Tech Help and Discussions

A security researcher says an audio driver is recording every keystroke entered, accessible to any person or malware that knows where to look. An audio driver installed in several HP laptops contains a keylogger-type feature that records every keystroke entered into the computer into a log file, according to a security researcher. Swiss security firm Modzero said in a security advisory posted Thursday that the keylogger activity was discovered in the Conexant HD audio driver package (version 1.0.0.46 and earlier), found on dozens of HP business and enterprise laptop models, including HP Elitebook, ProBook, and ZBook models -- including the latest Folio G1 laptop…

• • 
• 1 reply
• 612 views

starbuck replied May 13, 20177 yr

The decryptor works on .amnesia files on victims' devices A new decryption tool for ransomware victims has been released, this time for those affected by the Amnesia Ransomware. Over the weekend, Emsisoft announced they had a new decryptor ready for Amnesia, a ransomware that was spotted just earlier this month. According to the company's CTO and malware researcher Fabian Wosar, the malware has had another variant released called CryptoBoss. This new family of ransomware was named Amnesia based on the extension that gets added to encrypted files by the first variant (.amnesia). The CryptoBoss variant has yet to get a decryptor, but researchers are work…

• 1 reply
• 839 views
• 1 follower

Tony D replied May 8, 20177 yr

This little machine had Trend Micro Maxium Security, AVG CloudCare and SuperAntiSpyware. It was running pretty slow. I uninstalled AVG using the AVG uninstaller. It was still slow. It's running pretty well now that the Trend software is not running. Ran Malwarebytes Antimalware. It found 1,964 threats which were all MindSpark and Ask in Chrome. They were quarantined. MBAM shows them in the quarantine, but there is no scan report available. That's strange. Can you take a look at the scan logs to remove any AVG items that remain and see if there's anything else to be concerned about? Thank you. Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 03-05-…

• 10 replies
• 11.5k views
• 1 follower

starbuck replied May 7, 20177 yr

A new tool against ransomware available for free The war against ransomware can claim another won battle as a new decrypter has been released for free by Emsisoft. This time, the decrypter works on the Cry128 strain from the CryptON ransomware family. Strains from the CryptON ransomware, such as the X3M and Nemesis, started popping up here and there back in December of last year. Security Researchers claim they are all put together using the same builder, which is the software application which automates the process of customizing a malware executable. The Cry128 strain that can now be decrypted with this free tool began appearing on April 22, 2017, so it…

• 1 reply
• 694 views
• 1 follower

Tony D replied May 3, 20177 yr

Hi, In my Action Center, I am being offered KB4015552 described as 'Optional' and 'April, 2017 Preview of Monthly Quality Rollup for Windows 7'. I understand that the previews are released on the third Tuesday of each month but will become part of the following month's Patch Tuesday update. This is the first time I have noticed a preview update being offered on my system so I am a little confused as to what is best for me to do. Is there any advantage in me downloading and installing this review version or would it be better to wait until the next Patch Tuesday offerings? I would welcome advice and comments. Cheers.

• • 
• 2 replies
• 1.2k views

Kick replied April 21, 20177 yr

I've been using Macrium Reflect free versions for many years now and have found the program excellent for the creation of backup image files. On several occasions it has come to my rescue. I am now approaching a time when I should consider replacing the 160GB hard drive on my Windows 7 desktop with something of larger capacity. I would therefore be using the Macrium Reflect disk cloning option which seems straightforward enough. My question, however, relates to the replacement hard drive (it would be a tradition SATA HDD rather than SSD or hybrid). Should the drive be left unformatted for the operation or, as some drives come already formatted ntfs, can the drive b…

• • 
• 9 replies
• 1.3k views

Kick replied April 14, 20177 yr

I'm looking at a computer where someone called the user, told them that there was a problem with their computer. The user allowed them remote access and gave them the password to get into their machine. We've since changed the password. I see that the scammer put three files on this Windows 10 machine: 1) AnyDesk.exe onto the Desktop 2) FixMeit Client.exe into the Downloads folder 3) An MS Access file titled "New Microsoft Access Database.accdb" It doesn't look like any executables were installed. What piques my curiosity is that MS Access file. What would that be for?

• 4 replies
• 986 views
• 1 follower

Tony D replied April 2, 20177 yr

Microsoft now reserves the right to force critical patches to Windows 10 PCs over metered connections. Windows 10 Home users may soon lose some of their already limited ability to prevent Microsoft from forcing automatic system updates on their PCs. While there’s no official way to prevent updates in Windows 10 Home, a workaround is to mark your Wi-Fi connection as metered. The Windows Insider Preview Build 15058 released on Tuesday reduces the effectiveness of that workaround, as WinSuperSite recently spotted. In build 15058, heading to Settings > Update and Security > Windows Update reveals the following note: “We’ll automatically download and insta…

• 1 reply
• 508 views

peterr replied April 1, 20177 yr

Another severe bug has been found in LastPass, giving yet another reason to stop using browser-based password manager extensions It's been over a year since I presented on LostPass at ShmooCon, and in that time, many more bugs have been found in password managers. The most severe of which are in browser-based password managers extensions such as LastPass. Tavis Ormandy yesterday demonstrated a remote code execution on the latest LastPass version. This isn't the first extremely severe bug he's found in LastPass, either; there've been so many extremely severe bugs in LastPass it would be tedious to list them out. But LastPass isn't alone: Keeper, Dashlane and e…

• 4 replies
• 1.4k views

peterr replied April 1, 20177 yr

Malicious loaders delivered by self-extracting Dropbox files - enabling payloads to bypass detection. One of the most common forms of ransomware is evolving a new technique in order to become even more effective and harder to detect - the ability to evade detection by cybersecurity tools which use machine learning to identify threats. Rather than relying on specifically identified signatures of known threats, some cybersecurity defences employ machine learning in an effort to detect previously unknown malware and the methods used to deliver them to unsuspecting victims. The Cerber family of ransomware is already one of the most successful variants of file-enc…

• 3 replies
• 790 views
• 1 follower

Tony D replied March 30, 20177 yr

When this machine boots, WinPatrol say there's a new unknown program in the startup. It's a number starting with 14900xxxxx. The xxxxx digits are different each time. Each time it boots, I click WinPatol's Reject button. Here's an example. Logs are attached. MBAM scan log.txt FRST.txt Addition.txt JRT.txt AdwCleaner[C0].txt

• 15 replies
• 1.7k views
• 1 follower

starbuck replied March 22, 20177 yr

I downloaded an ISO file of Win 10 and think I copied the contents to a DVD. At any rate it did allow a clean install. I then copied the same contents to a flash drive but have not yet used it. I was told this cannot be done to create a bootable disc for either DVD or flash Drive. A moderator told me I do not need Rufus and can do as I told you I did. But another person said I cannot just copy the files. I know the DVD worked but have not used the flash drive as my system is fine. Could you help clear this up?

• • 
• 6 replies
• 1.1k views
• 1 follower

Tony D replied March 2, 20177 yr