Windows 10: Persistent malware

JoeLangefeld · May 15, 2022

I've got a problem. I've been dealing with malware off and on for the past two years. I think somebody in the house invited it in and, having the only Windows computer around, got saddled with something rather nasty. It started two years ago as a Vobfus worm, which I fought tooth and nail. Now, I think the computer is mostly good except for one pernicious little..... I have reformatted my hard drive/ssd countless times. I've reinstalled Windows so many times, I should have a plaque for expertise. Even after reformatting the ssd and overwriting with 0s or doing a factory reset, clearing C

:)

Brink · May 15, 2022

New malware persistence method leveraging Windows 10 UWP apps

A security researcher from Norway has discovered a new trick that can allow malware to persist on infected systems after reboots.

In infosec circles, the term for this is "persistence" and refers to a malware strain's ability to start right back up after a system reboot.

There are various ways in which malware authors obtain boot persistence, such as by modifying boot sectors, hijacking the Windows COM system, or by hijacking DLLs and shortcut files.

But, by far, the most popular method remains using the Windows Registry to add registry keys that call the malware's process on boot-up.

Oddvar Moe, a Norwegian blogger and Windows security specialist, has recently discovered a new and somewhat clever way of abusing the Windows Registry to trick Windows into running a malware's process after a boot-up.

Moe's new method only works on Windows 10, and only with apps developed for the Universal Windows Platform, a new Windows runtime system that Microsoft launched back in 2015.

In an interview with ZDNet, Moe said the technique should work with any UWP apps, but it is only useful when used with UWP apps that Windows 10 runs automatically after boot-up --such as Cortana and the People app.

"If an attacker targets other apps, the user needs to run that app mnually for it to run the planted binary," Moe told ZDNet regarding using the technique with non-startup UWP apps...
Click to expand...

Read more:

Researcher finds new malware persistence method leveraging Microsoft UWP apps | ZDNet

Persistence using Universal Windows Platform apps (APPX) s Blog

Brink · May 15, 2022

New malware persistence method leveraging Windows 10 UWP apps

A security researcher from Norway has discovered a new trick that can allow malware to persist on infected systems after reboots.

In infosec circles, the term for this is "persistence" and refers to a malware strain's ability to start right back up after a system reboot.

There are various ways in which malware authors obtain boot persistence, such as by modifying boot sectors, hijacking the Windows COM system, or by hijacking DLLs and shortcut files.

But, by far, the most popular method remains using the Windows Registry to add registry keys that call the malware's process on boot-up.

Oddvar Moe, a Norwegian blogger and Windows security specialist, has recently discovered a new and somewhat clever way of abusing the Windows Registry to trick Windows into running a malware's process after a boot-up.

Moe's new method only works on Windows 10, and only with apps developed for the Universal Windows Platform, a new Windows runtime system that Microsoft launched back in 2015.

In an interview with ZDNet, Moe said the technique should work with any UWP apps, but it is only useful when used with UWP apps that Windows 10 runs automatically after boot-up --such as Cortana and the People app.

"If an attacker targets other apps, the user needs to run that app mnually for it to run the planted binary," Moe told ZDNet regarding using the technique with non-startup UWP apps...
Click to expand...

Read more:

Researcher finds new malware persistence method leveraging Microsoft UWP apps | ZDNet

Persistence using Universal Windows Platform apps (APPX) s Blog

Le Boule · May 15, 2022

Malware Detected

If this is what you are seeing suggest you follow all
ofthe steps listed in this removal guide:
https://www.bleepingcomputer.com/virus-removal/remove-the-requested-resource-is-in-use-error/

Other scanners that may help resolve this malware issue are listed in
List of Malware Removal Tools

Regards…

Top 10 Ways PUPs Sneak Onto Your Computer. And How To Avoid Them. - Emsisoft | Security Blog

Windows 10: Persistent malware

Persistent malware

Persistent malware

Persistent malware

Persistent malware - Similar Threads - Persistent malware

PC Infected with Persistent Malware Downloading Files Hourly

PC Infected with Persistent Malware Downloading Files Hourly

Persistant Advanced Malware Threat Windows, Chrome, and Mobile devices

Persistant Advanced Malware Threat Windows, Chrome, and Mobile devices

Microsoft Edge Malware version persistent versions 4x.xx.

very persistent malware, search-fine.com is making me want to explode.

Persistent malware

Persistent malware

Search-fine.com - Very Persistent Malware