Ransomware napada

 Da,sa jedne strane što manje "roštanja" po disku povečava šansu povrata podataka a sa druge strane ako ne očistiš PC od malwera (pogotovo ransoma) onda si opet u opasnosti nakon povrata podataka jer neki ransomi se ne obrišu nakon enkripcije podataka pa postoji velika šansa da ti opet lockaju vračene podatke!

Eto, zapetljana odluka 

 Da ali što više nešto drlja po disku ( skeneri i čistači u ovom slučaju ) to je šansa povrata podataka manja jer čim se na nekoj mikro-lokaciji hard diska nešto upiše na mjesto od kuda je ransomware izbrisao datoteku ( jer ransom radi da napravi kriptiranu kopiju neke datoteke i onda tu orginalnu datoteku izbriše ) onda postaje skoro pa nemoguće vratiti tu datoteku!

Sa ovime nsi u potpunosti eliminirao potencijalno ostajanje malwera. Jer ti možda ostati na cloudu. A i nema ti smisla jer onda nećeš sigurno ništa vratiti. Jer će samo kriptirane kopirati na cloud. ;)

Nemam instaliranu aplikaciju od cloud servisa već sve uploadam preko browsera. 

Fixed.

Eto opet novog vala Exploit-Malwaretising Ransomware napada, ovaj puta u pitanju su razne vrlo poznate internet stranice.

https://blog.malwarebytes.org/malvertising-2/2016/03/large-angler-malvertising-campaign-hits-top-publishers/

http://arstechnica.com/security/2016/03/big-name-sites-hit-by-rash-of-malicious-ads-spreading-crypto-ransomware/

http://www.bug.hr/forum/topic/komentari-it-vijesti/hrvati-opet-zrtve-ransomwarea/232314.aspx?page=0&jumpto=4835979&sort=asc&view=flat

domain shadowing ... ukradu podatke s kojima je registrirana domena pa dodaju poddomenu neke sasvim legalne tvrtke. onda lažiraju stranicu i stave malware u sliku 1x1px. I još ako imaš tu mrtvi piksel, ne možeš primjetit ;)

https://blog.malwarebytes.org/malvertising-2/2016/03/a-look-into-malvertising-attacks-targeting-the-uk/

Jesi prijavio na Malwarebytes forum?

btw: Nije mi samo jasno kakve veze ima MBAR koji je pasivni portabilni scanner sa problemima bootanja i logiranja???

 Da, pa znam da je mbar u beti. 

Nisam ništa javljao na njihov forum. Iako sam pomislio na to. Imam još nekoliko mjeseci i MBAE koji je također aktivan u pozadini, ali on mi nije radio nikakve probleme.

EDIT: Pa koliko Malwarebytes ima tih programa? Nisam znao da pored MBAM, MBAE, MBARW imaju i MBAR. Znam da MBAM ima u sebi mogućnost skeniranja tj. pretrage za rootkit-ovima. Onda je očito taj MBAR tu još učinkovitiji jer je baš specijaliziran za to.

I jopet. Ovaj puta samo IE kroz flash i silverlight

http://arstechnica.com/security/2016/03/certified-ethical-hacker-website-caught-spreading-crypto-ransomware/

*Izgleda da su gadovi sve bliže

Ajd super za TM 

Nego, jesi to sam testirao ili neko drugi?

Ako jesi, na koji način i da li si testirao i druge av proizvode?

Pozdrav ekipa, long time no see, našao sam na listu C&C servera koji hostaju ove zaražene payloade. Ako možete u ruterima zblokirajte navedenu listu.

https://ransomwaretracker.abuse.ch/tracker/

workingcatstudios.com
dukeplasticslab.com
2bdfb.spinakrosa.at
88fga.ketteaero.com
holishit.in
livingbybuddhism.com
minteee.com
176.31.47.100
185.117.72.94
asianbooty.net
empoweringinternationalministries.org
www.farmastock.ru
skyray.ie
tigabersaudara.com
mskphilly.org
emprendamosjuntos.com
famouscouponcodes.com
catalog.olegran.com
enticemetwo.yzwebsite.com
khacphucwifiyeu.com
kokalsportsco.com
barocchiautofficina.it
smenterprisesgroup.com
miss-green.ru
oktransport.eu
kutumobilya.com.tr
luroweb.sk
golfenaccion.com
89.108.84.132
3qbyaoohkcqkzrz6.tordoor.li
redtable.biz
strategicdisaster.info
www.affiliateproductes.com
affiliateproductes.com
bwpegsfa.info
swfqg.in
xyhhuxa.be
hmndhdbscgru.pw
uhgmnigjpf.biz
uj5nj.onanwhit.com
2gdb4.leoraorage.at
videoaminproduktion.de
mcgroupuae.com
46.8.44.39
jeansowghsqq.com
pilfingr.com
3qbyaoohkcqkzrz6.torgateway.li
6g4ds.froekuge.com
9hrds.wolfcrap.at
setprosports.info
marvel-games.com
missdionnemendez.com
217.12.218.158
ipekmodakaftan.com
mgm88tv.com
84.19.170.244
maxmpl.com
samuday.org
phukienchat.com.vn
32kl2rwsjvqjeui7.tor2web.org
32kl2rwsjvqjeui7.onion.cab
32kl2rwsjvqjeui7.onion.to
vewrb.italisumo.at
gwbak.nickymaru.com
diwali2k15.in
grandaareyoucc.asia
isityouereqq.com
toys.inspirr.computerline.hk
195.64.154.126
masterlegue.com
toolaria.com
92.63.87.106
8b4bb47tiaolhy4uhhlfaqerg.sofarany.at
tradinbow.com
217.12.199.90
irudhkunrlfu25fhkaqw34blr5qlby4tgq43t.orrisbirth.com
g4dhhg53jsdjnnkjwjrfyiouh3o4u4th.vinerteen.com
74nfnjhlq45nkgws4hbdbk45wekfjhqw4talefgnv.curryfort.at
nwcpgymgh.work
mkis.org
promedia.co.in
46.148.20.46
commonsenseprotection.com
94dbhbj3l4blaeyfgl7q45glbaer.giponfeste.at
uhufnlsad7bhf4ykqfbevmxergwrth.himfinn.com
accemfsqovkd.pw
classemgmt.testbada.com
exaltation.info
h5nuwefkuh134ljngkasdbasfg.corolbugan.com
p54dhkus4tlkfashdb6vjetgsdfg.greetingshere.at
f4dsbjhb45wfiuqeib4fkqeg.meccaledgy.at
resumosdenovela.net
plfbvdrpvsm.pw
shampooherbal.com
joshsawyerdesign.com
51.254.181.122
hmgame.net
3qbyaoohkcqkzrz6.bestxprice.ch
3qbyaoohkcqkzrz6.livecamshow.ch
3qbyaoohkcqkzrz6.tormaster.fr
51.255.107.8
marketathart.com
91.195.12.187
3qbyaoohkcqkzrz6.torstation.li
dumberg.org
beedqybvjehzlud5.tor2web.org
kkr4hbwdklf234bfl84uoqleflqwrfqwuelfh.brazabaya.com
prodocument.co.uk
3qbyaoohkcqkzrz6.torgate.es
188.127.231.116
37.139.27.52
hppl.net
glslindia.com
gargsons.com
flaxxup.com
demo.essarinfotech.net
creditwallet.net
c001456.aaa.ididp.com
alumaxgroup.in
aimsande.com
3qbyaoohkcqkzrz6.torplanet.eu
51.255.107.10
esbook.com
nlhomegarden.com
emmy2015.com
imgointoeatnowcc.com
giveitalltheresqq.com
kel52.com
washitallawayff.com
giveitallhereqq.com
ohelloguyff.com
974gfbjhb23hbfkyfaby3byqlyuebvly5q254y.mendilobo.com
a64gfdsjhb4htbiwaysbdvukyft5q.zobodine.at
ohelloguyqq.com
ohelloguymyff.com
ohelloguyzzqq.com
howisittomorrowff.com
bonjovijonqq.com
198.1.95.93
neyenirneicilir.com
controlfreaknetworks.com
jambola.com
oregonreversemortgage.com
shirongfeng.cn
91.234.32.192
91.219.30.254
31.184.196.75
sappmtraining.com
bfd45u8ehdklrfqwlhbhjbgqw.niptana.at
www.momstav.com
galit-law.co.il
peterdickem.com
nobilitas.cz
50.28.211.199
nro.gov.sd
ghayatv.com
mommycantakeff.com
hellomississmithqq.com
kh5jfnvkk5twerfnku5twuilrnglnuw45yhlw.vealsithe.com
vtechshop.net
kaleofis.com
31.184.196.78
multibrandphone.com
irhng84nfaslbv243ljtblwqjrb.pinnafaon.at
rbg4hfbilrf7to452p89hrfq.boonmower.com
tele-channel.com
91.234.33.149
vitrok.org
xn--b1afonddk2l.xn--p1ai
ncrweb.in
iwear.md
fortyseven.com.ar
fashion-boutique.com.ua
anoukdelecluse.nl
gibdd.ws
specializedaccess.co.uk
151.236.14.51
78.40.108.39
bqbbsfdw.be
egovrxvuspxck.be
marciogerhardtsouza.com.br
ahlanmedicalcentre.com
cam-itour.info
91.195.12.131
www.ekowen.sk
shofukai.web.fc2.com
saachi.co
planetarchery.com.au
myonlinedeals.pk
hipnotixx.com
ari-ev.com
nguoitieudungthongthai.com
ihsanind.com
sfasdik.com
37.235.53.18
vizkore.biz
cerbyk.org
hgdre.org
www.informaticauno.net
89.108.85.163
149.154.157.14
51457642.de.strato-hosting.eu
het-havenhuis.nl
kokoko.himegimi.jp
lahmar.choukri.perso.neuf.fr
ministerepuissancejesus.com
ozono.org.es
www.vtipnetriko.cz
rzss2zfue73dfvmj.onlinerpgame.ch
t54ndnku456ngkwsudqer.wallymac.com
hrfgd74nfksjdcnnklnwefvdsf.materdunst.com
greetingsjamajcaff.com
ghdeg.com
gfjhfg.com
geriky.org
drcordoba.com
192.121.16.196
iheartshop.net
glhxgchhfemcjgr.pw
csucanuevo.csuca.org
185.92.220.35
vrvis6ndra5jeggj.livewargaming.ch
vrvis6ndra5jeggj.livegaming.ch
fhgetyh.com
newculturemediablog.com
www.souqaqonline.com
www.promumedical.com
texfibre.eu
surprise.co.in
sub4.gustoitalia.ru
shapes.com.pk
scs-smesi.ru
ptunited.net
lightsroom.ru
kievelectric.kiev.ua
kiddyshop.kiev.ua
jldoptics.com
fibrefamily.ru
dsignshop.com.au
azshop24.com.vn
alexkote.ru
aqarhits.com
saludaonline.com
w6bfg4hahn5bfnlsafgchkvg5fwsfvrt.hareuna.at
po4dbsjbneljhrlbvaueqrgveatv.bonmawp.at
u54bbnhf354fbkh254tbkhjbgy8258gnkwerg.tahaplap.com
howareyouqq.com
hellomisterbiznesqq.com
109.237.111.168
46.108.39.18
212.47.223.19
hellomydearqq.com
tmfilms.net
mafianeedsyouqq.com
itsyourtimeqq.su
gutentagmeinliebeqq.com
goonwithmazerqq.com
helloyoungmanqq.com
lenovowantsyouqq.com
thisisyourchangeqq.com
invoiceholderqq.com
itisverygoodqq.com
hpalsowantsff.com
openroadsolutions.com
www.decorandoimoveis.com
arendroukysdqq.com
blizzbauta.com
fromjamaicaqq.com
yesitisqqq.com
xxryposdrt.org
185.82.216.213
oehknf74ohqlfnpq9rhfgcq93g.hateflux.com
gfkuwflbhsjdabnu4nfukerfqwlfwr4rw.ringbalor.com
ohellowruff.com
blablaworldqq.com
lenovomaybenotqq.com
mafiawantsyouqq.com
conspec.us
velajsweg.com
oprtiwyx.com
tusrecetas.net
trion.com.ph
fitga.ru
nerfetyv.org
rzss2zfue73dfvmj.truewargame.ch
cudcfybkk.pw
wdvxeval.ru
gvludcvhcrjwmgq.in
soclosebutyetqq.com
ohelloweuqq.com
goktugyeli.com
iqinternal.com
hamilton150.co.nz
fisioactivo.com
i3ezlvkoi7fwyood.tor2web.org
i3ezlvkoi7fwyood.onion.to
serbiotecnicos.com
onegiantstore.com
isthereanybodyqq.com
ujajajgogoff.com
takaram.ir
dustinhansenbook.com
95.213.184.10
192.71.213.69
americancorner.udp.cl
vrvis6ndra5jeggj.onlinebattlefield.ch
pts764gt354fder34fsqw45gdfsavadfgsfg.kraskula.com
ropytowero.com
wotreposdo.net
birufolen.com
sawsvore.net
pakezspohos.org
sondr5344ygfweyjbfkw4fhsefv.heliofetch.at
www.countrysaloonriki.sk
leksvik.historielag.org
sumiden-e.co.jp
e-monalisa.ro
ecofriend.co.jp
camberfam.de
ptlchemicaltrading.com
live.mycondofit.com
media.mycondofit.ca
gym.crossfitgreektown.com
outlook.gymzone.org
cloud.gymzonesudbury.com
opravnatramvaji.cz
ubermensch.altervista.org
tianshilive.ru
5.34.183.195
kypsuw.pw
sitemar.ro
accessinvestment.net
pacificgiftcards.com
lpholfnvwbukqwye.onion.cab
lpholfnvwbukqwye.onion.to
185.14.29.188
thisisitsqq.com
kowoplosezox.com
xefarporove.net
peqbkinexyr.org
zsn5qtrgfpu4tmpg.tor2web.org
uiredn4njfsa4234bafb32ygjdawfvs.frascuft.com
yyre45dbvn2nhbefbmh.begumvelic.at
ohiyoungbuyff.com
helloyungmenqq.com
mansolution.in.th
challengestrata.com.au
dichiro.com
beyondthedog.net
91.219.29.55
music.mbsaeger.com
stacon.eu
worldisonefamily.info
imagescroll.com
lazymoosestamping.com
maternalserenity.co.uk
hongsi.com
biocarbon.com.ec
cursos.feyda.net
igatha.com
www.vishvagujarat.com
tes543berda73i48fsdfsd.keratadze.at
gwe32fdr74bhfsyujb34gfszfv.zatcurr.com
zsn5qtrgfpu4tmpg.onion.cab
heizhuangym.com
best-service.jp
surrogacyandadoption.com
gnkltbsaeq35rejl.tor2web.org
gnkltbsaeq35rejl.onion.cab
gnkltbsaeq35rejl.onion.to
jessforkicks.com
viralcrazies.com
domaine-cassillac.com
double-wing.de
eatside.es
185.22.67.27
kkd47eh4hdjshb5t.angortra.at
tt54rfdjhb34rfbnknaerg.milerteddy.com
91.121.97.170
definitionen.de
ecocalsots.com
recaswine.ro
nupleta.com.br
bnjhx.eu
jxqdry.ru
odgtnkmq.pw
lutheranph.com
5.34.183.136
51.254.19.227
twbers4hmi6dc65f.onion.cab
twbers4hmi6dc65f.onion.to
twbers4hmi6dc65f.tor2web.org
national-drafting.com
31.184.197.119
nnrtsdf34dsjhb23rsdf.spannflow.com
zsn5qtrgfpu4tmpg.tor2web.fi
snibi.se
haarsaloncindy.nl
ytrest84y5i456hghadefdsd.pontogrot.com
www.big-cola.com
salesandmarketing101.net
ikstrade.co.kr
nn54djhfnrnm4dnjnerfsd.replylaten.at
185.46.11.239
feuerwehr-stadt-riesa.de
paintituppottery.com
takatei.com
www.hanoiguidedtours.com
www.rippedknees.co.uk
salaeigroup.com
ecolux-comfort.com
vonee.com
abdal.com.ua
building.msu.ac.th
konyavakfi.nl
www.granmarquise.com.br
dd7bsndhr45nfksdnkferfer.javakale.at
k4restportgonst34d23r.oftpony.at
6dtxgqam4crv6rr6.onion.cab
188.138.88.184
31.184.233.106
24fkxhnr3cdtvwmy.onion.nu
24fkxhnr3cdtvwmy.onion.link
24fkxhnr3cdtvwmy.onion.to
zsn5qtrgfpu4tmpg.onion.lt
zsn5qtrgfpu4tmpg.onion.gq
frame3d.de
autohaus-seevetal.com
bisofit.com
www.healthstafftravel.com.au
31.41.47.37
gitybdjgbxd.nl
svkjhguk.ru
5rport45vcdef345adfkksawe.bematvocal.at
b4youfred5485jgsa3453f.italazudda.com
prest54538hnksjn4kjfwdbhwere.hotchunman.com
pvwinlrmwvccuo.eu
iglesiaelrenacer.com
aditaborai.com.br
85.25.138.187
theassemblyguy.co.nz
www.001edizioni.com
94.242.57.45
46.4.239.76
185.14.30.97
dltvwp.it
uxvvm.us
dongxinh.com
dustywinslow.com
95.181.171.58
kqlxtqptsmys.in
195.154.241.208
fnarsipfqe.pw
sdwempsovemtr.yt
kpybuhnosdrm.in
luvenxj.uk
xfyubqmldwvuyar.yt
dkoipg.pw
lovemydress.pl
195.64.154.14
86.104.134.144
ekop.org
mosaudit.com
yoyoeventos.com
madisonbootcamps.com
millsmanagement.nl
nonnuoccaobang.com
italyprego.com
www.kadinweb.net
dunyamuzelerimuzesi.com
iicsdrd.com
www.plexipr.com
www.bishopbell.co.uk
studiolegalecsb.it
smartnote.co
dechehang.com
www.feddoctor.com
portret-tekening.nl
ascortimisoara.ro
zavidovodom.com
southinstrument.org
wefindco.com
westhollywooddentaloffice.com
surusegitimmerkezi.com
8vs.com
glitchygaming.com
grochowina.net
tcblog.de
toysfortheneedyandaid.org
dining-bar.com
london-escorts-agency.org.uk
event-travel.co.uk
jadwalpialadunia.in
aspectdesigns.com.au
inspirenetworks.in
cheapshirts.us
patrianossa.com.br
silstop.pl
portalmaismidia.com.br
procrediti.com.ua
www.gjscomputerservices.com.au
ilovesport.kiev.ua
babylicious.ie
fun-pop.com
d3mpd.fe.uns.ac.id
icsot.na.its.ac.id
emprende21.es
kuruyaprak.com
arttoday.sk
7-eleven-handbags.com
balkanium.altervista.org
anime-tuner.square7.ch
avancarvisual.com.br
www.taoblu.com
www.weddingsonthefrenchriviera.com
worldinoneplace.info
markossolomon.com
jauregia.net