Windows 10: Is the initial discount worth the risk of losing access, malware infection, and no help if...

likhon sahosa · Jun 6, 2024

Cheap activation keys for Windows or Office are tempting, but they can be risky. These keys might be illegitimate, leading to deactivation, security threats, and no support. i face the problem plz give me a solution

:)

bruinator · Jun 6, 2024

steps taken for infected Pc's.

I was hoping someone could give me a list of step by step instructions you use as a guide to clean virus, malware...etc. so I can keep my PC clean if it gets infected.

thx

Tryx3 · Jun 6, 2024

There is no greater risk of malware infection for an Admin user account than there is for a Standard user account

Technical Level : Intermediate

Summary
My aim is to answer this question - Is it always correct to advise computer owners to log in for day-to-day computer activities as Standard users rather than as Admin users as a system security measure?

This article is an extract from a longer report that was originally posted in a thread in this forum in 2013. The report has been reviewed [17 May 2015] and is available
in
pdf format.

The operating system considered during the investigation was Windows 7.

Windows 10 users cannot assume that the same considerations apply. There are some differences in the behaviour of the Built-In Admin account in Windows 10 so there might well be other changes affecting the current topic [in Windows
10, the Built-In Admin is designed not to be able to access Settings].

Details

There is no greater risk of malware infection for an Admin user account than there is for a Standard user account.

There would be, in principle, no difference in the amount of system damage caused by a malware infection in an Admin user account than there would be if a Standard user account were infected.

A computer owner can decide whether or not to log in as an Admin user based merely on convenience as long as these conditions are met:

UAC is at its default setting, and

All UAC prompts are studied so that unthinking approval is not given, and

IE’s Protected Mode & SmartScreen Filter are on, and

Data Execution Prevention (DEP) is on, and

A real-time anti-malware utility is on, and

The Built-In Admin account is disabled, and

The Guest account is disabled.

There is a fairly common misconception
that an Admin user account is more prone to getting infected. This is not true.

There is a fairly common misconception
that an Admin user account [other than the Built-In Administrator account] has system-wide access. This is not true.

The most that can be said for always logging in as a Standard user is that

Doing so enforces the need for a password in the UAC prompt ["Elevation UI”] so, it might be asserted, the user is more likely to pay attention to what the
Elevation UI is seeking approval for than if it merely requires a click on the OK button [as is the case when logged in as an Admin user].
However, I found no evidence to justify such an assertion despite exhaustive searches.

Any malware infection is limited to those folders in which the infected account can make changes [write new files, edit existing files, delete files]. Whilst this applies equally to Admin user accounts, it is likely that over time many of the
folders of other users will have granted write access to an Admin user account -
this often happens because the Admin account is used to sort out problems being experienced by other users. Such access means that an infected Admin user account can spread malware across to the folders of other user accounts and so there would be
more of the computer to clean up after an infection. This, for me personally, is persuasive and is the reason that I only use an Admin user account when it is unavoidable.

- - - - - - - - - - - - - - - - -

I am not questioning the usefulness of having two additional password-protected Admin accounts i.e. in addition to those accounts routinely logged in to by users.
The existence of & limited usage of these accounts enhances system resilience by establishing a high degree of confidence that at least one fully-functioning
& malware-free Admin account will exist when other accounts are afflicted with user profile corruption or malware.

One of these additional Admin accounts can be used for granting Admin approval in UAC prompts and for other tasks that demand an Admin account [such as making System images or obtaining device drivers from the
Microsoft update catalog service].

The other additional Admin account is held
in reserve, tested but otherwise unused.

Brink · Jun 6, 2024

Microsoft Advanced Threat Analytics - NotPetya malware

On June 27, 2017 reports on a new variant of Petya (which was later referred to as NotPetya) malware infection began spreading across the globe. It seems the malware’s initial infection delivered via the “M.E.doc” update service, a Ukrainian finance application. Based on our investigation so far, the propagation steps executed by the malware can be considered sophisticated and well tested.The malware distributes itself as a DLL file, spreading over internal networks using different lateral movement techniques.

This blog post focuses on the network behavior analysis of NotPetya and the techniques it uses to propagate in the network. This is ongoing research, and we’ll update with additional findings as those become available.

Malware Propagation Flows

Delivery & Initial execution

The malware is delivered via the “M.E.doc” service to infect the first endpoint.

The malware executes and extracts the relevant components to disk. These include:

PsExec – Network remote execution tool.

A credential dumping tool.

More information on these steps can be found at the Windows Security blog.

Reconnaissance

The internal network is probed using multiple discovery methods to identify new workstations and domain controllers. These include:

LANMAN NetServerEnum2 API used to get information about workstations and domain controllers.

Probing using ports 139 and 445 to other endpoints.

If a domain controller is accessible, the malware queries its DHCP Service to enumerate DHCP subnet.

In case DHCP subnets are discovered, the malware will continue its discovery against those subnets as well.

Reconnaissance example – NetServerEnum2

In the screenshot above, we can see the NetServerEnum2 API used by the infected machine.

The response includes the domain controller and a list of all known workstations response.

Lateral Movement

To spread itself on the network, the malware tries to access the administrative share ($admin).

If the SeDebugPrivilege privilege obtained (Step2), a credentials dumping tool is used to recover additional user credentials from the local memory.

Our lab tests have shown that in addition to the current account session, only one additional user is used by the malware to probe the remote hosts. The malware seems to ignore memory dumped users who were tagged under a new credentials session. Moreover, it seems like only one user (the last one who is in memory) is used to probe the destination host

Each target endpoint is accessed using multiple authentication protocols, such as NTLM and Kerberos over GSSAPI (SPNEGO). The credentials used for access are:

Current user context, under which the malware is running.

Successfully dumped credentials (if available).

In the screenshot below, we can see multiple CIFS ticket requests performed by the malware on behalf of the dumped user. Such broad abnormal access attempts performed by the malware will be detected by Microsoft Advanced Threat Analytics’ (ATA) abnormal behavior detection. Based on previously learned user behavior analytics, the detection mechanism will recognize and alert on the abnormal resource access performed by the malware using the compromised credentials.

Multiple TGS-REQ

In the screenshot above, we can see multiple CIFS ticket requests.

Example of abnormal user access – ATA

Remote Execution

If access to the administrative share was obtained, the malware copies itself to the target host and executes PSEXEC and WMIC.

Malware Copy

PSEXEC Service creation

In the screenshot above, the infected host starts executing the PSEXEC tool.

Exploitation (optional)

If all propagation steps failed, the malware tries to execute one of the SMB exploits (MS17-010).

Available SMB Exploits:

EternalBlue – CVE-2017-0144

EternalRomance – CVE-2017-0145

The above steps are performed simultaneously, using multiple threads and runs against each target host. For further information regarding the SMB exploit mitigation, malware encryption steps and initial infection stage, please refer to the Petya worm capabilities blog post.

The spreading capabilities used by the NotPetya malware introduce a new level of sophistication when executing lateral movement.

Detection and mitigation

Microsoft Advanced Threat Analytics allows customers to detect and to investigate a variety of advanced techniques including the lateral movement technique used by NotPetya.

This type of lateral movement can be detected by ATA as abnormal resource access – given the large scanning performed by the user to attempt access additional endpoints on the subnet.

There are several ways customers can detect and prevent NotPetya from impacting their environment.

First, we strongly recommend customers that have not yet installed security update MS17-010 to do so as soon as possible. If applying the patch is not possible, disable SMB V1 on the corporate networks.

Second, we recommend that you verify good credential hygiene. To learn more, read the following article about protecting high value assets with secure admin workstations.

Additional Resources

KB

MS17-010 Security Update

Blog

New ransomware, old techniques: Petya adds worm capabilities

Windows 10 platform resilience against the Petya ransomware attack

Click to expand...

Source: Advanced Threat Analytics security research network technical analysis: NotPetya Microsoft Secure

Windows 10: Is the initial discount worth the risk of losing access, malware infection, and no help if...

Is the initial discount worth the risk of losing access, malware infection, and no help if...

Is the initial discount worth the risk of losing access, malware infection, and no help if...

Is the initial discount worth the risk of losing access, malware infection, and no help if...

Is the initial discount worth the risk of losing access, malware infection, and no help if... - Similar Threads - initial discount worth

Is the initial discount worth the risk of losing access, malware infection, and no help if...

Help with malware infection?

Help with malware infection?

Infected by malware

Infected by malware

Infected by malware

Is it worth risking an update for me?

Growing Risk of Malware

Growing Risk of Malware