Vera Crypt help.

[rotvl25]

Hello guys, i need your help. I've encrypted the system disc and i have problem with one application, after finishing work in this application when i reboot my pc i got message from vera crypt about probably evil maid attack - i change my password. I run this application one more time with the same effect, its really problem? anyone could steal the password to my computer? sorry for my english . I am waiting for a response.

 

[kanewolf]

If you read the definition of an "evil maid" attack -- https://www.schneier.com/blog/archives/2009/10/evil_maid_attac.html What you are seeing seems to be a false positive. But did the application you are running come from a reputable source and not torrent or hacked in some way?

 

[COLGeek]

What is the exact error/warning you are receiving? Can you post a screen capture or picture of it?

 

[rotvl25]

" WARNING: The verification of VeraCrypt bootloader fingerprind failed!
Your disk may have been tampered with by an attacker ("Evil Maid" Attack)
This Warning can also be triggered if you restored VeraCrypt boot loader using an Rescue Disk generated using a different VeraCrypt Version. You are advised to change your password immadiately which will also restore the correct VeraCrypt and to take measures to avoid access to this machine by untrusted entities.


I got message like this. Is it possible to steal the password without physical access to the computer ??

 

[COLGeek]

A keylogger or other installed malware can potentially steal a password and share with a nefarious user, yes.

Have you scanned this system for malware and viruses lately? Also, kanewolf asked some very good questions earlier. Do you have any software installed from dubious sources (torrents, cracked games, etc)?

 

[rotvl25]

I have one game I downloaded it from the internet (but i dont know its pirate or no, this game is from 2008 year) and i have photoshop (full legal, registered) - guys i have one more question, i have 2 pc's if I cut one from the Internet(cable) this keylogger will be still work ? (if i have keylogger on pc i dont know it) i can work on 2 pc's one without internet, one with internet .. that's not a problem for me.

 

[COLGeek]

The keylogger (if present) should be removed. A tool like Malewarebytes can help (even the free version) to remove such infections. Disconnecting an infected system will prevent it from communicating or spreading, but you limit the system's usefulness and your ability to keep it up to date.

As stated earlier, you are likely seeing a false positive. However, you should still scan all of your systems. It is free and easy to do.

https://www.malwarebytes.com/mwb-download/

 

[rotvl25]

Thank you!