Malware is any software application which subverts the will of the legitimate owner of a computer, by means of force or subterfuge, with or without personal or monetary gain on the part of the creator.

learn more… | top users | synonyms

11
votes
6answers
1k views

weird visitors to my website

For the last three months I have thousands of real visitors to a single page on my website. Those visits are recorded in Google Analytics and count as page views in adsense reports, but they are fake: ...
10
votes
6answers
2k views

How do I safely inspect a suspicious email attachment?

I received a pretty blatantly spammy email to my Gmail account. I'm not really sure how it made it through the spam filters, since it has all of the telltale signs. The FROM field is spoofed as ...
10
votes
3answers
381 views

How to deobfuscate this PHP malware?

Two days ago a file called "images.php" appeared on a friend's server, which he noticed because it caused errors. The file contained the following. This code is of unknown origin and presumed to be ...
10
votes
1answer
2k views

Oligomorphism vs polymorphism vs metamorphism in malware

What is the difference between these three? As I understand it, polymorphic malware code actually is always the same, and it's just that it appears to be different (through encryption, data ...
10
votes
2answers
345 views

How do you visit a link without risking your computer?

I got a link from: http //61.19.247./~naowit/dustin.html (removed the last digits so you don't accidentally click it! (they were 192)), which was masked as a youtube.com link via email. Now I'm not ...
9
votes
3answers
4k views

Do I really need an Anti-Virus software if I'm careful about where I browse?

A friend told to me the following: I don't use Anti-Virus software at all, I am just careful about where I go and what I click on. I've also heard this from other people as I've repaired their ...
9
votes
5answers
1k views

Ads appearing in our application when they should not be

I received a strange issue reported by one of my web application users. Apparently they are getting "ads" within the browser window when using my application. I didn't add advertisements at all. It's ...
9
votes
3answers
589 views

Reason for writing Self-Decrypting Virus

What is the rationale behind writing a self-decrypting virus? By this I mean a virus that has it's payload encrypted, decrypts at runtime and runs it. How does this protect the virus from antivirus ...
9
votes
5answers
1k views

Detecting malware-infected USB drives

I'm about to distribute some relatively cheap promotional usb drives to some of my company's clients. I'm fairly confident the company I purchased them from wouldn't intentionally implant malware on ...
9
votes
4answers
480 views

Unknown malware, how to report it and whom to report it to?

I'm a professional Windows system administrator, but I've been caught off-guard (or maybe some malware writer has been very clever) and I caught some unknown malware on my home computer (Windows 7 x64 ...
9
votes
4answers
502 views

What would happen if one of the popular Linux repositories is hacked?

Even though most people consider downloading your Linux software from you own distribution's repositories as safe, thinking about the scenario where a repository gets hacked sounds thrilling. What ...
9
votes
4answers
1k views

How would you analyze an image to find out if there are scripts embedded in it?

How would you analyze an image to find out if there are scripts or possible malware embedded in it? What tools / methods to use?
9
votes
2answers
975 views

Malware known to use port knocking to evade detection by network scanners?

Are there any known cases of malware in the wild that utilize port knocking on a backdoor to evade detection by network scanners?
9
votes
2answers
3k views

Detecting reflective DLL injection

In the past few years, malware (and some pen-test tools like Metasploit's meterpreter payload) have begun to use reflective DLL injection (PDF) to load a DLL into the memory of a process. The benefit ...
8
votes
4answers
769 views

Is disabling auto-run enough to protect against malicious code from removable media automatically infecting a machine?

If I block auto-run on a windows machine, is this enough to protect it from malicious code (assuming I don't run any files manually)? Or are there known vulnerabilities that may cause infection?
8
votes
6answers
9k views

How can I prevent viruses/malware from infecting my flash drive?

I've a pen drive that I carry to the college lab . It seems all the systems in lab is infected. I need to be able to write to the drive, so I can't simply write protect it. Everytime I insert a ...
8
votes
3answers
2k views

Am I protected from USB autorun malware on Windows 7?

As far as I know, the autorun.inf problem (the possibility of automatically executing code when a USB stick is plugged in) was solved through Windows Updates for XP, and on 7 it is no longer possible ...
8
votes
5answers
596 views

Can a mobile phone battery contain malware?

It has 3 terminals and is presumably a smart battery. I bought it on ebay recently for $2.74 USD and that included postage from China to Australia. It would normally retail for maybe $40 - $50. The ...
8
votes
2answers
2k views

How can a malicious URL affect a computer?

Many security experts advise not to click on malicious URLs. How can clicking a URL affect a computer's security? If a malicious file was downloaded and executed, then a computer's security may be ...
8
votes
2answers
9k views

Advice on what to do after being hacked?

After running a system scan earlier today, I found that my computer had been infected by a trojan horse. My reason for running the scan was because Windows kept shutting down and then recovering. ...
8
votes
1answer
925 views

How to study the packets sent by a keylogger

One of my friends runescape account got hacked through key-logger. He downloaded a runescape gold generator from a file sharing site and tried to use it. I have a strong doubt that it is a key-logger. ...
8
votes
2answers
226 views

Where to find papers / information about spyware, tracking and cookie problems?

I am right now working on a problem and looking for some papers / information about spyware, tracking and cookie problems. I am no expert in that area, so I lack the knowledge where to find material ...
8
votes
5answers
1k views

Pursuing a career in Malware Analysis

When I was a kid, I want to become a Malware Analyst and work in a Antivirus company. At that time, I love to try out different antivirus solutions and did a research project on Computer ...
8
votes
3answers
2k views

Can malware read keychain entries on iOS devices?

Keychain entries of a 3rd party app are protected according their 'protection class'. For example, assigning the class 'kSecAttrAccessibleWhenUnlocked' to a keychain entry means that the entry is only ...
8
votes
3answers
173 views

How to identify and analyze malware that checks for security tools before running?

I've been reading about the ZeroAccess and looking into some bot's code source* and I found this piece of code which checks if filemon is running in the infected computer before running the bot. ...
8
votes
1answer
238 views

Is there a public database of mutex names that are associated with malware?

I remember seeing something like this a while back, and it'd be incredibly useful for a project I'm working on. Essentially there was a list of mutex names, with a list of malware identifiers (e.g. ...
7
votes
6answers
1k views

Using linux to combat windows flash drive malware?

I just put an old flash drive which i used with a windows machine into my linux. I noticed many files, mostly exes which were never visible in windows (my windows does not hide hidden files and ...
7
votes
5answers
2k views

Browsing on a USB OS (Linux) safe from malware?

Let's say I have a computer. It's a personal computer - the one you'd typically find in homes. In this scenario, it's running Windows XP SP3, although it could run 7, Vista, etc. I have a USB drive ...
7
votes
3answers
1k views

Nmap indicates that “telepathstart” and “telepathattack” are listening on ports 5010 and 5011 of my Linux box. What are these?

I have a linux box on my network which, according to Nmap, contains two services called telepathstart and telepathattack listening on ports 5010 and 5011. From the same box, I am receiving inbound ...
7
votes
2answers
6k views

Is Buzzdocks a security threat?

A BuzzDock toolbar suddenly appeared in my Chrome browser. I definitely did not install it nor do I remember installing any crapware. It is not unknown to the internet community (Example 1, Example ...
7
votes
4answers
11k views

Security issues with allowing Dropbox installations on client PC's in our organisation

Does anyone know if there is any good reasons not to allow Dropbox installations on our client PC's? All the PC's have antivirus installed and running. I know it is an additional attack vector to ...
7
votes
3answers
714 views

How does a root kit work inside a virtual machine?

In my class, we are discussing virtual machine based root kits. I've research root kits, but could not find any information specifically talking about how root kits work inside of virtual machines ...
7
votes
2answers
310 views

Are there any independent organizations doing (publicly available) IT security research?

When looking up security risks on the net I find that all research being cited (if any is cited) always seems to come from the Anti-Malware companies. (just e.g., this article cites F-secure, AVG and ...
7
votes
2answers
216 views

How serious is a local virus in terms of network security

My colleague got a notification on his machine of a possible virus (through the virus scanner that is installed by default on all machines). He called up the tech department, and they simply told him ...
7
votes
3answers
2k views

attack/abuse notification email template

I'm building a template for use when sending "abuse" notifications to ISPs, hosting providers, etc., for when attacks originate from their netblock. Are there examples of templates used for this ...
7
votes
2answers
277 views

How do AV vendors choose malware names?

If you take a look at McAfee's recent malware page, you'll see that the names in the "Malware name" column aren't very human-readable: Downloader.a!cnz, W32/Autorun.worm.bgh, ...
7
votes
5answers
1k views

Malware code added when site viewed externally

Please see second followup at the bottom! (Now with added real malicious code! ...ish) Prompted by this question, I've noticed that my university's student charity organisation has an interesting ...
7
votes
1answer
166 views

Why Apache runs as unprivileged user?

Apache Web server as a security measure relinquishes its system privileges and runs as a normal unprivileged user before accepting clients over a networks. My Question is How this measure prevents ...
7
votes
3answers
261 views

How can I circumvent the lack of Java updates?

Just imagine you have a bunch of computers which need Java for some important software and you can't just switch to another vendor because all are using Java in this field of technology. If you start ...
7
votes
3answers
3k views

How to manage admin rights for helpdesk staff?

My question is about issuing administrative rights to helpdesk staff in a large Active Directory setting. Helpdesk staff commonly require administrative rights to provide support for end users. I ...
7
votes
3answers
110 views

How do I report new malware?

I have a new piece of malware that isn't detected by current anti-virus vendors. How do I report it to them? I want to do a good turn and help protect as many people as possible. What is the best ...
6
votes
4answers
462 views

Would running VMs inside of VMs be a more secure way to study viruses, etc?

I was reading this post on SuperUser, and it made me wonder about security. I've read somewhere else that some viruses/malware/whatever CAN break outside of a VM... and then infect the host OS. BUT, ...
6
votes
4answers
413 views

What abuses can an infected webpage do to me if I'm using Chrome and Flash is disabled

as a follow-up to this question Can you get virus just by visiting a website in chrome., I've read these pages: http://www.straightsectalk.com/?p=47 ...
6
votes
3answers
159 views

Is it safe to attach a potentially malicious hard drive to a Solaris machine?

We bring in hard drives from un-trusted sources and would like to ensure that they will not contain any harmful content. What kind of risk is there for Solaris? As in, if Solaris is running, and I ...
6
votes
1answer
526 views

Google showing spam links on my site

When I search the name of my site on Google, I see site links description which are spammy and not related to my site. Sometimes when I click I get redirect to phishing sites. But I have used many ...
6
votes
4answers
564 views

How can Antivirus differentiate between a Trojan and a normal remote desktop application software?

RAT (Remote Access Tool, e.g. Sub7) are considered malicious by Antivirus software. How can it distinguish between such patches and a client application for commercial software like NetSupport ...
6
votes
3answers
3k views

What programming language is Stuxnet written in?

I was listening to a story about Stuxnet and was curious if anyone knew what language it was written in? Is the source code for Stuxnet available anywhere?
6
votes
2answers
6k views

Can Keyloggers get passwords from Windows 7/8 Logon Screen?

If yes, do you know some examples of Keyloggers capable of perform this? EDIT: I mean when logon in the windows right after power on the PC and/or when locked with Win+L.
6
votes
4answers
3k views

What are the best ways to fake a web server

I was wondering if anyone had some insight into the best way to fake a web service response rather than setting up a web server. For instance, while doing dynamic analysis of malware it's useful to ...
6
votes
3answers
199 views

Spamming exploits without user detection

So I asked this question because I had thought that attackers would have a way to identify client software, because surely if 100 different exploits were spammed against a users machine they would ...