Jump to content

toxinon12345

ESET Insiders
 View Profile  See their activity

  • Posts

    165

  • Joined

  • Last visited

  • Days Won

    5

 Content Type 

Posts posted by toxinon12345

    Locky

    in Malware Finding and Cleaning

    Posted · Edited by toxinon12345

    Ok, another plus would make a Directory tree Read-only.

    For example, I designed my HD partition 'F:' as Read only by creating this rule:

    Blocked file writes for:

    This source app

    ----> [userFolder]\appData\Local\temp\svchost.exe

    These file path

    ---> F:\*.*

    So F: and any subfolder would be protected against Locky

    Locky

    in Malware Finding and Cleaning

    Posted · Edited by toxinon12345

    We even could block application execution from %temp% folder.

    Create a rule blocking application start for :

    ---> [userFolder]\appData\Local\Temp\svchost.exe

    as far as I know, Locky writes to this path as part of its install

    Locky

    in Malware Finding and Cleaning

    Posted · Edited by toxinon12345

    HIPS is for geek users.

    I created a HIPS rule as a mitigation for the LOCKY threat (Filecoder):

    ---> Log enabled, notification enabled

    ---> Registry keys [blocked] for

    √[Renaming]

    √[Modify] operations

    HKEY_USERS\*\software\LOCKY\*

    Then make sure to remove any existing LOCKY regkey at that location

    JS/ScrInject.B Trojaner detected on suvbsites of biggest German news site focus.de

    in ESET Internet Security & ESET Smart Security Premium

    Posted

    @Swex: This incident could be just an "annoying" FP, but this ocurred over what threat name?

    As far as I know (and ironically), ScrInject and Phishing could be as simple as Autorun INF plain text?

    Incidents like this makes me wonder if specific features like Exploit Blocker local mechanisms are enhanced with LiveGrid requests? . . .should enhance that precision and reduce any significant amount of affected users?

    Internet Protection Module 1173B.3 / 1173.5 / 1180

    in ESET NOD32 Antivirus

    Posted

    I think these modules are more frequent in Beta testing of new releases, example: right now it would be the internet protection module (1203b), HIPS module (1186b), the new config module (1134b) and translation support module (1363b)

    i suppose precedence of module download would be beta channel first, then your prefered update channel (usually regular) and then your not prefered channel (usually pre-release)

×
×
  • Create New...