Could this be malware?


Recommended Posts

5 hours ago, BudMan said:

Well you should prob look into the details of each error/warning and look to correct stuff that is not correct.

 

I'm not seeing any dcom 10010 errors, but in mine I see some 10016, which I have just corrected.  Decom permissions can be adjusted..

 

Volmgr 46, points to crash dump file not there? Not created?

http://www.eventid.net/display-eventid-46-source-volmgr-eventno-10647-phase-1.htm

 

Are you disabling swap?? ie your pagefile?

I will do so. The dcomm 10016 is one too. How did you correct it?

10 hours ago, Peresvet said:

TL;DR 6 pages, so sorry if it's been addressed already, but you are missing lots of unallocated space there, ~ 46GB.

It's over provisioning

5 hours ago, BudMan said:

fixed the permissions on the decom...

 

You will want to look for the specific that was causing yours mine was the Immersive Shell

Would you offer instructions on how you fixed the decom error?

What is your specific error - do a simple google for the exact error and you will more than likely find multiple hits on how to correct it.. For example.. Here were instructions how to fix an esent error was also seeing.

 

https://answers.microsoft.com/en-us/windows/forum/all/event-viewer-erro-esent-455-since-update-1903/624a2548-06e5-47f4-bb99-76d6412895a0

 

here was specific fix for the 10016 error I was seeing

https://answers.microsoft.com/en-us/windows/forum/windows8_1-performance/error-event-id-10016-distributedcom/130522d2-beac-4495-980a-65e1e3279901

 

Keep in mind the errors I was seeing could be different than what your seeing.

Well whatever it is now that is causing the problem I did in fact have malware, ransomware to be exact. For the first time in my life I started using Tor browser and now I am getting ransom notes in my email is anyone familiar with these?

An email threatening ramsonware is also not ransomware - its just spam..

 

Also the emails saying this is your password, and I know what you did on some p0rn site - send me some crypto - again spam..

I haven't read through the full breadcrumb trial of this thread so apologies if this has already been mentioned, but random crashes/BSOD's can sometimes be caused by bad RAM.

 

Have you tried running memtest 86 on your computer and let it run a full sweep of your RAM?

 

You can download the ISO file (https://www.memtest86.com/) and either burn it to CD, or create a bootable USB memory stick using Rufus (https://rufus.ie/).

 

Depending your computers BIOS setup, you may need to enable legacy boot support to boot from USB media/CD's.  (My motherboard calls it CSM - compatability support module).

 

Once you have the motherboard booting from USB/CD, let memtest run a full sweep.  If its all fine, you can rule out memory issues.

2 hours ago, BudMan said:

An email threatening ramsonware is also not ransomware - its just spam..

 

Also the emails saying this is your password, and I know what you did on some p0rn site - send me some crypto - again spam..

What about the fact that the password s they showed were my actual passwords?

 

Because some site data was compromised... That had your passwords..

 

1) Hack some site that has emails and passwords

2) use said emails to spam emails saying xyz - proof we have your passwords

3) profit.

https://techcrunch.com/2018/07/12/ransomware-technique-uses-your-real-passwords-to-trick-you/

 

edit:

This is another example of why you use very complex passwords, use different passwords for all sites.. And pay attention to any sites that have been compromised

 

Look into https://haveibeenpwned.com/

 

edit2:  To be honest some help desk guy that works for company xyz, could leverage his access to emails and passwords for such a scheme as well.  Site wouldn't have to have be compromised by outsiders.

 

 

  • Thanks 2

In addition to the above ... if you do get some emails saying they know your password is (your actual password)... be sure that all sites that you use that password/email combo have been changed.  Don't worry about the "ransom note" email itself ... just start changing passwords (if the password is your actual password) if you haven't already.

 

I've gotten a few of those "ransom note" emails but they contained older passwords of mine.

 

You can also use https://haveibeenpwned.com/ to check your email address vs. data breaches.

^very good advice.  While the complexity of the passwords does not help if the site has been compromised.. Using complex passwords can get you out of the habit of using the same password over and over once you start letting your password tool generate them for you..

 

I normally create account on new site with easy to remember and type password, then after account created complex it up to normally the max number of characters they allow, etc.

 

You know I would not be surprised if some of these spammers just send random stuff to emails.. When you send out a billion emails in a day - you prob hit on a few combo's of users that used some common password, etc.  And take the bait.. So just with a user list of say 10 million email address... I could send out saying hey I know your password for facebook, and it was p@55word! send me $$ and I won't do xyz..

 

The reason we get spam is the people sending them are not paying for the sending.. When it cost me say 2 minutes of work to send out 10 million emails, even if I only get .001% hit rate for users that fall for it - hey easy money... Until such time that users wise up and stop falling for this nonsense.. There will be spammers trying to take advantage..

 

Here is a funny example of something in my spam folder, was just going through to see if anything mis marked..   How and the F could anyone fall for such nonsense?

spam..thumb.png.d3a99c6c7674d46f28fa2783fe1597cb.png

 

Just blows my mind that somewhere, someone is thinking they are going to get 45 million dollars???

Does anyone else have an issue seeing your attachments (sorry, off topic)?  

 

 

Capture.JPG

 

I also tried with my phone .. on the Sprint mobile (to make sure my router wasn't blocking something) ... but your attachments don't work for me.

 

Right clicking and selecting "Open image in new tab" gives the following error ...

 

This XML file does not appear to have any style information associated with it. The document tree is shown below.
<Error>
<Code>AccessDenied</Code>
<Message>Access Denied</Message>
<RequestId>5EF1CE48A4FDD3F4</RequestId>
<HostId>
VInyw41A+Zzy/aACyc/tHGTkjdwhbL6QHatXMPPfyN+6i1ErbvjK6/bqcw7NQmHS/QY4fNm7T6A=
</HostId>
</Error>

Weird ...

54 minutes ago, BudMan said:

Not sure but I am seeing them.. Your not I take it.

 

edit: just opened in another browser and can see them just fine as well.. Thinking maybe its just you..

No I'm getting the same as @Jim K here.

1 hour ago, BudMan said:

Not sure but I am seeing them.. Your not I take it.

 

edit: just opened in another browser and can see them just fine as well.. Thinking maybe its just you..

Looks like there's actually a file permission issue with the neowin cdn...

Ok I checked the  https://haveibeenpwned.com/  site and it says I have been compromised by over 30 sites and they want me to buy a password program. What can I do now? Should I notify my service provider?

22 minutes ago, devnulllore said:

Ok I checked the  https://haveibeenpwned.com/  site and it says I have been compromised by over 30 sites and they want me to buy a password program. What can I do now? Should I notify my service provider?

No..your service provider can't do anything about it.

 

Just be sure your passwords are changed (especially if that email you received contained current password(s) or if the compromised sites revealed currently used password(s)).  Just might be time to go through all your logins and update. :)

So exactly - when I look at my email on the pwnd site.. its listed in 6.. one being Adobe, back in 2013

 

Adobe: In October 2013, 153 million Adobe accounts were breached with each containing an internal ID, username, email, encrypted password and a password hint in plain text. The password cryptography was poorly done and many were quickly resolved back to plain text.

 

will just list the text vs screenshot, since there might be an issue with screenshots currently?

 

Anywhoo you see that adobe had problem back in 2013, my email address was listed in there.  My ISP has nothing to do with Adobe's lack of security.. Same goes with your ISP and the sites you have accounts on that have been compromised..

 

And sure they might suggest you use password site or software xyz.. Your free to do that if you wish.. Use of password site/software will allow you to use different passwords for each site much easier then you doing it yourself... Nobody can remember complex passwords, especially once you start using different ones on each and every site you have accounts on.. I am guessing you have way more than 30 ;)  If all your sites use different passwords - even if one compromised they only gain access to that site account, and not all of yours since your using different passwords on each site.

What does your browser have to do with a site being compromised and the sites incompetence at correctly securing their users passwords/info?

 

Nothing you do or run on your end has anything to do with that... You could use a 120 character complex password, doesn't matter if the site stores it in the clear, or in a easy to reverse hash in their DB, and that DB is gotten by someone.

 

The one thing you can do to help mitigate issues when that happens is use different passwords for each site.

edit: Also the other thing you could do is enable 2FA.. So even of the info is compromised - they would also need to be able to do the 2FA.. That is not fullproof either, but it can help - depending on the MFA the site has enabled and how they have it implemented, etc.

This topic is now closed to further replies.
  • Recently Browsing   0 members

    • No registered users viewing this page.
  • Posts

    • One of the strangest galaxies in our Universe could help answer some long overdue questions by Sayan Sen Image by Pixabay via Pexels | Not representative An international team of astronomers led by the Department of Astronomy at Tsinghua University has discovered an unusually metal-poor galaxy that may contain signs of first-generation star formation. The galaxy, named Metal-Pristine Galaxy COSMOS Redshift 3 (MPG-CR3), or CR3, was identified using observations from the James Webb Space Telescope (JWST), the Very Large Telescope (VLT), and the Subaru Telescope. The findings, published in The Astrophysical Journal Letters, describe CR3 as the most metal-poor galaxy known from the period known as "cosmic noon," around 11.5 billion years ago. Cosmic noon refers to a period when the universe was producing stars at its highest rate and galaxies were growing rapidly. In astronomy, "metals" refers to all elements heavier than helium, including oxygen, carbon, and iron. Because CR3 contains so few of these heavier elements, researchers say it closely resembles what scientists expect the earliest galaxies in the universe may have looked like. The discovery is significant because it could offer clues about Population III (Pop III) stars, the first generation of stars thought to have formed after the Big Bang. These stars are believed to have formed from gas made almost entirely of hydrogen and helium, before heavier elements were created inside stars and spread across the universe through supernova explosions. Hence this is why CR3 has been referred to as a "living fossil." Scientists have long believed that Population III stars existed only in the very early universe. As more generations of stars formed and died, they enriched surrounding gas with heavier elements, making the conditions needed for metal-free star formation increasingly rare. Because of this, researchers expected the formation of such stars to have largely ended after the epoch of reionization, a period when radiation from the first stars and galaxies transformed the neutral hydrogen filling the universe and made it largely transparent to ultraviolet light. CR3 appears to challenge that idea. The galaxy was observed at a redshift of z = 3.193 ± 0.016. Redshift measures how much light from a distant object has been stretched as the universe expands and helps astronomers determine how far back in time they are looking. In this case, the redshift corresponds to roughly 11.5 billion years ago during cosmic noon. Although the universe was already several billion years old by that point, CR3 shows characteristics more commonly associated with much earlier galaxies. Observations revealed exceptionally strong emissions from hydrogen and helium, including Lyα, Hα, and He I λ10830. Lyα, or Lyman-alpha emission, is a specific wavelength of light produced by hydrogen and is widely used to study distant galaxies. Hα emission is another hydrogen signature commonly used to trace active star formation, while He I λ10830 is produced by helium and can indicate the presence of very hot, young stars. The measured equivalent widths of EW₀(Lyα) = 822 ± 101 Å and EW₀(Hα) = 2814 ± 327 Å are among the highest ever observed in star-forming galaxies. Equivalent width is a measure of the strength of an emission line relative to the surrounding light, and such large values are typically associated with intense and very recent star formation. At the same time, researchers found no statistically significant detections of metal emission lines, including [O III] λλ4959, 5007 and C IV λλ1548, 1550. Emission lines act as chemical fingerprints that reveal which elements are present in a galaxy. Oxygen and carbon lines are commonly seen in galaxies that have already undergone significant chemical enrichment. Their absence in CR3 suggests an unusually pristine environment. Using abundance calibration methods developed with JWST observations, the team placed a 2σ upper limit on the galaxy's gas-phase metallicity of 12+log(O/H)<6.52, corresponding to less than 0.7% of the Sun's metallicity (Z < 7 × 10⁻³ Z⊙). Gas-phase metallicity measures the abundance of heavy elements in a galaxy's gas. A 2σ upper limit indicates that the true value is very unlikely to be higher than the quoted threshold. Even when accounting for uncertainties in the calibration methods, the most conservative limit remains 12+log(O/H)<6.95, making CR3 the most metal-poor galaxy identified at cosmic noon. The galaxy also appears to contain very little dust. Researchers measured a Lyα/Hα flux ratio of 13.9 ± 2.5, a result that suggests negligible dust attenuation, meaning very little of the galaxy's light is being absorbed or scattered by cosmic dust. Because dust is usually produced by earlier generations of stars, this finding further supports the idea that CR3 has experienced very little chemical enrichment. Further analysis using spectral energy distribution modelling, a technique that compares observed light with theoretical models, suggests that CR3 contains an extremely young stellar population only around 2 million years old. The modelling, which used Population III stellar templates, also indicates the galaxy has a stellar mass of approximately 6.1 × 10⁵ M⊙. The symbol M⊙ represents one solar mass, or the mass of the Sun. One of the key questions raised by the discovery is how such a chemically primitive galaxy could exist in a universe that had already spent billions of years producing heavier elements. To investigate this, the researchers examined CR3's surroundings. Their analysis suggests the galaxy may lie in a slightly underdense environment, with a density contrast of roughly δ ≈ −0.12. An underdense region contains less matter and fewer galaxies than average. The team suggests that this relative isolation may have helped preserve pockets of pristine gas. Metal-rich material expelled from nearby galaxies may never have reached CR3, while the lower rate of galaxy mergers and interactions could have slowed the mixing of enriched gas into the system. If future observations confirm these findings, CR3 could provide some of the strongest evidence yet that first-generation star formation continued well after the epoch of reionization. Such a result would challenge the conventional view that pristine star formation ended by z ≳ 6 and suggest that small pockets of metal-free gas survived much longer than previously thought. Researchers stress that more observations will be needed to determine the galaxy's true nature. Future spectroscopic studies with higher resolution and better signal quality could help confirm whether CR3 is genuinely hosting Population III star formation. The discovery is also expected to encourage searches for other similar galaxies, which could help astronomers better understand how the first stars formed and how galaxies evolved in the early universe. Source: Tsinghua University, IOPscience This article was generated with some help from AI and reviewed by an editor. Under Section 107 of the Copyright Act 1976, this material is used for the purpose of news reporting. Fair use is a use permitted by copyright statute that might otherwise be infringing.
    • "I think in the immediate absence of a partner to apply relief" In the words of Sterling Archer... "Phrasing!"
    • For me, the fundamental problems with these "smartglasses" is that they really don't work well for people with significant prescriptions and massively up the price if you use attached lenses if they have displays, and if they don't, then they're not actually "smart" anything, rather just connecting to your phone and relaying voice to an AI. In a few cases like this, they throw in small cameras to feed video to the AI. All around, these feel like both a solution looking for a problem, and the problems it tries to solve seem more easily solved by different approaches and designs. Oddly, if the rumours are true, Apple may actually have invented something for once and it kind of does this right: put cameras in ear buds and manage the interface to AI exactly as most of us do: tapping on an ear bud and saying "Hey Google" or "Hey Siri." That makes them compatible with almost everyone, can double up as a hearing assist device, an impaired vision assist device, a "smart" device... and answer your phone and play music. That just seems like a better solution all around.
    • Usually the bigger ones with many fixes/changes take a few, theyre an exception to the rule most likely
    • If you don’t get lucky with Valve’s Steam Machine reservation system, you can make your own Steam Machine instead. Valve says that “starting with the SteamOS 3.8 release, you can put together your own Steam Machine using whatever PC parts you want.” SteamOS 3.8.10 launched last week with a slew of updates, including “improved compatibility with recent Intel and AMD platforms.” Alongside that improved compatibility, Valve is giving gamers the green light to install SteamOS on their own desktops. In an interview with The Verge, Valve’s Pierre-Loup Griffais said Valve has been “rolling out improvements to [SteamOS] so it’s more compatible with desktop hardware,” including eventual support for Nvidia graphics. Griffais says Valve has “a growing team” working on Nvidia driver support for SteamOS, adding, “We’re collaborating with Nvidia very closely.” While he mentioned that Nvidia support might not come this year, Griffais emphasized that “it’s certainly something that we’re working on in the background.”     Subscription not needed: https://archive.fo/Tssfc Subscription needed: https://www.theverge.com/games/953411/valve-steamos-desktop-nvidia
  • Recent Achievements

    • Dedicated
      HidekoYamamoto94 earned a badge
      Dedicated
    • One Month Later
      timbobit earned a badge
      One Month Later
    • One Month Later
      nates earned a badge
      One Month Later
    • Week One Done
      Almohandis earned a badge
      Week One Done
    • Rookie
      dorf went up a rank
      Rookie
  • Popular Contributors

    1. 1
      +primortal
      452
    2. 2
      +Edouard
      161
    3. 3
      PsYcHoKiLLa
      107
    4. 4
      Michael Scrip
      84
    5. 5
      Steven P.
      70
  • Tell a friend

    Love Neowin? Tell a friend!