Print it out
That sounds more like doomsday scenario.
Stung by Spora Ransomware - Bastard!
- Thread starter Hawkster
- Start date
-
- Tags
- spora ransomware viruses
That sounds more like doomsday scenario.Prob not. If you could pay, you could easily pay more. Thats how in kidnapping happens :/
- May 18, 2012
- 7,659
- 7,497
That's a bummer, happened with my friend and he had to reinstall everything. I felt sorry for him because I couldn't fix the problem. I hope you don't lose much of your data and kept a backup of it. From now on remember not to download and run anything which you don't trust fully.
datsunguy
Supreme Member
- Sep 30, 2016
- 1,468
- 1,136
sounds like it, but print doesnt degrade over time like like digitally stored media does.Print it out
if its for long term, get a hard copy of it.
HoNeYBiRD
Elite Member
- May 1, 2009
- 10,187
- 12,580
Most of the time not. I read an article when these ransomwares were fairly new and i think a percentage was mentioned too i can't seem to recall now, but most of the time you won't get your files back even if you pay.
Cyber-insurance is blooming: https://nakedsecurity.sophos.com/2017/01/09/fear-factor-pushing-up-cyber-insurance-premiums/
The best course of action to prevent situations like this is not with AVs and with making your system bulletproof (which won't hurt for sure), but with making regular backups of your files, what you keep offline and/or in the cloud somewhere. When you're getting hit with shit like this, at worst you need to reinstall the OS, but you won't lose any important data. It's advisable to do regular backups anyway, hdds can go poof and data can get corrupted beyond saving.
I started to do weekly backups a few months ago.
tb303
Supreme Member
- Dec 18, 2011
- 1,238
- 909
I read that the Spora ransomware had a "try before you buy" feature. As in it lets you upload 1 or 2 files and decrypts them for you. This shows they have the keys and are able to decrypt your files IF you pay. Crafty as fuck that is!
A good tip for anyone wanting to limit exposure to ransomware is to change your windows file associations
spora and most of the others are generally coming in a zip containing a .js file. If you run the js file it fetches the exe that starts encrypting. Quick fix for this is make sure they open in something safe like notepad.
set all .JS files to open with notepad.exe as default
set all .VBS files to open with notepad as well
There are others but these seem to be used most. I have also seen stuff using powershell to hook stuff but theres no easy way to disable powershell fully in windows which is just plain stupid.
A good tip for anyone wanting to limit exposure to ransomware is to change your windows file associations
spora and most of the others are generally coming in a zip containing a .js file. If you run the js file it fetches the exe that starts encrypting. Quick fix for this is make sure they open in something safe like notepad.
set all .JS files to open with notepad.exe as default
set all .VBS files to open with notepad as well
There are others but these seem to be used most. I have also seen stuff using powershell to hook stuff but theres no easy way to disable powershell fully in windows which is just plain stupid.
Capo Dei Capi
BANNED
- Oct 23, 2014
- 752
- 7,253
It sucks that there isn't a linux version of SEO tools, you could increase security even further.
gman777
Power Member
- Apr 7, 2016
- 715
- 676
System restore doesn't remove the viruses. I mean, it's not like system restore would create a complete backup of your whole files, and then replace those with the current ones(like a reinstallation). In fact, I consider it pointless.
Can you make a screenshot of your task manager's processes? Maybe I'll be able to find something sketchy.
Right click on your taskbar -> start task manager -> processes -> Show processes from all users.
Can you make a screenshot of your task manager's processes? Maybe I'll be able to find something sketchy.
Right click on your taskbar -> start task manager -> processes -> Show processes from all users.
gman777
Power Member
- Apr 7, 2016
- 715
- 676
Brilliant idea. Holy shit. Gonna drop python and take c++ monster.
Hawkster
Elite Member
- Jun 22, 2013
- 3,668
- 4,124
This is exactly how it got me https://www.bleepingcomputer.com/ne...h-malware-via-new-font-wasnt-found-technique/
Capo Dei Capi
BANNED
- Oct 23, 2014
- 752
- 7,253
What about this?
https://petapixel.com/2016/02/16/glass-disc-can-store-360-tb-photos-13-8-billion-years/
Reaver
Elite Member
- Aug 6, 2015
- 1,898
- 5,794
Hawkster
Elite Member
- Jun 22, 2013
- 3,668
- 4,124
booted into safe mode and removed all traces of it manually from start up etc, and with a little help from malwarebytes.
My pdf, word files are still encrypted though. I'll just have to wait until trend micro or whoever update their decryption software for this new ransomeware, if they ever do.
My pdf, word files are still encrypted though. I'll just have to wait until trend micro or whoever update their decryption software for this new ransomeware, if they ever do.
datsunguy
Supreme Member
- Sep 30, 2016
- 1,468
- 1,136
the data is etched in by the laser creating tiny marks and that is not rewritable, but its also too small and complicated for use too read so computers do it for us and that's why they call it 'digital' storage media.
in principal its no different than me marking a stone slab with a chisel.
and to be clear i was thinking of more traditional digital media such as SSDs and HDDs which store data magnetically or using semiconductors.
pretty cool stuff that though, and if it were to become a standardized way to archive info for long term, i'd like to use it.
Hawkster
Elite Member
- Jun 22, 2013
- 3,668
- 4,124
I actually havent tried that yet because i was worried it would pass on the virus somehow to the other pc
Hawkster
Elite Member
- Jun 22, 2013
- 3,668
- 4,124
By dummy do you mean create one? Anything new doesn't get encrypted since i removed the virus.
This is an encrypted pdf http://www17.zippyshare.com/v/VAFClsPX/file.html it should be woodworking plans
This is an encrypted pdf http://www17.zippyshare.com/v/VAFClsPX/file.html it should be woodworking plans
moonshine7000
Elite Member
- Mar 4, 2013
- 4,375
- 4,005
Hi op sorry to hear that.Its best to run seo tools on a virtual machine because some of those websites that scrapebox scrapes are hacked websites.Check the windows files for any unusual files most windows system files are digitally signed by microsoft.Also check the autostart registry keys the malware uses to run when windows starts.Also unusual services and drivers
gman777
Power Member
- Apr 7, 2016
- 715
- 676
@Hawkster It says it's corrupted. But no infection occurred.
If you want, I can make a test with a smaller file maybe? 10-15mb max?
Nonetheless, this thing with ransomware looks great, and it seems that there are people willing to spend money.
How I believe it actually acts: it modifies the PATH for the .pdf/.doc format. So, instead of using adobe reader/microsoft office to open, it will actually open the virus. Simple, yet effective.
However, it may go deeper and inject some code in the .pdf/docx files, not sure yet.
I'd really give it a try if I wouldn't be so petrified by "ethics", but tell me what exactly is pure white hat?
If you want, I can make a test with a smaller file maybe? 10-15mb max?
Nonetheless, this thing with ransomware looks great, and it seems that there are people willing to spend money.
How I believe it actually acts: it modifies the PATH for the .pdf/.doc format. So, instead of using adobe reader/microsoft office to open, it will actually open the virus. Simple, yet effective.
However, it may go deeper and inject some code in the .pdf/docx files, not sure yet.
I'd really give it a try if I wouldn't be so petrified by "ethics", but tell me what exactly is pure white hat?
Last edited: