Windows 10: Backdoor attack?

STnM · Dec 17, 2022

My wife was almost the victim of scammers imitating PayPal. During the conversation her Blue screen said "software updating, do not turn off your computer". She scanned with Norton 360 and found nothing. Today she got the same screen. She immediately removed WiFi adapter and scanned again. Is this some sort of backdoor attack? And how can this be removed?

:)

Brink · Dec 17, 2022

New Moriya rootkit stealthily backdoors Windows systems

Unknown threat actors have been employing a Windows rootkit for years to stealthily install backdoors on vulnerable machines.

In a campaign dubbed Operation TunnelSnake by Kaspersky researchers, the team said on Thursday that an advanced persistent threat (APT) group, origin unknown but suspected of being Chinese-speaking, has used the rootkit to quietly take control of networks belonging to organizations.

Rootkits are packages of tools that are designed to stay under the radar by hiding themselves in deep levels of system code. Rootkits can range from malware designed to attack the kernel to firmware, or memory, and will often operate with high levels of privilege.

According to Kaspersky, the newly-discovered rootkit, named Moriya, is used to deploy passive backdoors on public-facing servers. The backdoors are then used to establish a connection -- quietly -- with a command-and-control (C2) server controlled by the threat actors for malicious purposes.

The backdoor allows attackers to monitor all traffic, incoming and outgoing, that passes through an infected machine and filter out packets sent for the malware.
Click to expand...

Read more:

New Moriya rootkit stealthily backdoors Windows systems | ZDNet

Operation TunnelSnake | Securelist

DaveM121 · Dec 17, 2022

What can we do if we attacked by the Wanna Cry ransomware?

If you are running Windows 10 and have the latest updates you are safe from this ransomware attack. Microsoft has released patches in March and last week to counteract the backdoor that allowed this malware. There is a lot of panic going around, caused by
a lot of mis-information . . .

Here is Microsoft's Customer Guidance on the Ransomware Attack:

In March, we released a security update which addresses the vulnerability that these attacks are exploiting. Those who have Windows Update enabled are protected against attacks on this vulnerability. For those organizations who have not yet applied the
security update, we suggest you immediately deploy Microsoft Security Bulletin MS17-010.

For customers using Windows Defender, we released an update earlier today which detects this threat as Ransom:Win32/WannaCrypt.
As an additional “defense-in-depth” measure, keep up-to-date anti-malware software installed on your machines. Customers running anti-malware software from any number of security companies can confirm with their provider, that they are protected.

This attack type may evolve over time, so any additional defense-in-depth strategies will provide additional protections. (For example, to further protect against SMBv1 attacks, customers
should consider blocking legacy protocols on their networks).

For the full article and a list of updates released by Microsoft, Click HERE

LynnTatum · Dec 17, 2022

calc.exe Calculator worms IRCBot backdoor Trojans

Name

Microsoft Calculator

Filename

calc.exe

Command

calc.exe

Description

A variant of the
IRCBot family of worms and IRC backdoor Trojans.

Moved from: Windows / Windows 10 / Desktop, Start, & personalization / Start Menu

Windows 10: Backdoor attack?

Backdoor attack?

Backdoor attack?

Backdoor attack?

Backdoor attack? - Similar Threads - Backdoor attack

I think I have a backdoor virus

I think I have a backdoor virus

windows 11 infinitly loop reboot , MSI has a backdoor.

windows 11 infinitly loop reboot , MSI has a backdoor.

backdoor virus

backdoor virus

Backdoor attack?

Backdoor attack?

backdoors