Results 1 to 5 of 5

Thread: BlackLotus

  1. #1

    Thread Starter
    Frenzied Member
    Join Date
    Dec 2012
    Posts
    1,470

    BlackLotus

    Microsoft has issued some guidance on how to identify a BlackLotus intrusion.
    https://www.microsoft.com/en-us/secu...otus-campaign/
    This one is hard to identify because it modifies the boot process. To summarize, from the Command Prompt:
    - mountvol e: /s
    - e:
    - cd \efi\Microsoft\boot
    - dir *.efi
    Consult the link above to determine if there are related files with different time/date stamps. Run as Adminstrator may be required, and older systems may use a different Drive letter such as "d:".

    This information came to me via CISA.

    J.A. Coutts

  2. #2
    Super Moderator Shaggy Hiker's Avatar
    Join Date
    Aug 2002
    Location
    Idaho
    Posts
    38,989

    Re: BlackLotus

    Not sure what this is. Is there a question? Was this in response to something else?
    My usual boring signature: Nothing

  3. #3
    PowerPoster
    Join Date
    Nov 2017
    Posts
    3,116

    Re: BlackLotus

    Seems like a heads-up, and the VB6 section of the site probably gets the most eyeballs.

  4. #4
    Super Moderator dday9's Avatar
    Join Date
    Mar 2011
    Location
    South Louisiana
    Posts
    11,715

    Re: BlackLotus

    @couttsj - I moved this thread to General PC. If there is any legitimate reason why it should stay in the VB6 forum, please let me know.
    "Code is like humor. When you have to explain it, it is bad." - Cory House
    VbLessons | Code Tags | Sword of Fury - Jameram

  5. #5

    Thread Starter
    Frenzied Member
    Join Date
    Dec 2012
    Posts
    1,470

    Re: BlackLotus

    Quote Originally Posted by dday9 View Post
    @couttsj - I moved this thread to General PC. If there is any legitimate reason why it should stay in the VB6 forum, please let me know.
    Optionbase1 is correct in his observation. I figured that it would get moved, but I am disappointed that it does not show up as having been moved. It is easy to tell that General PC does not get visited very much, and I needed to get the word out as quickly as possible.

    J.A. Coutts

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •  



Click Here to Expand Forum to Full Width