Re:Chrome 0-day exploit used in Operation WizardOpium
by ianai on Saturday November 02, 2019 @06:28AM
(#21426880)
It’s checking for chrome versions below the current, 78, so update to that. You also have to be on Windows. On windows, make sure you have your antivirus setup to block random executables from download and execution. I’d also block those hosts at the firewall and dns. It gets more complicated from there if you’re infected. But you probably aren’t.
Edit-just realized you actually asked for how to tell if you were infected. Check the windows task scheduler for unknown tasks. It installs items there for persistence.
Edit-search your history and hard drive for “behindcorona” domains. That’s where it loads things from. There are more specifics in the page.
Edit-just realized you actually asked for how to tell if you were infected. Check the windows task scheduler for unknown tasks. It installs items there for persistence. Edit-search your history and hard drive for “behindcorona” domains. That’s where it loads things from. There are more specifics in the page.