Malware is any software application which subverts the will of the legitimate owner of a computer, by means of force or subterfuge, with or without personal or monetary gain on the part of the creator.

learn more… | top users | synonyms (1)

3
votes
1answer
140 views

Is this the end of malware use of DNS?

I read about the release of a free dataset of malware related DNS queries called "Predict". A researcher or network security team can download or query this data set and use it to identify malware ...
-7
votes
3answers
75 views

What File Types Should I Scan Before Opening? [closed]

In general, a person downloads some files from the Internet. Secure practice is to, at least, scan them before opening them. In light of this, what file types (i.e. extensions) should a normal user ...
2
votes
0answers
158 views

Open source database of malware signatures [closed]

I'm looking for an open source database of malware signatures/hashes (if possible regularly updated and well documented) that I could use in one of my software for scanning a huge numbers of files ...
1
vote
2answers
70 views

Actual use of covert channel in malware

I have seen several academic sources mentioning covert channels in computers, such as one process sending data to another process/thread on the same machine in a way that attempts to avoid detection. ...
2
votes
2answers
78 views

How does malware performs a UDP hole punch?

I want to know how do malware like ZeroAccess hole punch the network without using a external server? Or do they just mainly infect non-NAT users? Does that mean all NAT users are safe?
4
votes
1answer
102 views

Would DLL hijacking work with load-time linking?

I was wondering if DLL hijacking would work with all types of linking or just run-time linking. I hear that malware uses it and wanted to know how it works
1
vote
3answers
134 views

Large amount of foreign IPs hitting out firewall, is this automated scans or are we under attack?

I just got put in charge of a network. In the logs on our firewall I noticed that we had a large amounts of machines trying to connect to port 53 as well as about a dozen other ports. Are these ...
4
votes
3answers
251 views

Windows: unknown program/service etc. sends HTTP request to download a file; how can I find the origin of that request?

The firewall of my company has detected and blocked a repetitive (every 15 min) HTTP request from a PC, which tries to start a download of a file called ..._chrome_installer.exe(or so) from the host: ...
3
votes
2answers
8k views

Does Chrome OS Allow Executable Files?

My company has some real security issues and I am wondering if using Chrome OS can be some solution to my problem. Typical Windows computers seems all to vulnerable to attacks from malicious images ...
1
vote
1answer
95 views

Malware code in WordPress?

I'm pretty sure that we have malware code in our WordPress website - Here is the code in question, it is located at the top of every php file in the website; { ...
2
votes
1answer
702 views

Zeus botnet source code

I am doing my project on botnets and wanted to understand the source code of the Zeus botnet. Where is the right place to get started with some analysis of zeus botnet source code? I need a good ...
3
votes
1answer
257 views

Does malware which infects the BIOS/ Firmware always need 'root' access to do so?

There are very few hardened Operating Systems who restrict or totally disable Terminal 'root' access for the user. Would this feature prevent persistent BIOS rootkits from writing into BIOS or ...
5
votes
4answers
12k views

Can a PDF file contain a virus?

Could a PDF file contain any type of malware?
-4
votes
1answer
90 views

AV isn't dead, so why network appliances differ in handling malicious code [closed]

when taking a look under the hood of some firewall appliances there can be observed a tremendous difference on how they handle malicious code. mostly, av-scanning is restricted to well-known protocols ...
7
votes
0answers
133 views

How to isolate persistent pop-up browser hijack [closed]

There's a persistent browser pop-up affecting Mozilla Firefox which has evaded a number of security pre-cautions and attempts to find a remove it. It's gone on for at least 3 months. The pesky pop-up ...
-4
votes
2answers
106 views

What are the chances of a normal Internet user being hacked or infected by malware?

Say I'm a normal Internet user, I visit some well-known social networks like Facebook, twitter, play flash-based games in Facebook, visit some big websites that are known to be safe and trusted and ...
1
vote
0answers
54 views

Browser Popup Survey Scam [closed]

I am looking for information on a new phishing threat that I have personally encountered. What happens is that during normal web surfing, a tab is opened that directs you to a survey regarding your ...
1
vote
2answers
79 views

A malicious folder is created automatically? [closed]

After I ran a third party game and uninstalled it, my antivirus is showing this message repeatedly every 7-8 seconds. When I run the antivirus it shows the malware detected and removed, but again ...
2
votes
2answers
271 views

What do I do, I got a virus warning on a webpage

I went to the web address (hxxp://www.asanka.com) (WARNING: BE CAREFUL WHEN VISITING) on Safari, then suddenly I got a warning message [image below] What do I do? I'm freaked out. I have a lot of ...
1
vote
0answers
2k views

How do I get rid of the Total Ad Performance malware from my Android? [closed]

My Sony Xperia Z3 Compact has been infected by a malware that redirects my browsers to either one of the two websites: www.totaladperformance.com or www.admomi.com. I have the paid version of ...
2
votes
2answers
449 views

Prevent a file from being encrypted

Is it possible to prevent a file from being encrypted, or at least being easily decrypted in case of encryption? For instance; with the Crypto Locker malware attacking users, could you set up a ...
11
votes
3answers
4k views

Detecting reflective DLL injection

In the past few years, malware (and some pen-test tools like Metasploit's meterpreter payload) have begun to use reflective DLL injection (PDF) to load a DLL into the memory of a process. The benefit ...
-1
votes
1answer
40 views

indicators of compromise via email servers

Malicious files are commonly infiltrated on to the network via email attachments. Besides awareness and education to my staff to refrain from clicking on suspicious attachments, I would also like to ...
2
votes
1answer
5k views

In Metasploit, how to use a custom exe as payload?

Question was once on a mailing list but wasn't answered. I want to use a custom exe as a payload in metasploit. For example when I use exploit/multi/browser/java_atomicreferencearray and want to ...
7
votes
1answer
156 views

Javascript phishing attack sucker: Do I need to be worried? [closed]

So, I'm an idiot. I opened a javascript phishing attack file. I would really, really appreciate some help with decoding the Javascript to figure out whether I'm in trouble, and what sort. I'm on OS X ...
14
votes
2answers
51k views

Is it possible to make a phone call appear to come from another phone, even to the network provider?

Quick Question Is it possible that I could call a mobile number, but have the call forwarded through another number active on a different phone that someone else has? I have had unlimited access to ...
6
votes
1answer
2k views

ISP glitch or a malware? Has this ever happened to you?

Brief background: I consider myself a relatively paranoid power-user, if not an absolute pro. I regularly update my AV and keep up with all the latest updates on my Windows 7 machine. But what ...
9
votes
6answers
39k views

Scanning for files than have been encrypted by CryptoLocker

I am just asking in case someone has already done the analysis. A customer has a large set of network drives that were mapped to a CryptoLocker infected machine. The infection itself has been treated. ...
3
votes
1answer
46 views

Secure online server -> Airgap transport?

I'm facing the issue to develop a system which archives some data, which was available via a web-server some time before (to selected users). Now the question arises on how to securely transport the ...
2
votes
1answer
123 views

Mystery IP address Hijack

I'm working on a customer's new website. To get things up and running quickly, we're maintaining his domain name service and hosting the website on another server. Customer bought the URL name years ...
4
votes
2answers
154 views

Malware: extract private keys from smartcard?

We all appreciate smartcards because they secure private keys so they don't get exposed to the world. But in a production-environment it's often the case that smartcards are staying inserted for a ...
3
votes
1answer
389 views

How to avoid ransomware

Malware files execute themselves after downloading them. Let's look at it from the point of view of a piece of ransomware like CryptoLocker, from Wikipedia: Crypyowall 3.0, uses a payload ...
3
votes
2answers
265 views

Can malware provide hidden remote access to a user's desktop?

Is there a possibility that malware on a computer could be providing remote access to an external party without the computer user being aware? I.e., some kind of hidden active remote access tool? ...
4
votes
2answers
255 views

How do cryptographic algorithms help hackers to bypass Antivirus software?

I was wondering how do hackers use cryptography for bypassing antivirus software. I don't have some deep understanding on how antivirus software works, but I know that every antivirus has base of ...
3
votes
1answer
70 views

Hooking an *unexported* API

I want to know is there any way to hook (inline hook) an unexported API of a PE? I have this binary (PE 32 bit) which does not uses any DLL (A statically linked binary) and I would like to know what ...
3
votes
2answers
80 views

How to sanitize archive files?

I am looking for a way to make sure that a particular archive file does not contain any sort of malicious code. From time to time new vulnerabilities pop up (e.g. gzip, 7zip) so I though a good idea ...
9
votes
5answers
631 views

Is there anything I can do about IDN homograph attacks?

I have been reading about IDN homograph attacks, and I cannot think of any better way than Tell my users not to trust emails asking for passwords, etc Buy all domains similar to mine (expensive and ...
1
vote
0answers
34 views

Open Source Software & Android Malware Campaigns [closed]

I am looking to find a report that lists malware campaigns launched against Open Source Software (OSS) and/or Android OS. Ideally, this report would have been published in 2014. I am trying to ...
1
vote
2answers
144 views

How effective is antivirus software? [duplicate]

On one hand, most antivirus websites claim their products are highly effective, and I've seen antivirus "test" videos claiming 95%+ detection rates for new malware (as in less than a day old, not old ...
1
vote
3answers
137 views

How to get started as a Malware Analyst? [closed]

Sorry if this is posted in the wrong section. A little about me: I'm going to be a sophomore in the fall at university, my major is Computer Science (Information Assurance). I've been interested in ...
6
votes
3answers
202 views

find if 0-day flash bug was exploited (on a particular machine)

There have been several critical 0-day exploits in the past days/weeks in Flash alone. Nobody knows how long the 0-days have been exploited, and it is reasonable to expect that there are 0-days being ...
0
votes
0answers
20 views

Security Data Analytics - Classical Measurements/Metrics

for my new Job I have to prepare information about how Security Data Analysis is actually use in practice. So my question is if someone can provide me with measurements/metrics/queries (don't really ...
5
votes
2answers
189 views

How can a font be used for privilege escalation?

Recently Kaspersky released an analysis of Duqu 2.0 and apparently the malware used a True Type Font File to exploit a critical vulnerability (CVE-2011-3402) to "jump directly into Kernel". I haven't ...
0
votes
4answers
1k views

“Virus Found” Web Browser Pop-up

I use a website that typically creates a new tab with an ad on the first click. Usually, I can close the tab without even looking at it, but recently a more aggressive strain brings up a pop-up (for ...
5
votes
1answer
3k views

Hiding process from Task Manager [closed]

What technique is used to hide a process from Task Manager? I'm currently researching ways I can do this in C++. Is this process called hooking? ...
1
vote
2answers
87 views

Malware From from external drive

How do malware start from external drives? Especially on Windows (from > Windows 7) commands like Open=Example.exe on an autorun.inf file have been defaulted disabled to not allow auto run when an USB ...
5
votes
1answer
127 views

Video site requests Adblocker to be shut off, next day I have 3 “weird” bookmarks

I was on a site trying to view a video and the site requested that I turn off my adblocker to view the video. So I did and then the next day I noticed that I had 3 "weird" bookmarks in my bookmark ...
86
votes
7answers
55k views

How secure are virtual machines really? False sense of security?

I was reading this CompTIA Security+ SYO-201 book, and the author David Prowse claims that: Whichever VM you select, the VM cannot cross the software boundaries set in place. For example, a ...
1
vote
4answers
297 views

Malware script uploaded - CPU has been maxed out

I received notifications that the CPU was maxed out. Using Process Manager in WHM, I could see that commands named "fuckyou" was running some kind of cron sript on our server. The file it was calling ...
0
votes
0answers
40 views

Why malicious browser extensions along with API hooking

Most malware steals financial data by hooking to browser APIs like PR_Read, PR_write etc.. Also I see some malware like Sinowal use browser extensions along with these API hooks. I believe a user ...