Path: csiph.com!weretis.net!feeder4.news.weretis.net!feeder5.news.weretis.net!news.solani.org!.POSTED!not-for-mail From: Thomas 'PointedEars' Lahn Newsgroups: comp.lang.javascript Subject: Re: This is a VIRUS - how does it works? Date: Thu, 30 Mar 2017 18:31:12 +0200 Organization: PointedEars Software (PES) Lines: 83 Message-ID: <5023259.DvuYhMxLoT@PointedEars.de> References: Reply-To: Thomas 'PointedEars' Lahn Mime-Version: 1.0 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: 8Bit X-Trace: solani.org 1490891472 30949 eJwNyckRwDAIBLCWwHtgynE8of8SEn0lOH2LlqnRtErIjA7ygRFt8u4/hdVe5pHf2tYxc/oD2xoO2Q== (30 Mar 2017 16:31:12 GMT) X-Complaints-To: abuse@news.solani.org NNTP-Posting-Date: Thu, 30 Mar 2017 16:31:12 +0000 (UTC) User-Agent: KNode/4.14.2 X-Face: %i>XG-yXR'\"2P/C_aO%~;2o~?g0pPKmbOw^=NT`tprDEf++D.m7"}HW6.#=U:?2GGctkL,f89@H46O$ASoW&?s}.k+&. i received an email from a fake DHL corrier (about a package delivering), > it had an attachment, > the attachment was a "ST6890945.zip" file, > it contained a .jse file, > the file is "ST6890945.jse" > > the body of the email invited me to open and read the attachment, > I extracted on the Desktop folder the .jse file > and I double-clicked the .jse file First mistake. Never open suspicious e-mails. Never open suspicious attachments directly. > on my Windows 10 64 bit Second mistake, see below. > What happened: > a black window shortly opened, > a hourglass appeared, > the black open window closed > the .jse delete himself > (in about three seconds) > > > I downloaded and run an antivirus (SpyHunter) Third mistake. Once your system is compromised, no malicious software recognition tool in the world can 100 % undo that. Also, SpyHunter is not an antivirus, it is a spyware removal tool. > it found a > - "wsKs.exe" file in "C:/Program Data" folder > - a Registry entry in "HKLM/..../run" called "Load" > the "Load" entry was pointing to the "wsKs.exe" file > - a suspicious cookie (I dont'remeber its name) > > I deleted all the three of them, Fourth mistake. Only reinstalling your system can make it clean again. Only if you really know what you are doing (and you clearly don’t), and the malicious software did not have privileged access, it may suffice to delete and recreate the affected user account. > but I don't know if they had been created by this "ST6890945.jse" > or if they were an old virus, so the "ST6890945.jse" malicious injections > could still be in my Windows 10... You better count on that. > I downloaded and run another antivirus (Avast), > it didn't find anything That does not mean that your system is clean. Antivirus software can only find malware that is recognizable as such; either clearly recognizable because of known patterns, or similar to known patterns as recognizable by heuristics. > is there anybody who is able to understand what it does > (and therefore what should have I delete more from my Windows 10 64 > bit...)? Yes. Delete everything of it. Windows 10 is the biggest virus and spyware of all. > PAY ATTENTION: > In the following posts I'll send the .zip file containing the .jse file You did not, and that is good so. This is a non-binary newsgroup. -- PointedEars FAQ: | | Twitter: @PointedEars2 | Please do not cc me./Bitte keine Kopien per E-Mail.