Malware is any software application which subverts the will of the legitimate owner of a computer, by means of force or subterfuge, with or without personal or monetary gain on the part of the creator.

learn more… | top users | synonyms (1)

3
votes
2answers
253 views

Accidentally came across the source code for some malware, what to do?

I accidentally, the other day, went to a dodgy site, and today I discovered that in my cache there lay a text file. And after reading the contents of the file, I have deduced that it is the source ...
0
votes
0answers
14 views

How to detect office Malwares [on hold]

There are many undetectable Microsoft Office malware samples. I'm trying to detect them by dynamic analysis of cuckoos sandbox. Most of Malwares contains embedded exes but if I write rule to detect ...
3
votes
1answer
45 views

Phishing/Malware redirection through AdExchange on Android

Issue: Yesterday I discovered a strange behaviour in the Chefkoch.de App. During the search for recipe, Firefox opens up with a (German) phishing warning screen. This happened not only on this ...
0
votes
0answers
80 views

CryptWall virus attack [on hold]

Is there something new about any solution to decrypt all my files that are infected with the CryptWall virus? All my files have extension *.abc.
1
vote
2answers
42 views

Difference between virus and trojan?

To my current understanding: a virus is a program that does not self replicate and relies on the host file being spread, it has malicious intent. A trojan is a program that is run be deceiving the ...
2
votes
2answers
368 views

Why does Google Safe Browsing keep detecting malware on my website?

We provide a freemium service to upload large files and download them later on. Using ClamAV, we scan every file for viruses after it is uploaded and before it can be downloaded. The file is deleted ...
4
votes
2answers
88 views

What is a “roving” backdoor?

What is a "roving" backdoor? I understand the general concept of a backdoor. Emphasis on keyword qualifier: "roving"...
3
votes
2answers
111 views

My IP address switched suddenly and then switched back

Sometimes I look at the login history of my blog account (a Tumblr blog) to make sure no one else is logging in (because I have private posts that I want to keep private). Even though today I ...
1
vote
1answer
65 views

Network setup for malware analysis lab in a corporate view

I am planning to setup a malware analysis lab in the Incident Response team of the company I work for. As I am basically a malware analyst I some how managed to get up with the malware analysis lab ...
0
votes
1answer
64 views

Is mgicinjs.info a virus or malware site? How to get rid of it?

Today I noticed that almost all of my web project (published or in localhost) have a set of weird script references in their pages: And they are all automatically generated - they doesn't appear in ...
9
votes
1answer
163 views

New social engineering tactic that uses printer serial numbers?

We have been getting a new kind of scammer-esque call every couple weeks here at the office (I work at an enterprise web application development company). Basically, the flow of events is this: ...
4
votes
1answer
152 views

Why did this attack use 0.0.0.0 as IP address and why did it work?

Working through this exercise in network forensics, the attacker used a buffer overflow exploit to send commands to the victim's command prompt. The commands open an FTP session and download some ...
4
votes
3answers
84 views

Does Gmail's 'preview' feature for documents in the browser prevent malware?

I'm concerned about opening attached Word documents and other files (images, PDFs, etc). Gmail has a feature that previews these in the browser for you in a popup, without leaving the Gmail screen - ...
6
votes
0answers
114 views

Where is the best place to get descriptions of malware?

I'm looking for a source of descriptions of 1990s to early 2000s malware; I have searched for a very long time yet found very little. I require information such as payload activation dates, files ...
3
votes
2answers
139 views

A compromised USB

Assuming that a given USB drive is compromised(infected), what's the best way to deal with it? I mean, obviously, the solution is to nuke(format) the drive. But for that, the device needs to be ...
2
votes
1answer
392 views

What's with the Facebook malware which posts obscene posts in all the groups? [closed]

How to get rid of the Facebook malware which sends pornographic posts in all the groups you belong to? I always made fun of people who became victim of this malware/virus saying they are not cautious ...
6
votes
2answers
1k views

Can a piece of malware/virus inject itself into an ISO

Let's say that I have an infected PC. I download a copy of the Windows ISO(obviously clean) and burn it to an USB. Is it possible that the malware on my computer can inject itself in this process/ISO ...
1
vote
1answer
75 views

How do I track IPs my computer is accessing?

Month or two my Mac OS machine in ~5% cases goes aviasales.ru instead of imgur.com links that I click. The history in newly opened tab has only the current Aviasales URL, and the link I click looks ...
0
votes
1answer
121 views

Does CryptoWall needs a internet connection to encrypt my files?

Does CryptoWall 3.0 use some resource on the internet to encrypt my files? I watched this video on YouTube - in this video a tool is used to sniff network traffic and find information about ...
39
votes
4answers
6k views

Have computer criminals been known to exploit easily-edited websites like Wikipedia to embed malicious scripts?

When I was reading a page on Wikipedia several months ago (December 2014) I saw what looked like a pop-up window from BT, but I soon realized that when I closed the page the pop-up disappeared. I then ...
2
votes
2answers
73 views

How to track down and remove Mac malware that is calling out?

Little Snitch periodically brings up a dialog that says: Terminal via node wants to accept an incoming connection from X on port 3000 (remoteware-cl). X are different IPs in eastern europe. A full ...
3
votes
3answers
192 views

How to avoid fake “Windows Virus Alert”

I was recently browsing online when I came across this page: When I chose to close the tab, I received this message: And after choosing "Leave this page" twice, I receive this message: ...
0
votes
1answer
75 views

Can a ratter use your webcam undetected? [duplicate]

The Black Hat conference (I wasn't there) had a session on "ratters" (RAT for Remote Access Trojan) who take illicit footage of users (usually female) by hijacking their systems. The question I have ...
2
votes
1answer
150 views

Is there any known encrypting ransomware that attacks Macs?

Just about every article I read about Cryptowall, Cryptolocker, and its ilk seems to assume that the reader is running some flavor of Windows. When I Google "ransomware OSX", I get a long list of ...
1
vote
3answers
97 views

how to protect my data from malware/spyware that infected my BIOS?

we all know that some countries do their best to spy on their citizens and the citizen of other countries and that countries maybe have specialized spying agencies wither they are known or not, and, ...
2
votes
1answer
46 views

Can virtualization protect me from an infected BIOS?

As you know, there are attacks on the firmware of BIOS and HDD. What if I used some kind of VMS, maybe VirtualBox? Will this protect me from an already infected BIOS (and by that, I mean, no one can ...
3
votes
1answer
91 views

Is it dangerous to have the built-in Administrator account enabled?

I've seen it said that when using the built-in Windows Administrator account, the best practice is to enable it (net user administrator /active:yes), use it, and then disable it. I do realize it's a ...
3
votes
1answer
61 views

Can malware spread via bluetooth file transfer in Android?

I am aware of some malware that spreads when two devices are paired using Bluetooth; but can malware spread when sending a clean file to someone or receiving it via bluetooth ? If so, does it need ...
1
vote
1answer
37 views

Detecting the source of dll injection

Is it possible to determine the process that performed DLL injection against a victim process?
25
votes
3answers
4k views

Is HTML5 vibrate feature a security vulnerability?

While surfing a news website on my mobile, I receive a virus infection alert warning that triggers my phone to vibrate incessantly. The alert looks like the following: I didn't expect my phone to ...
0
votes
1answer
97 views

A sneaky way of disabling Microsoft Security Essentials?

For a long time I've been dismissing and ignoring this popup, which is easy since it only appears at boot (or logon) which is once every few months: But recently I became suspicious after a crash ...
1
vote
0answers
6 views

Is it possible to low level format an Virtual Machine? [closed]

I just came to wonder, if you can low level format the disk of an Virtual Machine, maybe you guys can help me with that?
1
vote
3answers
93 views

Malware in RevSlider plugin?

Maybe my WordPress site is hacked, because it's always send spams (5000 / day). I found one file in plugins folder which contains this base64 code. What shoul I do? EDIT: Oh, i found another one: ...
3
votes
1answer
142 views

Is this the end of malware use of DNS?

I read about the release of a free dataset of malware related DNS queries called "Predict". A researcher or network security team can download or query this data set and use it to identify malware ...
-7
votes
3answers
75 views

What File Types Should I Scan Before Opening? [closed]

In general, a person downloads some files from the Internet. Secure practice is to, at least, scan them before opening them. In light of this, what file types (i.e. extensions) should a normal user ...
2
votes
2answers
79 views

How does malware performs a UDP hole punch?

I want to know how do malware like ZeroAccess hole punch the network without using a external server? Or do they just mainly infect non-NAT users? Does that mean all NAT users are safe?
1
vote
2answers
71 views

Actual use of covert channel in malware

I have seen several academic sources mentioning covert channels in computers, such as one process sending data to another process/thread on the same machine in a way that attempts to avoid detection. ...
1
vote
3answers
137 views

Large amount of foreign IPs hitting out firewall, is this automated scans or are we under attack?

I just got put in charge of a network. In the logs on our firewall I noticed that we had a large amounts of machines trying to connect to port 53 as well as about a dozen other ports. Are these ...
1
vote
1answer
96 views

Malware code in WordPress?

I'm pretty sure that we have malware code in our WordPress website - Here is the code in question, it is located at the top of every php file in the website; { ...
-4
votes
1answer
91 views

AV isn't dead, so why network appliances differ in handling malicious code [closed]

when taking a look under the hood of some firewall appliances there can be observed a tremendous difference on how they handle malicious code. mostly, av-scanning is restricted to well-known protocols ...
4
votes
3answers
257 views

Windows: unknown program/service etc. sends HTTP request to download a file; how can I find the origin of that request?

The firewall of my company has detected and blocked a repetitive (every 15 min) HTTP request from a PC, which tries to start a download of a file called ..._chrome_installer.exe(or so) from the host: ...
1
vote
0answers
57 views

Browser Popup Survey Scam [closed]

I am looking for information on a new phishing threat that I have personally encountered. What happens is that during normal web surfing, a tab is opened that directs you to a survey regarding your ...
-4
votes
1answer
108 views

What are the chances of a normal Internet user being hacked or infected by malware? [on hold]

Say I'm a normal Internet user, I visit some well-known social networks like Facebook, twitter, play flash-based games in Facebook, visit some big websites that are known to be safe and trusted and ...
7
votes
0answers
156 views

How to isolate persistent pop-up browser hijack [closed]

There's a persistent browser pop-up affecting Mozilla Firefox which has evaded a number of security pre-cautions and attempts to find a remove it. It's gone on for at least 3 months. The pesky pop-up ...
1
vote
0answers
2k views

How do I get rid of the Total Ad Performance malware from my Android? [closed]

My Sony Xperia Z3 Compact has been infected by a malware that redirects my browsers to either one of the two websites: www.totaladperformance.com or www.admomi.com. I have the paid version of ...
2
votes
2answers
278 views

What do I do, I got a virus warning on a webpage

I went to the web address (hxxp://www.asanka.com) (WARNING: BE CAREFUL WHEN VISITING) on Safari, then suddenly I got a warning message [image below] What do I do? I'm freaked out. I have a lot of ...
-1
votes
1answer
40 views

indicators of compromise via email servers

Malicious files are commonly infiltrated on to the network via email attachments. Besides awareness and education to my staff to refrain from clicking on suspicious attachments, I would also like to ...
7
votes
1answer
159 views

Javascript phishing attack sucker: Do I need to be worried? [closed]

So, I'm an idiot. I opened a javascript phishing attack file. I would really, really appreciate some help with decoding the Javascript to figure out whether I'm in trouble, and what sort. I'm on OS X ...
2
votes
1answer
124 views

Mystery IP address Hijack

I'm working on a customer's new website. To get things up and running quickly, we're maintaining his domain name service and hosting the website on another server. Customer bought the URL name years ...
3
votes
1answer
46 views

Secure online server -> Airgap transport?

I'm facing the issue to develop a system which archives some data, which was available via a web-server some time before (to selected users). Now the question arises on how to securely transport the ...