mgkaok Posted June 29, 2017 ID:1139272 Share Posted June 29, 2017 Forbes online posted the following on 6-28: "concerned users should check whether their computer is already infected, and if so, if the ransomware is not yet running. To do this, look for two "rundll32.exe" files running in the Windows Task Manager. If they're present, power off the PC and do not turn it back on again. Reinstalling Windows will then remove NotPetya." I have those two files running. I am using Malware Bytes Premium 3.0.6. Am I protected or should I reinstall Windows as suggested? Link to post Share on other sites More sharing options...
Aura Posted June 29, 2017 ID:1139273 Share Posted June 29, 2017 Hi mgkaok This article is wrong on so many levels, I don't even know where to start. Can you link me the article so I can review it? Link to post Share on other sites More sharing options...
Reconfirm Posted June 29, 2017 ID:1139282 Share Posted June 29, 2017 https://www.forbes.com/sites/thomasbrewster/2017/06/28/three-things-you-can-do-to-stop-notpetya-ransomware-wrecking-your-pc/#6c8f506e77b0 Link to post Share on other sites More sharing options...
mgkaok Posted June 29, 2017 Author ID:1139283 Share Posted June 29, 2017 Here: https://www.forbes.com/sites/thomasbrewster/2017/06/28/three-things-you-can-do-to-stop-notpetya-ransomware-wrecking-your-pc/#3b245a977b05 Thanks Link to post Share on other sites More sharing options...
Aura Posted June 29, 2017 ID:1139286 Share Posted June 29, 2017 The information provided in this article is way too generic to identify NotPetya. It's basically saying "if you see a rundll32.exe process running, you're done for it". rundll32.exe is a legitimate Windows process and multiple instances can run on a normal system, it does not mean that you're infected. Honestly, I wouldn't trust any information coming from websites that aren't an "authority" in InfoSec when it comes to information security. Blogs from Antivirus vendors, security product vendors, independant (recognized) malware researchers, etc. can, but not Forbes, The Washington Post, etc. Follow the instructions below and provide me both the FRST.txt and Addition.txt logs so I can confirm it. https://forums.malwarebytes.com/topic/9573-im-infected-what-do-i-do-now/ Link to post Share on other sites More sharing options...
mgkaok Posted June 29, 2017 Author ID:1139294 Share Posted June 29, 2017 Thanks, Aura. The 2 files are attached. Addition.txt FRST.txt Link to post Share on other sites More sharing options...
Aura Posted June 29, 2017 ID:1139307 Share Posted June 29, 2017 I skimmed through your logs, and I can tell you that you aren't infected by NotPetya, so you can rest easy Link to post Share on other sites More sharing options...
mgkaok Posted June 29, 2017 Author ID:1139310 Share Posted June 29, 2017 U R the best! Thank you!! Link to post Share on other sites More sharing options...
Aura Posted June 29, 2017 ID:1139363 Share Posted June 29, 2017 No problem mgkaok, you're welcome Here are a few good read about NotPetya if you're interested. And these articles are from researchers/companies that can be trusted to provide accurate information https://blog.malwarebytes.com/cybercrime/2017/06/petya-esque-ransomware-is-spreading-across-the-world/https://blogs.technet.microsoft.com/mmpc/2017/06/27/new-ransomware-old-techniques-petya-adds-worm-capabilities/https://www.malwaretech.com/2017/06/petya-ransomware-attack-whats-known.htmlhttp://blog.emsisoft.com/2017/06/27/petya-petna-ransomware/ Link to post Share on other sites More sharing options...
Aura Posted June 29, 2017 ID:1139364 Share Posted June 29, 2017 Glad we could help. :)If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.Other members who need assistance please start your own topic in a new thread. Thanks! Link to post Share on other sites More sharing options...
Recommended Posts