Re:Chrome 0-day exploit used in Operation WizardOpium
by euph0ria on Saturday November 02, 2019 @05:51AM
(#21426746)
Please let us know what your procedure is?
[ Parent
| on HN ]
Re:Chrome 0-day exploit used in Operation WizardOpium
by ianai on Saturday November 02, 2019 @06:28AM
(#21426880)
It’s checking for chrome versions below the current, 78, so update to that. You also have to be on Windows. On windows, make sure you have your antivirus setup to block random executables from download and execution. I’d also block those hosts at the firewall and dns. It gets more complicated from there if you’re infected. But you probably aren’t.
Edit-just realized you actually asked for how to tell if you were infected. Check the windows task scheduler for unknown tasks. It installs items there for persistence. Edit-search your history and hard drive for “behindcorona” domains. That’s where it loads things from. There are more specifics in the page.