Malware is any software application which subverts the will of the legitimate owner of a computer, by means of force or subterfuge, with or without personal or monetary gain on the part of the creator.

learn more… | top users | synonyms (1)

-3
votes
0answers
29 views

Rogue file appears over and over again, how to fix security [duplicate]

I've been trying to get rid of several rogue files that appear in my website file directories. I run a cronjob to check for any file changes and delete them every time the cron job catches them. I've ...
13
votes
2answers
649 views

Advertisement on Skype tried to download a file to my computer using Javascript

I usually have Skype running in the background. If you have ever used Skype before, you probably know it has advertisements. One of these advertisements made two windows pop up on my screen, asking to ...
0
votes
1answer
72 views

mail.ru and slightsearch.ru hijacking browser default search engine set by admin

I recently got malware installed on my PC that contained software that infected my google chrome, by hijacking my default search engine. I tried: Removing newly installed programs from PC, using ...
5
votes
3answers
149 views

Mitigating the risk for a successful ransomware infection

The company I work for has been getting hit with loads and loads of frightfully sophisticated ransomware spam lately, people masking as consultants, customers, very specific company requests, etc. ...
0
votes
2answers
88 views

Posting links to executable files and security

If someone is able to post on the forum of my website links to executable files (malware) hosted on remote websites: can we say that my website suffers from a security hole ?
0
votes
1answer
30 views

How to safely exchange functionality of a file between two computers?

I have two computers and the goal is to move a functionality of a given file from computer A to computer B. The file is supposed to have a certain known functionality but it potentially could expose ...
8
votes
2answers
861 views

How to avoid ransomware

Malware files execute themselves after downloading them. Let's look at it from the point of view of a piece of ransomware like CryptoLocker, from Wikipedia: Crypyowall 3.0, uses a payload ...
3
votes
1answer
4k views

Zeus botnet source code

I am doing my project on botnets and wanted to understand the source code of the Zeus botnet. Where is the right place to get started with some analysis of zeus botnet source code? I need a good ...
0
votes
0answers
53 views

Do these DNS requests seem like Conficker/Torpig-like behaviour?

I'm at my wit's end on this one... I have been seeing weird traffic from an IP on a client's local network and I think the host is malicious. Looking at the traffic it is producing, is always ...
1
vote
2answers
34 views

Random autofill [closed]

I was trying to pay for something just now, and when I put my name in the chrome autofill came up and I clicked it. The address that showed up was wrong though but corresponded to the postcode of one ...
8
votes
2answers
2k views

Will completely wiping your hard drive remove all malware? [duplicate]

I recently bought a new computer. Now I want to convert my old PC into a Linux system. However, I want to start completely fresh and not bring over any malware. I am already planning to wipe ...
-3
votes
1answer
59 views

How can a polymorphic virus decrypt and execute portions of the code during runtime?

I found this article about a polymorphic virus that encrypted and decrypted itself during runtime. The article said that the only non-encrypted part was a stub that decrypted the next part of the ...
0
votes
2answers
70 views

Malware able to “read” one's screen

I was searching online about multifactor authentication. One of the reasons that people recommend it is because they fear someone may use a keylogger to "steal" their password, so they use one more ...
2
votes
1answer
145 views

Could someone help me deobfuscate this malicious script code [duplicate]

Two months ago one of our Wordpress sites was infested through and through. This was at the same time I started working at this company. Our main platform is Plone, but I guess they did some on the ...
6
votes
3answers
103 views

Is tails os susceptible to a cold boot attack?

I've looked at the documentation and it mentions that upon shutdown the data residing in the ram is overwritten, however it doesn't go into any detail on how it does this. Documentation link: ...
1
vote
2answers
170 views

Server full disk encryption protection from malware

A group of LINUX servers is using dm-crypt to encrypt data. The servers do not store data long-term but are only temporary stopping points for data before it is sent to other systems. The time the ...
15
votes
5answers
2k views

Can a .sh file be malware?

Can a .sh file be a virus or something harmful? Is it like .exe files on Windows? If yes, can someone read this script and tell me if it safe and is it effect any how on GnuPG security? It gives me an ...
4
votes
1answer
81 views

How do I use a directory of YARA files?

I'm going through the Malware Cookbook PEScanner and they want a path to my YARA files to search on. I currently have a directory full of YARA rules for known pieces of malware. What would be the ...
6
votes
3answers
263 views

Does malware persist after wiping hard drive and reinstalling OS from manufacturer disc? [duplicate]

This question is related to a computer where users other than the owner have had access for periods of several hours at a time. The following steps have been taken to clean the computer: Used ...
0
votes
2answers
87 views

Is it possible to hide malicious code within/behind an image? [closed]

Is it possible to hide malicious code either within an image, or behind it as it is displayed on a webpage and then if the user saves this image, they actually are downloading the malicious code? ...
5
votes
1answer
223 views

What are the actions of Locky on the source files which lead to encrypting?

During discussions about possible actions to mitigate the risk of the ransomware Locky, someone pointed at the possibility of preventing at OS level the creation of .locky files via the File Server ...
2
votes
3answers
69 views

Does any malware target Tails?

Tails is not a popular OS and is optimized for security, which makes me doubt there is a significant amount of malware that targets it. I googled "malware targeting tails," and found no relevant ...
3
votes
0answers
93 views

One-time mystery redirect from one of our pages

I'll make the explanation of the situation as thorough as I can, and the question is at the bottom. Recently, we received a report from one of our users that, immediately after logging out of our ...
-3
votes
1answer
138 views

With Ubuntu on Windows 10, could exploits and malware that work on Ubuntu (or related distros) work on Windows? [closed]

So apparently Hell has finally and completely frozen over: the next major update for Windows 10 will be able to natively run Bash, related tools, and even some broader set of Linux binaries/programs ...
35
votes
8answers
26k views

Is making a clean install enough to remove potential malware?

Is formatting the disk and reinstalling the system from scratch (to Ubuntu) enough to remove any potential hidden software spyware, keyloggers etc.? Or can something still persist installed in the ...
7
votes
4answers
996 views

How to trace the actions performed by a virus?

Is that possible to trace the actions performed by a virus? Run Time , stolen data and the files consulted and get the relative impact on my pc.?
20
votes
4answers
3k views

How is malware distributed within zip files?

Recently it seems there has been a big outbreak of zip files being emailed to people with a .js file containing code that downloads and executes cryptoware. How does the .js actually get executed ...
1
vote
1answer
55 views

How to distinguish malware from system crash?

Recently, I browsed to a website, which appeared to consume all the computer's resources. Although the mouse cursor continued to move, the browser (and other applications) slowed down fast and soon ...
5
votes
3answers
465 views

Is this powershell script an infection?

While I was sitting in front of the computer not using it,my Windows 10 machine quickly flashed a few terminal windows, and then gave me a Windows Security popup, asking for my password. I have no ...
106
votes
9answers
74k views

How secure are virtual machines really? False sense of security?

I was reading this CompTIA Security+ SYO-201 book, and the author David Prowse claims that: Whichever VM you select, the VM cannot cross the software boundaries set in place. For example, a ...
4
votes
2answers
784 views

Is there any known encrypting ransomware that attacks Macs?

Just about every article I read about Cryptowall, Cryptolocker, and its ilk seems to assume that the reader is running some flavor of Windows. When I Google "ransomware OSX", I get a long list of ...
7
votes
1answer
883 views

How does this javascript attack work?

There is a closed question on StackOverflow with a similar code excerpt but it is closed due to not being a programming related question so I thought I would ask here instead. It was emailed in a Zip ...
0
votes
0answers
40 views

Where to get a specific malware by its name?

First of all, I have referred almost all the links provided by the following links Finding a specific malware sample for malware analysis purposes ...
0
votes
2answers
49 views

Is there a server/website specific malware scanner? [closed]

I have multiple Linux CentOS servers that are scanned with the Google Webmaster Tools, and when it finds some malicious code on my servers(shared/dedicated), the ranking of those site drops. What I am ...
-2
votes
4answers
74 views

Zero-day malware protection [closed]

What is the best approach in defending your company against zero-day malware? Is there a firewall/system to do that? Is it good to run every file in a sandbox and to track activity of the sandbox?
0
votes
2answers
54 views

Protection against file distributed malware

Let's say I have one server called A which host an upload website which is connected at the network connection B. Let's say one of my clients uploads multiple .rar files of 1 MB (that contains malware ...
4
votes
2answers
845 views

Malware (adware?) infection on linux

Recently I've get stuck with a malware(adware/virus ?) which I can't remove. here is the condition: I'm using Linux (Archlinux), it's uptodate and I don't install any packages outside standard repos ...
24
votes
5answers
3k views

How can I safely check whether an email link leads to a malicious website?

Over the last few weeks, I've gotten several spam emails from different friends that only contained links to different websites. I would like to click on those links and see what's on the website. ...
12
votes
8answers
7k views

How to safely view a malicious PDF?

I have a PDF with important information that may contain malware. What would be the best way to view it?
3
votes
4answers
274 views

Remove pdf malware by re-printing to new pdf or text extract?

Consider you have a suspicious pdf file that might contain malware. Would it be sufficient to either: (1) open the pdf file in a virtual environment and let the pdf viewer or pdf-creator program ...
2
votes
0answers
53 views

Creating a dynamic malware analysis environment

I don't know much about malware analysis so why this question here. I have analysed Short cut virus statistically and its impact on USB drives and wrote a code to repair its damage. My static ...
1
vote
1answer
41 views

Windows command line does not check for revoked certificates: How bad is it?

I recently updated my D-link wifi dongle driver. However, I had to do this through the command line because Microsoft revoked the D-link certificates after a leak. The executable would simply not ...
4
votes
1answer
62 views

Regarding malware and hardware

Bit of a weird one, hope this is the appropriate venue: I've just purchased some Ethernet-over-power adapters that were returned to and repackaged by a brick and mortar retailer. I'm trying to be ...
14
votes
3answers
818 views

How can a font be used for privilege escalation?

Recently Kaspersky released an analysis of Duqu 2.0 and apparently the malware used a True Type Font File to exploit a critical vulnerability (CVE-2011-3402) to "jump directly into Kernel". I haven't ...
6
votes
3answers
316 views

Malware: extract private keys from smartcard?

We all appreciate smartcards because they secure private keys so they don't get exposed to the world. But in a production-environment it's often the case that smartcards are staying inserted for a ...
6
votes
1answer
74 views

Do viruses infect recovery partitions? [duplicate]

In the "Good ol' Days", Windows came on a CD, and when one got a virus, one had original, write only medium to clean up one's computer completely. Nowadays, most computers have a "recovery ...
4
votes
2answers
96 views

Notifying users of a possible security breach

Yesterday, a coworker informed me that a user had opened a malicious e-mail containing a .dotm document which she could not open. I undertook the usual steps to prevent the malware from spreading to ...
2
votes
2answers
418 views

Beside GIFAR are there any other known polyglot files? [closed]

A GIFAR file is a polyglot file with a fancy name. It can be "opened" both as a valid GIF file and a valid JAR file thus leading to security issues under certain circumstances. Definition of a GIFAR ...
1
vote
1answer
46 views

Retrieving malware report information from malware network

I'm getting ready to stand up an isolated malware network at the place I work for performing analysis tasks and it will have a suite of reverse-engineering and analysis tools on it. For obvious ...
0
votes
1answer
149 views

Is that possible for Linux and windows machines to be infected with KeRanger ransomware?

According to theguardian The Transmission site offers the open source software that was infected with the ransomware called KeRanger malware, it's programmed to encrypt files on an infected personal ...