Malware is any software application which subverts the will of the legitimate owner of a computer, by means of force or subterfuge, with or without personal or monetary gain on the part of the creator.
3
votes
2answers
151 views
How content-type:image can lead to infected JAR file?
Symantec published a news about a malvertising campaign targeting IE users with Java exploits (already known vulnerabilities). At some point they explain that the users are redirected on malicious ...
2
votes
4answers
501 views
My website has been hacked, what do i do next? [closed]
So. I couldn't see any other question like this on Sec.Se so i thought i'd ask.
My public website www.foo.com has been hacked. The front page is sending it to be redirected to seoblog.fooblog.com in ...
17
votes
6answers
450 views
How to deal with a person who gets easily fooled by internet and mail scams?
alternative title: How to deal with a person who has gotten paranoid and doesn't want to go online anymore?
A person, who has over the years been scammed many times, by bad spam/fraud emails, and ...
18
votes
6answers
844 views
Why are vulnerabilities and lack of security possible in computers?
I have heard about computer vulnerabilities, virus, malware, etc.
Why are these threats possible?
Why doesn't the computer just do the things it is supposed to?
Why do some people write malware, ...
7
votes
1answer
361 views
How to study the packets sent by a keylogger
One of my friends runescape account got hacked through key-logger. He downloaded a runescape gold generator from a file sharing site and tried to use it.
I have a strong doubt that it is a key-logger. ...
4
votes
4answers
319 views
Is online banking more secure on iOS than a desktop computer?
Does Apple's iOS provide a more secure environment for online commerce (banking or shopping) than Windows or Mac OS X? Since the only software that can run on iOS must be vetted by Apple, the ...
17
votes
6answers
961 views
Best practices for handling computer viruses
I realize this question may be quite broad (and hopefully not a violation of the FAQs), but I'm interested in hearing how many of you handle a computer infected with Malware.
In a small-to-medium ...
4
votes
3answers
376 views
Malware infections from visiting or using YouTube
Is it possible to be infected by viruses or other malware while visiting YouTube?
What kind of measures do the YouTube staff take to prevent viruses and malware?
1
vote
1answer
418 views
Android apk malware
I was browsing some website last night and that website suddenly sent me an apk called 'browser_update_install.apk', DrWeb light detect it and was able to delete it.
My question here is about the apk ...
5
votes
4answers
229 views
Can malware hide their network activity from Resource Monitor (perfmon)?
Is it possible for malware to hide their network activity from tools like the Resource Monitor that ships with windows?
How much effort is it for a malware developer to implement such functionality? ...
3
votes
2answers
108 views
DPAPI and malware
I'm considering using the Windows DPAPI to protect an ECDH key I use to encrypt some data in a local database in a Windows desktop application. I'm new to DPAPI, but its my understanding that DPAPI ...
2
votes
3answers
184 views
Sucuri giving false positive with their free online scanner because of an .htaccess RewriteRule
I'm not sure where to ask this Question - here, SO, Webmasters.SE, somewhere else? Please migrate if appropriate.
tl;dr:
The following rule in my .htaccess is causing Sucuri's free online scanner to ...
2
votes
1answer
167 views
Good tools for reverse engineering colaboratively?
Does anybody know a good set of tools for doing reverse engineering of binaries in a collaborative way?. My original idea is to disassemble a binary, allowing to add information about functions, ...
3
votes
1answer
239 views
Is this code harmful? Why?
Code: http://pastebin.com/kJ8ZGP82
That code gets retrived from http://ui.sidepage.co for every HTTP page I visit (not HTTPS) and load it into the body tag of the page.
Is it harmful in any way? ...
3
votes
1answer
174 views
How dangerous is a virus introduced to a malicious website in chrome?
I am using Google's Chrome browser under Linux (Ubuntu) 64 bit for web browsing.
If I a virus uses for example a leak in the flash player, the virus will get the privileges of the user who started ...
1
vote
2answers
202 views
How is it possible that a virus can infect the system if the browser is started with non-admin rights
If I open my web browser (for example firefox) in Windows 7 with activated UAC as normal user (non admin) a virus - which uses a security leak in my browser - will only gets privileges of the normal ...
2
votes
3answers
198 views
How hard it would be to infect a system with malware through a portable web browser
If I use a portable web browser on a USB device like
Google Chrome Portable how hard it would be to get infected by a malware/virus in the system to which the USB device is connected?
Google Chrome ...
0
votes
3answers
151 views
Using a VM to access internet when malware blocks internet access?
My computer was recently infected by some malware which had blocked internet access. I had a virtualization software with an OS in it. Surprisingly, I could access the internet from the VM. I know ...
6
votes
2answers
112 views
Process authentication for Linux
Is there any possibility to authenticate a running process in Linux to be sure that this is the original/right one?
I know that an Linux operating system is only that secure like the way you use it. ...
2
votes
2answers
154 views
Analyzing Network Anomalies for Malicious events
For a network security project we are listing to our network traffic of about 50-60 hosts. We aim at identifying malicious event within our network traffic by identifying network anomalies.
Our main ...
1
vote
1answer
290 views
Cuckoo Sandbox python errors after task submission
I'm New to Cuckoo Sandbox. Why am I getting this error?
I don't understand. If there is something wrong, can anyone please explain how to setup Cuckoo Sandbox? My setup works very well before I ...
3
votes
3answers
170 views
Security/Malware implications of storing data in a BLOB as opposed to the file system
From a programming perspective, there has long been a debate over whether to store files in a BLOB or Binary field in a database, or on the file system. The debate always seems to center around ...
3
votes
4answers
653 views
Writing malware in java?
To me, it seemed like malware could never be written in java. Those who taught me java said it was "secure" and did not allow "low-level access" like c,c++.
But, I discovered that it can be done - ...
-2
votes
6answers
736 views
Use PHP to check uploaded image file for malware?
I want my users to be able to upload a photo. Currently I am not checking the uploaded photo for problems of any kind, although I do limit the size to 32k.
Is there any way for me to check uploaded ...
6
votes
2answers
176 views
Example of malware in the wild?
I'd like to test an application that detects malware on my network. In order to do that, I have a Windows VM set up that I'd like to infect with malware. But for the life of me, I can't seem to find ...
11
votes
3answers
432 views
URL Shortening - How to verify if it is a non-malicous URL?
Again, I must mention that I have just started to learn about security. So, please bear with my newbie questions.
If I receive a shortened URL from somewhere, say in an my-email or in a social media ...
1
vote
3answers
163 views
Any one know about UDP traffic on source port 26221?
On my captured network traffic i observe a flow having a source udp port of 26221 and have different destination udp ports. Some of these destination ports were standards IANA ports. The average ...
1
vote
3answers
3k views
Multiple running instances of rundll32.exe
I've noticed that in the Task Manager of Windows 7, I have multiple running instances (2) of rundll32.exe. Does this necessarily means that my machine is infected by a malware as noted here: ...
2
votes
3answers
270 views
Strange file named Aview.exe - WinClient
Today I've just discovered some strange files on my Win 7 PC.
I was browsing through the Windows Firewall Inbound Rules and saw two ACCEPT rules for a program, Aview.exe.
It is located in ...
3
votes
1answer
199 views
what is the difference between virus, worm, trojan and other malware [closed]
Looking through the questions in IT security, I found out that there is no answer which cover this question in depth.
I am aware of the answer and just hope to see something detailed about:
main ...
2
votes
1answer
100 views
Trust linux images burned from untrusted systems
For securitys sake I'm assuming my system is successfully compromised after a targeted and/or non-targeted attack.
I've downloaded some linux images and burned them to do a re-install.
Since I can't ...
1
vote
0answers
31 views
vbs agent kz trj [duplicate]
Possible Duplicate:
Index page has been compromised, suspicious files are showing up
I have vbs agent kz trj one my laptop. my httpd.exe and mysql.exe is infected and deleted from Xampp. ...
1
vote
0answers
78 views
The point which distinguish metamorphic and polymorphic algorithms? [closed]
I am writing a paper about malware and code obfuscation and I realize at the and these abstractions have not got a bordered definition and it is really hard to emphases the point between them, so I ...
4
votes
1answer
157 views
“WICKED” entries in the default nginx vhost's logs
I have a small VPS running nginx, and for a long time now (several months, since I rented it) it has been collecting weird entries in its default (listen 80 default;) vhost's logs:
109.x.x.121 - - ...
2
votes
2answers
275 views
Where can I find worm traffic sample?
I have a program that has to detect scanning activity of worms.
I need some samples of worms' traffic (pcap files) to try the program, and notes about the procedures which must be taken when running ...
3
votes
4answers
252 views
Malware via power outlet
This is perhaps a very dumb question, but as I have no knowledge nor experience of IT security I have no option but to ask here.
Is it possible to get malware onto your computer or smartphone by ...
2
votes
1answer
72 views
Seeing outboud connections to random domains, how do I isolate the app responsible?
Last night I loaded up Fiddler2 to do a little debugging and I saw three connections to domains like
hghefhhig
How can I go about isolating the application responsible?
I was thinking possibly ...
5
votes
2answers
124 views
How serious is a local virus in terms of network security
I work at an insurance company in the U.S. My colleague got a notification on his machine of a possible virus (through the virus scanner that is installed by default on all machines). He called up the ...
0
votes
1answer
70 views
How does duqu implement its dll files in PNF file format?
As you know files with PNF extension are associated with bitmap file type, from technically point of view how did authors of duqu implement this? as I concluded it is possible to make dlls in any ...
2
votes
3answers
268 views
I found a malicious website embedded in Malware spam. What should I do?
An email is using social engineering to get users to click on a malicious URL that downloads javascript and then runs malicious code.
Who should I report these malicious URLs to? (Microsoft ...
48
votes
10answers
4k views
How do you explain the necessity of “nuke it from orbit” to management and users?
When a machine has been infected with malware, most of us here immediately identify the appropriate action as "nuke it from orbit" - i.e. wipe the system and start over. Unfortunately, this is often ...
1
vote
1answer
145 views
uninstall and reinstall after hacking [closed]
My computer has been hacked. If I uninstall and reinstall do I loose my files?
The facebook tech tried to sell me a number of pkgs ranged $149-$299 and told me that my account was hacked as was my ...
0
votes
0answers
100 views
How can I find out what is doing a “Trojan.Agent-252697” [closed]
I've scanned my computer with clamAV which has found one file infected with Trojan.Agent-252697. I've of course immediately removed the file, but I have no idea how can I find out what does this ...
7
votes
2answers
2k views
Advice on what to do after being hacked?
After running a system scan earlier today, I found that my computer had been infected by a trojan horse. My reason for running the scan was because Windows kept shutting down and then recovering.
...
2
votes
1answer
83 views
Is there a website or free downloadable program to identify and remove malware from an ISO file?
Is there a website or free downloadable program that allows a user to identify and remove multiple types of malware from an ISO file?
4
votes
5answers
455 views
How will microvirtualisation change the security field, if at all?
I'm interested in what Bromium has been working on. I don't understand how this will affect computer security. Will this reduce the number of exploitable vulnerabilities in common operating systems? ...
0
votes
4answers
134 views
Infection I can't shut down, disguises process as scvhost.exe [closed]
A little while ago my home machine got hit and I was able to clean out just about everything except this one process. I can't find the origin but it shows in my process manager as scvhost.net by the ...
5
votes
1answer
138 views
Cufon or Prototype as an attack vector for Blackhole exploit kit?
I've been asked to look into the security of a client site that's apparently throwing antiviral messages when visited.
Specifics:
It's being detected as a Blackhole exploit kit inside of a Cufon ...
3
votes
3answers
146 views
What are some ways to steal a password/PIN using this system?
http://cups.cs.cmu.edu/soups/2007/posters/p147_lim.pdf
Essentially uses an on-screen keypad that does not show the complete keypad numbers at a time. The image is refreshed at the rate of the ...
0
votes
0answers
146 views
Android plankton [closed]
Have anybody experience with analysing of android malware ?
I have tried to understand the Plankton malware. Main difference between plankton and "ordinary" malware is that the "ordinary" malware ...
