Warning: Did You Install the Play Store on Windows 11? Read This Now

[Gandalf_The_Grey]

Content source

https://www.howtogeek.com/797298/warning-did-you-install-the-play-store-on-windows-11-read-this-now/

In March 2022, we published instructions for installing the Google Play store on Windows 11. The method involved an open-source project from GitHub. Unfortunately, it contained malware. Here’s how to fix it.

Let’s lead with the important part:

At this point in time, we don’t have reason to believe that any of your sensitive information was compromised.

Table of Contents

Here's What Happened
What the Script Did
How to Fix It
Cleaning Up Manually
Cleaning Up With a Script
What We're Doing

Editor’s Note: Over the past 15+ years, we’ve seen many Windows applications and browser extensions turn to the dark side. We strive to be incredibly careful and only recommend trustworthy solutions to our readers. Because of the increasing risk that malicious actors pose to open-source projects, we will be even more diligent with future recommendations.

Additionally, we’d like to stress once again that there is no evidence your sensitive information was compromised. The domain the malware depends on has now been removed, and its creators can no longer control it.

 

[SeriousHoax]

I used that tool to install PlayStore a couple of months ago. But later I reinstalled Windows again and luckily didn't install PlayStore anymore.

 

[The_King]

At this point we can probably classify google has malware in general.

 

[ForgottenSeer 94654]

The problem is not Google. The problem is that assuming GitHub and other "open-source" projects considered "reputable" contain fully inspected, vetted safe code. It was the GitHub script that had malicious commands implanted in it.

"Unfortunately, the script that downloaded the Windows Toolbox did more than it advertised. It also contained obfuscated code that would set up a series of scheduled tasks and created a browser extension targeting Chromium-based browsers — Google Chrome, Microsoft Edge, and Brave. Only Windows PCs with their language set to English were targeted."

 

[ForgottenSeer 93475]

This is scary. I read somewhere ago that there are attacks targeting open source projects
People trust these projects and don't expect anything bad from them

 

[show-Zi]

I think the premise of being supported by 性善説(the belief that people are born good by nature) is both an attraction and a drawback of GitHub.

 

[Virtuoso]

This again shows that Open source software is not an Utopia with rainbows and unicorns which is usually how the evangelists portray it to be.

 

[upnorth]

At this point in time, we don’t have reason to believe that any of your sensitive information was compromised.

Additionally, we’d like to stress once again that there is no evidence your sensitive information was compromised.

Very poor comfort for those that actually been infected, and also a very weak assessment since guessing and speculate is not going to help. If I personal had been effected by this, I for sure would Not start install another script just because the fumbling part say so. The added trace and information on what occurred on a infected system is important as I would either deal with it myself, or allow an official known AV vendor and their team handle it and not more unknown people on Github, as that started the mess in the first place. Seems that the concept of Trust is hard to grasp.

I find it disturbing that the IP address on the outbound connection is not added and informed about, even if the domain is now dead or not. It's basic ABC investigation on " How To " trace and find a possible infection, but for some reason that specific information one has to reach out and ask for or is available elsewhere. If a system still today try to contact that specific IP, it's a sure sign of infection and a deeper check and cleaning must be done in one way or the other.

For those on this forum that think they might been effected and also found parts that howtogeek been kind enough to supply, it's recommended to please start a new thread here:

Windows Malware Removal Help & Support

Get help removing adware, malware, spyware, ransomware, trojans, and viruses from Windows PCs. Follow the instructions in the pinned topics first. For security purposes, only authorized members may respond to requests for assistance.

malwaretips.com

 

[ForgottenSeer 94654]

This again shows that Open source software is not an Utopia with rainbows and unicorns which is usually how the evangelists portray it to be.

FOSS and other "open source" projects of various flavors are not the answer to the malware and other IT security problems. From a security perspective, they have proven to be highly flawed many times. It's a broadly complex subject, but security is a process - involving, first and foremost, willingness, discipline, perseverance and then money. Few people and organizations are willing to do what it actually takes - sort of like taking 1 tablet per day and hoping to lose 30 kilos when overweight, instead of diet and exercise. Lowest costs, highest revenues, and convenience & speed are the primary objectives and the malware and inherently weak security are treated as a necessary evil and costs of doing business or participating in the digital world.

This is the human way of doing things.

Should IT security be a much higher priority in daily living? It depends upon your perspective. Lots of people do not care one bit about security. However, most of them do care about their money or credit worthiness. So a global cyber event that resulted in millions of people and companies losing their funds or ability to obtain funds is probably what it would take for attitudes and priorities to change.

Are most people willing to pay an extra 1 or 2% in additional costs for better IT security? Many would say yes, but guess what? - businesses have been passing on increased IT security costs to consumers and other companies for years and as you can see the trend is that with all that money spent, IT security has grown worse over the decades. Security is not a software problem. It is a people problem.

 

[Gandalf_The_Grey]

Now on Bleeping Computer:

Windows 11 tool to add Google Play secretly installed malware

A popular Windows 11 ToolBox script used to add the Google Play Store to the Android Subsystem has secretly infected users with malicious scripts, Chrome extensions, and potentially other malware.

www.bleepingcomputer.com