Virus attached to emby file....should I be concerned? Thoughts?

[diaz1510 154]

I'm assuming this isn't normal? Discovered by Windows Defender. 

Edited June 7, 2023 by diaz1510

[nuke11 24]

You might want to read the security alert at the top of the forum.

Emby Server does not start - Security advisory 2023-05-25 | Emby Documentation

Before you delete the file, try and send them to the developers of Emby as instructed at the bottom of the article.

Edited June 7, 2023 by nuke11

[diaz1510 154]

Gotcha.  I will say I see absolutely no issues with the way Emby is performing.  I am not having any trouble at all.  It just came up after I did a scan.

[seanbuff 1318]

5 minutes ago, diaz1510 said:

Gotcha.  I will say I see absolutely no issues with the way Emby is performing.  I am not having any trouble at all.  It just came up after I did a scan.

Good to hear, however as your system has detected the presence of one the key infected files. I would take the time to perform some of the necessary actions in the advisory, looking for and deleting any of the other known affected files.

Also ensure you upgrade to the latest version 4.7.13.0 and perform these actions:

Quote

• Assign new passwords to all of your Emby Server users
• Don't allow local login without password
• Ensure no user has an empty password

 

[darkassassin07 652]

40 minutes ago, diaz1510 said:

Gotcha.  I will say I see absolutely no issues with the way Emby is performing.  I am not having any trouble at all.  It just came up after I did a scan.

Yeah, hacking peoples systems and maintaining that connection usually requires avoiding being noticed...

 

Don't be complacent and make sure you don't have other compromised systems/services. Literally everything else you do with that computer is potentially at risk; online banking for example.

 

The good news is the domain that 'pluggin' was sending your data too is no longer active as of a few weeks ago now. (assuming you don't have an updated version of the virus than what emby had analyzed, still a good idea to send them your copy)

[diaz1510 154]

Sent it to softworkz and got it all handled...thanks!