Jump to content

itman

Most Valued Members
  • Posts

    12,172
  • Joined

  • Last visited

  • Days Won

    319

Kudos

  1. Upvote
    itman received kudos from peteyt in ESET and malwarebazaar (abuse.ch)   
    Quite a few are fixated with VirusTotal as the "Holy Grail" reference when it comes to security software detection capability. It is very far from that status as noted in this article: https://www.virusbulletin.com/virusbulletin/2018/01/vb2017-paper-virustotal-tips-tricks-and-myths/
    Of note;
  2. Upvote
    itman received kudos from peteyt in ESET and malwarebazaar (abuse.ch)   
    You really can't count on Eset detection on VT for new malware.
    The first thing Eset will do for new malware is create a LiveGrid blacklist detection for it while it analyzes the malware further. Those LiveGrid blacklist detection's do not show in VT results.
    Remember that not all Eset detection and/or protection mechanisms are deployed on the copy deployed at VT.
  3. Upvote
    itman received kudos from miki1980 in js/chromex.agent.bz help   
    The first question that needs to be answered is what is this C:\Windows\SystemTemp directory is about? Checking my Win 10 22H2 installation, I also have the sub-directory and it appears to have been created on 6/4/2023. No Win Update of any type ran on that date or the prior date. The directory is totally locked down, not even read access is allowed. As such, I am surprised Eset could detect anything resident in that directory.
    This Github article: https://github.com/golang/go/issues/56899 states C:\Windows\SystemTemp directory was created as a Windows security hardening feature for Win 11. Looks like Microsoft also added the directory to Win 10 but possibly not used there?
    In any case, I can't see how a Chrome extension could be created C:\Windows\SystemTemp unless something changed its Win access permissions to do so, then reestablished the original permissions. In any case, Eset can't delete the malicious extension from C:\Windows\SystemTemp because it doesn't have the permissions to do so it appears. Hence, the constant Eset notification when the malicious Chrome extension attempts to load into Brave.
  4. Upvote
    itman received kudos from miki1980 in js/chromex.agent.bz help   
    You removed the screen shot that originally was shown in your posting.
    The screen shot showed that the JavaScript Eset is detecting originates from a C:\Windows\????Temp\ sub-directory. The process that accesses the script in this directory appears to be one that unzips extensions prior to loading\running it in the Brave browser. You need to identify what is creating this extension and stop it from doing so.
  5. Upvote
    itman received kudos from miki1980 in js/chromex.agent.bz help   
    Assuming you have set up syncing from your Smart phone to the Brave browser, the malware Eset is detecting originates from your Smart phone. It is being transferred to your Brave browser whenever the sync processing runs.
    You will have to remove the malware from the Smart phone. Until that is done, your only alternative is to disable syncing of your Smart phone to the Brave browser.
    Ref.: https://support.brave.com/hc/en-us/articles/360021218111-How-do-I-set-up-Sync-
  6. Upvote
    itman gave kudos to Marcos in js/chromex.agent.bz help   
    Since this is an English forum, we kindly ask you to post in English.
    Most likely you have sync turned on, check sync settings by opening brave://settings/braveSync/setup.
    Also post the appropriate record from the Detections log. Alternatively you can supply logs collected with ESET Log Collector.
     
  7. Upvote
    itman gave kudos to Marcos in js/chromex.agent.bz help   
    That means you have another machine with sync turned on where the troublesome extension is still installed.
  8. Upvote
    itman received kudos from micasayyo in Terminator malware can disable Eset?   
    Eset will block a direct download of the driver as my test yesterday shows: https://forum.eset.com/topic/36535-eset-and-malwarebazaar-abusech/?do=findComment&comment=167543
  9. Upvote
    itman received kudos from archz2 in Exporting firewall settings from Windows firewall?   
    I couldn't find a detailed write up on Folder Firewall. However, I found another product: https://www.ilovefreesoftware.com/27/windows-10/how-to-block-folders-in-windows-firewall-to-restrict-internet-access.html that appears to be identical in functionality; there are other software like this.
    I saw no mention that the Win firewall outbound rules processing needs to be enabled. It appears this software just uses the Win firewall outbound rule section as a storage location for the rules it creates. This software monitors for outbound Internet traffic; then checks Win firewall outbound rules for a match on the source .exe; and finally applies the block action specified for the matching Win outbound firewall rule.
    As it currently stands now, the Eset firewall by default will also evaluate Win inbound firewall rules. In theory at least, it could also do so for Win firewall outbound rules. That is only evaluate blocked rules. Will Eset do so? Doubtful in my opinion. Win firewall rules can be easily hacked by an attacker since they are stored in clear text in the registry. Also, apps like Adobe Reader and the like can add inbound firewall rules at will; just like this Folder Firewall app can for outbound rules. As it currently stands, Eset's evaluation of Win inbound firewall rules is a potential security risk. The risk being factored by it is the only way to allow Win native apps to run unimpeded since these app .exe names constantly change.
  10. Upvote
    itman received kudos from nabeelmansoor in Live Guard on EIS   
    Yes. Refer to the below screen shot;

    Sample submission settings are contained within Cloud- based protection section. By default, all noted suspicious file types will be submitted except Word document files.
    The important point to note in regards to LiveGrid is the only interactive protection provided is for cloud blacklist lookup. Although LiveGrid might submit a suspicious file to the Eset cloud for further analysis, it does not block execution of the file unless it is blacklisted.
  11. Upvote
    itman received kudos from Aryeh Goretsky in Block Adobe Reader from creating child processes - ESET PROTECT   
    Before creating a HIPS rule to block Adobe Reader from starting child processes, realize that it does spawn legit child processes including itself per the below Process Explorer screenshot:

  12. Upvote
    itman gave kudos to New_Style_xd in Do I need another Malware Program?   
    It is not advisable to use two real-time security products, in that case it is better to use MalwareBytes disabled the real-time option, because it can conflict with any antivirus, slowing down your machine.
  13. Upvote
    itman received kudos from Dex98 in Block Adobe Reader from creating child processes - ESET PROTECT   
    Before creating a HIPS rule to block Adobe Reader from starting child processes, realize that it does spawn legit child processes including itself per the below Process Explorer screenshot:

  14. Upvote
    itman received kudos from peteyt in Critical Firmware Vulnerability in Gigabyte Systems Exposes ~7 Million Devices   
    Based on a posting on wilderssecuritycom: https://www.wilderssecurity.com/threads/gigabyte-mobos-supply-chain-risk-from-gigabyte-app-center-backdoor.451620/#post-3149242 , it appears Gigabyte has pushed a firmware update to address this issue. There is also the question if a firmware update will be pushed for motherboards no longer supported.
    It is uncharacteristic for Gigabyte to react this quickly to a vulnerability, so this must be a serious one.
    -EDIT- Gigabyte statement here: https://www.gigabyte.com/Press/News/2091
  15. Upvote
    itman received kudos from peteyt in Critical Firmware Vulnerability in Gigabyte Systems Exposes ~7 Million Devices   
    https://thehackernews.com/2023/05/critical-firmware-vulnerability-in.html
    Mitigations
    https://eclypsium.com/blog/supply-chain-risk-from-gigabyte-app-center-backdoor/
    Affected Gigabyte motherboard firmware
    https://eclypsium.com/wp-content/uploads/Gigabyte-Affected-Models.pdf
  16. Upvote
    itman received kudos from KathDM5 in why ESET doesn't detect IP tracking attacks   
    You control tracking via browser setting options and select add-ons/extensions. Refer to this thread: https://www.wilderssecurity.com/threads/web-beacons-on-websites-and-in-e-mail.450381/ .
    My test results:

  17. Upvote
    itman received kudos from micasayyo in Do I need another Malware Program?   
    You can't other than by trial and errot testing. However, certain security products that only function as on-demand scanners such as HitMan Pro, Norton Power Eraser, etc.. are "safe bets." Also, you can always use set Microsoft Defender to periodic scanning mode.
  18. Upvote
    itman received kudos from micasayyo in Intel threat detection technology.   
    Refer to this recent AV lab test that was addressed just to this question: https://selabs.uk/reports/enterprise-advanced-security-ransomware-intel-threat-detection-technology-2023-02/ .
    The important point to note in this test is the disparity in detection rates between Intel and AMD processor.
  19. Upvote
    itman received kudos from el el amiril in RPC server denied?   
    Again;
    If you disable that rule, you will bork a bunch of necessary internal network activity.
  20. Upvote
    itman received kudos from ryanxcii in ESET FDE got error after updating Windows Update KB5026361   
    Microsoft has an article on how to update your TPM firmware: https://support.microsoft.com/en-us/windows/update-your-security-processor-tpm-firmware-94205cbc-a492-8d79-cc55-1ecd6b0a8022 on Win 10.
  21. Upvote
    itman received kudos from AAndrejko in ESET FDE got error after updating Windows Update KB5026361   
    Microsoft has an article on how to update your TPM firmware: https://support.microsoft.com/en-us/windows/update-your-security-processor-tpm-firmware-94205cbc-a492-8d79-cc55-1ecd6b0a8022 on Win 10.
  22. Upvote
    itman received kudos from Tonyset in Banking protection stopped working   
    BTW - in regards to that nVidia driver caused blue screen, nVidia has stopped supporting Win 7 for sometime: https://www.bleepingcomputer.com/news/software/nvidia-is-dropping-support-for-windows-7-and-windows-8-drivers/ .
    "Time to give up that Win 7 ghost."
  23. Upvote
    itman received kudos from Tonyset in Banking protection stopped working   
    You might also want to review this list of Win 7 security vulnerabilities: https://www.cvedetails.com/vulnerability-list/vendor_id-26/product_id-17153/Microsoft-Windows-7.html .
    Microsoft has patches for these but they are only available for Win 7 Pro+ extended support installations.
  24. Upvote
    itman received kudos from Nightowl in VBS/Runner.OBI !!!   
    As far as IoBit Unlocker goes, it is legit software: https://www.iobit.com/en/iobit-unlocker.php used to change file permissions in Windows. However, it has been used in malware attacks;
    https://www.wilderssecurity.com/threads/wisevector-stop-x.431502/page-8#post-2942745
    Unless you intentionally installed IoBit Unlocker, assume it is being used on your device for malicious purposes.
  25. Upvote
    itman received kudos from user_12212 in Strange devices on network inspector   
    That's my conclusion.
    What you can do is disconnect WI-Fi repeater and establish only a direct connection to the router. Then run another Network Inspector scan.
    Also note that any Wi-FI based device can be hacked. Therefore, ensure the Wi-Fi repeater has a strong encryption protocol associated with it; preferably WPA3.
×
×
  • Create New...