Malware is any software application which subverts the will of the legitimate owner of a computer, by means of force or subterfuge, with or without personal or monetary gain on the part of the creator.

learn more… | top users | synonyms

0
votes
1answer
33 views

Why an attacker would use a trojan over a spyware?

I'm trying to figure out some possible attack scenarios for a project I'm conducting. I've read plenty of material about malware and, in particular, spyware and trojans. While it's hard to find unique ...
0
votes
3answers
132 views

Malware stole an executable file on my computer? Seems unlikely

If you don't want to read all of the details, skip to the bottom; I'll make a summary. I created a computer program as a proof of concept (I threw it together in 12 hours, so I wrote it in Visual ...
1
vote
0answers
44 views

Identify Known Malware By Hash (MD5) Across Network [migrated]

I need to design a solution that will allow me to submit a series of MD5 hashes and then be alerted if these hashes are found on any machine (Windows) on the network. I'm open to existing solutions ...
0
votes
1answer
1k views

How much can someone see from my iPhone by connecting to my wifi

How much can someone see from my iPhone by connecting to my wifi and can they copy my messages files documents etc
0
votes
2answers
71 views

Can malware cause firefox to send GET requests?

Is it possible for a site to host malware such that if a certain page is accessed, Firefox is made to send additional GET requests? I'm seeing traffic for attacks coming from me that I haven't done. ...
-1
votes
2answers
144 views

I have discovered a botnet during testing [on hold]

Whilst testing a server I discovered a botnet. I have the executable downloaded to the server and decompiled the file to get the strings from it. My question is what would the next logical step be ...
1
vote
2answers
322 views

Is a C plugin safe if I read it through an echoing parser before?

I wanted to use sharable plugins for an application. However, the plugins were extremely time critical, so I wanted to distribute them as C libraries. Now, these are not guaranteed to be safe (the ...
2
votes
1answer
32 views

After restoring from a (valid) full disk backup can malware still persit?

In the comments to this question it is mentioned that even after a backup recovery malware still can persist. Do I understand that correctly? How is this possible? If Acronis True Image is used to ...
3
votes
1answer
71 views

How to identify and analyze malware that checks for security tools before running?

I've been reading about the ZeroAccess and looking into some bot's code source* and I found this piece of code which checks if filemon is running in the infected computer before running the bot. ...
0
votes
1answer
36 views

Legality of adding malice to an open source software? [closed]

With the heartbleed bug in the news recently and after reading Bruce Schneier's commentary on the issue I started wondering if there would be any legal implications for intentionally adding malice to ...
2
votes
2answers
1k views

What are the most common infection vectors for personal computers?

We have OWASP to tell us about common security vulnerabilities in webapps and such, but what are the most common infection vectors for personal computers? A few example vectors: Social engineering ...
2
votes
3answers
46 views

Simple methods of preventing infection from external drives

What are some simple methods of preventing my computer from being infected by USB drives and other storage devices? I'm not asking for any bullet-proof methods, just something that can prevent ...
-2
votes
0answers
14 views

Can ping the ip-Address but not the site and neither browse to it [migrated]

Due to some malware or virus, I was unable to connect to any site while the connection showed "Internet Access". On experimenting, I found that I was able to ping the I.P. address of google. But when ...
1
vote
1answer
136 views

How does CryptoDefense ransomware encrypt large data with a (relatively) small RSA key?

I recently encountered some news about the recently new Ransomware called CryptoDefense: it uses RSA 2048 to encrypt your valuables and offers the private key for a price. (It's already been solved ...
1
vote
0answers
36 views

Enabling virutalization, addressing the bluepill risk?

Background to this question is the ambivalence I assume with virtualization. Also to start directly with clarity: the term bluepill should here be a placeholder to denote "malware that uses ...
1
vote
1answer
150 views

What does a Remote Desktop Connection risk for both computers?

I recently had a malware issue called "mysearchdial" that installed itself into my home computer's browser because someone didn't pay attention to what they were installing. I RDP'd into my work ...
0
votes
0answers
27 views

Exploit.Win32.CVE-2010-2568.gen malware detected [migrated]

I am not very good with computers. Actually, I am very bad :( so if you are willing to answer my question, could you please explain your answer in very simple terms, like to a complete dummy? Thanks ...
1
vote
2answers
66 views

Verifying integrity of text files

While I was away from my home I needed to do some work on a java program so I booted a friends netbook(windows 8) I had with me and finished most of the works I needed to do there. Tho when I returned ...
0
votes
0answers
23 views

How to find a FUD trojan that infected my os? [migrated]

recently I've been trying to understand how to apply some courses on analyzing some malwares, but it seems that during this process my pc was infected,after seeing the led of the webcam turned on for ...
3
votes
2answers
79 views

Can viewing an email message in Outlook 2013 install malware on my computer?

I routinely get spam messages which state "Your account for [Insert game here] has been flagged. If you don't click this link/send us this info/go to this website in the next 72 hours, your account ...
3
votes
1answer
98 views

Drive-by downloads

I am aware of the problem of drive-by downloads, which happens when one visits a malicious site and a malware is downloaded to the PC. I want to ask that when such a program is downloaded, how does it ...
15
votes
3answers
633 views

Are official browser add-ons really safe?

Almost any browser addon/extension that I install on my Chrome or Firefox (be it Firebug, RESTClient, ...) warns me, saying: It [the add-on] can: Access your data on all website Access ...
-1
votes
1answer
55 views

Unusual image may contain hidden data

I have received an image from a friend. This is the image. is there any way to detect any anomalies in this image. Thanks
3
votes
4answers
10k views

Scanning for files than have been encrypted by CryptoLocker

I am just asking in case someone has already done the analysis. A customer has a large set of network drives that were mapped to a CryptoLocker infected machine. The infection itself has been treated. ...
0
votes
2answers
136 views

Getting detailed information about an infected website

I have a set of bad URL's. I want to know the nature of infections affecting these URL's . Running an online scanner such as VirusTotal gives me some basic information from various engines about the ...
1
vote
1answer
114 views

How can this be possible? (malware autoinstall on chrome)

I have a website, using an ads service (qadabra). Yesterday some users reported me that the ads service sometimes redirects to a site containing malware. the url is this: PLEASE DON'T OPEN IT, IT ...
2
votes
1answer
79 views

Windows: Any method to enforce user confirmation before the browser opens a URL requested by an external desktop app?

A robust outgoing firewall will protect against desktop applications directly connecting to the internet without your permission. However, as the browser is a generally authorized application for ...
-1
votes
3answers
109 views

Are virtual keyboards themselves secure? [closed]

It is advised to use on-screen keyboards on, for example, banking operations (especially if the site doesn't have a virtual keyboard) to beat keyloggers (at least minimize the risk). There is some ...
0
votes
1answer
253 views

Potential problem in public Maven repository

Problem This morning I found that, what I thought was one of our proprietary artifacts, had been published to a public repository: http://repo.grails.org/grails/simple/codehaus-cache/com/ If you ...
0
votes
2answers
80 views

Why does host's antivirus detect guest's malware?

I'm analyzing some malicious files on a VM and I'm noticing that every time I open a file, the host's antivirus detects it. Why does this happen? Is the malicious content escaping to the host?
13
votes
2answers
10k views

Is it possible to make a phone call appear to come from another phone, even to the network provider?

Quick Question Is it possible that I could call a mobile number, but have the call forwarded through another number active on a different phone that someone else has? I have had unlimited access to ...
11
votes
3answers
219 views

Retrieve files from possibly infected USB

I work in a lab environment, and save data to a shared PC. This PC is not networked, and so the only way to get the data from that PC to my own, is through USB. The lab director has mentioned that the ...
1
vote
2answers
113 views

How big is the threat of Desktop Linux malware? [closed]

Most malware one hears about on the news seems to fit into one of two categories: Windows viruses, trojans, rootkits etc. Linux server "worms", backdoors and similar How big is the threat of ...
16
votes
5answers
909 views

Why would a virus writer bother to check to see if a machine is infected before infecting it?

I was looking at the tripartite structure of a virus, and it seems to check to see if a computer is infected before infecting it with the virus. Would this be an attempt to use files that are already ...
11
votes
3answers
32k views

How serious is InstallIQ?

Background: Recently I've seen hits for InstallIQ a "potentially unwanted application" from ESET. From what I can find it seems like this is an installer wrapper that asks people to install other ...
2
votes
3answers
415 views

How to check if URL/ IP belongs to a zeus bot

I have a set of URL's which might be Zeus hosts / C&C servers since my security appliance says so. Is there a way to check if these really belong to Zeus?
15
votes
5answers
1k views

Becoming a malware analyst?

So, I'm currently 16 and am considering a career in IT when I finish school. The thing that has intrigued me the most while growing up is malware. I've come across it so often and have often had to ...
15
votes
4answers
2k views

Malwares source repositories. Where?

As the best way to learn is to read the code, do you know where I can find malware/virus/whatever source code to read?
53
votes
8answers
26k views

How secure are virtual machines really? False sense of security?

I was reading this CompTIA Security+ SYO-201 book, and the author David Prowse claims that: Whichever VM you select, the VM cannot cross the software boundaries set in place. For example, a ...
6
votes
4answers
549 views

Has my network/computer been breached?

I'm not sure if this is the right site to ask, so I apologise if it isn't, but here goes. A while ago I started noticing some odd behaviour. My Gmail account was compromised, it seemed, and I had to ...
0
votes
3answers
87 views

What are the pros and cons of using live CDs vs VMs for malware analysis?

I'm planning on doing some malware research for a research project, and I was wondering what would be a better option for keeping my system safe from viruses accidentally infecting it. I'm only ...
1
vote
1answer
46 views

ensuring that compiled (and signed) packages don't contain malicious code

I would like to understand how the packaged Linux distributions (i.e. Debian) ensure that their packages don't contain any malicious code. I know that packages are signed, and that I can download the ...
1
vote
1answer
62 views

Malware threats from other mounted hard drives

I am going to install Linux on an external hard drive and my internal hard drive is currently running Windows. When I boot to my Linux and I still have my windows hard drive mounted is it possible for ...
-2
votes
1answer
59 views

does any botnet/malware traffic use ssh or anything else other than TCP/IP? [closed]

if i sniff all traffic leaving my router, if botnet traffic is present will it be IP traffic or does any malware use other protcols such as SSH, FTP, TFTP, etc?? do antivirus software programs ...
1
vote
0answers
61 views

Is winmail.dat a malware propagation vector?

Some of my coworkers use Microsoft Outlook (I believe) and have it configured in such a way that mail attachments are encapsulated in winmail.dat files. Apart from the general annoyance and lack of ...
3
votes
2answers
97 views

What patterns does a signature based anti-virus look for?

I'm working on a uni project where I will attempt to create a malware that uses some form of genetic algorithm to "evolve" itself out of being recognized by a signature based AV software. For this I ...
0
votes
2answers
107 views

Is anti virus software supposed to clean up registry entries made by malware?

I just cleaned up a virus infection on my computer (running windows) by running an Anti Virus Scan. The malicious executable files are now deleted. However, the registry entries made by it remain. ...
0
votes
1answer
52 views

How to prevent malware to know when removable devices are plugged in

The question is clear, I'm a programmer and wrote a software to disinfect the USB devices when they got the malware which hides the files and creates a shortcut of the virus . Using this soft we can ...
3
votes
4answers
3k views

How can I detect backdoors?

I have a machine running Mac OS X and I suspect there may be a backdoor installed. I know that I could take it to a professional security firm for analysis, or nuke it from orbit, but I'm interested ...
1
vote
2answers
57 views

Where do suspect requests from logged-in users to my website come from?

I have an ASP.Net MVC 4 web application that is hosted on a Windows 2008 server. The application is secured by a custom ASP.Net membership provider. Only users who are granted permission by the admin ...