Malware is any software application which subverts the will of the legitimate owner of a computer, by means of force or subterfuge, with or without personal or monetary gain on the part of the creator.

learn more… | top users | synonyms

4
votes
1answer
3k views

What can I do to make sure my computer isn't infected with FinSpy?

What steps have been taken by common free software OS distributions to protect against it? What can Windows users do? What ways are there to rid a system of it?
7
votes
3answers
4k views

How to manage admin rights for helpdesk staff?

My question is about issuing administrative rights to helpdesk staff in a large Active Directory setting. Helpdesk staff commonly require administrative rights to provide support for end users. I ...
2
votes
2answers
10k views

How does Remote Access Trojan / Backdoor Software work?

How does the RAT works? I understand it as once we surf the infected website, browser might download the trojan to our PC automatically. Will it executed and auto install in our computer? I can't ...
6
votes
2answers
7k views

Can Keyloggers get passwords from Windows 7/8 Logon Screen?

If yes, do you know some examples of Keyloggers capable of perform this? EDIT: I mean when logon in the windows right after power on the PC and/or when locked with Win+L.
6
votes
3answers
716 views

What methodologies are useful when reverse-engineering malware / shellcode?

Whilst I'm familiar with reverse engineering techniques from a technical standpoint, I've never found a good methodology for approaching and dissecting malware / shellcode. I've found hundreds of ...
5
votes
7answers
3k views

How to safely view a malicious PDF?

I have a PDF with important information that may contain malware. What would be the best way to view it?
14
votes
6answers
4k views

Finding a specific malware sample for malware analysis purposes

I wish to analyze the changes made by a specific virus. For example, Win32.Sality. Where can I get the sample of this, or other similar, malware for testing?
3
votes
5answers
1k views

How can I know if my PC is getting infected?

I have installed an antivirus, but as no antivirus is perfect, what can I do to diagnose if my PC is getting infected? For example, keeping a close eye on what programs and tasks run when I turn my ...
3
votes
2answers
562 views

Why do I get AV alerts when browsing a web page?

I'm using the latest version of Firefox and Windows is up to date. When I was browsing a webpage and clicked a link the browser displayed "connection has been reset" and AVAST poped-up saying "Alert!" ...
1
vote
1answer
164 views

Appilicability of Theoritical Computer Science/Formal methods in Malware research

I would like to know the importance of Theoritical CS/Formal methods in Malware research. Due to the large volume of new malware variants received per day (~50,000 samples/day according to McAfee), ...
39
votes
3answers
2k views

Mars Curiosity Rover Security

Does the software in the Mars Curiosity Rover have any security features built-in? I can't imagine how someone would hack into it, but if the rover does indeed have some protection against malicious ...
0
votes
1answer
412 views

How securely use Firefox Add-on to prevent steal data?

Some videos on YouTube demonstrate how a Firefox extension can collect login information used to login to websites such as Facebook. After installing this tool/malware as Firefox Add-on, I observed ...
1
vote
2answers
148 views

Preventing Client PC's from accessing C&C machines

At my office I find us constantly fighting with malware. All users run under the "user" level, we have McAfee and have recently reviewed the Best Practices guide to ensure we adhere to it, all of my ...
4
votes
2answers
5k views

Security Alert - Office File Validation - how to decide whether to proceed?

Recently, when opening a Microsoft Word document that came from a trusted source, I received the following warning message: The warning message is titled "Security Alert - Office File Validation". ...
1
vote
1answer
842 views

on stack execution on windows 7 :: metasploit :: meterpreter :: executable crypter

I posted this on stackoverflow, was advised to move it to security section. I was writing an executable crypter as an exercise with goal of Antivirus evasion, now the problem is the final executable ...
15
votes
2answers
680 views

Is there a real possibility of getting malware by “drive-by”?

I know malware can be gotten by downloading and running stuff, but is there a real possibility of just viewing a webpage or clicking a link and getting one? Assuming using only Firefox / Chrome and ...
2
votes
2answers
2k views

What are the most common infection vectors for personal computers?

We have OWASP to tell us about common security vulnerabilities in webapps and such, but what are the most common infection vectors for personal computers? A few example vectors: Social engineering ...
2
votes
4answers
782 views

Detecting malware hidden in P2P traffic

Consider a network situation involving (only) Peer to Peer traffic in medium sized network. For the sake of convenience, a simple P2P application like DC++ may be assumed, although I am aiming at a ...
2
votes
3answers
273 views

Find changes and modifications made to system by application or virus,

I would like to use either Hyper-V or Vmware to take a Clean Base snapshot and a snapshot after an application or virus has made changes so I can then see what was changed between the two images. ...
3
votes
2answers
919 views

How do browser injections work?

I've heard many times that malware like Zeus, SpyEye and Citadel are able to do browser injections to steal credit card data. How do they do it? how do browser "injections" work? How are they able to ...
-1
votes
3answers
251 views

How to find & remove twitter spambot?

Sometimes i can see that i've "retweeted" some tweets , that i actually didn't. And all of them spam to some gaming & pharma websites. I've got windows 7 64bit, norton internet security , using ...
3
votes
5answers
424 views

Can web application do anything to prevent risk from client-side malware?

Client side malware (keyloggers, screenscrapers etc.) is a great risk. It can't be effectively stopped from side of ordinary application. Only users themselves can do some measures to prevent risk ...
6
votes
4answers
492 views

Would running VMs inside of VMs be a more secure way to study viruses, etc?

I was reading this post on SuperUser, and it made me wonder about security. I've read somewhere else that some viruses/malware/whatever CAN break outside of a VM... and then infect the host OS. BUT, ...
0
votes
1answer
376 views

Can the FiddlerCore library be used for Malware (e.g. MitM attacks)?

I've used the excellent Fiddler web debugging software before and have recently come across the Fiddler Core headless .NET library which gives you all the abilities of Fiddler in library form. It's ...
-3
votes
2answers
215 views

Malicious Script [closed]

Any idea what this does? === ...
5
votes
4answers
13k views

How to prevent my website from getting malware injection attacks?

My website was banned as a malware website by Google. When I checked the code, I found out that some code injected many files on my server. I cleaned everything manually, edited all files on my server ...
4
votes
4answers
398 views

Malware that uses http as a covert channel

I'm working on a http traffic analyzer and I need a collection of malware, which uses http as a way to get commands and respond, to analyze their network behaviour. Is there any database of malware, ...
2
votes
1answer
519 views

Intepreting PE (Portable Executable) headers of suspicious malware files

I am starting up on malware analysis, and I am analyzing a file to see if it is packed or obfuscated. Using PEview I am examining the .text, .rdata and .data headers. I know that if there is a big ...
0
votes
2answers
982 views

Is there any known Malware for Windows Phone 7?

I cannot find anything on google that indicates there has been cases of malware on Windows Phone 7, doe's anyone know if this is true?
3
votes
2answers
181 views

Where a sysadmin deletes a company's data, why can't they just restore from backups

As an example, in the UBS Duronio case, Mr. Duronio executed code that deleted everything in its path, but isn't there a backup server? Why was UBS hit by the loss of data? If the backup is available, ...
4
votes
5answers
392 views

Why wasn't the flame malware flagged by firewalls?

Why didn't any firewalls catch the flame malware siphoning out all of that data? I thought there was firewall software that looks for "suspicious" activity?
0
votes
2answers
104 views

Should a host based firewall have an API accessible to other applications?

Some people are hesitant to use Windows Firewall because it allows software to alter its state via an API. The benefit of this is that the Firewall configuration can be centrally manged in GPO. On ...
17
votes
3answers
782 views

Why do rootkits hide in drivers?

A lot of rootkits for Windows (maybe even Linux?) do hide in drivers. Why is that? One reason I can think of is that using a driver they run in kernel mode and have full system access, but aren't ...
3
votes
2answers
695 views

How does DNS Changer malware detection work?

This malware directs your computer to use DNS servers under control of the badguys. These DNS servers were taken over by the FBI. They were replaced with clean ones, to prevent service disruption, but ...
3
votes
1answer
331 views

Find malware in browser extensions

How can I check if an extension/addon consist of malware code? Is it easy to detect if it collects sensitive data (like spyware), logging keystrokes and so on? Can AV recognize malware extension as ...
40
votes
4answers
3k views

What cryptographic flaw was exploited by Flame, to get its code signed by Microsoft?

Today, Microsoft released a security advisory warning that the "Flame" malware exploited a weakness in a cryptographic algorithm used by Microsoft Terminal Server Licensing Service, and was thereby ...
12
votes
5answers
1k views

Can a .sh file be malware?

Can a .sh file be a virus or something harmful? Is it like .exe files on Windows? If yes can someone read this script and tell me if it safe and is it effect any how on gpg security. It gives me an ...
1
vote
1answer
230 views

SNMP trap by legitimate program?

Is there any way to tell if this SNMP trap is something created by a legitimate program? Update: Hex Dump 0000000: 30 82 00 ec 02 01 00 04 06 70 75 62 6c 69 63 a4 82 00 dd 06 82 00 09 2b 06 ...
2
votes
3answers
204 views

How to test for presense of antivirus?

I want to test that when user uploads file, then it goes through up-to-date and properly configured antivirus. I think that to test for it I need some malware that is likely to be detected (it doesn't ...
1
vote
1answer
378 views

DNS query through squid? [closed]

My IDS picked up our squid proxy server doing a dynamic DNS request. I wasn't aware squid passed DNS requests from the client to the internal DNS server. Is this possible? Snort Alert: ET POLICY ...
0
votes
1answer
106 views

Changing malware trends in VM

I recently came (Dunno, since when it was happening) to know that malwares can detect if they are running inside a VM like Vmware, and thus can change their behaviour. So my question is how the ...
-1
votes
2answers
125 views

What information is sought by malware researchers and those reverse engineering malware?

I have seen many write-ups on "malware research", what information are they trying to gather? Is it the origins of the malware? Or its behavior patterns? Or something else?
7
votes
5answers
1k views

Malware code added when site viewed externally

Please see second followup at the bottom! (Now with added real malicious code! ...ish) Prompted by this question, I've noticed that my university's student charity organisation has an interesting ...
0
votes
1answer
285 views

What is the purpose of this malware code?

This is the code that I found on my client's website: ?><noindex><nofollow> <iframe src="htxp://atluscomdnsup23.ikwb.cxm/main.php?page=1f1214ff37a3022d" height="0" width="0" ...
-2
votes
1answer
146 views

Why did I get unresponsive script when I start my system and open web browser? [closed]

The script on opening web broswersays Warning: Unresponsive Script A script on this page may be busy,or it may have stopped responding.You can stop the script now,or you can continue to see if the ...
9
votes
4answers
580 views

What would happen if one of the popular Linux repositories is hacked?

Even though most people consider downloading your Linux software from you own distribution's repositories as safe, thinking about the scenario where a repository gets hacked sounds thrilling. What ...
7
votes
2answers
7k views

Is Buzzdocks a security threat?

A BuzzDock toolbar suddenly appeared in my Chrome browser. I definitely did not install it nor do I remember installing any crapware. It is not unknown to the internet community (Example 1, Example ...
11
votes
6answers
2k views

weird visitors to my website

For the last three months I have thousands of real visitors to a single page on my website. Those visits are recorded in Google Analytics and count as page views in adsense reports, but they are fake: ...
1
vote
0answers
161 views

Hidden Registry Strings - possible rootkit? [closed]

Win server 2003 R2 SP2 - no noticeable issues on the machine. When I create new strings in regedit, I hit refresh and they are gone! I try to re-add and it complains the string already exists. I am ...
0
votes
1answer
57 views

File directory deletion [closed]

So I heard this guy talkin about how one time he deleted someone's windows directory remotely. He claimed to have gotten into the system and deleted it such that the files are all still there, but the ...