New answers tagged

0

I agree there may be value in backing up because the way this works - and indeed it may even be possie to recover some s data from it (due to the way it encrypts - recoverable deleted copies of some data probably exist, and might be recoverable with photorec or similar). In order to fo the best possible backup you really eant to do a bitcopy of the drive. ...


1

It really depends on a lot of things. What do you use to view the email with and is your pc's security up-to-date? Have you installed all relative updates? If an email has malicious code attached in it that abuses a security flaw it is possible for a virus to be downloaded and installed by just viewing the email. If your system is up-to-date with a recent ...


1

If the body of the email is HTML then it depends on your email client. In the old days, we used to use Javascript when sending HTML newsletters and (from memory) MS Outlook 2000 (or prior) who accept it. I know MS Outlook (desktop), Thunderbird, Gmail, Yahoo, Outlook.com (I think pretty much all the big players) will prevent any javascript from executing ...


-1

Could be that your system was taken over during the late hours of the night. That would explain an entire re installation of your OS. I would check with malware bytes if you have any rootkits installed on your system.


-1

I ended up using savscan by Sophos. This command line tool was able to achieve what I was after, with no configuration needed and it's free!


0

I read the EMET user manual and found this, which eludes to the fact that you have to manually update EMET to the next version and how to export your setting beforehand.


0

Caveat: I'm not up on the specifics of individual programs. The way the anti-ransomware [repair] software works is similar to a virus scanner. It has to find a [partially] encrypted file and deduce which ransomware encrypted it and the encryption algorithm and key used. So far, a fair amount of ransomware has used simple encryption (e.g. XOR, etc) with a ...


0

I'm not aware of the actual results of these specific applications, but there is software that does work, and also software that helps if you are affected after all. The ransomware works by encrypting just small parts of each file, instead of encrypting the entire file. The applications recognize this, and undo it. If they detect the entire file is being ...


4

There have been vulnerabilities in d-link routers relating to DNS where the DNS settings can be changed remotely. These have been reported as recently as last year. So if your firmware really dates to 2010, then it is likely that it contains this vulnerability, and you should get updated firmware from D-Link. Here is an article.


1

Backups, by definition, should be offline, offshore and incremental with a reasonable backup window, so if you notice that you lost a file (not only cause a ransomware but also by human error) AFTER the last backup you can go back to a previous backup set and restore it before corruption/encryption/accidental deletion/etc. You also need to keep you backups ...


0

There are 3 basic types of malware: Malware that exploits the user Malware that exploits bugs A combination of 1 and 2 Your type of malware is at least 2 or 3 so in order to actually do anything, it needs something to exploit. The file is opened for reading and some code is executed parsing the file. Thus, in theory, if the virus exploits a bug in the ...


1

First Advice : When you get some unknown vbscript files like this, the first thing is don't ever execute it until you understand what this file can execute. Second Advice : If you really want to show what it execute, just, edit it with Notepad or Notepad++ and find this word Execute and replace it by MsgBox to get what this script can do ! I correct the ...


0

I'm not convinced it actually does anything, but it's intention certainly looks dodgy. It builds up a string 14 characters long containing what looks like is intended to contain binary characters and then finally executes that string. What this then does I have no idea, but it's not something I'd try on my own machine. However I think it has errors. My VBS ...


1

I decoded this vbscript code ! The suspicious file is located on this folder %Appdata% And check on your registry for any suspicious entry on : HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run and HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run I worte a vbscript that can found any suspicious vbscript file running in ...


4

If you're still worried about what might have happened to your computer, take a look at this ( lines are left as strings for security reason ). Do not try to execute this code If you don't know what you're doing. I'm at work atm so I can't analyze this code in depth but it doesn't seem good. From a quick overview i found that there's File and folder ...


4

It's obfuscated and you can be damn sure it isn't benign. Consider your computer you ran it on as "not secure" anymore. Which means that don't do any banking on it, don't order anything over the internet, and don't trust that machine at all. On a different machine, one known not to be compromised, change all your passwords for your accounts and then do ...


5

Bitdefender's Crypto-Ransomware Vaccine inserts recognition markers that ransomware uses to check if it has already infected a system, for example a registry entry. The Locky Trojan is an executable file and once launched, the Trojan checks for the presence and the contents of the below registry keys. | Path | Type ...


3

This is known as the XORDDos Linux Trojan The trick is to run kill with -STOP for the process to be paused so it doesn't create a new one. `kill -STOP PROCESS_ID`


1

I have decided to use EV code signing certificate, which will give reputation to my products automatically and some Antivirus vendors promised that false positive error wont affect EV code signed exes.


0

Even safe mode locks some files. Modern Windows and windows install dvds have a recovery/repair/advanced mode which will always work as a last resort. Shift f10 or menus get you into command mode which you can use to delete any file as its not running that install of windows or locking its files. From some situations you can also type explorer.exe to run ...


0

There is many ways to do this, one example is like @Moab told you. First atempt: I should restart my computer in safe mode instead. How to restart Computer in safemode 3 quick ways then delete the files manually. Second atempt: Download a program called Unlocker Download Unlocker Here I have very hard to believe not of these altenatives should work if ...



Top 50 recent answers are included