2

I bought a laser plotter, and the seller provided me with software to control it. It's called EleksCam. The provided package from the seller (from aliexpress) consisted of assembly instructions and other stuff (see files from seller.png).

What worries me, is that I have downloaded the software EleksCam from the official site, and comparing the contents of the folder from the seller and the official site, they have two different sets of files (see compare packages.png). It's supposed to be the same software, same version. Yet, the seller insists that I install his package, running the bin application. Which I stupidly did. It didn't work, so I went to the official package, realising the difference in the contents (no bin file there).

Could someone tell me what to do next? How do I get rid of the potential malware? Here's a link to the compressed folder of the seller's package. The bin file is in there.

Help?

EDIT - POSSIBLY CRUCIAL DETAIL: when running the driver file, I was prompted to allow it to make changes on the hdd (as per usual), but when I clicked yes, and got back to usual screen, the console saying something like "you can use CTRL+G" so I did, and it seems it's a xBox related windows function for screen recording. Same thing happens when running the original app's driver installation.

files from sellerboth packages

10
  • I'm not sure what we can tell you. Your question is "I clicked on a program, how do I get rid of the potential malware?" The first step is to gather info to determine if it is malware and what it might have done. Did you scan the file? Send to Virustotal?
    – schroeder
    Aug 20, 2018 at 10:48
  • I scanned it with Avast, no threats detected. Same with Virustotal. That somehow isn't reassuring.
    – uhl
    Aug 20, 2018 at 11:00
  • 1
    Is it possible the vendor's documentation is out of date?
    – Tom K.
    Aug 20, 2018 at 11:20
  • Then you have 2 possible realities: 1) your vendor created a virus that no one else has ever seen, in which case your only course of action is to nuke that machine and rebuild it from scratch, or 2) it's benign. And there is no way for us to tell you which reality is the one you are in.
    – schroeder
    Aug 20, 2018 at 11:58
  • IMHO, you should check the documentation again and see whether you are missing some step (it seems the program need dotnet 4.0 framework to be installed) , see the driver appear inside the Drive manager, etc. Some Chinese cheap hardware manufacturers may hire a hacker to hack legitimate software and pack as their own so they don't need to pay for development (most of the time, the original driver might only works for specific hardware ID) . If you worry about spyware/malware, then you should reinstall your machine OS from the scratch.
    – mootmoot
    Aug 20, 2018 at 12:18

3 Answers 3

1

Do basic malware analysis.

  • Compare the sizes of the executable, one from the seller and one from the official site.
  • Submit the binary to VirusTotal, from there there are a lot of anti-virus vendors which has a library of hashes that are deemed malicious. (Sometimes it can be an unknown malware)
  • Download process explorer to check for potential running processes.
  • Check for abnormal outbound connections (netstat).

And I believe this is a benign application. Upon checking on the file system you have, there's nothing suspicious about it.

2
  • Better than checking the sizes of the files would be comparing the hash of each file, as vulnerabilities can sometimes be added only by changing bytes.
    – Steve
    Aug 24, 2018 at 6:21
  • @vulnerableuser how do I identify suspicious outbound connections if I haven't monitored them previously? Here's what I got: pastebin.com/fQRG6Kxs
    – uhl
    Aug 24, 2018 at 11:10
0

https://www.bitdefender.com/support/how-to-create-a-bitdefender-rescue-cd-627.html

Use a boot disk, this just mounts your drive and scans it offline. Generally if nothing is found, it's likely clean and the paranoid thoughts are typically threats too sophisticated to waste hours looking, or just don't exist.

take the machine offline, then delete the files. You can search for any files altered at the same time or look at sysinternals autoruns to check persistence.

are all the files exactly the same when loaded into virus total?

6
  • user2505690`s advice is great becuase of my disabilty to comment on his question, i am just topping that if you are suspicious just nuke the hard disk. sourceforge.net/projects/dban using an usb in bios booting.
    – kaladont
    Aug 21, 2018 at 16:55
  • apparently it doesn't handle ssd's well, and seems to be out of date. I decided to use PartitionWizard instead. I just worry, that my pendrive got automatically infected after plugging into a infected computer.
    – uhl
    Aug 21, 2018 at 18:18
  • then simply reformat. Aug 21, 2018 at 22:18
  • @user2505690 yeah, but how does that assure my pen drive that I backup to won't just reinfect the main drive? Also, is it possible that the backup partition (that is hidden/has no assigned letter) also needs formatting? You write: " You can search for any files altered at the same time or look at sysinternals autoruns to check persistence. are all the files exactly the same when loaded into virus total?" how do I go about doing that?
    – uhl
    Aug 22, 2018 at 2:34
  • you have to back up to last known good. I wouldn't go to such lengths really to clean everything as the boot disk antivirus should be sufficient for most cases. Either manually install the virus total context plugin and right click a sample of files and compare the md5, or look for a powershell script that can loop through the command get-filehash. Aug 22, 2018 at 12:45
0

A simple way to check if the files are malware is to upload them to Virustotal to see what other antiviruses say, the details, relations, behaviour, and more. There is many, many, many other good alternatives to this like app.any.run which gives you its own sandbox and gives you more options than virustotal. To use app.any.run you have to make an account, but don't worry it's free to use.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .