Hot answers tagged

5

Bitdefender's Crypto-Ransomware Vaccine inserts recognition markers that ransomware uses to check if it has already infected a system, for example a registry entry. The Locky Trojan is an executable file and once launched, the Trojan checks for the presence and the contents of the below registry keys. | Path | Type ...


4

It's obfuscated and you can be damn sure it isn't benign. Consider your computer you ran it on as "not secure" anymore. Which means that don't do any banking on it, don't order anything over the internet, and don't trust that machine at all. On a different machine, one known not to be compromised, change all your passwords for your accounts and then do ...


4

If you're still worried about what might have happened to your computer, take a look at this ( lines are left as strings for security reason ). Do not try to execute this code If you don't know what you're doing. I'm at work atm so I can't analyze this code in depth but it doesn't seem good. From a quick overview i found that there's File and folder ...


4

Do not assume that everything with a bizarre name is a virus! For example, the items in \Windows\WinSxS are all named with non-English character sequences, but they're critical to your system's health. Subkeys under HKCU\Software\Classes that start with AppX belong to Windows Universal (or Metro, if you like) apps, the kind you get from the Windows Store. I ...


4

There have been vulnerabilities in d-link routers relating to DNS where the DNS settings can be changed remotely. These have been reported as recently as last year. So if your firmware really dates to 2010, then it is likely that it contains this vulnerability, and you should get updated firmware from D-Link. Here is an article.


3

This is known as the XORDDos Linux Trojan The trick is to run kill with -STOP for the process to be paused so it doesn't create a new one. `kill -STOP PROCESS_ID`


1

I have decided to use EV code signing certificate, which will give reputation to my products automatically and some Antivirus vendors promised that false positive error wont affect EV code signed exes.


1

You should be safe. You told your computer not to run the file. Note that I did say, "should be". I didn't say, "are". Why? Because there is an ongoing battle between malware authors and people trying to protect computers. So things don't always happen as one would hope. A virus is a program. That means it is a series of steps. You can think of a ...


1

I decoded this vbscript code ! The suspicious file is located on this folder %Appdata% And check on your registry for any suspicious entry on : HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run and HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run I worte a vbscript that can found any suspicious vbscript file running in ...


1

First Advice : When you get some unknown vbscript files like this, the first thing is don't ever execute it until you understand what this file can execute. Second Advice : If you really want to show what it execute, just, edit it with Notepad or Notepad++ and find this word Execute and replace it by MsgBox to get what this script can do ! I correct the ...


1

Backups, by definition, should be offline, offshore and incremental with a reasonable backup window, so if you notice that you lost a file (not only cause a ransomware but also by human error) AFTER the last backup you can go back to a previous backup set and restore it before corruption/encryption/accidental deletion/etc. You also need to keep you backups ...


1

If the body of the email is HTML then it depends on your email client. In the old days, we used to use Javascript when sending HTML newsletters and (from memory) MS Outlook 2000 (or prior) who accept it. I know MS Outlook (desktop), Thunderbird, Gmail, Yahoo, Outlook.com (I think pretty much all the big players) will prevent any javascript from executing ...


1

It really depends on a lot of things. What do you use to view the email with and is your pc's security up-to-date? Have you installed all relative updates? If an email has malicious code attached in it that abuses a security flaw it is possible for a virus to be downloaded and installed by just viewing the email. If your system is up-to-date with a recent ...



Only top voted, non community-wiki answers of a minimum length are eligible