Malware is any software application which subverts the will of the legitimate owner of a computer, by means of force or subterfuge, with or without personal or monetary gain on the part of the creator.

learn more… | top users | synonyms (1)

2
votes
2answers
2k views

Somehow unexpectedly my computer got infected with malware

So I consider myself a pretty conscious computer user. I run Windows 7 SP1 Pro 64bit and I update it. For surfing on the web I use Firefox 20.0.1 - I keep it updated. I also have NoScript and AdBlock ...
2
votes
3answers
417 views

How isolated are 2 operating systems on 1 harddisk?

Lets say I have 2 windows dual booting on the same harddrive (windws 7), How isolated are they? I am thinking that there should be up to date antiviruses software on both Windows, and they should be ...
2
votes
4answers
1k views

My website has been hacked, what do i do next? [closed]

So. I couldn't see any other question like this on Sec.Se so i thought i'd ask. My public website www.foo.com has been hacked. The front page is sending it to be redirected to seoblog.fooblog.com in ...
2
votes
3answers
218 views

How to test for presense of antivirus?

I want to test that when user uploads file, then it goes through up-to-date and properly configured antivirus. I think that to test for it I need some malware that is likely to be detected (it doesn't ...
2
votes
4answers
1k views

How would a keylogger bypass Wireshark sniffing?

I often see malicious keyloggers being advertised as having anit-wireshark feature. Meaning their data can't be sniffed. Is it possible to do so? How would they do it? My guess is that they just ...
2
votes
3answers
2k views

Malware not showing up in virus scan

I have some malware on my computer at work that I'm having a hard time getting rid of. I'm only interning there over the summer, so I'm guessing that it was downloaded by the previous user because I ...
2
votes
2answers
186 views

Security Practices by Employees in a Corporate Environment

Consider the following situation : 1. Somehow my boss's system got infected with a malware ( He visited one of the Java exploits website). 2. He sends a PDF document containing the requirement ...
2
votes
2answers
1k views

Antivirus settings: delete or quarantine the file?

I understand that most antiviruses by default quarantine infected files. I have changed it to remove all infected files immediately. Would this cause more harm than good?
2
votes
4answers
786 views

How to identify the Java program that is maliciously accessing my web site from many client addresses?

For many years, my personal web site receives numerous pairs of hits that look like this, every day: 202.xx.xx.xx - - [22/Apr/2013:12:02:26 +0000] "GET / HTTP/1.1" 200 5923 "-" "Java/1.4.1_04" 202.xx....
2
votes
1answer
143 views

Trust linux images burned from untrusted systems

For securitys sake I'm assuming my system is successfully compromised after a targeted and/or non-targeted attack. I've downloaded some linux images and burned them to do a re-install. Since I can't ...
2
votes
1answer
589 views

With Ubuntu on Windows 10, could exploits and malware that work on Ubuntu (or related distros) work on Windows? [closed]

So apparently Hell has finally and completely frozen over: the next major update for Windows 10 will be able to natively run Bash, related tools, and even some broader set of Linux binaries/programs ...
2
votes
3answers
108 views

Methods to have multiple Anti Virus installed on one machine

I am running Windows 8.1 Pro, Ideally I would like to have the top 5 Anti Virus installed but I am aware it is not advised as they can clash with each other. I was wondering if there is a favoured ...
2
votes
2answers
309 views

Viewing an infected file via FTP and code editor won't infect my PC right?

My apologies this may sound like a paranoid question... Recently my friend's website was infected by malware. With her permission, I FTP into her account to have a look and found some malicious PHP ...
2
votes
3answers
960 views

How are 1x1 pixel images used in a malicious context?

I have been analyzing malware and I am seeing many 1x1 png and gif files. What could these be used for?
2
votes
1answer
721 views

How Browsers prevents Malware and Phishing attacks

I want to know how phishing and malware protection features are implemented in modern browsers like Chrome, Firefox, IE etc. Are these features heuristic based, or do browsers maintain a list of ...
2
votes
2answers
1k views

Is copying & pasting to the clipboard vulnerable to keyloggers? (CTRL+C and CTRL+V) [duplicate]

If I copy a username/password from an email and paste it into an FTP client or an online form in the browser, can keyloggers capture this private information? And does it make any difference whether ...
2
votes
2answers
17k views

How does Remote Access Trojan / Backdoor Software work?

How does a RAT works? I understand it as once we visit the infected website, the browser might download the Trojan to our PC automatically. Will it be executed and auto-installed in our computer? I ...
2
votes
2answers
89 views

Hardening Javascript in respect to Javascript Malware/Ransomeware like Ransome32

Are there any methods or standards to harden Javascript implementations to help reduce/remediate the the risks associated with Javascript malware like the Ransom32 or other types of Javascript attacks?...
2
votes
3answers
82 views

Does any malware target Tails?

Tails is not a popular OS and is optimized for security, which makes me doubt there is a significant amount of malware that targets it. I googled "malware targeting tails," and found no relevant ...
2
votes
1answer
648 views

What's with the Facebook malware which posts obscene posts in all the groups? [closed]

How to get rid of the Facebook malware which sends pornographic posts in all the groups you belong to? I always made fun of people who became victim of this malware/virus saying they are not cautious ...
2
votes
2answers
178 views

Is loopback interface protected from sniffing?

I'm trying to understand what are the risks derived from unprotected communications within the same device, by the use of the loopback interface. I've verified it is possible to capture packets, with ...
2
votes
3answers
376 views

How could an iPhone be transmitting abnormal loads of data without apparently running anything?

My iPhone has sent/received 900MB in 15 days from "com.busuu.japanese.a" I got this information from Onavo, which 'compresses' my data. I have never heard of Busuu until today. It is a language ...
2
votes
1answer
2k views

Windows PE file and Malwares

Trying to understand how and why any virus, malware, worm and code injections are successful after all in a Windows Portable Executable format. I was going through the PE structure documentation, ...
2
votes
4answers
1k views

Detecting malware hidden in P2P traffic

Consider a network situation involving (only) Peer to Peer traffic in medium sized network. For the sake of convenience, a simple P2P application like DC++ may be assumed, although I am aiming at a ...
2
votes
5answers
540 views

malware classification based on action [closed]

Where can I get info with a view to classify malware based on actions performed by the them. Eg. modifying registry files, copying themselves into other executable's etc.
2
votes
1answer
66 views

What risks do I have now that I accidentaly opened a suspicious URL send to me by Skype?

The following URL was sent to me by a trusted Skype contact (from my university): WARNING - DO NOT CLICK IF YOU DON'T KNOW WHAT YOU'RE DOING http://bit.ly/28PPw3V#dahubas=my_skype_id I clicked on ...
2
votes
2answers
334 views

Can a BIOS or UEFI infection transfer to other storage drives without the OS presence?

I am already aware that a BIOS or UEFI malware "activate" only in the OS environment. Is it possible though that a spread mechanism be activated without the presence of the OS, so that it would infect ...
2
votes
1answer
293 views

Does CryptoWall needs a internet connection to encrypt my files?

Does CryptoWall 3.0 use some resource on the internet to encrypt my files? I watched this video on YouTube - in this video a tool is used to sniff network traffic and find information about ...
2
votes
3answers
2k views

Can a wireless headphone (bluetooth) contain malware?

Can a wireless (bluetooth) headphone store data? Also, if it can, then can someone put malware in it? I assume that the device must necessarily be able to store some sort of data, since it has buttons ...
2
votes
1answer
318 views

What does this potentially malicious code do? [closed]

While reading a website called 4chan/b/ someone posted this code snippet, i was wondering what it does when executed? it appears to be C code, how harmful is it? This is the full post: Run a live ...
2
votes
3answers
5k views

How to search for evidence of Camfecting (webcam hacking)?

I'm worried about camfecting (webcam hacking). The camera light on my mac (running OSX) is not on, but it isn't hard wired so that doesn't say a lot. I've ran a virus scan but no signs. Now my idea ...
2
votes
3answers
172 views

Known windows malware propagated via unmounted iPhone

Last week I was told by our security department that my PC (running windows 7) was infected by a trojan and that it needed to be re-imaged. So re-imaged it was! Given the fact that I had been using ...
2
votes
1answer
147 views

Sonar power saving. Attacks and how to mitigate

I recently came upon a program called Sonar power saving that uses speakers and microphone to put the computer in power saving mode as long as you move away from the screen. http://stevetarzia.com/...
2
votes
1answer
283 views

Where's the virus in this web site?

I made my friend go to this web site and it immediately infected his machine with malware (AntiVirus SecurityPro). It happened just by going to the front page. It seemed the malware started up, but ...
2
votes
2answers
358 views

Is interpreted malware easier to detect than compiled malware?

Is compiled code more of a security risk than interpreted code? I'm under the impression that it is due to the fact that compiled code can hide malicious code from malware scans.
2
votes
2answers
327 views

How does duqu delete itself?

I'm curious to know how Duqu deletes itself. From technical point of view and generally, how can an executable delete itself while is running? Does Duqu use a specific procedure to do this?
2
votes
1answer
6k views

In Metasploit, how to use a custom exe as payload?

Question was once on a mailing list but wasn't answered. I want to use a custom exe as a payload in metasploit. For example when I use exploit/multi/browser/java_atomicreferencearray and want to ...
2
votes
1answer
172 views

Is there a tool that puts on a webserver some .html or .php files filled with popular malware like java drive-bys or other browser exploit payloads? [closed]

As mentioned in the title I'm looking for a tool that puts on a webserver some .html or .php files filled with popular malware like java drive-bys or other browser exploit payloads? Maybe there is ...
2
votes
1answer
181 views

Can a bad guy be judged for gaining access to sensitive information?

Assuming a hacker has sent to somebody a malware. It's a trojan (digitally signed by TeamViewer) which runs automatically when windows starts up and sends the login info to a web site using GET (...
2
votes
1answer
76 views

What to do with an APK file containing Swf.Exploit.CVE_2015_0323-1 and ELF File?

I received an APK file from a source. Prior to installation, I ran a virus scan on it. The result had following main features: The file contained Swf.Exploit.CVE_2015_0323-1 It required android....
2
votes
1answer
203 views

Could someone help me deobfuscate this malicious script code [duplicate]

Two months ago one of our Wordpress sites was infested through and through. This was at the same time I started working at this company. Our main platform is Plone, but I guess they did some on the ...
2
votes
2answers
110 views

Disabling downloads in the browser; are there any benefits?

I was playing around with the security settings in my browser (IE) after being attacked by malware. I noticed an option to disable downloads. If I were to disable downloads, and re-enable them when ...
2
votes
1answer
184 views

Data collection when responding to malware alerts

When investigating malware alerts I would like to collect some information from the system before the decision gets made to take the system off of the network and re-imaged, or if further forensics is ...
2
votes
2answers
234 views

Determining safety of Android APK executable that requires root

On my request, a developer gave me a new version of his Android app to test. The app requires root permissions. I do not know the developer personally. I have no specific reasons to trust or ...
2
votes
2answers
282 views

Which security measures does PyPI and similar third-party software repositories take?

PyPI is a third-party software repository for Python packages. Everybody can upload packages to it (see The Python Package Index (PyPI)). How does PyPI prevent people from uploading malware? When I ...
2
votes
2answers
519 views

Convert PDF to plain text, remove malware?

Take a PDF, copy all, paste it into a .rtf document in textedit, --> make plain text. will this remove/nullify any malware from/in the pdf? In other words, if I open the PDF on one machine and convert ...
2
votes
1answer
671 views

What is the difference between YARA and CLAMAV?

Can any one explain the difference between YARA and ClamAV ? Are they just two different ways of writing AV or Malware signatures ?
2
votes
2answers
867 views

How safe are Firefox addons from official mozilla.org site?

I would like to install the Dictionary Pop-Up addon for Firefox. I usually don't install any addons, but this one looks especially tempting. I could not find any information on the Mozilla page, ...
2
votes
1answer
501 views

I need help identifying the cause of weird outbound traffic from my network

I have some weird traffic heading outbound from my network. It is being blocked by the firewall from exiting and I'm not sure what the source is. I've looked at the machine and don't see anything ...
2
votes
1answer
3k views

How to detect infected devices on your local network [closed]

Today I read about a researcher who bought a digital TV recorder and connected it to the internet - probably using port forwarding to enable attackers to connect to the recorder. After a while someone ...