Malware is any software application which subverts the will of the legitimate owner of a computer, by means of force or subterfuge, with or without personal or monetary gain on the part of the creator.

learn more… | top users | synonyms

2
votes
1answer
280 views

Good tools for reverse engineering colaboratively? [closed]

Does anybody know a good set of tools for doing reverse engineering of binaries in a collaborative way?. My original idea is to disassemble a binary, allowing to add information about functions, ...
3
votes
1answer
493 views

Is this code harmful? Why?

Code: http://pastebin.com/kJ8ZGP82 That code gets retrived from http://ui.sidepage.co for every HTTP page I visit (not HTTPS) and load it into the body tag of the page. Is it harmful in any way? ...
4
votes
1answer
447 views

How dangerous is a virus introduced to a malicious website in chrome?

I am using Google's Chrome browser under Linux (Ubuntu) 64 bit for web browsing. If I a virus uses for example a leak in the flash player, the virus will get the privileges of the user who started ...
2
votes
3answers
449 views

How hard it would be to infect a system with malware through a portable web browser

If I use a portable web browser on a USB device like Google Chrome Portable how hard it would be to get infected by a malware/virus in the system to which the USB device is connected? Google Chrome ...
2
votes
2answers
2k views

How is it possible that a virus can infect the system if the browser is started with non-admin rights

If I open my web browser (for example firefox) in Windows 7 with activated UAC as normal user (non admin) a virus - which uses a security leak in my browser - will only gets privileges of the normal ...
0
votes
3answers
242 views

Using a VM to access internet when malware blocks internet access?

My computer was recently infected by some malware which had blocked internet access. I had a virtualization software with an OS in it. Surprisingly, I could access the internet from the VM. I know ...
12
votes
5answers
866 views

Detection and analysis of unknown malware

Suppose I have a binary which is suspicious. How can I determine whether it is malicious, and if it is, reverse-engineer how it works and what it does? For example, maybe using static analysis? Are ...
3
votes
1answer
586 views

What is known about the sirefef/zeroaccess malware/botnet?

There appears to be an increase in p2p communication among botnets that has been attributed to the sirefef/zeroaccess malware botnet. What is known on this particular threat?
2
votes
4answers
838 views

Detecting malware hidden in P2P traffic

Consider a network situation involving (only) Peer to Peer traffic in medium sized network. For the sake of convenience, a simple P2P application like DC++ may be assumed, although I am aiming at a ...
1
vote
1answer
641 views

Cuckoo Sandbox python errors after task submission

I'm New to Cuckoo Sandbox. Why am I getting this error? I don't understand. If there is something wrong, can anyone please explain how to setup Cuckoo Sandbox? My setup works very well before I ...
3
votes
3answers
776 views

Security/Malware implications of storing data in a BLOB as opposed to the file system

From a programming perspective, there has long been a debate over whether to store files in a BLOB or Binary field in a database, or on the file system. The debate always seems to center around ...
3
votes
4answers
4k views

Writing malware in java?

To me, it seemed like malware could never be written in java. Those who taught me java said it was "secure" and did not allow "low-level access" like c,c++. But, I discovered that it can be done - ...
1
vote
3answers
19k views

Multiple running instances of rundll32.exe

I've noticed that in the Task Manager of Windows 7, I have multiple running instances (2) of rundll32.exe. Does this necessarily means that my machine is infected by a malware as noted here: ...
6
votes
2answers
238 views

Example of malware in the wild?

I'd like to test an application that detects malware on my network. In order to do that, I have a Windows VM set up that I'd like to infect with malware. But for the life of me, I can't seem to find ...
2
votes
3answers
698 views

Strange file named Aview.exe - WinClient

Today I've just discovered some strange files on my Win 7 PC. I was browsing through the Windows Firewall Inbound Rules and saw two ACCEPT rules for a program, Aview.exe. It is located in ...
1
vote
3answers
274 views

Any one know about UDP traffic on source port 26221?

On my captured network traffic i observe a flow having a source udp port of 26221 and have different destination udp ports. Some of these destination ports were standards IANA ports. The average ...
2
votes
1answer
297 views

what is the difference between virus, worm, trojan and other malware [closed]

Looking through the questions in IT security, I found out that there is no answer which cover this question in depth. I am aware of the answer and just hope to see something detailed about: main ...
1
vote
2answers
776 views

Where can I find worm traffic sample?

I have a program that has to detect scanning activity of worms. I need some samples of worms' traffic (pcap files) to try the program, and notes about the procedures which must be taken when running ...
2
votes
1answer
126 views

Trust linux images burned from untrusted systems

For securitys sake I'm assuming my system is successfully compromised after a targeted and/or non-targeted attack. I've downloaded some linux images and burned them to do a re-install. Since I can't ...
3
votes
5answers
1k views

How can I know if my PC is getting infected?

I have installed an antivirus, but as no antivirus is perfect, what can I do to diagnose if my PC is getting infected? For example, keeping a close eye on what programs and tasks run when I turn my ...
1
vote
3answers
191 views

Where can I find information on existing viruses?

As part of my research, I have created a small malware corpus which I'm conducting my tests against. I would like to categorize them based on Metamorphic / Polymorphic / etc. I am not sure if this is ...
3
votes
1answer
224 views

“WICKED” entries in the default nginx vhost's logs

I have a small VPS running nginx, and for a long time now (several months, since I rented it) it has been collecting weird entries in its default (listen 80 default;) vhost's logs: 109.x.x.121 - - ...
3
votes
4answers
462 views

Malware via power outlet

This is perhaps a very dumb question, but as I have no knowledge nor experience of IT security I have no option but to ask here. Is it possible to get malware onto your computer or smartphone by ...
2
votes
1answer
83 views

Seeing outboud connections to random domains, how do I isolate the app responsible?

Last night I loaded up Fiddler2 to do a little debugging and I saw three connections to domains like hghefhhig How can I go about isolating the application responsible? I was thinking possibly ...
13
votes
4answers
1k views

How is a worm different from a virus?

In spite of various online articles, I'm a bit unclear on the distinction between a "worm" and a "virus". Two related questions-- Is there a useful and clear distinction here or no? If so, what is ...
0
votes
1answer
116 views

How does duqu implement its dll files in PNF file format?

As you know files with PNF extension are associated with bitmap file type, from technically point of view how did authors of duqu implement this? as I concluded it is possible to make dlls in any ...
3
votes
3answers
344 views

I found a malicious website embedded in Malware spam. What should I do?

An email is using social engineering to get users to click on a malicious URL that downloads javascript and then runs malicious code. Who should I report these malicious URLs to? (Microsoft ...
0
votes
2answers
1k views

Is there any known Malware for Windows Phone 7?

I cannot find anything on google that indicates there has been cases of malware on Windows Phone 7, doe's anyone know if this is true?
1
vote
1answer
218 views

uninstall and reinstall after hacking [closed]

My computer has been hacked. If I uninstall and reinstall do I loose my files? The facebook tech tried to sell me a number of pkgs ranged $149-$299 and told me that my account was hacked as was my ...
2
votes
1answer
126 views

Is there a website or free downloadable program to identify and remove malware from an ISO file?

Is there a website or free downloadable program that allows a user to identify and remove multiple types of malware from an ISO file?
5
votes
1answer
359 views

Cufon or Prototype as an attack vector for Blackhole exploit kit?

I've been asked to look into the security of a client site that's apparently throwing antiviral messages when visited. Specifics: It's being detected as a Blackhole exploit kit inside of a Cufon ...
1
vote
4answers
199 views

Infection I can't shut down, disguises process as scvhost.exe [closed]

A little while ago my home machine got hit and I was able to clean out just about everything except this one process. I can't find the origin but it shows in my process manager as scvhost.net by the ...
5
votes
3answers
775 views

Phishing virus found on server

I recently had a call from BELL concerning a virus on our Linux ( Debian ) Server. Apparently Google emailed our client about an Italian Database found on our server that was doing phishing. They ...
3
votes
3answers
196 views

What are some ways to steal a password/PIN using this system?

http://cups.cs.cmu.edu/soups/2007/posters/p147_lim.pdf Essentially uses an on-screen keypad that does not show the complete keypad numbers at a time. The image is refreshed at the rate of the ...
7
votes
2answers
7k views

Is Buzzdocks a security threat?

A BuzzDock toolbar suddenly appeared in my Chrome browser. I definitely did not install it nor do I remember installing any crapware. It is not unknown to the internet community (Example 1, Example ...
4
votes
2answers
174 views

What is the state of the Windows Update certificate after Flame?

May 28, The Flame malware is discovered in Iran and by Kaspersky Labs. June 5, Dan Goodin (Ars Technica) points out that Flame had hijacked WindowsUpdate, spreading signed malware through that ...
5
votes
1answer
830 views

When and Why does Chrome display malware detection warning?

Google Chrome contains malware detection feature. When user visits some site, browser may display warning that site contains malware. What does it mean that site contains malware? Does it mean that ...
7
votes
3answers
2k views

attack/abuse notification email template

I'm building a template for use when sending "abuse" notifications to ISPs, hosting providers, etc., for when attacks originate from their netblock. Are there examples of templates used for this ...
5
votes
2answers
2k views

How would I go about rebuilding the IAT of a packed executable?

When executables are packed with a tool such as UPX, the real code and data sections are encrypted or obfuscated, then loaded into memory using an injected decrypter stub. This makes static analysis ...
-4
votes
1answer
376 views

What are the technial and programming requirements for writing a stealth keylogger? [closed]

I'm planning to write/code one such stealth keylogger that would bypass detection by a certain antivirus. (I don't want to name the vendor as I know how good Google queries are against StackExchange ...
19
votes
4answers
2k views

Are anti-virus companies companies regularly committing software piracy?

As Mikko Hypponen highlighted in a recent tweet, anti-Virus companies collect and store both samples of malicious software and samples of legitimate software: This got me to thinking, what ...
4
votes
2answers
607 views

Can a malware jump from a virtual to the physical machine? [duplicate]

Possible Duplicate: How secure are virtual machines really? False sense of security? I found out that malware authors check if the hard drive volume name, or network card MAC matches ...
2
votes
2answers
284 views

How does duqu delete itself?

I'm curious to know how Duqu deletes itself. From technical point of view and generally, how can an executable delete itself while is running? Does Duqu use a specific procedure to do this?
0
votes
2answers
803 views

Is a VPN the only way to protect against rogue Wifi access points MITM attacks?

Given that it's very easy set up a rogue access point and MITM that connection, is a VPN to a trusted host the only real way to secure my browsing and other TCP/UDP actions? This question relates to ...
5
votes
7answers
3k views

How to safely view a malicious PDF?

I have a PDF with important information that may contain malware. What would be the best way to view it?
6
votes
2answers
392 views

How a malware executes remote payload

Let's assume a malware was installed (on a UNIX-based platform) with some social engineering tricks. The original installed code itself may be benign, but the only malicious activity is that the ...
4
votes
1answer
416 views

In the light of recent information about RarVM, can we still trust RAR files?

See: http://blog.cmpxchg8b.com/2012/09/fun-with-constrained-programming.html https://github.com/taviso/rarvmtools It would seem according to these two sources that rar files can contain custom ...
20
votes
2answers
2k views

From a technical standpoint, how does the zero-day Internet Explorer vulnerability discovered in September 2012 work?

I'm looking for an answer that explains the issue from the prespective of a developer/engineer. What is exactly being exploited and why does it work? Please note that I am not looking for ...
7
votes
2answers
376 views

How do AV vendors choose malware names?

If you take a look at McAfee's recent malware page, you'll see that the names in the "Malware name" column aren't very human-readable: Downloader.a!cnz, W32/Autorun.worm.bgh, ...
4
votes
2answers
385 views

How can I recognize and find file(s) dropped by malware?

Suppose I am doing malware analysis. How can I recognize if, during the analysis process, a piece of malware dropped a file in my system, and if so, the path of the file? What are the procedures, ...