Warning from ISP about Murofetweekly "Virus"

Shino · 2020-11-09 06:57:24

Hello,

I got a message from my (German) ISP that one of the devices behind my internet connection could be infected with a "virus" called Murofetweekly.
I share my Internet connection with 2 other people. I, personally, only have an Arch-Linux machine and an Android cell phone. Other computers in my network include Win7 and Win10 PCs.

Does anyone know what this Murofetweekly thing is? My reasearch online was not very conclusive. Most of the sites I've found are in German.

Is there a risk of my Arch machine being infected? I doubt it, but I have quite some AUR packages and get a lot of spam Emails. So, there are definitely threats.

Thank you

schard · 2020-11-09 07:05:13

Searching for the name, I came across the Alias W32/Murofet.A.
This indicates that it is a Malware for 32-bit Windows Systems.
Furthermore, it is designated as a Trojan, not as a Virus.
So it would seem most likely, that one of the Windows devices is infected with said malware, given that the message from your ISP is authentic an trustworthy.

On a side note, I'd recommend to not share your private internet connection with third-party members in Germany.
Get some Information about "Störerhaftung" and you'll realize that you as the contracting party with the ISP, are fully responsible for what happens over your internet connection.

Last edited by schard (2020-11-09 07:06:22)

Shino · 2020-11-09 07:14:48

Thanks for the answer.

I put "virus" in quotes as I didn't know what kind of malware or other stuff it was. The text from 1&1 (my German ISP) said virus.
The mesage from the ISP is trustworthy. I called their support hotline (The number I have in my contract, not the one in the email) and they confirmed this.

It seems, that this malware is used to generate pseudo-random domains and aids with the creation of botnets. Therefore the ISPs had an eye on it.

Regarding the "Störerhaftung": I don't share my internet with any 3rd party members. It's family. I couldn't convince them switching to Linux (, yet).

mpan · 2020-11-09 08:14:48

Inquiry your ISP, what makes them think you are infected with that malware. Without that informaton it’s hard to determine the cause. It may be a false positive from IDS that hasn’t been investigated, but blindly passed downstream. It may as well be misidentification of actual malware based on a similar network usage pattern. But in general I agree with schard: it’s most likely the other people.

As for using the term “virus”, the two common explanations:

In communication with a customer, companies often choose words that make it easy for an average recipient to understand the message. Even if that means using wrong terms.
People responsible for mundane tasks related to security are not expected to have even the basic knowledge of the subject.

schard · 2020-11-09 08:37:33

If the respective devices are all those of family members, I'd just ask them to check them for malware [1] or offer them to do it for them.
I'd also check any potential logs on my IAD aka. "router" to see whether any unwanted "guest" devices have been around.
I don't know who's in your household, but there is the possible scenario, that the kids shared the family WiFi password with their school friends.

[1] Be sure to perform an offline malware scan. I.e. scan any potentially infected system from a live medium and not from a potentially compromised, installed OS.

Shino · 2020-11-09 13:30:35

Other people's devices are not the issue here. Due to Corona, we don't have guests . Router is WPA2 Protected with a (more or less easy to circumvent) MAC filter.

I'm at work today and will check the issue when I get home. Thanks for the answers.

Do you recommend any tools for offline virus checking from a bootable device?

Lone_Wolf · 2020-11-09 14:22:00

For windows devices Dr.Web livedisk looks good , see https://free.drweb.com/aid_admin/

Arch Linux

#1 2020-11-09 06:57:24

Warning from ISP about Murofetweekly "Virus"

#2 2020-11-09 07:05:13

Re: Warning from ISP about Murofetweekly "Virus"

#3 2020-11-09 07:14:48

Re: Warning from ISP about Murofetweekly "Virus"

#4 2020-11-09 08:14:48

Re: Warning from ISP about Murofetweekly "Virus"

#5 2020-11-09 08:37:33

Re: Warning from ISP about Murofetweekly "Virus"

#6 2020-11-09 13:30:35

Re: Warning from ISP about Murofetweekly "Virus"

#7 2020-11-09 14:22:00

Re: Warning from ISP about Murofetweekly "Virus"

Board footer