Windows 10: New Nodersok malware has infected thousands of PCs

Brink · Sep 27, 2019

Thousands of Windows computers across the world have been infected with a new strain of malware that downloads and installs a copy of the Node.js framework to convert infected systems into proxies and perform click-fraud.

The malware, named Nodersok (in a Microsoft report) and Divergent (in a Cisco Talos report), was first spotted over the summer, distributed via malicious ads that forcibly downloaded HTA (HTML application) files on users' computers.

Users who found and ran these HTA files started a multi-stage infection process involving Excel, JavaScript, and PowerShell scripts that eventually downloaded and installed the Nodersok malware.

The malware itself has multiple components, each with its own role. There's a PowerShell module that tries to disable Windows Defender and Windows Update, and there's a component for elevating the malware's permissions to SYSTEM level.

But there are also two components that are legitimate apps -- namely WinDivert and Node.js. The first is an app for capturing and interacting with network packets, while the second is a well-known developer tool for running JavaScript on web servers.

According to Microsoft and Cisco reports, the malware uses the two legitimate apps to start a SOCKS proxy on infected hosts. But here is where the reports diverge. Microsoft claims the malware turns infected hosts into proxies to relay malicious traffic. Cisco, on the other hand, says these proxies are used to perform click-fraud.

Nevertheless, malware is malware, and it's not a good sign when someone gets infected, despite the output. Just like any other malware strain built on a client-server architecture, Nodersok's creators could, at any point, deploy other modules to perform additional tasks, or even deploy secondary malware payloads like ransomware or banking trojans.

Since Microsoft found the malware, Windows Defender should also be able to spot it.

To prevent infections, the best advice is that users not run any HTA files they find on their computers, especially if they don't know the files' precise origin. Files downloaded from a web page out of the blue are always a bad sign and shouldn't be trusted, regardless of extension.

According to Microsoft telemetry, Nodersok has managed to already infect "thousands of machines in the last several weeks." Most of the infections have taken place this month, and have hit US and EU-based users, the company said...
Click to expand...

Read more:

Microsoft: New Nodersok malware has infected thousands of PCs | ZDNet

https://www.microsoft.com/security/b...based-malware/

:)

bruinator · Sep 27, 2019

steps taken for infected Pc's.

I was hoping someone could give me a list of step by step instructions you use as a guide to clean virus, malware...etc. so I can keep my PC clean if it gets infected.

thx

MoxieMomma · Sep 27, 2019

steps taken for infected Pc's.

Hi:

I was hoping someone could give me a list of step by step instructions you use as a guide to clean virus, malware...etc. so I can keep my PC clean if it gets infected.

thx
Click to expand...

There is no one set of "boilerplate", "cookbook" or standard steps.
Each computer is unique.
Each malware infection is unique.
Proper diagnosis, cleanup and repair depends on the particular infection and the system that is infected.
The process can be tedious and time-consuming, often requiring the use of multiple powerful tools, in the proper sequence.
Many of them can actually damage the system if deployed improperly by untrained computer users.

Bottom line:
Malware cleanup is best done with *customized* support provided by trained individuals who know what tools to use and how to use them.

There are a few folks with such expertise here at this forum (I am not one of them).
And there are a number of reputable computer disinfection fora where trained malware removal experts provide free, custom assistance.

Cheers,

Bat 1 · Sep 27, 2019

PC infected with malware

Paying for the NPAV cause I've seen some Bad Malware in some of the cracks ? Heck I've seen enough problems caused by Legit versions.

Run Malwarebytes and SuperAntiSpyware, then rKill and one or more of the others listed all the way at the bottom of the page Download RKill. Save all the Personal files to another drive, then low level format the drive with http://hddguru.com/software/HDD-LLF-...l-Format-Tool/

Disconnect the power and hold the on button down for 30 seconds, wait a few minutes then do it again. Connect everything back and make the Fresh Install using a GENUINE Microsoft ISO. I'll admit to being an ex-pirate and I spent thousands of hours a Year downloading and testing torrents for Malware and seen some stuff so Dangerous it's Not worth taking Chances with any Personal information on a drive that's been infected.

Windows 10: New Nodersok malware has infected thousands of PCs

New Nodersok malware has infected thousands of PCs

New Nodersok malware has infected thousands of PCs

New Nodersok malware has infected thousands of PCs

New Nodersok malware has infected thousands of PCs - Similar Threads - Nodersok malware has

Help with malware infection?

Help with malware infection?

Infected by malware

Infected by malware

Infected by malware

Malware infection

Possible malware infection?

Hackers opening SMB ports on routers to infect PCs with NSA malware

PC infected with malware