0

Got infected, it happened as i was sitting on the PC (Windows 10), i noticed a slow-down and one of the external disks had high activity, upon inspection noticed some files had the .nuclear extension. I immediately pulled the hard-drive out.

I have no hope of recovery, and am not paying the b@st@rds - only lost downloads which i can download again. But just want to work-out how it could have happened?

I had qbitTorrent running for weeks, no issues, no dramas happily progressing. Then i decide to download a youtube vid, went to the keepvid website, type the url, choose the download option, and the file starts downloading.

I walk away to do other stuff, come back 1 hour later to check progress of download, and it appears the PC had re-started. and looks suspicious, antivirus is off, etc. and i notice the slowdown.

I am led to think some popup ad on keepvid website was the culprit, because things started going wrong from that point.

Q. What is the most likely source, qbitTorrent or keepvid?

(i know this is opinion based, but need some expert opinions so we can all learn).

closed as primarily opinion-based by Steffen Ullrich, tim, schroeder Sep 23 '17 at 11:24

Many good questions generate some degree of opinion based on expert experience, but answers to this question will tend to be almost entirely based on opinions, rather than facts, references, or specific expertise. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 3
    I think it is impossible to say from this description how the malware got into your PC or what might be the most likely path. It might be any of the activity you describe but it might also a different activity you don't even remember. It might be that the malware got downloaded and executed earlier already and only activated itself after some time. – Steffen Ullrich Sep 23 '17 at 5:12
  • 1
    Additionally, it's highly unlikely that a (supposed) zero day for a drive by infection from ads is "burned up" by ransomware. – Tobi Nary Sep 23 '17 at 6:46
1

Many ransomware types lie dormant for a while before attacking so that you can't track down where it came from. Also, you may not have initially been infected with this type of ransomware. You may have gotten some other dropper malware and it later pushed out a bunch of different malware to infected computers. Without an in depth forensic analysis of the computer nobody can tell you specifically where it came from.

You want us to tell you an a or b answer but the issue is that it's very likely neither of the two.

Not the answer you're looking for? Browse other questions tagged or ask your own question.