Microsoft Exposes Adrozek, Malware That Hijacks Chrome, Edge, and Firefox (zdnet.com) 17
Microsoft has raised the alarm today about a new malware strain that infects users' devices and then proceeds to modify browsers and their settings in order to inject ads into search results pages. From a report: Named Adrozek, the malware has been active since at least May 2020 and reached its absolute peak in August this year when it controlled more than 30,000 browsers each day. But in a report today, the Microsoft 365 Defender Research Team believes the number of infected users is much, much higher. Microsoft researchers said that between May and September 2020, they observed "hundreds of thousands" of Adrozek detections all over the globe. Based on internal telemetry, the highest concentration of victims appears to be located in Europe, followed by South and Southeast Asia. Microsoft says that, currently, the malware is distributed via classic drive-by download schemes. Users are typically redirected from legitimate sites to shady domains where they are tricked into installing malicious software. The boobytrapped software installs the Androzek malware, which then proceeds to obtain reboot persistence with the help of a registry key.
Slashdot exposes Windows 10 (Score:4, Informative)
Wait A Minute (Score:2)
From the article:
Microsoft Defender Antivirus, the built-in endpoint protection solution on Windows 10, uses behavior-based, machine learning-powered detections to block Adrozek.
If Windows Defender blocks Adrozek, why is it a thing?
Re: (Score:3)
Indeed and:
Why do AV software keep allowing this kind of thing, there's a limited number of places that "reboot persistence" can exist so why not secure those places? If you look at "Autoruns" output then you can see everything that starts from all possible start-up points.
Re: (Score:2)
I take it this means my Macs are safe.
The dividends from dumping (Score:3)
How do I know? (Score:3)
How do "find" this threat on my browser?
Re: (Score:2)
It apparently show up as an extension you didn't install.
Re: (Score:2)
What's a 'registry'? (Score:1)
which then proceeds to obtain reboot persistence with the help of a registry key
What's a registry? I can't find one on my Linux system.
Re: (Score:2)
You aren't looking very carefully. A registry is the stuff that tells the system what application is supposed to open which files. Linux systems *do* have that. Well, most of them do, depending on which window manager you have installed. I think it was around Gnome 1.2 that this came in...I remember thinking that the shell automatically executing an activated file was dangerous....but it's *so* convenient. Just double-click on the file (depending on how your options are set) and the correct application
Re: (Score:2)
The registry is basically a hierarchical key-value store. That's it.
There's lots of reasons why you'd want one - settings for example. usually they're stored in dozens of configuration files in various formats.
Windows always had it (even in Windows 3.1), but everyone used INI files stored in WINDOWS directory instead. WIndows 95 consolidated this so all the system settings were also stored there.
Most environments will have some form of registry these days because it's too useful a thing not to have - a gene
Re: (Score:2)
Windows always had it (even in Windows 3.1), but everyone used INI files stored in WINDOWS directory instead. WIndows 95 consolidated this so all the system settings were also stored there.
Not really. Not only did a lot of that stuff still get stored in ini files in windows 95, but there are actually ini files in system directories in windows 7 as well. (And probably newer versions, but I don't have any newer versions of windows running here.)
Microsoft (Score:2)
...shows that the kind of attack that just does not work on anything else but Windows is still an issue when they said they had fixed it ...