9 ms·

I am in Tanzania(East Africa) and my father's computer is infected. All he did to get infected was plugging his laptop on the network at work(University of Dar

I am in Tanzania(East Africa) and my father's computer is infected. All he did to get infected was plugging his laptop on the network at work(University of Dar Es Salaam). The laptop is next to me and my task this night is to try to remove this thing.

iagovar 9y ago
Just that? No click somehwhere?
- raesene6 9y ago
  If someone connects to a network which has been infected and they've not applied the appropriate patch (MS17-010) it looks like they're in trouble if they're running Windows and don't have a firewall blocking incoming connections. So first person in a network has to have fallen for the phishing attack, but once it's in the network it can spread via the ETERNALBLUE exploit.
  - crocal 9y ago
    I confirm that. Once inside network it's a carnage.
- smelendez 9y ago
  It can copy itself across a network through a vulnerability in SMB, Windows' file-sharing protocol. That's the bug that was disclosed in the NSA leaks. Microsoft released a patch in March, but of course not all computers are patched.
- rhizome 9y ago
  Clicks are for phishing and trojans, i.e. human vulnerabilities. This is due to an operating system bug, which is a technical vulnerability. If you can get the right network packets to an unpatched machine, you can infect that machine.
devrandomguy 9y ago
This malware is well written, and uses strong encryption. I would suggest that you and your father spend the evening reading up on backup practices, and reconsider the value proposition of open source software. I hope I am not coming off as a smug jerk. My hope is that rather than becoming frustrated and demoralized after an evening of fruitless hacking, you and your uni will recover, and become resilient against future attacks.
- mhogomchungu 9y ago
  He has backups of his data. I personally use linux and my github repo is here[1] where i have a bunch of encryption related projects(zuluCrypt,SiriKali and lxqt_wallet). The last windows computer i used was windows xp. I dont want to move him to linux because i am not always around and he can ask other people for help when he is on windows. [1] https://github.com/mhogomchungu https://github.com/mhogomchungu
  - devrandomguy 9y ago
    Thank God for backups! And thank you for making sure people make backups. My mother is in a similar situation. She is an elementary school teacher, and has little time for unrelated endeavors like this. What time she does have, is spent in the garden, as it should be. Nevertheless, we are now seeing that the time-cost of closed source software, is greater than that of open-source software. My solution has been to prepare a KDE based distro for her, to work with her, side by side, whenever she needs to learn new tools. It is a good bonding experience, when both people can maintain a positive attitude about it. The solution to the problem of malware, is education.
    - AdeptusAquinas 9y ago
      How quickly some forget heartbleed. The solution to malware is obscurity. Have an OS that no one wants to break into, and you won't be broken into.
      - devrandomguy 9y ago
hackuser 9y ago
Tip: Don't spend time trying to remove malware and undo its effects. You'll never know if you succeeded; most malware is designed to hide itself, and likely this particular malware is well-written. Wipe the laptop and reinstall. It's more certain, and probably won't take much longer than trying to remove the malware. If the malware infects firmware or other subsystems below the OS, and thus won't be removed by a reinstall, buy a new laptop if that's an option.

iagovar 9y ago

Just that? No click somehwhere?

raesene6 9y ago
If someone connects to a network which has been infected and they've not applied the appropriate patch (MS17-010) it looks like they're in trouble if they're running Windows and don't have a firewall blocking incoming connections. So first person in a network has to have fallen for the phishing attack, but once it's in the network it can spread via the ETERNALBLUE exploit.
- crocal 9y ago
  I confirm that. Once inside network it's a carnage.
smelendez 9y ago
It can copy itself across a network through a vulnerability in SMB, Windows' file-sharing protocol. That's the bug that was disclosed in the NSA leaks. Microsoft released a patch in March, but of course not all computers are patched.
rhizome 9y ago
Clicks are for phishing and trojans, i.e. human vulnerabilities. This is due to an operating system bug, which is a technical vulnerability. If you can get the right network packets to an unpatched machine, you can infect that machine.

devrandomguy 9y ago

This malware is well written, and uses strong encryption. I would suggest that you and your father spend the evening reading up on backup practices, and reconsider the value proposition of open source software. I hope I am not coming off as a smug jerk. My hope is that rather than becoming frustrated and demoralized after an evening of fruitless hacking, you and your uni will recover, and become resilient against future attacks.

mhogomchungu 9y ago
He has backups of his data. I personally use linux and my github repo is here[1] where i have a bunch of encryption related projects(zuluCrypt,SiriKali and lxqt_wallet). The last windows computer i used was windows xp. I dont want to move him to linux because i am not always around and he can ask other people for help when he is on windows. [1] https://github.com/mhogomchungu https://github.com/mhogomchungu
- devrandomguy 9y ago
  Thank God for backups! And thank you for making sure people make backups. My mother is in a similar situation. She is an elementary school teacher, and has little time for unrelated endeavors like this. What time she does have, is spent in the garden, as it should be. Nevertheless, we are now seeing that the time-cost of closed source software, is greater than that of open-source software. My solution has been to prepare a KDE based distro for her, to work with her, side by side, whenever she needs to learn new tools. It is a good bonding experience, when both people can maintain a positive attitude about it. The solution to the problem of malware, is education.
  - AdeptusAquinas 9y ago
    How quickly some forget heartbleed. The solution to malware is obscurity. Have an OS that no one wants to break into, and you won't be broken into.
    - devrandomguy 9y ago

hackuser 9y ago

Tip: Don't spend time trying to remove malware and undo its effects. You'll never know if you succeeded; most malware is designed to hide itself, and likely this particular malware is well-written. Wipe the laptop and reinstall. It's more certain, and probably won't take much longer than trying to remove the malware. If the malware infects firmware or other subsystems below the OS, and thus won't be removed by a reinstall, buy a new laptop if that's an option.