Malware is any software application which subverts the will of the legitimate owner of a computer, by means of force or subterfuge, with or without personal or monetary gain on the part of the creator.

learn more… | top users | synonyms (1)

0
votes
1answer
47 views

Objectively, how effective are malware removal tools at detecting infections?

I'm fully aware that concrete scientific data may not exist on this topic but I feel that the question at hand won't all boil down to opinion. Either way, with the rampant increase in sophistication ...
41
votes
5answers
8k views

Is it dangerous to call spam phone numbers, even if you know they're spammers?

I sometimes like to check spam just to see how the messages look like, and I found someone who actually put an American phone number (1-XXX-XXX-XXXX). Most of these spammers are either trying to get ...
3
votes
4answers
77 views

What makes Malware so difficult to remove?

Why is it that when malware or adware is installed it's extremely difficult to remove? You can't go into your programs list to uninstall it and usually need a special program to remove it. What do the ...
1
vote
4answers
142 views

Do technical advice sites sometimes link to malware, and if so, how should we properly research errors? [closed]

Suppose you get an error on your PC that shows up randomly, then you do a search on the internet for the error to find out how to fix it. Typically, you will get some sites that offer a solution, but ...
-4
votes
0answers
27 views

Specific ad links only with Chrome (not in incognito mode or Firefox)

I'm seeing some particular ad (erectile disfunction) links in [website removed] (right in the header) and I'd like to make sure this is not a problem with my pc. I only see those links with Chrome ...
0
votes
0answers
26 views

LAN client attempting to connect to many unkown IPs on Boot [migrated]

I have a Zywall 110 Firewall. While perusing the logs I was seeing random bursts of attempted connections to unknown external IP addresses from a single LAN client computer. I noticed because I would ...
1
vote
1answer
34 views

Router Malware Infection [closed]

I am aware that routers can be infected by malware and I have two questions. Can a router be infected with malware through the USB port. Are routers only susceptible to DNS malware such that you ...
1
vote
1answer
51 views

Ad-Banner Rendering Sites Serve with malicious content - how to respond?

We've received a random email, which was of-course by the way it looks might be a marketing attempt - however, one always needs for a verification to be done. The email read the following: We ...
5
votes
2answers
107 views

Security of Windows Processes using “RunAs A Different User”

I've struggled to find much information on this topic. What I'm interested in is the following: Scenario A user is logged into a Windows (7, 8.1, etc) workstation as a standard non-administrative ...
5
votes
1answer
42 views

Does prefetching/preloading in web browsers pose a security risk?

Today I googled the name of a domain that was reportedly serving up malware. My search results came up (with the compromised domain at the top of the list) and within seconds my AV gave an alert ...
5
votes
1answer
37 views

Are Push 2FA methods safe from Malware?

I am doing a survey on various 2FA solutions, and recently I came across “Push” 2FA (e.g Duo Security). In this solution, the site (e.g. a banking site) pushes a notification to the user’s mobile ...
0
votes
2answers
61 views

How dangerous are worm:win32/Goldrv!rfn and worm:win32/vbjk?

Windows defender has detected the following worms on my system and I was wondering how dangerous are they and what is it that they do?
2
votes
1answer
116 views

How does Zeus (and other malware) inject code into other processes

Recently, I've been studying how malware works, most recently the infamously known Zeus bot, and I've noticed one thing that I don't seem to understand: The malware is said to be able to hook APIs in ...
3
votes
2answers
99 views

What to do after a BadUSB attack? [closed]

I'm asking myself what to do after a user gets attacked by BadUSB? (Full scan, boot-time scan, ...?) Is the "bad usb" stick even able to infect the user's system with malware or other spy tools?
0
votes
1answer
49 views

Virus: Images get replaced on website [closed]

I have installed Windows 7 again on my laptop with Chrome as browser. The problem is that on different websites I visit, the actual images of the website get replaced with out of context images. It ...
1
vote
2answers
65 views

How does “Ransomware” Work?

So I am wondering how Ransomware files work. I know Ransomware encrypts all files with AES-256 for speed but where does RSA come in? Apparently RSA is slow to encrypt files so it uses AES-256 first ...
1
vote
1answer
57 views

How to protect Windows Registery from being changed or from programs trying to add keys

This question is with regards to Windows Personal PC. How to protect Windows Registry from being changed or from programs trying to add keys? I understand that the following general good practices ...
0
votes
2answers
146 views

Our users get a trojan horse alert on our site, but we don't. What do we do?

A user of our website got a trojan horse alert when she tried to get to our website. But myself and some other friends got no alert whatsoever and can go on the website and download files without ...
1
vote
0answers
17 views

iLivid infection/ iLivid behaviour analysis

Although lots of surveys and reports have been done on iLivid by lots of malware analyzers, I decided to inspect iLivid independent of previous research. I have read lots of reports about iLivid but ...
3
votes
4answers
163 views

Can my computer get infected if I hover the mouse to check the thumbnail of an e-mail attachment?

So, today an user sent me an e-mail about a suspicious e-mail. When I opened it to check it, I accidentaly hovered the mouse over the "doc.jpg" and it opened the image thumbnail. I never bothered to ...
0
votes
0answers
22 views

What's the Safest Way to Open / View Email Attachments? [duplicate]

I'm aware that opening email attachments is a great way to let malware onto my computer. Friends and relatives often send me videos as attachments, so I'm wondering if there's a way to download and ...
1
vote
0answers
84 views

How Skype Click to Call plugin is used to send spam?

My friend had Skype Click to Call plugin installed within browser on Mac OSX. And his Skype account started to send some automatic spam messages linking to lose weight websites (via goo.gl) without ...
0
votes
2answers
51 views

How to reinstall Win7 from a D-drive on an infected laptop

The laptop is infected with some sort of bad stuff (virus? Trojan? malware? etc). I am thinking of wiping it clean and reinstal Win7 "from scratch". I am running Win7 from an HP Probook, which has a ...
0
votes
1answer
41 views

Bad USB malware and Chrome OS

I have recently been readiing about the unpatchable bad usb and similar malware. I use chrome OS which is supposed to be very secure but could someone with physical acess to my system compromise it ...
1
vote
0answers
26 views

Detecting Malcode in Excel and Word Documents

There are a bunch of tricks to circumvent potentially malicious macros in office documents you receive. My question is how do I [forensically] detect if there are malicious macros in the documents? ...
3
votes
2answers
155 views

Google Chrome on Android constantly being redirected

I have an Android (5.0.1 with December 2015 patches). My problem is with Chrome (latest version as per Google Play Store). Which has malicious redirect going on to ...
27
votes
2answers
3k views

Identifying the author(s) of a piece of malware

When a new piece of malware appears, people can try to determine where it comes from, and who its authors could be. How do security experts attempt to identify the authors of a new publicly disclosed ...
1
vote
0answers
19 views

Access android internal storage for full passive deep malware scan?

Is it possible to passively (with a computer) view/scan all content on an android mobile device's internal storage without crackopen/damaging it? For a deep malware scan of the whole storage of the ...
0
votes
2answers
68 views

Difference between antivirus and sandbox?

When reading about how antivirus and sandbox work, my understanding is that an AV scans a file to see whether it matches with known viruses signatures. Sandbox can be used to obtain the behaviors of a ...
0
votes
0answers
16 views

Resource of malware source code written in C/C++ [duplicate]

I've started to study malware analysis and have dissected a few binaries. However, I'd like to view the source code of some malware (C/C++) in order to get better insight. I am mainly interested in ...
4
votes
1answer
52 views

Reducing risk for malware exposure from USB storage devices

I have a somewhat hypothetical situation where I need to re-image a machine using a USB thumb drive, however I cannot be certain that the drive itself is malware free. It is the only thumb drive that ...
0
votes
1answer
24 views

When NtUnmapViewOfSection is called?

I'm analyzing an executable and I see that it created a process child and within it there was a call to NtUnmapViewOfSection. I know that this method is almost always malicious and can be used for ...
1
vote
1answer
32 views

What is the purpose of enclosing process spawning?

This file/script is supposed to scan for outdated Node modules and prompt the developer to update them, however I believe it is malware. The instructions were to download the file, set the executable ...
1
vote
1answer
46 views

How can I send a file with DLL to Cuckoo Sandbox?

I want to submit an executable for analysis in Cuckoo Sandbox. The file must be in the same folder with a DLL I have. How can I request Cuckoo to test my exe and make it run properly? (i.e exe and ...
0
votes
2answers
108 views

How does malware install itself as a service without requiring user's credential?

I order to understand malware, I've tried to create a toy-example myself. However, I don't understand how the malware install itself on the computer as a service, without the credentials of the user. ...
1
vote
0answers
23 views

cuckoo sandbox - PID exit

I hope someone could help me I've played with cuckoo for a while however I've just done a new installation and it all works however it will not run the binary i would like to scan. the PID exits ...
-5
votes
2answers
35 views

Can a login page be configured to target specific user [closed]

Can a website be configured to only download malware onto a system if a specific user logs in.
1
vote
0answers
78 views

Does this pdf file embeds an exploit or malware?

So a friend of mine was sent a phishing attack(Which was tailored for him and he fell for it) which also downloaded this pdf file: hxxps://www.dropbox.com/s/qw9mcw9p3pmc5j5/resume.pdf?dl=0 and he ...
2
votes
1answer
54 views

Is it there any way to detect payloads generated by veil framework

While pentesting, I used to generate a malicious payloads using the veil framework. The generated payload bypasses antivirus & infects the target system. Is there any way to detect veil payloads ...
0
votes
2answers
57 views

What processes would indicate my computer is infected with malware?

If one opens Task Manager on a Windows machine and looks at all the processes that are currently running, are there any tell-tale signs that one of them is malware?
0
votes
2answers
45 views

Is there a full-disk-encryption OR file-encryption solution where a trojan can NOT extract the secret key (e.g. from RAM)?

Is there a full-disk-encryption OR single-file-encryption solution like an operating system or a combination of devices or services ... that make sure that the master-decryption-key can NOT be ...
1
vote
0answers
27 views

using a directory of yara files

I'm going through the Malware Cookbook PEScanner and they want a path to my yara files to search on. I currently have a directory full of yara rules for known pieces of malware. What would be the ...
1
vote
2answers
58 views

Malicious email attachments analysis

I have a question regarding incoming emails with malicious attachments on my email server. So, my idea, in my ideal setup, is to have a machine aside running virtualization software. This would run ...
4
votes
1answer
70 views

Antivirus constantly detecting tmp files as threats

Recently my antivirus has been constantly detecting threats and it's always tmp files. I delete maybe 50 of these files each day. A few days ago it detected a trojan. Last week it detected many ...
19
votes
5answers
3k views

Is it possible for a file that is non-executable and read-only to run malicious code?

On a POSIX system, is there a possibility for a file which is non-executable and read-only (aka with a mode 444) to run malicious code on a machine? If so, can you explain how it would do so?
4
votes
1answer
118 views

Is this VM-sandbox idea a good idea for testing viruses? [duplicate]

You want to look at some viruses, so you use something like VirtualBox to create a sandbox environment. But what if we change that environment a lot? What if we do: STEP ONE: Create a bootable flash ...
23
votes
2answers
2k views

How trustworthy is `sudo apt-get install (package name)` in Ubuntu?

One of the easy ways to install a program in Ubuntu Linux is to type a command in the terminal, but how do I know that the program is coming from a trusted source and not from somewhere dangerous? ...
3
votes
0answers
43 views

All Devices on Network Being Redirected to Malware Download [closed]

I have a curious problem. I received a compromised email from an address on my university's domain. Not realizing it was faked, I clicked a link in the email to a url on my university's domain, and ...
3
votes
1answer
39 views

How To Remove Possible Virus Files

See the original question. Using both AutoRun, where I disabled anything that wasn't verified or highlighted (that seemed suspicious), I looked at Process Explorer and found the above unverified. In ...
-1
votes
1answer
60 views

Griefing in the social circles of security experts? [closed]

When I was in college more than 15 years ago, I had some friends who were taking CS degrees with focus on Information Security. These folks knew how to write fuzzers, knew how use ring 0 debuggers, ...