Malware is any software application which subverts the will of the legitimate owner of a computer, by means of force or subterfuge, with or without personal or monetary gain on the part of the creator.

learn more… | top users | synonyms (1)

2
votes
1answer
705 views

How Browsers prevents Malware and Phishing attacks

I want to know how phishing and malware protection features are implemented in modern browsers like Chrome, Firefox, IE etc. Are these features heuristic based, or do browsers maintain a list of ...
2
votes
2answers
1k views

Is copying & pasting to the clipboard vulnerable to keyloggers? (CTRL+C and CTRL+V) [duplicate]

If I copy a username/password from an email and paste it into an FTP client or an online form in the browser, can keyloggers capture this private information? And does it make any difference whether ...
2
votes
2answers
17k views

How does Remote Access Trojan / Backdoor Software work?

How does a RAT works? I understand it as once we visit the infected website, the browser might download the Trojan to our PC automatically. Will it be executed and auto-installed in our computer? I ...
2
votes
1answer
621 views

What's with the Facebook malware which posts obscene posts in all the groups? [closed]

How to get rid of the Facebook malware which sends pornographic posts in all the groups you belong to? I always made fun of people who became victim of this malware/virus saying they are not cautious ...
2
votes
2answers
174 views

Is loopback interface protected from sniffing?

I'm trying to understand what are the risks derived from unprotected communications within the same device, by the use of the loopback interface. I've verified it is possible to capture packets, with ...
2
votes
3answers
375 views

How could an iPhone be transmitting abnormal loads of data without apparently running anything?

My iPhone has sent/received 900MB in 15 days from "com.busuu.japanese.a" I got this information from Onavo, which 'compresses' my data. I have never heard of Busuu until today. It is a language ...
2
votes
1answer
2k views

Windows PE file and Malwares

Trying to understand how and why any virus, malware, worm and code injections are successful after all in a Windows Portable Executable format. I was going through the PE structure documentation, ...
2
votes
4answers
1k views

Detecting malware hidden in P2P traffic

Consider a network situation involving (only) Peer to Peer traffic in medium sized network. For the sake of convenience, a simple P2P application like DC++ may be assumed, although I am aiming at a ...
2
votes
5answers
540 views

malware classification based on action [closed]

Where can I get info with a view to classify malware based on actions performed by the them. Eg. modifying registry files, copying themselves into other executable's etc.
2
votes
3answers
71 views

Does any malware target Tails?

Tails is not a popular OS and is optimized for security, which makes me doubt there is a significant amount of malware that targets it. I googled "malware targeting tails," and found no relevant ...
2
votes
2answers
320 views

Can a BIOS or UEFI infection transfer to other storage drives without the OS presence?

I am already aware that a BIOS or UEFI malware "activate" only in the OS environment. Is it possible though that a spread mechanism be activated without the presence of the OS, so that it would infect ...
2
votes
1answer
278 views

Does CryptoWall needs a internet connection to encrypt my files?

Does CryptoWall 3.0 use some resource on the internet to encrypt my files? I watched this video on YouTube - in this video a tool is used to sniff network traffic and find information about ...
2
votes
3answers
2k views

Can a wireless headphone (bluetooth) contain malware?

Can a wireless (bluetooth) headphone store data? Also, if it can, then can someone put malware in it? I assume that the device must necessarily be able to store some sort of data, since it has buttons ...
2
votes
1answer
311 views

What does this potentially malicious code do? [closed]

While reading a website called 4chan/b/ someone posted this code snippet, i was wondering what it does when executed? it appears to be C code, how harmful is it? This is the full post: Run a live ...
2
votes
3answers
169 views

Known windows malware propagated via unmounted iPhone

Last week I was told by our security department that my PC (running windows 7) was infected by a trojan and that it needed to be re-imaged. So re-imaged it was! Given the fact that I had been using ...
2
votes
1answer
147 views

Sonar power saving. Attacks and how to mitigate

I recently came upon a program called Sonar power saving that uses speakers and microphone to put the computer in power saving mode as long as you move away from the screen. ...
2
votes
1answer
279 views

Where's the virus in this web site?

I made my friend go to this web site and it immediately infected his machine with malware (AntiVirus SecurityPro). It happened just by going to the front page. It seemed the malware started up, but ...
2
votes
2answers
354 views

Is interpreted malware easier to detect than compiled malware?

Is compiled code more of a security risk than interpreted code? I'm under the impression that it is due to the fact that compiled code can hide malicious code from malware scans.
2
votes
2answers
326 views

How does duqu delete itself?

I'm curious to know how Duqu deletes itself. From technical point of view and generally, how can an executable delete itself while is running? Does Duqu use a specific procedure to do this?
2
votes
1answer
6k views

In Metasploit, how to use a custom exe as payload?

Question was once on a mailing list but wasn't answered. I want to use a custom exe as a payload in metasploit. For example when I use exploit/multi/browser/java_atomicreferencearray and want to ...
2
votes
1answer
172 views

Is there a tool that puts on a webserver some .html or .php files filled with popular malware like java drive-bys or other browser exploit payloads? [closed]

As mentioned in the title I'm looking for a tool that puts on a webserver some .html or .php files filled with popular malware like java drive-bys or other browser exploit payloads? Maybe there is ...
2
votes
1answer
179 views

Can a bad guy be judged for gaining access to sensitive information?

Assuming a hacker has sent to somebody a malware. It's a trojan (digitally signed by TeamViewer) which runs automatically when windows starts up and sends the login info to a web site using GET ...
2
votes
1answer
154 views

Could someone help me deobfuscate this malicious script code [duplicate]

Two months ago one of our Wordpress sites was infested through and through. This was at the same time I started working at this company. Our main platform is Plone, but I guess they did some on the ...
2
votes
2answers
102 views

Disabling downloads in the browser; are there any benefits?

I was playing around with the security settings in my browser (IE) after being attacked by malware. I noticed an option to disable downloads. If I were to disable downloads, and re-enable them when ...
2
votes
1answer
178 views

Data collection when responding to malware alerts

When investigating malware alerts I would like to collect some information from the system before the decision gets made to take the system off of the network and re-imaged, or if further forensics is ...
2
votes
2answers
232 views

Determining safety of Android APK executable that requires root

On my request, a developer gave me a new version of his Android app to test. The app requires root permissions. I do not know the developer personally. I have no specific reasons to trust or ...
2
votes
2answers
254 views

Which security measures does PyPI and similar third-party software repositories take?

PyPI is a third-party software repository for Python packages. Everybody can upload packages to it (see The Python Package Index (PyPI)). How does PyPI prevent people from uploading malware? When I ...
2
votes
2answers
514 views

Convert PDF to plain text, remove malware?

Take a PDF, copy all, paste it into a .rtf document in textedit, --> make plain text. will this remove/nullify any malware from/in the pdf? In other words, if I open the PDF on one machine and convert ...
2
votes
1answer
629 views

What is the difference between YARA and CLAMAV?

Can any one explain the difference between YARA and ClamAV ? Are they just two different ways of writing AV or Malware signatures ?
2
votes
2answers
842 views

How safe are Firefox addons from official mozilla.org site?

I would like to install the Dictionary Pop-Up addon for Firefox. I usually don't install any addons, but this one looks especially tempting. I could not find any information on the Mozilla page, ...
2
votes
1answer
480 views

I need help identifying the cause of weird outbound traffic from my network

I have some weird traffic heading outbound from my network. It is being blocked by the firewall from exiting and I'm not sure what the source is. I've looked at the machine and don't see anything ...
2
votes
2answers
476 views

Do multiplatform viruses exist? [closed]

Is there any known virus that targets the main operating systems: Windows, Linux and Mac OS X?
2
votes
1answer
3k views

How to detect infected devices on your local network [closed]

Today I read about a researcher who bought a digital TV recorder and connected it to the internet - probably using port forwarding to enable attackers to connect to the recorder. After a while someone ...
2
votes
3answers
1k views

Does Skype compromise my system (beyond the scope of calls/chats)?

First of all, please don't shout at me for wanting to use Skype. I know that it's evil and I fully expect all the calls and text chats going through it to be stored permanently in govt data centers, ...
2
votes
2answers
6k views

How do worms spread over LAN? [duplicate]

I've been researching LAN recently, and I came across a post talking about viruses spreading over LAN, and I was wondering, how is this possible? Would it not be a huge security issue to allow files ...
2
votes
1answer
4k views

How to check if your computer has a backdoor installed on it? [closed]

Just some time ago I had this unusual popup from Malwarebytes Anti-Malware (MBAM): I did a quick Google of the IP address and found this thread where the OP is complaining of MBAM blocking ...
2
votes
3answers
872 views

Strange file named Aview.exe - WinClient

Today I've just discovered some strange files on my Win 7 PC. I was browsing through the Windows Firewall Inbound Rules and saw two ACCEPT rules for a program, Aview.exe. It is located in ...
2
votes
1answer
369 views

what is the difference between virus, worm, trojan and other malware [closed]

Looking through the questions in IT security, I found out that there is no answer which cover this question in depth. I am aware of the answer and just hope to see something detailed about: main ...
2
votes
2answers
3k views

What are the most common infection vectors for personal computers?

We have OWASP to tell us about common security vulnerabilities in webapps and such, but what are the most common infection vectors for personal computers? A few example vectors: Social engineering ...
2
votes
1answer
456 views

How to reverse engineer w32/malware!gemini?

How would you go about reverse engineering malware W32/Malware!Gemini. Recently I found it installed on my computer and would like to trace where the data is being sent.
2
votes
1answer
711 views

How do you remove the Security Sphere malware?

My boss' computer has become infected with something called "Security Sphere". When googling for information on how to remove it I get many pages that have been optimized for the term "Security Sphere ...
2
votes
1answer
627 views

Can anyone give me more info on this sketchy url I recently visited, is it an attack site?

My girlfriend was browsing images on google when suddenly her browser redirected to this url: defender-iies.co.cc/scan3/167 The site seemed to be posing as an anti virus, saying your computer is at ...
2
votes
2answers
54 views

Protect against virus and malware attacks from website ads with iptables

Lots of websites spread malware by publishing advertisements that distribute malware. Even YouTube's ad network has been compromised in the past. Browser ad blockers and related plugins have there own ...
2
votes
1answer
60 views

How to prevent IoT devices from phoning home via the neighbor's wifi?

I'm wondering what, if anything, can be done to thwart the sort of attack described below. First, you can assume the following: (1) There are several devices in your home which you have deliberately ...
2
votes
1answer
197 views

How does Zeus (and other malware) inject code into other processes

Recently, I've been studying how malware works, most recently the infamously known Zeus bot, and I've noticed one thing that I don't seem to understand: The malware is said to be able to hook APIs in ...
2
votes
1answer
97 views

Is it there any way to detect payloads generated by veil framework

While pentesting, I used to generate a malicious payloads using the veil framework. The generated payload bypasses antivirus & infects the target system. Is there any way to detect veil payloads ...
2
votes
2answers
94 views

xcodeghost infection in a byod device

We detected network traffic from a device infected with xcodeghost trying to reach a known bot command and control address. Obviously, we removed the device from the network. The user removed two ...
2
votes
2answers
309 views

Automatic redirection to another website

As soon as I open a webpage, I am redirected to another site. I have an antivirus on my PC, but it has not been able to do anything to stop this. I have reseted my browser settings (Chrome) and ...
2
votes
2answers
161 views

How to find a process that is sending HTTP HEAD requests

When I was using fiddler for testing a web Client(capturing non-browser traffic only), it captured the below by coincidence. Is there any way that i can found out which process is doing this? I am on ...
2
votes
1answer
97 views

How Is It Possible That an App Connects to 0.0.0.142 IP Address? [closed]

I regularly review connections being established from apps in my phone to external services. Lately, I found Facebook connecting to 0.0.0.142. So I deleted Facebook for Android app. Now, I just found ...