Hot answers tagged

4

It's obfuscated and you can be damn sure it isn't benign. Consider your computer you ran it on as "not secure" anymore. Which means that don't do any banking on it, don't order anything over the internet, and don't trust that machine at all. On a different machine, one known not to be compromised, change all your passwords for your accounts and then do ...


4

If you're still worried about what might have happened to your computer, take a look at this ( lines are left as strings for security reason ). Do not try to execute this code If you don't know what you're doing. I'm at work atm so I can't analyze this code in depth but it doesn't seem good. From a quick overview i found that there's File and folder ...


4

There have been vulnerabilities in d-link routers relating to DNS where the DNS settings can be changed remotely. These have been reported as recently as last year. So if your firmware really dates to 2010, then it is likely that it contains this vulnerability, and you should get updated firmware from D-Link. Here is an article.


2

It's very unlikely that any damage has been made to your system, especially if none of those 3 antimalware programs reported anything strange. Also, keep in mind that Chrome's tabs are sandboxed so it's hard (though not impossible) to alter a PC from the browser, if you haven't downloaded anything strange. However, I was curious on how could a web freeze a ...


2

Access to your personal files only requires personal privileges, not administrator privileges. The moment you open the virus, it already runs with personal privileges, it does not need any more consent than you clicking on it. From there on, it just enumerates whichever files it can find and is only able to encrypt those which you have the privilege to ...


2

Be aware that CryptoLocker will encrypt any files it finds on network shares. Therefore, you should remove all virtual network cards from your virtual machine. (Don't just disable them within the guest operating system as this runs the risk of them being re-enabled by malicious software. I doubt cryptolocker does this, but it is still good security hygiene. ...


2

The link below has a list of file extensions used by Cerber: http://www.bleepingcomputer.com/news/security/the-cerber-ransomware-not-only-encrypts-your-data-but-also-speaks-to-you/ .iso is not in the list but Cerber uses a config file that stores a list of file extensions to target. This makes Cerber more flexible since the list of file extensions is ...


1

I decoded this vbscript code ! The suspicious file is located on this folder %Appdata% And check on your registry for any suspicious entry on : HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run and HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run I worte a vbscript that can found any suspicious vbscript file running in ...



Only top voted, non community-wiki answers of a minimum length are eligible