Malware is any software application which subverts the will of the legitimate owner of a computer, by means of force or subterfuge, with or without personal or monetary gain on the part of the creator.

learn more… | top users | synonyms (1)

84
votes
7answers
51k views

How secure are virtual machines really? False sense of security?

I was reading this CompTIA Security+ SYO-201 book, and the author David Prowse claims that: Whichever VM you select, the VM cannot cross the software boundaries set in place. For example, a ...
74
votes
10answers
6k views

How do you explain the necessity of “nuke it from orbit” to management and users?

When a machine has been infected with malware, most of us here immediately identify the appropriate action as "nuke it from orbit" - i.e. wipe the system and start over. Unfortunately, this is often ...
28
votes
4answers
16k views

Does a Virtual Machine stop malware from doing harm?

I would like to know if it is save for the host system of a virtual machine (VM - VirtualBox OSE in my case) to execute malware. Can a virus break out and read or write data from the host system? ...
29
votes
7answers
15k views

Is making a clean install enough to remove potential malware?

Is formatting the disk and reinstalling the system from scratch (to Ubuntu) enough to remove any potential hidden software spyware, keyloggers etc.? Or can something still persist installed in the ...
44
votes
5answers
4k views

Is it safe to install malware in a VM

Is it safe to install malware in virtual machines? I would like to investigate malware, but I don't want to infect my own computer. Can I install the malware in a VMWare VM, maybe even without ...
53
votes
4answers
4k views

What security risks are posed by software vendors deploying SSL Intercepting proxies on user desktops (e.g. Superfish)

There has been quite a bit of concern noted relating to the recent discovery that Lenovo are pre-installing a piece of Adware (Superfish) which has the capability of intercepting SSL traffic from ...
14
votes
5answers
1k views

Methods of mitigating threats from keyloggers

I am concerned about keyloggers being installed on my system and transmitting sensitive data out of our network. Is there a common method that such malware uses to send its collection back to the ...
17
votes
6answers
2k views

What are the security implications of people downloading addons, wrongly thinking that they are safe?

I recently learned about a plugin for Firefox called Fire Sheep, which was featured on the Security Now podcast. I downloaded F.S. and began examining it. To my surprise it includes C++ code that must ...
7
votes
2answers
2k views

Why should I restrict the content type of files be uploaded to my site?

We are building an application where users can upload resumes in our system for our administrators to download. We are having a debate about restricting the content type of the files that can be ...
25
votes
2answers
28k views

Can you get virus just by visiting a website in chrome

I've recently read Google Chrome: The End of Drive-By Downloads. Is it true to say that drive-by-downloads are history in Google Chrome? So if I have a link (from a spam email) I can right-click >> ...
14
votes
6answers
6k views

Finding a specific malware sample for malware analysis purposes

I wish to analyze the changes made by a specific virus. For example, Win32.Sality. Where can I get the sample of this, or other similar, malware for testing?
3
votes
2answers
220 views

What are ways I can analyze malware in an infected machine, not just clean it?

I often run into infected devices in my environment and would like to learn more about the specific infections that have gotten in. What are the best tools and techniques I could use to do this? I ...
12
votes
4answers
674 views

Unknown malware, how to report it and whom to report it to?

I'm a professional Windows system administrator, but I've been caught off-guard (or maybe some malware writer has been very clever) and I caught some unknown malware on my home computer (Windows 7 x64 ...
7
votes
3answers
3k views

Any additional security with large blacklisting hosts file?

I run Windows with a pretty hefty c:/windows/system32/drivers/etc/hosts file obtained from http://winhelp2002.mvps.org/hosts.htm. I update this file as regularly as I remember and layer it with ...
20
votes
8answers
2k views

Best practices for handling computer viruses

I realize this question may be quite broad (and hopefully not a violation of the FAQs), but I'm interested in hearing how many of you handle a computer infected with Malware. In a small-to-medium ...
13
votes
4answers
2k views

How is a worm different from a virus?

In spite of various online articles, I'm a bit unclear on the distinction between a "worm" and a "virus". Two related questions-- Is there a useful and clear distinction here or no? If so, what is ...
14
votes
3answers
2k views

Can a guest virtual machine be compromised by a virus on the host machine?

All questions ask about the other way round, ie. can a virtual machine compromise the host. But I'm asking can a virus on the host machine compromise the guest virtual machine?
10
votes
2answers
16k views

Advice on what to do after being hacked?

After running a system scan earlier today, I found that my computer had been infected by a trojan horse. My reason for running the scan was because Windows kept shutting down and then recovering. ...
38
votes
4answers
21k views

Should I get an antivirus for Ubuntu?

Considering the recent thread regarding anti-virus for the Mac I wonder how many of the arguments put forth are relevant today to Linux systems, specifically Ubuntu. There are no known Ubuntu ...
20
votes
4answers
44k views

How to inject executable, malicious code into PDF, JPEG, MP3, etc.?

I wanted to know if its generally possible to inject executable code into files like PDFs or JPEGs etc., or must there be some kind of security hole in the application? And if so, how would one do ...
18
votes
3answers
916 views

Are official browser add-ons really safe?

Almost any browser addon/extension that I install on my Chrome or Firefox (be it Firebug, RESTClient, ...) warns me, saying: It [the add-on] can: Access your data on all website Access ...
22
votes
4answers
6k views

Are popular porn sites more likely to be infected with malware?

I'm trying to help my friend understand this because he believes that since a site is very popular, that it's less likely to infect its viewers because of its security! Is a popular site less likely ...
18
votes
4answers
626 views

Malware - are removal tools acceptable or is bare metal re-install the only safe option?

I see a number of companies offering "malware removal" services. I see some software that claims to be able to remove malware from an infected machine. Is using a removal software tool to 'clean' an ...
8
votes
4answers
940 views

Is disabling auto-run enough to protect against malicious code from removable media automatically infecting a machine?

If I block auto-run on a windows machine, is this enough to protect it from malicious code (assuming I don't run any files manually)? Or are there known vulnerabilities that may cause infection?
5
votes
3answers
5k views

Javascript Malware: How does it work, and how can it be mitigated?

I am wondering how malware gets served through Javascript. I've noticed a few illegitimate pop-ups while visiting some financial websites. I wonder how malware exploits work against the application ...
7
votes
4answers
3k views

What does this malicious PHP script do? [closed]

Somebody hacked my site and uploaded this script (template46.php) to my webroot and its content is: <?php $vIIJ30Y = Array('1'=>'F', '0'=>'j', '3'=>'s', '2'=>'l', '5'=>'M', ...
19
votes
4answers
3k views

Malwares source repositories. Where?

As the best way to learn is to read the code, do you know where I can find malware/virus/whatever source code to read?
19
votes
4answers
3k views

Reverse engineering malware/viruses

Assuming a machine has malware, regardless of how it got there, one thing I would like to learn to do is to take the binary file and reverse engineer it to see what the malware is doing/has already ...
20
votes
2answers
2k views

From a technical standpoint, how does the zero-day Internet Explorer vulnerability discovered in September 2012 work?

I'm looking for an answer that explains the issue from the prespective of a developer/engineer. What is exactly being exploited and why does it work? Please note that I am not looking for ...
14
votes
2answers
46k views

Is it possible to make a phone call appear to come from another phone, even to the network provider?

Quick Question Is it possible that I could call a mobile number, but have the call forwarded through another number active on a different phone that someone else has? I have had unlimited access to ...
9
votes
4answers
2k views

How would you analyze an image to find out if there are scripts embedded in it?

How would you analyze an image to find out if there are scripts or possible malware embedded in it? What tools / methods to use?
1
vote
6answers
8k views

Use PHP to check uploaded image file for malware?

I want my users to be able to upload a photo. Currently I am not checking the uploaded photo for problems of any kind, although I do limit the size to 32k. Is there any way for me to check uploaded ...
8
votes
3answers
3k views

Am I protected from USB autorun malware on Windows 7?

As far as I know, the autorun.inf problem (the possibility of automatically executing code when a USB stick is plugged in) was solved through Windows Updates for XP, and on 7 it is no longer possible ...
5
votes
1answer
2k views

Hiding process from Task Manager [closed]

What technique is used to hide a process from Task Manager? I'm currently researching ways I can do this in C++. Is this process called hooking? ...
3
votes
3answers
3k views

Can malware physically damage a hard drive?

I recently responded to an incident of supposed malware infection. The symptoms were simply, "My computer freezes at random times." The response ended with replacement of the physical hard drive and ...
3
votes
1answer
2k views

Is bit.ly a malware distributor?

I clicked this link http://girlsguidetosurvival.wordpress.com/ Chrome gave me this warning - Attackers currently on bit.ly might attempt to install dangerous programs on your computer that ...
3
votes
5answers
1k views

How can I know if my PC is getting infected?

I have installed an antivirus, but as no antivirus is perfect, what can I do to diagnose if my PC is getting infected? For example, keeping a close eye on what programs and tasks run when I turn my ...
1
vote
1answer
160 views

what is the difference between dll hijacking and dll injection

I am confused. I would like to know if dll hijacking and dll injection are the same or are they different. I know that some malware use it to do malicious things. thank you in advance
1
vote
2answers
239 views

Identifying suspicious encrypted traffic [duplicate]

Firstly, I welcome a better title for this question. I admit I'm a security novice. I'm trying to determine whether I have malware and what that malware may be doing. Using Wireshark, I see several ...
39
votes
3answers
6k views

How to detect if I am vulnerable to “Superfish,” and how to remove it?

The site has already a discussion of the security risks of "Superfish". It seems to me that anything that tampers with the bits of one's connection is bad. If it tampers with TLS connections, it is ...
21
votes
6answers
1k views

Why are vulnerabilities and lack of security possible in computers?

I have heard about computer vulnerabilities, virus, malware, etc. Why are these threats possible? Why doesn't the computer just do the things it is supposed to? Why do some people write malware, ...
17
votes
2answers
768 views

Is there a real possibility of getting malware by “drive-by”?

I know malware can be gotten by downloading and running stuff, but is there a real possibility of just viewing a webpage or clicking a link and getting one? Assuming using only Firefox / Chrome and ...
11
votes
2answers
4k views

Detecting reflective DLL injection

In the past few years, malware (and some pen-test tools like Metasploit's meterpreter payload) have begun to use reflective DLL injection (PDF) to load a DLL into the memory of a process. The benefit ...
15
votes
3answers
4k views

Recommendations for honeypot software

A couple of us wanted to setup a honeypot/honeynet with the goal of learning; not planned to be in a production environment. What's a good recommendation for a high interaction or low interaction ...
14
votes
7answers
1k views

How is it possible to embed executable code in an image

I was reading up on FireEye and came across this NYTimes article detailing a Skype chat where an image was sent that was laden with malware: Quote: To gain access to information on the ...
18
votes
7answers
1k views

Why do malware creators use such clever technologies for such silly purposes?

Some days ago I got infected by a malware, probably something new and very clever, as it went in unstopped and no scanning tool was able to detect it afterwards (see this question). It was a ...
17
votes
7answers
880 views

How to deal with a person who gets easily fooled by internet and mail scams?

alternative title: How to deal with a person who has gotten paranoid and doesn't want to go online anymore? A person, who has over the years been scammed many times, by bad spam/fraud emails, and ...
19
votes
4answers
2k views

Are anti-virus companies companies regularly committing software piracy?

As Mikko Hypponen highlighted in a recent tweet, anti-Virus companies collect and store both samples of malicious software and samples of legitimate software: This got me to thinking, what ...
12
votes
5answers
982 views

Detection and analysis of unknown malware

Suppose I have a binary which is suspicious. How can I determine whether it is malicious, and if it is, reverse-engineer how it works and what it does? For example, maybe using static analysis? Are ...
11
votes
5answers
284 views

Security of root terminal (su -) when logged into X

I often log into X as normal user (of course), open terminal and switch to root: su - I have then a terminal owned by user but effectively with root privileges. Are there any security issues in ...