Windows 10: This password-stealing malware just added a new way to infect your PC

Borg 386 · Jul 5, 2018

A powerful form of malware which can be used to distribute threats including Trojans, ransomware and malicious cryptocurrency mining software has been updated with a new technique which has rarely been seen in the wild.
Click to expand...

What intrigued researchers is how Smoke Loader is now using an injection technique which hadn't been used to distribute malware until just days ago. The code injection technique is known as PROPagate and was first described as a potential means of compromise late last year.

This technique abuses the SetWindowsSubclass function -- a process used to install or update subclass windows running on the system -- and can be used to modify the properties of windows running in the same session. This can be used to inject code and drop files while also hiding the fact it has happened, making it a useful, stealthy attack.

It's likely that the attackers have observed publicly available posts on PROPagate in order to recreate the technique for their own malicious ends.

Those behind this process have also added anti-analysis techniques to complicate forensics, runtime AV scanners, tracing, and debugging that any researchers may attempt to conduct on the malware.
Click to expand...

While there's still plenty of Smoke Loader attacks which look to deliver additional malware to compromised systems, in some cases the malware is being equipped with its own plug-ins to go straight onto performing its own malicious tasks.

Each of these plugins are designed to steal sensitive information, specifically stored credentials or sensitive information transferred over a browser -- the likes of Firefox, Internet Explorer, Chrome, Opera, QQ Browser, Outlook, and Thunderbird can all be used to steal data.

The malware can even be injected into applications like TeamViewer, potentially putting the credentials of others on the same network as the infected machine at risk too.
Click to expand...

Read more: This password-stealing malware just added a new way to infect your PC | ZDNet

:)

bruinator · Jul 5, 2018

steps taken for infected Pc's.

I was hoping someone could give me a list of step by step instructions you use as a guide to clean virus, malware...etc. so I can keep my PC clean if it gets infected.

thx

MoxieMomma · Jul 5, 2018

steps taken for infected Pc's.

Hi:

I was hoping someone could give me a list of step by step instructions you use as a guide to clean virus, malware...etc. so I can keep my PC clean if it gets infected.

thx
Click to expand...

There is no one set of "boilerplate", "cookbook" or standard steps.
Each computer is unique.
Each malware infection is unique.
Proper diagnosis, cleanup and repair depends on the particular infection and the system that is infected.
The process can be tedious and time-consuming, often requiring the use of multiple powerful tools, in the proper sequence.
Many of them can actually damage the system if deployed improperly by untrained computer users.

Bottom line:
Malware cleanup is best done with *customized* support provided by trained individuals who know what tools to use and how to use them.

There are a few folks with such expertise here at this forum (I am not one of them).
And there are a number of reputable computer disinfection fora where trained malware removal experts provide free, custom assistance.

Cheers,

malware · Jul 5, 2018

Password-Stealing Trojan Targets Skype

A password-stealing Trojan is targeting Skype, posing as a security plug-in for the popular VOIP and IM service and displaying a fake log-in screen that's almost identical to the real thing. McAfee's Avert Labs is identifying the Trojan as PWS-Pykse, and F-Secure is referring to it as Trojan-Spy.Win32.Skyper.B. Skype is calling it 65404-SkypeDefenderSetup.exe. The Trojan identifies itself as the "Skype-Defender" plug-in and is attempting to steal Skype usernames and passwords, along with all usernames and passwords saved in Internet Explorer. After execution, the Trojan disables running instances of Skype and swaps in its fake Skype login window. If the victim enters his or her username and password, the malware captures it and any others saved in IE and posts it via http to a Web site for the malware author to retrieve. Security researchers, and Skype, are recommending that users update their antivirus detections to avoid infection.

Source: eWeek

Windows 10: This password-stealing malware just added a new way to infect your PC

This password-stealing malware just added a new way to infect your PC

This password-stealing malware just added a new way to infect your PC

This password-stealing malware just added a new way to infect your PC

This password-stealing malware just added a new way to infect your PC - Similar Threads - password stealing malware

Help with malware infection?

Infected by malware

Infected by malware

Infected by malware

PC maybe infected by a malware??

Malware infection

My PC is infected with a malware

Trickbot banking malware added password and browser history stealing

PC infected with malware