Resubmissions

14/07/2026, 16:55

260714-vfd6msg12l

19/02/2026, 16:42

260219-t7mfnah18e10

General

  • Target
    Andrew Bettany, Mike Halsey - Windows Virus and Malware Troubleshooting-Apress (2017).epub.jar
  • Size 1.7MB
  • Sample260714-vfd6msg12l
  • SHA256 5cdcf8ad07effa91dec699c83fdd01837138a9fb61693bdd7fa5df457928b05b
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10

Malware Config

Extracted

Ransom Note
  • <style xmlns="http://www.w3.org/1999/xhtml" type="text/css" id="kobostylehacks">div#book-inner p, div#book-inner div { font-size: 1.0em; } a { color: black; } a:link, a:visited, a:hover, a:active { color: blue; } div#book-inner * { margin-top: 0 !important; margin-bottom: 0 !important;}</style> </head><body><div xmlns="http://www.w3.org/1999/xhtml" id="book-columns"><div xmlns="http://www.w3.org/1999/xhtml" id="book-inner"><div class="ChapterContextInformation"><div class="ContextInformation" id="b978-1-4842-2607-0_1"><div class="ChapterCopyright"><span xmlns="http://www.w3.org/1999/xhtml" class="koboSpan" id="kobo.1.1">© Andrew Bettany and Mike Halsey 2017</span></div><span class="ContextInformationAuthorEditorNames"><span class="Author"><span class="AuthorName"><span xmlns="http://www.w3.org/1999/xhtml" class="koboSpan" id="kobo.2.1">Andrew Bettany</span></span><span xmlns="http://www.w3.org/1999/xhtml" class="koboSpan" id="kobo.3.1"> and </span></span><span class="Author"><span class="AuthorName"><span xmlns="http://www.w3.org/1999/xhtml" class="koboSpan" id="kobo.4.1">Mike Halsey</span></span></span></span><span class="ContextInformationBookTitles"><span class="BookTitle" xml:lang="en"><span xmlns="http://www.w3.org/1999/xhtml" class="koboSpan" id="kobo.5.1">Windows Virus and Malware Troubleshooting </span></span></span><span class="ChapterDOI"><span xmlns="http://www.w3.org/1999/xhtml" class="koboSpan" id="kobo.6.1">10.1007/978-1-4842-2607-0_1</span></span></div></div><!--Begin Abstract--><div class="MainTitleSection"><h1 class="ChapterTitle KBHeading" xml:lang="en"><span xmlns="http://www.w3.org/1999/xhtml" class="koboSpan" id="kobo.7.1">1. What Is Malware?</span></h1></div><div class="AuthorGroup"><div class="AuthorNames"><span class="Author"><span class="AuthorName"><span xmlns="http://www.w3.org/1999/xhtml" class="koboSpan" id="kobo.8.1">Andrew Bettany</span></span><sup><span xmlns="http://www.w3.org/1999/xhtml" class="koboSpan" id="kobo.9.1">1 </span><span class="ContactIcon"/></sup><span xmlns="http://www.w3.org/1999/xhtml" class="koboSpan" id="kobo.10.1"> and </span></span><span class="Author"><span class="AuthorName"><span xmlns="http://www.w3.org/1999/xhtml" class="koboSpan" id="kobo.11.1">Mike Halsey</span></span><sup><span xmlns="http://www.w3.org/1999/xhtml" class="koboSpan" id="kobo.12.1">2</span></sup></span></div><div class="Affiliations"><div class="Affiliation" id="Aff3"><span class="AffiliationNumber"><span xmlns="http://www.w3.org/1999/xhtml" class="koboSpan" id="kobo.13.1">(1)</span></span><div class="AffiliationText"><span xmlns="http://www.w3.org/1999/xhtml" class="koboSpan" id="kobo.14.1">Microsoft, York, North Yorkshire, UK</span></div></div><div class="Affiliation" id="Aff4"><span class="AffiliationNumber"><span xmlns="http://www.w3.org/1999/xhtml" class="koboSpan" id="kobo.15.1">(2)</span></span><div class="AffiliationText"><span xmlns="http://www.w3.org/1999/xhtml" class="koboSpan" id="kobo.16.1">Sheffield, South Yorkshire, UK</span></div></div><div class="ClearBoth"><span xmlns="http://www.w3.org/1999/xhtml" class="koboSpan" id="kobo.17.1"> </span></div></div></div><!--End Abstract--><div class="Fulltext"><div id="Par1" class="Para"><span xmlns="http://www.w3.org/1999/xhtml" class="koboSpan" id="kobo.18.1">Few things can happen to a PC that are worse than it becoming infected with malware. </span><span xmlns="http://www.w3.org/1999/xhtml" class="koboSpan" id="kobo.18.2">As a consequence, your PC might fail to start, you may lose your connection to the Internet, or a hardware component in the PC might fail, but all of this pales into insignificance when compared to the threat of infection.</span></div><div id="Par2" class="Para"><span xmlns="http://www.w3.org/1999/xhtml" class="koboSpan" id="kobo.19.1">Why is this? </span><span xmlns="http://www.w3.org/1999/xhtml" class="koboSpan" id="kobo.19.2">While troubleshooting problems on PCs commonly leads us to discover that the problem is isolated to just the machine in question, malware infection immediately threatens not just every other PC on your network but your servers, storage (both local and cloud), clients, partners, employees, and much more besides.</span></div><div id="Par3" class="Para"><span xmlns="http://www.w3.org/1999/xhtml" class="koboSpan" id="kobo.20.1">With the introduction of ransomware in the last few years, the threat is worse than ever before. </span><span xmlns="http://www.w3.org/1999/xhtml" class="koboSpan" id="kobo.20.2">Businesses might suddenly find all their documents and files encrypted and a demand for payment of a large ransom for the decryption key.</span></div><div id="Par4" class="Para"><span xmlns="http://www.w3.org/1999/xhtml" class="koboSpan" id="kobo.21.1">It’s not all doom and gloom though, as removing any type of malware from a PC, even unpleasant ransomware, is simpler than you might believe. </span><span xmlns="http://www.w3.org/1999/xhtml" class="koboSpan" id="kobo.21.2">Protecting your PCs from malware is even simpler still.</span></div><div id="Par5" class="Para"><span xmlns="http://www.w3.org/1999/xhtml" class="koboSpan" id="kobo.22.1">In this book, you’ll learn about the different types of malware threats that can attack PCs and networks, how you can defend against and identify them, and, most crucially, eradicate them, should an attack occur.</span></div><div id="Sec1" class="Section1 RenderAsSection1"><h2 class="Heading"><span xmlns="http://www.w3.org/1999/xhtml" class="koboSpan" id="kobo.23.1">A Brief History of Malware</span></h2><div id="Par6" class="Para"><span xmlns="http://www.w3.org/1999/xhtml" class="koboSpan" id="kobo.24.1">This might come as a surprise, but the earliest computer viruses were written for the Apple II and Macintosh computers . </span><span xmlns="http://www.w3.org/1999/xhtml" class="koboSpan" id="kobo.24.2">They would write themselves into the boot sector of a floppy disk, so they would execute when the disk was read.</span></div><div id="Par7" class="Para"><span xmlns="http://www.w3.org/1999/xhtml" class="koboSpan" id="kobo.25.1">The popularity of the IBM PC and MS-DOS caused a boom in viruses, as computer use grew within businesses. </span><span xmlns="http://www.w3.org/1999/xhtml" class="koboSpan" id="kobo.25.2">Viruses were tiny in size, when compared to the malware of today, and typically performed small tasks, from deleting files to rewriting the PC’s BIOS, so as to prevent the machine from starting, and then propagating further by copying themselves to every floppy disk placed into the machine. </span><span xmlns="http://www.w3.org/1999/xhtml" class="koboSpan" id="kobo.25.3">The first virus I was infected with, on an Olivetti PC back in 1991, played “Yankee Doodle Dandy” to me every day at five o’clock but was otherwise benign.</span></div><div id="Par8" class="Para"><span xmlns="http://www.w3.org/1999/xhtml" class="koboSpan" id="kobo.26.1">The Morris Worm was the first example of an Internet virus. </span><span xmlns="http://www.w3.org/1999/xhtml" class="koboSpan" id="kobo.26.2">Discovered at the end of 1988, it was written by a graduate student at Cornell University (Ithaca, New York) and launched from the computers of the Massachusetts Institute of Technology.</span></div><div id="Par9" class="Para"><span xmlns="http://www.w3.org/1999/xhtml" class="koboSpan" id="kobo.27.1">Although it was not originally written to cause any damage but to gauge the size of the Internet for its creator, an error in its code turned it from a harmless worm into an infectious denial-of-service tool that took significant time to remove from the thousands of computers it infected.</span></div><div id="Par10" class="Para"><span xmlns="http://www.w3.org/1999/xhtml" class="koboSpan" id="kobo.28.1">Since then, there have been many high-profile viruses in the wild, including the infamous Stuxnet worm that was allegedly created by the US and Israeli intelligence services to infect Iranian government computers and report on the country’s nuclear program. </span><span xmlns="http://www.w3.org/1999/xhtml" class="koboSpan" id="kobo.28.2">The Code Red worm of 2001, which defaced web sites and launched denial-of-service attacks, was at one point infecting more than 300,000 computers every day.</span></div><div id="Par11" class="Para"><span xmlns="http://www.w3.org/1999/xhtml" class="koboSpan" id="kobo.29.1">The rise of bots and ransomware took malware infection to a new level. </span><span xmlns="http://www.w3.org/1999/xhtml" class="koboSpan" id="kobo.29.2">A bot would infect thousands, sometimes even millions, of computers and then sit silently waiting for instructions. </span><span xmlns="http://www.w3.org/1999/xhtml" class="koboSpan" id="kobo.29.3">Control of the infected PCs would then be sold on the dark web to the highest bidder, who could then record keystrokes (such as usernames and passwords) from the PCs, get backdoor access to them, or launch distributed denial-of-service (DDoS) attacks that would flood Internet services and specific companies’ web servers with so much traffic, and over such a prolonged period, that the servers would fail.</span></div><div id="Par12" class="Para"><span xmlns="http://www.w3.org/1999/xhtml" class="koboSpan" id="kobo.30.1">Ransomware, which encrypts the files and documents of individuals and companies, is widely reported to be raking in millions of dollars for its creators every year, as universities, hospitals, major corporations, and even governments secretly pay costly ransoms for unlock keys.</span></div><div id="Par13" class="Para"><span xmlns="http://www.w3.org/1999/xhtml" class="koboSpan" id="kobo.31.1">Today, malware exists on every computing platform and operating system. </span><span xmlns="http://www.w3.org/1999/xhtml" class="koboSpan" id="kobo.31.2">The popularity of Google’s Android OS makes it a very tempting target, and even the advanced security of Apple’s iOS and OS X systems offers no guarantee of protection, because, as I’ll explain shortly, it’s the user and not the software that’s commonly attacked.</span></div><div id="Par14" class="Para"><span xmlns="http://www.w3.org/1999/xhtml" class="koboSpan" id="kobo.32.1"> Internet of Things (IoT) devices are a new route of attack into your network or home, as they can often come with very lax, or even zero, security. </span><span xmlns="http://www.w3.org/1999/xhtml" class="koboSpan" id="kobo.32.2">Once connected to your network and your router, they can be used as gateways through which other devices can also be accessed. </span><span xmlns="http://www.w3.org/1999/xhtml" class="koboSpan" id="kobo.32.3">Often, physical access to the IoT device will be required to infect the device, though it’s not unheard of for viruses to be pushed through firmware updating. </span><span xmlns="http://www.w3.org/1999/xhtml" class="koboSpan" id="kobo.32.4">If you use IoT devices, it’s always wise to change the default administrator username and password and to check that the manufacturer has taken security seriously when designing the firmware.</span></div><div id="Par15" class="Para"><span xmlns="http://www.w3.org/1999/xhtml" class="koboSpan" id="kobo.33.1">For the purposes of this book, however, I’ll be focusing on Windows 10 PCs and networks, which include servers, desktops, laptops, ultrabooks, and tablets, primarily running on Intel processors. </span><span xmlns="http://www.w3.org/1999/xhtml" class="koboSpan" id="kobo.33.2">ARM-based Windows 10 systems, such as smartphones and low-power devices, are less susceptible, because they are based on a more modern, and more secure, architecture of the Windows OS and don’t include the “legacy” code and features that are often the focus of malware attack. </span><span xmlns="http://www.w3.org/1999/xhtml" class="koboSpan" id="kobo.33.3">They are, however, not completely immune, and as such, the same techniques I’ll teach you in this book for removing malware from Intel-based systems will also apply to infections on ARM-PCs.</span></div></div><div id="Sec2" class="Section1 RenderAsSection1"><h2 class="Heading"><span xmlns="http://www.w3.org/1999/xhtml" class="koboSpan" id="kobo.34.1">The Psychology of Infection ?</span></h2><div id="Par16" class="Para"><span xmlns="http://www.w3.org/1999/xhtml" class="koboSpan" id="kobo.35.1">There was a time before the Internet when every single PC was a stand-alone, individual machine and, as such, the security they had in place was often poor, or even nonexistent. </span><span xmlns="http://www.w3.org/1999/xhtml" class="koboSpan" id="kobo.35.2">Even when the Internet became widespread in the late 1990s, it took companies such as Microsoft many years to become fully aware of the threat poor security posed to their users and their reputations.</span></div><div id="Par17" class="Para"><span xmlns="http://www.w3.org/1999/xhtml" class="koboSpan" id="kobo.36.1">The problem with viruses arose because malware exploited security vulnerabilities in operating systems that would allow them to run—automatically, unhindered, and silently—when they arrived on a PC via an e-mail, infected file from a disk, or across a network. </span><span xmlns="http://www.w3.org/1999/xhtml" class="koboSpan" id="kobo.36.2">Therefore, operating systems such as UNIX and Mac OS, which was a UNIX derivative, were often hailed as being far more secure than their Windows counterpart, because the user of the PC did not have the administrative rights needed to allow malware to run.</span></div><div id="Par18" class="Para"><span xmlns="http://www.w3.org/1999/xhtml" class="koboSpan" id="kobo.37.1">These days, however, our Windows PCs are far more secure. </span><span xmlns="http://www.w3.org/1999/xhtml" class="koboSpan" id="kobo.37.2">Features such as User Account Control (UAC) , first seen in Windows Vista, and Secure Boot, introduced with Windows 8, offer valuable first-line protection against infection. </span><span xmlns="http://www.w3.org/1999/xhtml" class="koboSpan" id="kobo.37.3">For this reason, the criminals (now more often criminal gangs) behind malware began to look to psychology to propagate their code.</span></div><div id="Par19" class="Para"><span xmlns="http://www.w3.org/1999/xhtml" class="koboSpan" id="kobo.38.1">How could end users be tricked into installing their malware? </span><span xmlns="http://www.w3.org/1999/xhtml" class="koboSpan" id="kobo.38.2">The answer was to disguise the malware as something innocuous, useful, or even fun, such as a codec required to play video on a web site, or an app, OS update, or driver that you might normally download directly from the official provider but that has been modified with an added payload and then made available on file-sharing or popular download sites.</span></div><div id="Par20" class="Para"><span xmlns="http://www.w3.org/1999/xhtml" class="koboSpan" id="kobo.39.1">The first line of defense against malware these days must be education and training of PC users, be they at home or in the workplace. </span><span xmlns="http://www.w3.org/1999/xhtml" class="koboSpan" id="kobo.39.2">People might find a “funny cat” video that won’t play without the codec being installed, a game that one of their colleagues has been playing, or they might be tired or rushed and click a security notice without first reading it or paying attention to what it might mean.</span></div><div id="Par21" class="Para"><span xmlns="http://www.w3.org/1999/xhtml" class="koboSpan" id="kobo.40.1">Any granting of administrative rights to malware allows that malware to install and operate freely on the PC. </span><span xmlns="http://www.w3.org/1999/xhtml" class="koboSpan" id="kobo.40.2">Even if something looks like a legitimate or fun game, it could have an unpleasant payload in the background, operating silently against you.</span></div><div id="Par22" class="Para"><span xmlns="http://www.w3.org/1999/xhtml" class="koboSpan" id="kobo.41.1">In the business space, and especially with ransomware, the problem is exacerbated. </span><span xmlns="http://www.w3.org/1999/xhtml" class="koboSpan" id="kobo.41.2">It takes only one employee (or perhaps a student at a university), overworked and up against a tight deadline, clicking a UAC security prompt, so that she can open a file a colleague or friend has sent her, to give malware free reign to access an

Signatures

File Explorer

  • Andrew Bettany, Mike Halsey - Windows Virus and Malware Troubleshooting-Apress (2017).epub.jar
    .zip 1.7MB
  • META-INF/calibre_bookmarks.txt
    172B
  • META-INF/container.xml
    .xml 250B
  • OEBPS/A417537_1_En_1_Chapter.html
    .html 41KB
  • OEBPS/A417537_1_En_1_Fig1_HTML.jpg
    .jpg 26KB
  • OEBPS/A417537_1_En_2_Chapter.html
    .html 67KB
  • OEBPS/A417537_1_En_2_Fig1_HTML.jpg
    .jpg 40KB
  • OEBPS/A417537_1_En_2_Fig2_HTML.jpg
    .jpg 27KB
  • OEBPS/A417537_1_En_2_Fig3_HTML.jpg
    .jpg 27KB
  • OEBPS/A417537_1_En_2_Fig4_HTML.jpg
    .jpg 11KB
  • OEBPS/A417537_1_En_2_Fig5_HTML.jpg
    .jpg 25KB
  • OEBPS/A417537_1_En_3_Chapter.html
    .html 81KB
  • OEBPS/A417537_1_En_3_Fig10_HTML.jpg
    .jpg 27KB
  • OEBPS/A417537_1_En_3_Fig1_HTML.gif
    .gif 17KB
  • OEBPS/A417537_1_En_3_Fig2_HTML.jpg
    .jpg 33KB
  • OEBPS/A417537_1_En_3_Fig3_HTML.jpg
    .jpg 37KB
  • OEBPS/A417537_1_En_3_Fig4_HTML.jpg
    .jpg 37KB
  • OEBPS/A417537_1_En_3_Fig5_HTML.jpg
    .jpg 30KB
  • OEBPS/A417537_1_En_3_Fig6_HTML.jpg
    .jpg 38KB
  • OEBPS/A417537_1_En_3_Fig7_HTML.jpg
    .jpg 27KB
  • OEBPS/A417537_1_En_3_Fig8_HTML.jpg
    .jpg 29KB
  • OEBPS/A417537_1_En_3_Fig9_HTML.jpg
    .jpg 29KB
  • OEBPS/A417537_1_En_4_Chapter.html
    .html 91KB
  • OEBPS/A417537_1_En_4_Fig1_HTML.jpg
    .jpg 49KB
  • OEBPS/A417537_1_En_4_Fig2_HTML.jpg
    .jpg 17KB
  • OEBPS/A417537_1_En_4_Fig3_HTML.jpg
    .jpg 61KB
  • OEBPS/A417537_1_En_4_Fig4_HTML.gif
    .gif 12KB
  • OEBPS/A417537_1_En_5_Chapter.html
    .html 90KB
  • OEBPS/A417537_1_En_5_Fig10_HTML.jpg
    .jpg 22KB
  • OEBPS/A417537_1_En_5_Fig11_HTML.jpg
    .jpg 31KB
  • OEBPS/A417537_1_En_5_Fig12_HTML.jpg
    .jpg 45KB
  • OEBPS/A417537_1_En_5_Fig13_HTML.jpg
    .jpg 28KB
  • OEBPS/A417537_1_En_5_Fig1_HTML.jpg
    .jpg 38KB
  • OEBPS/A417537_1_En_5_Fig2_HTML.jpg
    .jpg 40KB
  • OEBPS/A417537_1_En_5_Fig3_HTML.jpg
    .jpg 27KB
  • OEBPS/A417537_1_En_5_Fig4_HTML.jpg
    .jpg 41KB
  • OEBPS/A417537_1_En_5_Fig5_HTML.jpg
    .jpg 66KB
  • OEBPS/A417537_1_En_5_Fig6_HTML.jpg
    .jpg 29KB
  • OEBPS/A417537_1_En_5_Fig7_HTML.jpg
    .jpg 44KB
  • OEBPS/A417537_1_En_5_Fig8_HTML.jpg
    .jpg 44KB
  • OEBPS/A417537_1_En_5_Fig9_HTML.jpg
    .jpg 26KB
  • OEBPS/A417537_1_En_6_Chapter.html
    .html 41KB
  • OEBPS/A417537_1_En_6_Fig10_HTML.jpg
    .jpg 21KB
  • OEBPS/A417537_1_En_6_Fig11_HTML.jpg
    .jpg 35KB
  • OEBPS/A417537_1_En_6_Fig12_HTML.jpg
    .jpg 51KB
  • OEBPS/A417537_1_En_6_Fig1_HTML.jpg
    .jpg 73KB
  • OEBPS/A417537_1_En_6_Fig2_HTML.jpg
    .jpg 56KB
  • OEBPS/A417537_1_En_6_Fig3_HTML.jpg
    .jpg 55KB
  • OEBPS/A417537_1_En_6_Fig4_HTML.jpg
    .jpg 33KB
  • OEBPS/A417537_1_En_6_Fig5_HTML.jpg
    .jpg 60KB
  • OEBPS/A417537_1_En_6_Fig6_HTML.jpg
    .jpg 61KB
  • OEBPS/A417537_1_En_6_Fig7_HTML.jpg
    .jpg 33KB
  • OEBPS/A417537_1_En_6_Fig8_HTML.jpg
    .jpg 59KB
  • OEBPS/A417537_1_En_6_Fig9_HTML.jpg
    .jpg 46KB
  • OEBPS/A417537_1_En_BookBackmatter_OnlinePDF.html
    .html 30KB
  • OEBPS/A417537_1_En_BookFrontmatter_Figa_HTML.png
    .png 3KB
  • OEBPS/A417537_1_En_BookFrontmatter_Figb_HTML.jpg
    .jpg 17KB
  • OEBPS/A417537_1_En_BookFrontmatter_Figc_HTML.jpg
    .jpg 13KB
  • OEBPS/A417537_1_En_BookFrontmatter_Figd_HTML.jpg
    .jpg 10KB
  • OEBPS/A417537_1_En_BookFrontmatter_Fige_HTML.jpg
    .jpg 13KB
  • OEBPS/A417537_1_En_BookFrontmatter_OnlinePDF.html
    .html 66KB
  • OEBPS/A978-1-4842-2607-0_CoverFigure.jpg
    .jpg 126KB
  • OEBPS/ACoverHTML.html
    .html 1KB
  • OEBPS/contact.gif
    96B
  • OEBPS/content.opf
    .xml 8KB
  • OEBPS/js/kobo.js
    .js 5KB
  • OEBPS/sidebar.gif
    .gif 183B
  • OEBPS/springer_epub.css
    53KB
  • OEBPS/toc.ncx
    .xml 2KB
  • mimetype
    20B
  • rights.xml
    .xml 102B

Andrew Bettany, Mike Halsey - Windows Virus and Malware Troubleshooting-Apress (2017).epub.jar

  • SHA256 5cdcf8ad07effa91dec699c83fdd01837138a9fb61693bdd7fa5df457928b05b
  • MD5 SHA1 SHA512 SSDEEP TLSH