Just a file to check is there is ransomware activation inside

[waterreedshimmer]

Hello, this topic is linked to this one,

https://forums.spybot.info/showthread.php?77079-Activation-issue-on-Windows-10-Home-OEM-Windows-Store-suggestion

I am no more in Windows although I had bought it, I switched to Linux. So no need doing virus search.

It is just:
a) To share the suspected file I told you about:

Removed

Admin Edit
Please do not attach potential malware!

This file is mine, I don't remember having saved it, but I remember having created it so to print internet pics to draw them. So I used odt instead of docx.

I am tired to write now.

It says it wants to write something I didn't ask for in my external drive, not to disconnect it, I hope it didn't write nothing. File is from there. Important data saving.

And there is also this link that did appear in my history search:
hiring process - Should I keep asking candidates to include a specific word to filter out candidates who didn't pay attention to the job ad? - The Workplace Stack Exchange

I won't put link, but it's the hacker usual poem. He just says he is the same then the one who send me the fake ads. I don't believe it. I do search everything with my paranormal powers, and although I don't see people, no small bit of place looks the same.

I have no idea if there is a malware inside this file, but many things did gave suspicion, as you can't zip it and hex has infinite loop although it's very short.

So I am tired, I let you with that.

Oh yes Windows was saying this file was a system file important for it to work, and I would have errors if I delete it permanently from garbage. So I did went check garbage and this file did disappear and I got this ransomware suspicion.

I am no more in Windows anyway.

I won't solve better this issue anyway =)

Don't open it with Windows as it could disappear :/

:spider:

I'm sorry I'm tired, have a good new year =) And thank you very much on your past help on Windows.

[tashi]

Hello waterreedshimmer,

Files are not analyzed at this site. :)

You could upload files to:

Jotti's VirusScan - http://virusscan.jotti.org/
VirScan - http://www.virscan.org/
VirusTotal - http://www.virustotal.com/

Best regards.

[waterreedshimmer]

OK thank you very much.

There would be many blabla about it, either hacker tried to reach it, either it tried self activation on Ubuntu Linux :/ As I had files waiting to be written on my external drive and I did only one upload.

I do not believe infected file to be linked to fake ad jobs as a history link that already disappeared, just my click on it stayed in Firefox history, it was opened twice, not once, and first time, I was on a page and then I was on this real page that hacker used as a poem just to play with me trying to convince me it's linked.

I am not in informatics, this docx seems weird as it looked like already being a compressed file. True I accidentally open it at first. Was my name in it and some symbols. It is quite short as hex file but it does infinite loop and breaks hex program. And compression can only be done if put inside a folder. It can't be uploaded as.

So I will send it for being analysed. No idea if it was modified meanwhile by itself or by hacker. Maybe there is no hacker, maybe it tried to hide itself and made me think it can be modified by exterior.

But if there is a part of ransomware inside as I got some suspicious activity on my Linux, you better not open it.

I shall contact them.

This is a French Ubuntu Linux message saying data is waiting to be written on my external drive that I did only connect to upload the file. :/ So if it is suspicious then it is dangerous, then it reacts also in Linux.

Thank you very much and have a good day, you may close the topic =)

[waterreedshimmer]

They did find nothing, I'll try to find advanced research on it. No idea if virus still on it. But I don't believe file to be clean :/

Thank you very much =)

[waterreedshimmer]

If it was not clear, my Firefox history is fake, this website I was on it twice, not once. Just the 2nd time is there.

But you can do nothing about that, as I'm not on Windows, but browsers are system independent in what concerns threats.

Information suggested is fake: no link between fake job ads and Windows activation ransomware virus.

Thank you and goodbye =)