Malware is any software application which subverts the will of the legitimate owner of a computer, by means of force or subterfuge, with or without personal or monetary gain on the part of the creator.

learn more… | top users | synonyms (1)

0
votes
1answer
68 views

A sneaky way of disabling Microsoft Security Essentials?

For a long time I've been dismissing and ignoring this popup, which is easy since it only appears at boot (or logon) which is once every few months: But recently I became suspicious after a crash ...
1
vote
0answers
6 views

Is it possible to low level format an Virtual Machine? [migrated]

I just came to wonder, if you can low level format the disk of an Virtual Machine, maybe you guys can help me with that?
1
vote
3answers
82 views

Malware in RevSlider plugin?

Maybe my WordPress site is hacked, because it's always send spams (5000 / day). I found one file in plugins folder which contains this base64 code. What shoul I do? EDIT: Oh, i found another one: ...
3
votes
1answer
130 views

Is this the end of malware use of DNS?

I read about the release of a free dataset of malware related DNS queries called "Predict". A researcher or network security team can download or query this data set and use it to identify malware ...
-5
votes
3answers
62 views

What File Types Should I Scan Before Opening? [closed]

In general, a person downloads some files from the Internet. Secure practice is to, at least, scan them before opening them. In light of this, what file types (i.e. extensions) should a normal user ...
2
votes
2answers
72 views

How does malware performs a UDP hole punch?

I want to know how do malware like ZeroAccess hole punch the network without using a external server? Or do they just mainly infect non-NAT users? Does that mean all NAT users are safe?
1
vote
2answers
60 views

Actual use of covert channel in malware

I have seen several academic sources mentioning covert channels in computers, such as one process sending data to another process/thread on the same machine in a way that attempts to avoid detection. ...
1
vote
3answers
114 views

Large amount of foreign IPs hitting out firewall, is this automated scans or are we under attack?

I just got put in charge of a network. In the logs on our firewall I noticed that we had a large amounts of machines trying to connect to port 53 as well as about a dozen other ports. Are these ...
1
vote
1answer
88 views

Malware code in WordPress?

I'm pretty sure that we have malware code in our WordPress website - Here is the code in question, it is located at the top of every php file in the website; { ...
-4
votes
1answer
85 views

AV isn't dead, so why network appliances differ in handling malicious code [closed]

when taking a look under the hood of some firewall appliances there can be observed a tremendous difference on how they handle malicious code. mostly, av-scanning is restricted to well-known protocols ...
4
votes
3answers
215 views

Windows: unknown program/service etc. sends HTTP request to download a file; how can I find the origin of that request?

The firewall of my company has detected and blocked a repetitive (every 15 min) HTTP request from a PC, which tries to start a download of a file called ..._chrome_installer.exe(or so) from the host: ...
1
vote
0answers
36 views

Browser Popup Survey Scam [closed]

I am looking for information on a new phishing threat that I have personally encountered. What happens is that during normal web surfing, a tab is opened that directs you to a survey regarding your ...
-4
votes
2answers
82 views

What are the chances of a normal Internet user being hacked or infected by malware?

Say I'm a normal Internet user, I visit some well-known social networks like Facebook, twitter, play flash-based games in Facebook, visit some big websites that are known to be safe and trusted and ...
7
votes
0answers
64 views

How to isolate persistent pop-up browser hijack [closed]

There's a persistent browser pop-up affecting Mozilla Firefox which has evaded a number of security pre-cautions and attempts to find a remove it. It's gone on for at least 3 months. The pesky pop-up ...
1
vote
0answers
1k views

How do I get rid of the Total Ad Performance malware from my Android? [closed]

My Sony Xperia Z3 Compact has been infected by a malware that redirects my browsers to either one of the two websites: www.totaladperformance.com or www.admomi.com. I have the paid version of ...
2
votes
2answers
242 views

What do I do, I got a virus warning on a webpage

I went to the web address (hxxp://www.asanka.com) (WARNING: BE CAREFUL WHEN VISITING) on Safari, then suddenly I got a warning message [image below] What do I do? I'm freaked out. I have a lot of ...
-1
votes
1answer
35 views

indicators of compromise via email servers

Malicious files are commonly infiltrated on to the network via email attachments. Besides awareness and education to my staff to refrain from clicking on suspicious attachments, I would also like to ...
-2
votes
0answers
12 views

Prefetcher in registries [migrated]

I`m working on a malware & found the malware modifies these registries: HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Prefetcher\TracesProcessed: 0x00000086 HKLM\SOFTWARE\Microsoft\Windows ...
7
votes
1answer
124 views

Javascript phishing attack sucker: Do I need to be worried? [closed]

So, I'm an idiot. I opened a javascript phishing attack file. I would really, really appreciate some help with decoding the Javascript to figure out whether I'm in trouble, and what sort. I'm on OS X ...
2
votes
1answer
115 views

Mystery IP address Hijack

I'm working on a customer's new website. To get things up and running quickly, we're maintaining his domain name service and hosting the website on another server. Customer bought the URL name years ...
3
votes
1answer
42 views

Secure online server -> Airgap transport?

I'm facing the issue to develop a system which archives some data, which was available via a web-server some time before (to selected users). Now the question arises on how to securely transport the ...
4
votes
2answers
137 views

Malware: extract private keys from smartcard?

We all appreciate smartcards because they secure private keys so they don't get exposed to the world. But in a production-environment it's often the case that smartcards are staying inserted for a ...
2
votes
1answer
157 views

How to avoid ransomware

Malware files execute themselves after downloading them. Let's look at it from the point of view of a piece of ransomware like CryptoLocker, from Wikipedia: Crypyowall 3.0, uses a payload ...
2
votes
2answers
233 views

Can malware provide hidden remote access to a user's desktop?

Is there a possibility that malware on a computer could be providing remote access to an external party without the computer user being aware? I.e., some kind of hidden active remote access tool? ...
4
votes
2answers
203 views

How do cryptographic algorithms help hackers to bypass Antivirus software?

I was wondering how do hackers use cryptography for bypassing antivirus software. I don't have some deep understanding on how antivirus software works, but I know that every antivirus has base of ...
3
votes
2answers
75 views

How to sanitize archive files?

I am looking for a way to make sure that a particular archive file does not contain any sort of malicious code. From time to time new vulnerabilities pop up (e.g. gzip, 7zip) so I though a good idea ...
1
vote
0answers
31 views

Open Source Software & Android Malware Campaigns [closed]

I am looking to find a report that lists malware campaigns launched against Open Source Software (OSS) and/or Android OS. Ideally, this report would have been published in 2014. I am trying to ...
1
vote
2answers
121 views

How effective is antivirus software? [duplicate]

On one hand, most antivirus websites claim their products are highly effective, and I've seen antivirus "test" videos claiming 95%+ detection rates for new malware (as in less than a day old, not old ...
3
votes
1answer
440 views

Zeus botnet source code

I am doing my project on botnets and wanted to understand the source code of the Zeus botnet. Where is the right place to get started with some analysis of zeus botnet source code? I need a good ...
1
vote
2answers
77 views

A malicious folder is created automatically? [closed]

After I ran a third party game and uninstalled it, my antivirus is showing this message repeatedly every 7-8 seconds. When I run the antivirus it shows the malware detected and removed, but again ...
0
votes
0answers
18 views

Security Data Analytics - Classical Measurements/Metrics

for my new Job I have to prepare information about how Security Data Analysis is actually use in practice. So my question is if someone can provide me with measurements/metrics/queries (don't really ...
5
votes
2answers
175 views

How can a font be used for privilege escalation?

Recently Kaspersky released an analysis of Duqu 2.0 and apparently the malware used a True Type Font File to exploit a critical vulnerability (CVE-2011-3402) to "jump directly into Kernel". I haven't ...
1
vote
3answers
116 views

How to get started as a Malware Analyst? [closed]

Sorry if this is posted in the wrong section. A little about me: I'm going to be a sophomore in the fall at university, my major is Computer Science (Information Assurance). I've been interested in ...
1
vote
2answers
79 views

Malware From from external drive

How do malware start from external drives? Especially on Windows (from > Windows 7) commands like Open=Example.exe on an autorun.inf file have been defaulted disabled to not allow auto run when an USB ...
0
votes
4answers
553 views

“Virus Found” Web Browser Pop-up

I use a website that typically creates a new tab with an ad on the first click. Usually, I can close the tab without even looking at it, but recently a more aggressive strain brings up a pop-up (for ...
5
votes
1answer
124 views

Video site requests Adblocker to be shut off, next day I have 3 “weird” bookmarks

I was on a site trying to view a video and the site requested that I turn off my adblocker to view the video. So I did and then the next day I noticed that I had 3 "weird" bookmarks in my bookmark ...
0
votes
0answers
39 views

Why malicious browser extensions along with API hooking

Most malware steals financial data by hooking to browser APIs like PR_Read, PR_write etc.. Also I see some malware like Sinowal use browser extensions along with these API hooks. I believe a user ...
0
votes
0answers
49 views

injecting javascript in webviews in Android

I am relatively new to mobile application security. Currently I am supposed to audit an android application which uses a webview to display some static FAQ page in an activity. The webview in ...
3
votes
1answer
62 views

Hooking an *unexported* API

I want to know is there any way to hook (inline hook) an unexported API of a PE? I have this binary (PE 32 bit) which does not uses any DLL (A statically linked binary) and I would like to know what ...
0
votes
1answer
70 views

Server full disk encryption protection from malware

A group of LINUX servers is using dm-crypt to encrypt data. The servers do not store data long-term but are only temporary stopping points for data before it is sent to other systems. The time the ...
1
vote
0answers
34 views

How long does it typically take to distribute malware signatures?

Are there industry-wide measures that identify how long it typically takes to identify, develop and distribute new malware signatures? I want to understand how long organizations are typically ...
1
vote
0answers
52 views

Linux: Chinese Unionpay plugin, Ubuntu 64-bit - Spamware / Trojan?

China / Linux / Bank / Trojan / Backdoor / Executables Hey guys. I've got an account with a Chinese bank (I live here), and in the process of setting up an online account for the Chinese version of ...
0
votes
1answer
70 views

What items should be on a malware remediation checklist? [closed]

Edit: Let's assume Windows 7 and potentially Windows Server 2003/2008. IMHO, any machine that has malware should be reimaged/reformatted/OS reinstalled before it is deployed back into the ...
2
votes
1answer
70 views

Data collection when responding to malware alerts

When investigating malware alerts I would like to collect some information from the system before the decision gets made to take the system off of the network and re-imaged, or if further forensics is ...
1
vote
7answers
4k views

Malware ad.adsmatte infection

My PC is infected with malware, whenever I open a webpage and click on it a new tab opens on "ad.adsmatte.com". I scanned my PC with Malwarebytes but was unable to resolve the problem. So I ...
26
votes
1answer
3k views

What is an n-day security attack?

There are several attacks types in computer security. For instance, zero-day attacks consist of attacks that use undisclosed exploits. In contrast, what is an n-day attack? Is it a security concern?
0
votes
2answers
75 views

can this be canceled [closed]

Limi1.com put up a malware alert on my computer, with an accompaining number to call. it stated for 29.97 it would be fixed. this was last night today I called my credit card, and was told a charge of ...
1
vote
2answers
61 views

Potential worm damage on a physically isolated Tor system

I'm setting up a physically isolated Tor system (with one computer serving as the workstation and another as a Tor gateway), and I'm concerned about methods a worm could use to infect my OS. In the ...
0
votes
1answer
55 views

Website Loading Content from Malicious Sites

I own a website. Now today I find that when I load the site, Chrome shows "waiting for xxx.com" and some other unknown sites. I never added content or links from these sites. The website is running on ...
1
vote
1answer
99 views

running botnet for analysis

I a very curious to understand botnets practically. I want to run a p2p botnet (storm or waledac) for analysis and learning. I have mainly two issues: Where can i get access to binaries of either ...