any parents that might need suspending as well. Pull the network cable and/or turn off WiFi (and if you're paranoid, Bluetooth too). Check open files by those processes to see which one it is currently encrypting. If it's a particularly important one, ...


131

Hibernate the computer If the ransomware is encrypting the files, the key it is using for encryption is somewhere in memory. It would be preferable to get a memory dump, but you are unlikely to have the appropriate hardware for that readily available. Dumping just the right process should also work, but finding out which one may not be trivial (eg. the ...


9

[Mod Note: This answer is receiving a lot of flags, but is not worthy of deletion. This is a potentially valid course of action, though risky and potentially illegal in some jurisdictions. From a technical standpoint, this has a chance of being a way to preserve the data. Please see Meta for further discussion.] The best thing to do is nothing. Doing ...


7

In addition to the shutdown & copy approach others have mentioned there's another factor: The ransomware wants to hide what's going on until it's finished it's evil--thus the encrypted files are usually still readable as if they weren't encrypted until it's ready to demand it's ransom. Once you have located the files that matter and are encrypted put ...


51

Ransom-ware (or any encryption software for that matter) will not encrypt the file in-place, because the encrypted filesize will not match the unencrypted filesize bit-for-bit (unless it's just an xor shuffle, in which case it's not really encryption). More importantly, a spontaneous abortion of the encryption process (due to a shutdown, running out of ...


2

What steps should I take next to protect myself in case? If you're really concerned that someone might be using your google account on a different Chrome (which would result in Chrome syncing their autofills to your Chrome), make sure you have 2-Factor Authentication enabled for your Google account. You can also set a "Sync Pass-phrase" for your Chrome ...


1

We can't give a definitive answer from the info you've given. That said, I wouldn't worry. Most identity theft attacks wouldn't type things into your Chrome browser. Once an attacker can type things into your browser, there are better attacks (eg: stealing financial info) than identity theft that they can perform. Most likely, this is a problem with auto ...


0

Just a complement to @RobertMennell's answer for the software level part. There are different levels for wiping a hard disk, because the disk contains: a master boot record containing the primary loader => normally boots the active partition n partitions (4 primary or 3 primary and m extended with MBR-BIOS, 128 with GPT-UEFI), each containing: a ...


23

How deep down the rabbit hole do you want to go? For OS level malware: Sure, wiping the hard drive is fine. To be extra sure, overwrite the entire hard drive with 0s manually using a secure erase tool. For hardware/firmware level malware: Well... no. These things live in the actual firmware of your PC and will reinfect your hard drive every time. For ...


1

I have not developed a polymorphic virus myself but the idea of encrypting part of any executable (ELF, PE or otherwise) is not that unimaginable to me. As long as there is a part of code that are non-encrypted to kick start the process (the stub in your description), it should work. Remember that (while not encrypted, but instead compressed), the Linux ...



Top 50 recent answers are included