Malware is any software application which subverts the will of the legitimate owner of a computer, by means of force or subterfuge, with or without personal or monetary gain on the part of the creator.

learn more… | top users | synonyms

0
votes
3answers
575 views

DNS queries with hex string that is a SHA1 of a domain name! Is it a malware?

My computer does a lot of queries to strange domains such as: 56cea5c2b408989ab067adcb787d0f99209bbe07.mydomain.com The strange thing is that 56cea5c2b408989ab067adcb787d0f99209bbe07 is the SHA1 of ...
5
votes
2answers
1k views

Why should I restrict the content type of files be uploaded to my site?

We are building an application where users can upload resumes in our system for our administrators to download. We are having a debate about restricting the content type of the files that can be ...
2
votes
1answer
347 views

How to reverse engineer w32/malware!gemini?

How would you go about reverse engineering malware W32/Malware!Gemini. Recently I found it installed on my computer and would like to trace where the data is being sent.
2
votes
1answer
147 views

Is there a tool that puts on a webserver some .html or .php files filled with popular malware like java drive-bys or other browser exploit payloads?

As mentioned in the title I'm looking for a tool that puts on a webserver some .html or .php files filled with popular malware like java drive-bys or other browser exploit payloads? Maybe there is ...
4
votes
2answers
507 views

Can one get infected through visiting a site with a PHP script on it and if yes, how?

I can imagine a clientside JavaScript that gets executed in a vulnerable browser to do some harm, but how can this be done with PHP? Since it's serverside it shouldn't have access to the visitor's ...
1
vote
2answers
554 views

Online virus scanning service with remote file submission?

I have some links that contain hacking tool and whatnot and I want to pass them to a virus scanning service. The thing is that I don't want to download them to my pc and upload them to their service, ...
9
votes
4answers
1k views

How would you analyze an image to find out if there are scripts embedded in it?

How would you analyze an image to find out if there are scripts or possible malware embedded in it? What tools / methods to use?
6
votes
3answers
2k views

Any additional security with large blacklisting hosts file?

I run Windows with a pretty hefty c:/windows/system32/drivers/etc/hosts file obtained from http://winhelp2002.mvps.org/hosts.htm. I update this file as regularly as I remember and layer it with ...
13
votes
4answers
1k views

How is a worm different from a virus?

In spite of various online articles, I'm a bit unclear on the distinction between a "worm" and a "virus". Two related questions-- Is there a useful and clear distinction here or no? If so, what is ...
24
votes
4answers
11k views

Does a Virtual Machine stop malware from doing harm?

I would like to know if it is save for the host system of a virtual machine (VM - VirtualBox OSE in my case) to execute malware. Can a virus break out and read or write data from the host system? ...
13
votes
5answers
457 views

What is the risk of giving USB drives as promotional items by a healthcare provider

There have been a couple of instances where malware infected USB drives have been given away unknowingly as promotional items at conferences, e.g., IBM in 2010. Besides this, if a healthcare company ...
4
votes
3answers
131 views

Duqu and other reference material for security people

I would like to read more on Duqu and similar exploits when they appear. The problem is that most references from google are for laymen. Isn't there a reference website or... that reports on these ...
9
votes
5answers
1k views

Detecting malware-infected USB drives

I'm about to distribute some relatively cheap promotional usb drives to some of my company's clients. I'm fairly confident the company I purchased them from wouldn't intentionally implant malware on ...
12
votes
3answers
36k views

How serious is InstallIQ?

Background: Recently I've seen hits for InstallIQ a "potentially unwanted application" from ESET. From what I can find it seems like this is an installer wrapper that asks people to install other ...
2
votes
1answer
612 views

How do you remove the Security Sphere malware?

My boss' computer has become infected with something called "Security Sphere". When googling for information on how to remove it I get many pages that have been optimized for the term "Security Sphere ...
5
votes
1answer
431 views

Downloading suspect files into quarantine?

Are there any tools out there or methods available to download a suspect file for analysis without having to worry about being infected?
8
votes
3answers
2k views

Am I protected from USB autorun malware on Windows 7?

As far as I know, the autorun.inf problem (the possibility of automatically executing code when a USB stick is plugged in) was solved through Windows Updates for XP, and on 7 it is no longer possible ...
4
votes
1answer
184 views

German police malware “Staatstrojaner” general question

In the case of the recent find by CCC, how exactly would the malware used by German police for internet wiretapping work? In default mode, it takes screenshots of active windows, it logs data and ...
20
votes
4answers
31k views

How to inject executable, malicious code into PDF, JPEG, MP3, etc.?

I wanted to know if its generally possible to inject executable code into files like PDFs or JPEGs etc., or must there be some kind of security hole in the application? And if so, how would one do ...
6
votes
2answers
244 views

How does the predator network prevent outside control by an attacker?

I read several articles saying some of the command and control fleet for the US robotic attack planes may have been infected with a virus. Does this command and control system communicate with the ...
4
votes
1answer
139 views

The Economics and White Hat Nature of NSS ExploitHub

This question is about the economic model employed by NSS with their ExpoitHub exploit marketplace (site link) and whether it jives with the white hat claims of the company. The company has made news ...
2
votes
1answer
209 views

Detecting Key Loggers

We know that key loggers are the most effective and most annoying means of getting compromised over login id/password on the web or any application.... and your whole privacy is breached. Is there ...
3
votes
2answers
178 views

Potentially unsafe files on second hard drive, how to get my files back?

I have my files on a second hard drive (disconnected for now). This drive was connected to a system infected with Virus:W32/Virut. I have formatted my main hard drive and reinstalled Windows XP. Now I ...
6
votes
2answers
231 views

Where can I find good resources on reversing web malware?

I am wondering where I can find a good site with resources on reversing web malware like javascript, flash, html5, and any other stuff that is designed to attack the clients. Does anyone have any ...
6
votes
3answers
3k views

What programming language is Stuxnet written in?

I was listening to a story about Stuxnet and was curious if anyone knew what language it was written in? Is the source code for Stuxnet available anywhere?
24
votes
7answers
7k views

Is making a clean install enough to remove potential malware?

Is formatting the disk and reinstalling the system from scratch (to Ubuntu) enough to remove any potential hidden software spyware, keyloggers etc.? Or can something still persist installed in the ...
11
votes
5answers
826 views

Checking if notebook is clean of hardware spyware

Are there any simple steps one can follow to verify if a notebook is clean from hardware spyware? What should be looked for? How should it look? If any visual tutorials with photographs are ...
6
votes
2answers
628 views

Does the Mebromi BIOS flashing rootkit mean APTs for personal computers are here?

With the recent discovery of the Mebromi BIOS firmware virus/MBR rootkit http://www.theregister.co.uk/2011/09/14/bios_rootkit_discovered/ in the wild are we now actually in the age of Advanced ...
5
votes
2answers
552 views

How to detect infected machines on my wifi?

I currently live in a building with around 40-50 other tenants (mostly students) and we all share one connection to the Internet using one of 3 wifi routers that are spread throughout the building. ...
3
votes
2answers
181 views

What is multi-path malware?

I would like to know, in malware analysis, what is meant by "multi-path execution". I read this when I encounter the words in malware detection literature related to Control Flow Graph (CFG).
18
votes
4answers
570 views

Malware - are removal tools acceptable or is bare metal re-install the only safe option?

I see a number of companies offering "malware removal" services. I see some software that claims to be able to remove malware from an infected machine. Is using a removal software tool to 'clean' an ...
7
votes
4answers
12k views

Security issues with allowing Dropbox installations on client PC's in our organisation

Does anyone know if there is any good reasons not to allow Dropbox installations on our client PC's? All the PC's have antivirus installed and running. I know it is an additional attack vector to ...
3
votes
1answer
185 views

How can I assess the trust worthiness of a browser add-on?

Having learned a bit more about what add-ons/extensions can do in Firefox, I want to minimize my risk and use some safer mechanism to download videos (FLV in particular) for later viewing. ...
7
votes
5answers
2k views

Browsing on a USB OS (Linux) safe from malware?

Let's say I have a computer. It's a personal computer - the one you'd typically find in homes. In this scenario, it's running Windows XP SP3, although it could run 7, Vista, etc. I have a USB drive ...
17
votes
6answers
2k views

What are the security implications of people downloading addons, wrongly thinking that they are safe?

I recently learned about a plugin for Firefox called Fire Sheep, which was featured on the Security Now podcast. I downloaded F.S. and began examining it. To my surprise it includes C++ code that must ...
7
votes
2answers
312 views

Are there any independent organizations doing (publicly available) IT security research?

When looking up security risks on the net I find that all research being cited (if any is cited) always seems to come from the Anti-Malware companies. (just e.g., this article cites F-secure, AVG and ...
6
votes
2answers
380 views

Statistics on purposes of viruses/malware

Are there any resources that analyze the purpose or goal or the major viruses/malware out in the wild today? For example, what percentage are used to construct botnets (for DDoS or something else)? ...
6
votes
3answers
159 views

Is it safe to attach a potentially malicious hard drive to a Solaris machine?

We bring in hard drives from un-trusted sources and would like to ensure that they will not contain any harmful content. What kind of risk is there for Solaris? As in, if Solaris is running, and I ...
16
votes
6answers
1k views

Why do malware creators use such clever technologies for such silly purposes?

Some days ago I got infected by a malware, probably something new and very clever, as it went in unstopped and no scanning tool was able to detect it afterwards (see this question). It was a ...
10
votes
4answers
513 views

Unknown malware, how to report it and whom to report it to?

I'm a professional Windows system administrator, but I've been caught off-guard (or maybe some malware writer has been very clever) and I caught some unknown malware on my home computer (Windows 7 x64 ...
15
votes
3answers
2k views

Can Windows malware harm a Linux computer when it's executed with Wine?

I am an (Ubuntu) Linux user. Sometimes, I have to use Wine for running Windows executables. I would like to know if Windows malware (virus, trojan, worm,...), i.e. malware that was not intended to ...
6
votes
4answers
3k views

What are the best ways to fake a web server

I was wondering if anyone had some insight into the best way to fake a web service response rather than setting up a web server. For instance, while doing dynamic analysis of malware it's useful to ...
14
votes
4answers
6k views

Can home routers get infected?

I am behind a router(linksys that runs dd wrt on it) and I was infected with sality. I'm curious, can my router get infected too? If yes, how can I remove the infection? I used the search bar but ...
12
votes
5answers
810 views

Detection and analysis of unknown malware

Suppose I have a binary which is suspicious. How can I determine whether it is malicious, and if it is, reverse-engineer how it works and what it does? For example, maybe using static analysis? Are ...
8
votes
5answers
1k views

Pursuing a career in Malware Analysis

When I was a kid, I want to become a Malware Analyst and work in a Antivirus company. At that time, I love to try out different antivirus solutions and did a research project on Computer ...
10
votes
1answer
2k views

Oligomorphism vs polymorphism vs metamorphism in malware

What is the difference between these three? As I understand it, polymorphic malware code actually is always the same, and it's just that it appears to be different (through encryption, data ...
6
votes
3answers
201 views

Spamming exploits without user detection

So I asked this question because I had thought that attackers would have a way to identify client software, because surely if 100 different exploits were spammed against a users machine they would ...
1
vote
1answer
492 views

Firefox Desktop Shortcut Being Renamed

On my Vista PC the Firefox shortcut icon is being randomly renamed. The name changes to some variation of a recently visited URL. This unwanted action has survived several version updates. Of course I ...
2
votes
1answer
156 views

Can a bad guy be judged for gaining access to sensitive information?

Assuming a hacker has sent to somebody a malware. It's a trojan (digitally signed by TeamViewer) which runs automatically when windows starts up and sends the login info to a web site using GET ...
15
votes
3answers
3k views

Recommendations for honeypot software

A couple of us wanted to setup a honeypot/honeynet with the goal of learning; not planned to be in a production environment. What's a good recommendation for a high interaction or low interaction ...