Clémence Navarro

15 hours ago, throwawaydox said:

Also, here is the archive I have of the uncropped/uncensored photos originally hosted by Maison Close's parent company Lovely Planet, up to about 2023. UHQ. Archive password is LovelyPlanet

There are a couple of unrelated photos I think but most of them are Maison Close marketing material

 

https://gofile.io/d/I7AGDw

Amazing ... do you have any more uncensored, say from other shoots/models? 🤩

On 12/8/2024 at 5:48 AM, throwawaydox said:

Also, here is the archive I have of the uncropped/uncensored photos originally hosted by Maison Close's parent company Lovely Planet, up to about 2023. UHQ. Archive password is LovelyPlanet

There are a couple of unrelated photos I think but most of them are Maison Close marketing material

 

https://gofile.io/d/I7AGDw

Archive seems to contain a crypto-miner (XRM) that is rather difficult to get rid of.

It automatically installs once you decompress the archive.

The in-built Windows anti-virus does not remove the virus/trojan/miner. The virus also blocks installation of tools such as Malwarebytes.

It seems to enable the XMR miner at different times (when the computer is in standby). Considering the relative sophistication of the virus I wouldn't be surprised if gets enabled only for powerful CPUs.

Proceed at your own risk!

3 hours ago, solarpilot said:

Archive seems to contain a crypto-miner (XRM) that is rather difficult to get rid of.

 

It automatically installs once you decompress the archive.

 

The in-built Windows anti-virus does not remove the virus/trojan/miner. The virus also blocks installation of tools such as Malwarebytes.

 

It seems to enable the XMR miner at different times (when the computer is in standby). Considering the relative sophistication of the virus I wouldn't be surprised if gets enabled only for powerful CPUs.

 

Proceed at your own risk!

What are we looking for .. something unusual in the process listing? And how did you remove it ? thanks

4 hours ago, solarpilot said:

Archive seems to contain a crypto-miner (XRM) that is rather difficult to get rid of.

 

It automatically installs once you decompress the archive.

 

The in-built Windows anti-virus does not remove the virus/trojan/miner. The virus also blocks installation of tools such as Malwarebytes.

 

It seems to enable the XMR miner at different times (when the computer is in standby). Considering the relative sophistication of the virus I wouldn't be surprised if gets enabled only for powerful CPUs.

 

Proceed at your own risk!

I was able to install Malwarebytes and do a scan, it found something but I'm guessing it's something else. How do I make sure I'm not infected?

SMH it's just an image archive, ESET clears it, but I'll take it down
I think there was a PDF in there maybe that's what was triggering it

On 12/8/2024 at 3:01 PM, talos72 said:

Awesome!

Help, can I do something with that archive without being Premium on Gofile ?

Thanks

You would have noticed if it was activated (installed?). CPU was running at 100% (but sneakily the crypto-miner would stop working when you opened task manager), using a lot of electricity and generating a lot of heat. It blocks installation of malwarebytes (or running it if it is already installed) and several other 3rd party malware tools (e.g. ESET online scanner) and various windows services (system restore etc.). It would even try and shut down the browser when I was on the page for the tool that I used to remove it.

I suspect the crypto-miner only activates for IPs in Eastern Europe as I was only able to find info about it from resources in that region (luckily I speak some of the local languages). This may be a method to avoid quick detection. That being said, the virus payload also includes a remote-access trojan, so even if the crypto-miner is not running, it could be used to steal your data.

I did find that it adds Windows Defender exclusions for the following path: 

C:\ProgramData\WindowsTasks\apphost.exe

There are several other exclusion exes for that path. "WindowsTasks" is not a real Windows folder. And that wasn't the real apphost.exe. I was not able to actually navigate to it via File Explorer while the computer was infected.

It also disabled the Windows security centre.

I found a solution via this thread in a seemingly legit looking russian-language forum. 2 caveats however:

1. The crypto-miner remover actually triggers windows defender (this is mentioned in the thread). It seems that this a generic ML-based identification. Without going into details, if you write your own program (not a virus) and if does certain things, Windows Defender will label it as the exact same "virus" (unless you submit to MS for whitelisting). USE AT YOUR OWN RISK.

2. The tool has horrible UI and isn't very clear about it's findings. You do get a log file that shows corrections if the virus was identified, but it may be that this is a generic log file (that you get even when no cleaning was done).

URL to the tool: https://www.safezone.cc/resources/av-block-remover-avbr.224/

Click the "For english-speaking users" spoiler button for a guide.

I went with [5] straight away, rebooted into "Safe Mode with Networking", ran the tool and it did remove the virus (in my case it did create a quarantine folder, maybe if you're not infected it won't).

3 hours ago, throwawaydox said:

SMH it's just an image archive, ESET clears it, but I'll take it down
I think there was a PDF in there maybe that's what was triggering it

I got the infection as soon as I decompressed the archive with a licensed, fully updated copy of WinRar. Windows Defender did pop-up, but it said it had failed to clean the virus.

Hey, thanks for all the info. Quick question, I DLed the archive, opened it once, just opened one random picture and closed it. Then I deleted it since I saw here it was infected.

Am I being infected in your opinion?

I downloaded the file and did a scan with AVG before opening it.  The scan turned up nothing.  After I opened it I rescanned my computer (AVG again) but turned up nothing.  Is the crypto-miner hiding?

Maison Close Advent Calendar - Day 10

21 hours ago, throwawaydox said:

SMH it's just an image archive, ESET clears it, but I'll take it down
I think there was a PDF in there maybe that's what was triggering it

The link to the host no longer works, anyway.

Is it possible to upload again?

Thx. 

19 hours ago, solarpilot said:

You would have noticed if it was activated (installed?). CPU was running at 100% (but sneakily the crypto-miner would stop working when you opened task manager), using a lot of electricity and generating a lot of heat. It blocks installation of malwarebytes (or running it if it is already installed) and several other 3rd party malware tools (e.g. ESET online scanner) and various windows services (system restore etc.). It would even try and shut down the browser when I was on the page for the tool that I used to remove it.

 

I suspect the crypto-miner only activates for IPs in Eastern Europe as I was only able to find info about it from resources in that region (luckily I speak some of the local languages). This may be a method to avoid quick detection. That being said, the virus payload also includes a remote-access trojan, so even if the crypto-miner is not running, it could be used to steal your data.

 

I did find that it adds Windows Defender exclusions for the following path: 

 

C:\ProgramData\WindowsTasks\apphost.exe

 

There are several other exclusion exes for that path. "WindowsTasks" is not a real Windows folder. And that wasn't the real apphost.exe. I was not able to actually navigate to it via File Explorer while the computer was infected.

 

It also disabled the Windows security centre.

 

I found a solution via this thread in a seemingly legit looking russian-language forum. 2 caveats however:

 

1. The crypto-miner remover actually triggers windows defender (this is mentioned in the thread). It seems that this a generic ML-based identification. Without going into details, if you write your own program (not a virus) and if does certain things, Windows Defender will label it as the exact same "virus" (unless you submit to MS for whitelisting). USE AT YOUR OWN RISK.

 

2. The tool has horrible UI and isn't very clear about it's findings. You do get a log file that shows corrections if the virus was identified, but it may be that this is a generic log file (that you get even when no cleaning was done).

 

URL to the tool: https://www.safezone.cc/resources/av-block-remover-avbr.224/

 

Click the "For english-speaking users" spoiler button for a guide.

 

I went with [5] straight away, rebooted into "Safe Mode with Networking", ran the tool and it did remove the virus (in my case it did create a quarantine folder, maybe if you're not infected it won't).

 

 

I got the infection as soon as I decompressed the archive with a licensed, fully updated copy of WinRar. Windows Defender did pop-up, but it said it had failed to clean the virus.

 

 

 

Hey solarpilot, is this a joke?
I downloaded the zip-file and scanned it prior to and after the extraction. There was nothing detected. Also, there was no .pdf document in the archive.

Today I scanned the system top to bottom with two antimalware programs. I also scanned the system in "offline mode". Nothing has been detected.

So, what makes you think throwawaydox put malware in his zip-file? Why and how would he do that?

Also, I am really curious HOW you got all that info you've written above. It is impressive, but how did you find all that out? Are you a cybersecurity expert?
Please tell, how did you get suspicious in the first place and how can you verify that there has been malware in the .zip-file? Did I get you right that your "Windows Defender did pop-up" when extracting the file and that started the whole investigation?

Is there a method to cleary verify that there is no malware on the system?

You're writing about the path "C:\ProgramData\WindowsTasks\apphost.exe" but there is no "C:\ProgramData\WindowsTasks" folder in Windows 11.

Where and how did you see the "Windows Defender exclusions"? I have no idea where those are listed.

Thank you in advance.

Maison Close Advent Calendar - Day 11