I have recently run into some malware on my computer that has gathered up my computer's make and hard drive make and serial number, along with probably many other things.
The malware installed itself along with I believe an application called WINZIPPER that replaced WinRAR. Its installation did the obvious things of changing the start-up page in all of my (common) browsers, and initially ran an executable from a temp folder, though this was once only. It then added its URL to the startup shortcuts for all of my common browsers, including a query string containing all of that information.
Upon starting any of the browsers, it would add this URL:
whois search, the
delta-homes.com domain is registered by
Beijing ELEX Technology Co., Ltd.
who appears to be a games maker in China.
Removing all of the above and all references to that URL in the registry, I believe I have found all the points of infection. Though I think one of these web requests was successfully sent, so partly I offer this information as a searchable reference for the common good, and partially to ask what further danger or vulnerability do I have now that information has been stolen.
- If this is a known infection, have I found all of the infection points?
- With the damage done, what further risk am I now at?