Not sure who needs to know this, but if you download and install the Windows version of Rufus, the free software for writing ISO images to USB/CD-ROM, your PC will end up with about 100 trojans.
-
@snornik @snep @jordinki @briankrebs the "standard" version stores its settings in the registry
@umby995 @snep @jordinki @briankrebs
yeah and it stores it in:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects\{0DD0E83D-B8CC-4015-B164-66137069CC91}Machine\Software\Policies\Microsoft\Windows Defender\Real-Time Protection
edit: i mean again i did not crosscheck but please (at least) read the report before stating something
-
Not sure who needs to know this, but if you download and install the Windows version of Rufus, the free software for writing ISO images to USB/CD-ROM, your PC will end up with about 100 trojans.
Edit: The site I downloaded from was rufus[.]ie which is apparently the official site. During installation, the software threw up a couple of rather verbose messages saying it needed to download additional components.
Think I pulled down Rufus a couple of months back for a one off. Don't recall where I got it from, but didn't notice any untoward behavior, so possibly a more recent compromise?
-
Is it ironic that your Windoze PC gets infected while trying to download a file that allows you to write an installable Linux ISO? I think very much so and I'm still LOLing about it.
@briankrebs
Surely, the conspiracy isn't that deep.
-
@jordinki thank god! the Internet gods DO exist!
@briankrebs @jordinki it's Gods all the way down.
-
Not sure who needs to know this, but if you download and install the Windows version of Rufus, the free software for writing ISO images to USB/CD-ROM, your PC will end up with about 100 trojans.
Edit: The site I downloaded from was rufus[.]ie which is apparently the official site. During installation, the software threw up a couple of rather verbose messages saying it needed to download additional components.
@briankrebs I think the message here is that Windows is bad, and Rufus is bad.
Just use GNU+Linux with the dd command guys. Lol
-
Its very likely that Secure Boot is kicking in. A Windows .iso written to a USB stick will pass, as will Debian, Ubuntu and a few other Linux distros. VMware ESXi and Proxmox will also pass.
At the boot stage, that is not a Windows PC - its just a PC!
To be honest if you are not sure exactly what is what, then Secure Boot is a good thing.
@gerdesj @briankrebs lol mansplaining secure boot to brian krebs HAHAHAHA
-
Not sure who needs to know this, but if you download and install the Windows version of Rufus, the free software for writing ISO images to USB/CD-ROM, your PC will end up with about 100 trojans.
Edit: The site I downloaded from was rufus[.]ie which is apparently the official site. During installation, the software threw up a couple of rather verbose messages saying it needed to download additional components.
Well crap
-
Not sure who needs to know this, but if you download and install the Windows version of Rufus, the free software for writing ISO images to USB/CD-ROM, your PC will end up with about 100 trojans.
Edit: The site I downloaded from was rufus[.]ie which is apparently the official site. During installation, the software threw up a couple of rather verbose messages saying it needed to download additional components.
There's a good reason why I go with Ventoy nowadays. Besides of the "just drop the ISO and the USB will multiboot it" convenience -
@ajn142 @sindarina yes. I'm guessing supply chain hack. i have no data to support that, though.
@briankrebs @ajn142 @sindarina
I downloaded Rufus about a week and a half ago and I didn't notice anything suspicious, but do you know how I would check to see if I was compromised?
Thanks
-
@briankrebs @ajn142 @sindarina
I downloaded Rufus about a week and a half ago and I didn't notice anything suspicious, but do you know how I would check to see if I was compromised?
Thanks
@kiwiapple87 @ajn142 @sindarina You would likely notice on a recent model Windows PC b/c Windows Defender would go apeshit after you click yes to their prompt for installing more software.
-
@umby995 @snep @jordinki @briankrebs
yeah and it stores it in:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects\{0DD0E83D-B8CC-4015-B164-66137069CC91}Machine\Software\Policies\Microsoft\Windows Defender\Real-Time Protectionedit: i mean again i did not crosscheck but please (at least) read the report before stating something
@snornik @snep @jordinki @briankrebs yeah that's my bad. i am confused because the text report from anyrun doesn't show any registry activity at all, but the more info section for the process in the full report does show 1347 registry events, which definitely seems suspicious.
-
@kiwiapple87 @ajn142 @sindarina You would likely notice on a recent model Windows PC b/c Windows Defender would go apeshit after you click yes to their prompt for installing more software.
@briankrebs @ajn142 @sindarina
I don't recall any additional prompts. But I could be misremembering, and was hoping there is a process, file, or something that I can go look for that would tell me if I was compromised or not.
-
@briankrebs
I know you probably know, but for anyone else, I've always used Balena Etcher and never had issues.@RedOct @briankrebs lol etcher... well yes you could use a electron app and waste ram and resources or just dd it (even in wingw), if the iso is properly created
-
Is it ironic that your Windoze PC gets infected while trying to download a file that allows you to write an installable Linux ISO? I think very much so and I'm still LOLing about it.
@briankrebs Plot twist: Windoze IS the virus!
-
Is it ironic that your Windoze PC gets infected while trying to download a file that allows you to write an installable Linux ISO? I think very much so and I'm still LOLing about it.
@briankrebs New Alanis lyrics just dropped.
-
@snornik @snep @jordinki @briankrebs yeah that's my bad. i am confused because the text report from anyrun doesn't show any registry activity at all, but the more info section for the process in the full report does show 1347 registry events, which definitely seems suspicious.
-
@briankrebs Thanks. I'm running Rufus 4.15.2396, pulled from Github via the link on the rufus dot ie page. Writing a Win11 x64 ISO out to USB in a VM. It failed the USB write, but my USB drive might also be flakey.
Had to chime in since I used Rufus just last night myself. I did download the 4.15.2396 version from the rufus.ie site. I launched it once to build my bootable usb and closed it, but used the wrong image. I launched it a second time and didn't have anything odd happen. It is signed by Akeo Consulting with a signing time of 30 JUN 2026. I kept the file in case someone wants some details from it.
-
Is it ironic that your Windoze PC gets infected while trying to download a file that allows you to write an installable Linux ISO? I think very much so and I'm still LOLing about it.
@briankrebs while i get that point.... without linux alot are not used to console/tui tools and need a gui. i dont think its funny cause as a nerd your probably overwrite the whole windows partition anyway, pretty soon. as a newcomer you want to try out linux on a 2nd device and then this is not as funny anymore.
-
@briankrebs while i get that point.... without linux alot are not used to console/tui tools and need a gui. i dont think its funny cause as a nerd your probably overwrite the whole windows partition anyway, pretty soon. as a newcomer you want to try out linux on a 2nd device and then this is not as funny anymore.
@snornik 100 percent agree. I'm still fuming that we're at Windos 11 hundred and there is no obvious way to write an ISO to an external image. I credit that to Microsoft understanding this capability is a strong existential threat.
-
@snornik 100 percent agree. I'm still fuming that we're at Windos 11 hundred and there is no obvious way to write an ISO to an external image. I credit that to Microsoft understanding this capability is a strong existential threat.
@briankrebs YES! Sadly true!
