Malware is any software application which subverts the will of the legitimate owner of a computer, by means of force or subterfuge, with or without personal or monetary gain on the part of the creator.
6
votes
2answers
176 views
Example of malware in the wild?
I'd like to test an application that detects malware on my network. In order to do that, I have a Windows VM set up that I'd like to infect with malware. But for the life of me, I can't seem to find ...
2
votes
3answers
273 views
Strange file named Aview.exe - WinClient
Today I've just discovered some strange files on my Win 7 PC.
I was browsing through the Windows Firewall Inbound Rules and saw two ACCEPT rules for a program, Aview.exe.
It is located in ...
6
votes
5answers
793 views
Malware code added when site viewed externally
Please see second followup at the bottom! (Now with added real malicious code! ...ish)
Prompted by this question, I've noticed that my university's student charity organisation has an interesting ...
2
votes
1answer
202 views
Malware in browser extensions
How can I check if an extension/addon consist of malware code? Is it easy to detect if it collects sensitive data (like spyware), logging keystrokes and so on? Can AV recognize malware extension as ...
1
vote
3answers
164 views
Any one know about UDP traffic on source port 26221?
On my captured network traffic i observe a flow having a source udp port of 26221 and have different destination udp ports. Some of these destination ports were standards IANA ports. The average ...
3
votes
1answer
200 views
what is the difference between virus, worm, trojan and other malware [closed]
Looking through the questions in IT security, I found out that there is no answer which cover this question in depth.
I am aware of the answer and just hope to see something detailed about:
main ...
2
votes
2answers
277 views
Where can I find worm traffic sample?
I have a program that has to detect scanning activity of worms.
I need some samples of worms' traffic (pcap files) to try the program, and notes about the procedures which must be taken when running ...
2
votes
1answer
100 views
Trust linux images burned from untrusted systems
For securitys sake I'm assuming my system is successfully compromised after a targeted and/or non-targeted attack.
I've downloaded some linux images and burned them to do a re-install.
Since I can't ...
3
votes
5answers
711 views
How can I know if my PC is getting infected?
I have installed an antivirus, but as no antivirus is perfect, what can I do to diagnose if my PC is getting infected?
For example, keeping a close eye on what programs and tasks run when I turn my ...
1
vote
0answers
31 views
vbs agent kz trj [duplicate]
Possible Duplicate:
Index page has been compromised, suspicious files are showing up
I have vbs agent kz trj one my laptop. my httpd.exe and mysql.exe is infected and deleted from Xampp. ...
1
vote
3answers
152 views
Where can I find information on existing viruses?
As part of my research, I have created a small malware corpus which I'm conducting my tests against. I would like to categorize them based on Metamorphic / Polymorphic / etc.
I am not sure if this is ...
1
vote
0answers
79 views
The point which distinguish metamorphic and polymorphic algorithms? [closed]
I am writing a paper about malware and code obfuscation and I realize at the and these abstractions have not got a bordered definition and it is really hard to emphases the point between them, so I ...
4
votes
1answer
157 views
“WICKED” entries in the default nginx vhost's logs
I have a small VPS running nginx, and for a long time now (several months, since I rented it) it has been collecting weird entries in its default (listen 80 default;) vhost's logs:
109.x.x.121 - - ...
3
votes
4answers
252 views
Malware via power outlet
This is perhaps a very dumb question, but as I have no knowledge nor experience of IT security I have no option but to ask here.
Is it possible to get malware onto your computer or smartphone by ...
2
votes
1answer
72 views
Seeing outboud connections to random domains, how do I isolate the app responsible?
Last night I loaded up Fiddler2 to do a little debugging and I saw three connections to domains like
hghefhhig
How can I go about isolating the application responsible?
I was thinking possibly ...
5
votes
2answers
124 views
How serious is a local virus in terms of network security
I work at an insurance company in the U.S. My colleague got a notification on his machine of a possible virus (through the virus scanner that is installed by default on all machines). He called up the ...
12
votes
4answers
603 views
How is a worm different from a virus?
In spite of various online articles, I'm a bit unclear on the distinction between a "worm" and a "virus".
Two related questions--
Is there a useful and clear distinction here or no? If so, what is ...
0
votes
1answer
71 views
How does duqu implement its dll files in PNF file format?
As you know files with PNF extension are associated with bitmap file type, from technically point of view how did authors of duqu implement this? as I concluded it is possible to make dlls in any ...
2
votes
3answers
268 views
I found a malicious website embedded in Malware spam. What should I do?
An email is using social engineering to get users to click on a malicious URL that downloads javascript and then runs malicious code.
Who should I report these malicious URLs to? (Microsoft ...
48
votes
10answers
4k views
How do you explain the necessity of “nuke it from orbit” to management and users?
When a machine has been infected with malware, most of us here immediately identify the appropriate action as "nuke it from orbit" - i.e. wipe the system and start over. Unfortunately, this is often ...
0
votes
2answers
504 views
Is there any known Malware for Windows Phone 7?
I cannot find anything on google that indicates there has been cases of malware on Windows Phone 7, doe's anyone know if this is true?
1
vote
1answer
146 views
uninstall and reinstall after hacking [closed]
My computer has been hacked. If I uninstall and reinstall do I loose my files?
The facebook tech tried to sell me a number of pkgs ranged $149-$299 and told me that my account was hacked as was my ...
0
votes
0answers
100 views
How can I find out what is doing a “Trojan.Agent-252697” [closed]
I've scanned my computer with clamAV which has found one file infected with Trojan.Agent-252697. I've of course immediately removed the file, but I have no idea how can I find out what does this ...
2
votes
1answer
83 views
Is there a website or free downloadable program to identify and remove malware from an ISO file?
Is there a website or free downloadable program that allows a user to identify and remove multiple types of malware from an ISO file?
4
votes
5answers
460 views
How will microvirtualisation change the security field, if at all?
I'm interested in what Bromium has been working on. I don't understand how this will affect computer security. Will this reduce the number of exploitable vulnerabilities in common operating systems? ...
5
votes
1answer
142 views
Cufon or Prototype as an attack vector for Blackhole exploit kit?
I've been asked to look into the security of a client site that's apparently throwing antiviral messages when visited.
Specifics:
It's being detected as a Blackhole exploit kit inside of a Cufon ...
0
votes
4answers
134 views
Infection I can't shut down, disguises process as scvhost.exe [closed]
A little while ago my home machine got hit and I was able to clean out just about everything except this one process. I can't find the origin but it shows in my process manager as scvhost.net by the ...
5
votes
3answers
469 views
Phishing virus found on server
I recently had a call from BELL concerning a virus on our Linux ( Debian ) Server. Apparently Google emailed our client about an Italian Database found on our server that was doing phishing. They ...
3
votes
3answers
148 views
What are some ways to steal a password/PIN using this system?
http://cups.cs.cmu.edu/soups/2007/posters/p147_lim.pdf
Essentially uses an on-screen keypad that does not show the complete keypad numbers at a time. The image is refreshed at the rate of the ...
0
votes
0answers
146 views
Android plankton [closed]
Have anybody experience with analysing of android malware ?
I have tried to understand the Plankton malware. Main difference between plankton and "ordinary" malware is that the "ordinary" malware ...
5
votes
2answers
5k views
Is Buzzdocks a security threat?
A BuzzDock toolbar suddenly appeared in my Chrome browser. I definitely did not install it nor do I remember installing any crapware.
It is not unknown to the internet community (Example 1, Example ...
4
votes
2answers
135 views
What is the state of the Windows Update certificate after Flame?
May 28, The Flame malware is discovered in Iran and by Kaspersky Labs.
June 5, Dan Goodin (Ars Technica) points out that Flame had hijacked WindowsUpdate, spreading signed malware through that ...
5
votes
1answer
417 views
When and Why does Chrome display malware detection warning?
Google Chrome contains malware detection feature. When user visits some site, browser may display warning that site contains malware.
What does it mean that site contains malware? Does it mean that ...
0
votes
0answers
79 views
Exhaustive list of abuse notifications that organizations get [closed]
What are the different types of abuse notifications that organizations get? Here are some I could get off the web, but would be good to identify if someone already has a list of "types of abuse" ...
6
votes
3answers
495 views
attack/abuse notification email template
I'm building a template for use when sending "abuse" notifications to ISPs, hosting providers, etc., for when attacks originate from their netblock.
Are there examples of templates used for this ...
4
votes
2answers
409 views
How would I go about rebuilding the IAT of a packed executable?
When executables are packed with a tool such as UPX, the real code and data sections are encrypted or obfuscated, then loaded into memory using an injected decrypter stub. This makes static analysis ...
-4
votes
1answer
209 views
What are the technial and programming requirements for writing a stealth keylogger? [closed]
I'm planning to write/code one such stealth keylogger that would bypass detection by a certain antivirus. (I don't want to name the vendor as I know how good Google queries are against StackExchange ...
18
votes
4answers
1k views
Are anti-virus companies companies regularly committing software piracy?
As Mikko Hypponen highlighted in a recent tweet, anti-Virus companies collect and store both samples of malicious software and samples of legitimate software:
This got me to thinking, what ...
2
votes
2answers
238 views
Can a malware jump from a virtual to the physical machine? [duplicate]
Possible Duplicate:
How secure are virtual machines really? False sense of security?
I found out that malware authors check if the hard drive volume name,
or network card MAC matches ...
3
votes
2answers
190 views
How does duqu delete itself?
I'm curious to know how Duqu deletes itself. From technical point of view and generally, how can an executable delete itself while is running? Does Duqu use a specific procedure to do this?
0
votes
2answers
276 views
Is a VPN the only way to protect against rogue Wifi access points MITM attacks?
Given that it's very easy set up a rogue access point and MITM that connection, is a VPN to a trusted host the only real way to secure my browsing and other TCP/UDP actions?
This question relates to ...
5
votes
7answers
830 views
How to safely view a malicious PDF?
I have a PDF with important information that may contain malware. What would be the best way to view it?
14
votes
5answers
823 views
Why would a virus writer bother to check to see if a machine is infected before infecting it?
I was looking at the tripartite structure of a virus, and it seems to check to see if a computer is infected before infecting it with the virus. Would this be an attempt to use files that are already ...
7
votes
2answers
203 views
How a malware executes remote payload
Let's assume a malware was installed (on a UNIX-based platform) with some social engineering tricks. The original installed code itself may be benign, but the only malicious activity is that the ...
3
votes
1answer
251 views
In the light of recent information about RarVM, can we still trust RAR files?
See:
http://blog.cmpxchg8b.com/2012/09/fun-with-constrained-programming.html
https://github.com/taviso/rarvmtools
It would seem according to these two sources that rar files can contain custom ...
3
votes
2answers
218 views
What is disk encryption worth? Threat of proprietary Bios, SMM, optionrom, TPM etc?
Supposing there is private/secret data on a machine (i.e a x86 arch) the most reasonable thing to me would be to encrypt this data, so to protect it.
I understand that the purpose of ...
20
votes
2answers
1k views
From a technical standpoint, how does the zero-day Internet Explorer vulnerability discovered in September 2012 work?
I'm looking for an answer that explains the issue from the prespective of a developer/engineer. What is exactly being exploited and why does it work?
Please note that I am not looking for ...
6
votes
2answers
186 views
How do AV vendors choose malware names?
If you take a look at McAfee's recent malware page, you'll see that the names in the "Malware name" column aren't very human-readable: Downloader.a!cnz, W32/Autorun.worm.bgh, ...
4
votes
2answers
186 views
How can I recognize and find file(s) dropped by malware?
Suppose I am doing malware analysis. How can I recognize if, during the analysis process, a piece of malware dropped a file in my system, and if so, the path of the file?
What are the procedures, ...
2
votes
1answer
76 views
What authentication threat data exists?
I recently read an article that said there was not much data on which authentication threat vectors were actually being exploited in the real world. Eg what percent of password theft was by ...
