0

A few days ago, I downloaded an .zip attachment that claimed to be a transaction report. There was only one file inside the archive "TRANSACTION REPORT.scr". It seemed like AutoCad could open it (from the description column) so i instinctively double-clicked (stupid, yes) but nothing happened. After a second or so, i then remembered coming across viruses with the same extension and also why would a report be .scr of all things? So i ran a Kaspersky scan and i got nothing. I uploaded to VirusTotal which showed that only a few antivirus programs found it malicious and that it mainly sends a GET request to http://freegeoip.net/json/.

The thing is when i right-click on the .scr file, there is no 'open' among the options, only 7zip extract, rename and so on. So the question is, did the file really run when i double-clicked? I just ran another Kaspersky scan and this time, it detected it as a "DangerousObject" and deleted it (belatedly). So am i in any danger? What do you recommend? The file came with some bank-related email and i worry that a copy of it or something could be lurking somewhere on my pc waiting to forward my card details whenever i try to buy stuff. Thanks for your help.

2

3 Answers 3

0

Have you tried searching for information about the sender, message body text, exact filename etc.? If other people have encountered the same situation, it will be a lot easier to stop the potential problem.

As generic advice for the detection and removal of malware, I recommend installing and running a program called MalwareBytes. For me, this normally detects the majority, if not all problems, and is freely downloadable.

0

The thing is when i right-click on the .scr file, there is no 'open' among the options, only 7zip extract, rename and so on.

There should also be an option "Configure" which is specific to screen savers. The SCR extension is reserved for Windows screen savers, as can be verified at a cmd prompt.

    C:\>assoc .scr
    .scr=scrfile

    C:\>assoc scrfile
    scrfile=Screen saver

    C:\>ftype scrfile
    scrfile="%1" /S

So the question is, did the file really run when i double-clicked?

Something did run, most definitely. SCR files are just regular Windows EXEs with a different extension (https://msdn.microsoft.com/en-us/library/cc144066.aspx#Installing_New_Screen_Savers).

Normally, when you run a SCR file, the screen saver kicks in right away. The fact that with your SCR nothing happened makes it even less likely that the SCR in question is actually a genuine screen saver. Bottom line, you seem to have run an arbitrary EXE of unknown origin. Draw your own conclusions, no matter what the scans say.

0

If you ran an attachment from an email you didn't expect to receive you should assume you computer is compromised.

Best course of action would be to format, reinstall your OS, and restore your data from a back up.

There is no other guaranteed way of knowing that your computer is secure.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .