I have recently been infected by a ransomware (POLICE) malware after accessing to a supposedly inoffensive web page about "fuel injection drive data".
I didn't have suffient protection activated.
This piece of software copied an executable file into my hard drive and ran it straight away. The question is: How do the OS and browser allow this action without asking the user?
Some details. This happened last Dec 30th when I was trying to open this page “http://www.205gti.com/bosch/injectors.htm” which remained infected several days after and was signaled by the antivirus when I tried to open it again. Now it seams to be OK and is the first time I am able to open it and see its contents which is not much! The OS is XP Sp3 all updated. When It occurred I tried with all my tools to find the file that was running every time the XP was started (not in command mode) with no success. I started to get worried with how many times the system was reboot I think It wasn’t more the four times, by then I decided to restore a copy of the register three weeks older, next I run Malwarebytes (I had a nettop to help). Every thing came to normal. I would never suspect that Java runtime could have a security hole, I more though of an activeX.
To be honest and having a bunch of files and register keys in quarantine I don’t know which are the files or file responsible for the thread. I couldn't find even using autoruns.exe where the file was ¿?. I was much affected by the integrity of my system than to trap the nasty file. Thanks for the attn