Not sure who needs to know this, but if you download and install the Windows version of Rufus, the free software for writing ISO images to USB/CD-ROM, your PC will end up with about 100 trojans.
-
Its very likely that Secure Boot is kicking in. A Windows .iso written to a USB stick will pass, as will Debian, Ubuntu and a few other Linux distros. VMware ESXi and Proxmox will also pass.
At the boot stage, that is not a Windows PC - its just a PC!
To be honest if you are not sure exactly what is what, then Secure Boot is a good thing.
@gerdesj @briankrebs lol mansplaining secure boot to brian krebs HAHAHAHA
-
Not sure who needs to know this, but if you download and install the Windows version of Rufus, the free software for writing ISO images to USB/CD-ROM, your PC will end up with about 100 trojans.
Edit: The site I downloaded from was rufus[.]ie which is apparently the official site. During installation, the software threw up a couple of rather verbose messages saying it needed to download additional components.
Well crap
-
Not sure who needs to know this, but if you download and install the Windows version of Rufus, the free software for writing ISO images to USB/CD-ROM, your PC will end up with about 100 trojans.
Edit: The site I downloaded from was rufus[.]ie which is apparently the official site. During installation, the software threw up a couple of rather verbose messages saying it needed to download additional components.
There's a good reason why I go with Ventoy nowadays. Besides of the "just drop the ISO and the USB will multiboot it" convenience -
@ajn142 @sindarina yes. I'm guessing supply chain hack. i have no data to support that, though.
@briankrebs @ajn142 @sindarina
I downloaded Rufus about a week and a half ago and I didn't notice anything suspicious, but do you know how I would check to see if I was compromised?
Thanks
-
@briankrebs @ajn142 @sindarina
I downloaded Rufus about a week and a half ago and I didn't notice anything suspicious, but do you know how I would check to see if I was compromised?
Thanks
@kiwiapple87 @ajn142 @sindarina You would likely notice on a recent model Windows PC b/c Windows Defender would go apeshit after you click yes to their prompt for installing more software.
-
@umby995 @snep @jordinki @briankrebs
yeah and it stores it in:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects\{0DD0E83D-B8CC-4015-B164-66137069CC91}Machine\Software\Policies\Microsoft\Windows Defender\Real-Time Protection
edit: i mean again i did not crosscheck but please (at least) read the report before stating something
@snornik @snep @jordinki @briankrebs yeah that's my bad. i am confused because the text report from anyrun doesn't show any registry activity at all, but the more info section for the process in the full report does show 1347 registry events, which definitely seems suspicious.
-
@kiwiapple87 @ajn142 @sindarina You would likely notice on a recent model Windows PC b/c Windows Defender would go apeshit after you click yes to their prompt for installing more software.
@briankrebs @ajn142 @sindarina
I don't recall any additional prompts. But I could be misremembering, and was hoping there is a process, file, or something that I can go look for that would tell me if I was compromised or not.
-
@briankrebs
I know you probably know, but for anyone else, I've always used Balena Etcher and never had issues.@RedOct @briankrebs lol etcher... well yes you could use a electron app and waste ram and resources or just dd it (even in wingw), if the iso is properly created
-
Is it ironic that your Windoze PC gets infected while trying to download a file that allows you to write an installable Linux ISO? I think very much so and I'm still LOLing about it.
@briankrebs Plot twist: Windoze IS the virus!
-
Is it ironic that your Windoze PC gets infected while trying to download a file that allows you to write an installable Linux ISO? I think very much so and I'm still LOLing about it.
@briankrebs New Alanis lyrics just dropped.
-
@snornik @snep @jordinki @briankrebs yeah that's my bad. i am confused because the text report from anyrun doesn't show any registry activity at all, but the more info section for the process in the full report does show 1347 registry events, which definitely seems suspicious.
-
@briankrebs Thanks. I'm running Rufus 4.15.2396, pulled from Github via the link on the rufus dot ie page. Writing a Win11 x64 ISO out to USB in a VM. It failed the USB write, but my USB drive might also be flakey.
Had to chime in since I used Rufus just last night myself. I did download the 4.15.2396 version from the rufus.ie site. I launched it once to build my bootable usb and closed it, but used the wrong image. I launched it a second time and didn't have anything odd happen. It is signed by Akeo Consulting with a signing time of 30 JUN 2026. I kept the file in case someone wants some details from it.
-
Is it ironic that your Windoze PC gets infected while trying to download a file that allows you to write an installable Linux ISO? I think very much so and I'm still LOLing about it.
@briankrebs while i get that point.... without linux alot are not used to console/tui tools and need a gui. i dont think its funny cause as a nerd your probably overwrite the whole windows partition anyway, pretty soon. as a newcomer you want to try out linux on a 2nd device and then this is not as funny anymore.
-
@briankrebs while i get that point.... without linux alot are not used to console/tui tools and need a gui. i dont think its funny cause as a nerd your probably overwrite the whole windows partition anyway, pretty soon. as a newcomer you want to try out linux on a 2nd device and then this is not as funny anymore.
@snornik 100 percent agree. I'm still fuming that we're at Windos 11 hundred and there is no obvious way to write an ISO to an external image. I credit that to Microsoft understanding this capability is a strong existential threat.
-
@snornik 100 percent agree. I'm still fuming that we're at Windos 11 hundred and there is no obvious way to write an ISO to an external image. I credit that to Microsoft understanding this capability is a strong existential threat.
@briankrebs YES! Sadly true!
-
Is it ironic that your Windoze PC gets infected while trying to download a file that allows you to write an installable Linux ISO? I think very much so and I'm still LOLing about it.
@briankrebs dude you're still on that? lolz
-
@RedOct @briankrebs lol etcher... well yes you could use a electron app and waste ram and resources or just dd it (even in wingw), if the iso is properly created
@snornik @RedOct @briankrebs Ok. If not etcher, what?
-
@snornik @RedOct @briankrebs Ok. If not etcher, what?
@stevenally @RedOct @briankrebs
dd (easy if you already have a linux), if not, wsl or mingw
params are: if=inputPath of=outputPath status=progress (the last only needed if you want to see how long its gonna take)
"if" is the path to the iso
and "of" should be the device path not the partition mount point
and unmount all partitions beforeEdit:
but yeah as a newcomer to linux just use etcher, just for the first time, if your stuck on win probably easier than learning the difference between mount point and device paths.
one time does not make a big difference that's more of a pro tip i guess. if you need to write more than one iso to a drive, or do it often. -
Not sure who needs to know this, but if you download and install the Windows version of Rufus, the free software for writing ISO images to USB/CD-ROM, your PC will end up with about 100 trojans.
Edit: The site I downloaded from was rufus[.]ie which is apparently the official site. During installation, the software threw up a couple of rather verbose messages saying it needed to download additional components.
I've been made aware of a post from someone representing Rufus who says I'm very confused about this post. I've reported that Windows Defender went bananas after I installed Rufus on a Windows 11 device. It immediately popped up warnings about hacktools and trojans being installed while it was installing. I wish I had a record of it but I nuked everything after the alerts.
-
I've been made aware of a post from someone representing Rufus who says I'm very confused about this post. I've reported that Windows Defender went bananas after I installed Rufus on a Windows 11 device. It immediately popped up warnings about hacktools and trojans being installed while it was installing. I wish I had a record of it but I nuked everything after the alerts.
@briankrebs There are some rather ... possessive communities around USB boot image builders, I forget if it was rufus or ventoy or what, but long story short: if you badmouth the product, the sealions. Dear god, the sealions.
