Malware is any software application which subverts the will of the legitimate owner of a computer, by means of force or subterfuge, with or without personal or monetary gain on the part of the creator.

learn more… | top users | synonyms

5
votes
7answers
1k views

Safe to connect to external drive?

A customer provided an external drive (USB 2.0 and Firewire 800 connections), and wants me to copy files onto the drive. The drive is not new. I have no particular reason to suspect the customer ...
1
vote
2answers
115 views

Viewing an infected file via FTP and code editor won't infect my PC right?

My apologies this may sound like a paranoid question... Recently my friend's website was infected by malware. With her permission, I FTP into her account to have a look and found some malicious PHP ...
2
votes
2answers
88 views

Connecting trusted and untrusted networks

We have two domains that are isolated. First domain is the Corp LAN, the second is an hostile untrusted network with untrusted clients that could contain malware. Clients on the untrusted network ...
0
votes
2answers
249 views

How did piratebay.se search engine get in Chrome as an “other search engine”

I have an IT client with a user who had piratebay.se/... listed within his Chrome's (v39, 64-bit, OS X, 10.10.1) "Other Search Engine" section. I know a user could manually add it and suspect the ...
75
votes
7answers
44k views

How secure are virtual machines really? False sense of security?

I was reading this CompTIA Security+ SYO-201 book, and the author David Prowse claims that: Whichever VM you select, the VM cannot cross the software boundaries set in place. For example, a ...
0
votes
1answer
148 views

Where can I download the Sony hack malware (for analysis)? [closed]

I want to analyze the Sony hack Malware as there have been a lot of stories on who is responsible; from the US government implicating North Korea to news articles stating it's an inside job. The fact ...
0
votes
2answers
100 views

Only HTTP(S) port is open. Why do I need to worry about unpatched software?

Unpatched software poses no risk by themselves. They're only problematic when someone exploits it. How could malware get into my system if I do have unpatched software in general and I'm connected to ...
1
vote
1answer
64 views

Why is there a path to a .pdb file in an exe I am trying to reverse?

My query is ,if I'm seeing a .pdb path in a exe(VC++) what conclusion can I draw from it.Why does the exe have these paths and does it have significance in malware analysis? eg ...
0
votes
2answers
124 views

What is the best resource to learn malware analysis? [closed]

I am looking for a resource that helps learn malware analysis. I know about the practical malware analysis book but i am looking for something other than a book. For example a Site or video tutorials. ...
1
vote
2answers
106 views

Limitations of botnets [closed]

My question is very closely related to this question but I didn't find my answer there. Specifically, I'm interested in whether the C2 server can modify aspects/properties of the malware and, if so, ...
5
votes
1answer
287 views

Exploit SoakSoak injected in Wordpress

I have recently received an attack to my website and Google is warning visitors to not load the page. The malware is located in wp-includes/js/swfobject.js of my Wordpress and I had deleted it but ...
4
votes
1answer
69 views

Would DLL hijacking work with load-time linking?

I was wondering if DLL hijacking would work with all types of linking or just run-time linking. I hear that malware uses it and wanted to know how it works
8
votes
2answers
104 views

AV detection of signed malware

With the massive Sony leaks (including their private keys/certificate), i was wondering: How do major AVs deal with signed binaries? ie: Does it influence their detecting ability of the signed ...
16
votes
6answers
2k views

Becoming a malware analyst?

So, I'm currently 16 and am considering a career in IT when I finish school. The thing that has intrigued me the most while growing up is malware. I've come across it so often and have often had to ...
2
votes
1answer
204 views

What does this potentially malicious code do?

While reading a website called 4chan/b/ someone posted this code snippet, i was wondering what it does when executed? it appears to be C code, how harmful is it? This is the full post: Run a live ...
1
vote
0answers
129 views

Is the process Wslxrqjet.exe, tagged 'Google Chrome', malicious?

Multiple instances (between 3 and 15) of this of this process Wslxrqjet.exe are running on my Windows 8 system at all times. Windows Task Manager 'Description' field for all instances is "Google ...
-3
votes
1answer
272 views

Remote UAC bypass and Microsoft does not regard it as security Boundry [closed]

Microsoft has tremendously increased the security of Windows 8.1 but i found a technique to bypass UAC remotely I know that if User belongs to local group Administrators he is not given full Admin ...
0
votes
2answers
149 views

Prevent a file from being encrypted

Is it possible to prevent a file from being encrypted, or at least being easily decrypted in case of encryption? For instance; with the Crypto Locker malware attacking users, could you set up a ...
2
votes
1answer
170 views

what is the difference between dll hooking and dll injection [duplicate]

I am confused and would like to know the difference between DLL injection and DLL hooking? I am familiar with its use in malware and I know that key-loggers use it. I also know that SetWindowsHooKEX ...
2
votes
1answer
105 views

How Regin hides running instances of itself?

I have been reading Symantec & Kaspersky Labs analysis of the Regin malware. According to Symantec [Stage 2] can also hide running instances of Stage 1. Once this happens, there are no ...
13
votes
6answers
5k views

How do I safely inspect a suspicious email attachment?

I received a pretty blatantly spammy email to my Gmail account. I'm not really sure how it made it through the spam filters, since it has all of the telltale signs. The FROM field is spoofed as ...
1
vote
1answer
113 views

what is the difference between dll hijacking and dll injection

I am confused. I would like to know if dll hijacking and dll injection are the same or are they different. I know that some malware use it to do malicious things. thank you in advance
1
vote
1answer
95 views

Polymorphic/Metamorphic malware is written on low-level or high-level languages?

As a part of a course I study polymorphic/metamorphic malware. Every single paper and article I've stumbled upon mentions the techniques used by a malware to achieve polymorphism/metamorphism but non ...
9
votes
1answer
292 views

Malicious PDF Analysis

I have been analyzing a PDF I suspect to contain malicious content. For the most part, I've always trusted automated tools to determine if a PDF was safe to open. However, my eyes have been opened to ...
0
votes
2answers
123 views

How CryptoPHP: Sneaky malware works?

This malware is hidden in pirated themes and plug-ins for CMS . the ‘social.png’ file confirmed we had found the backdoor; as it contained a big blob of obfuscated PHP code . My question is how ...
9
votes
6answers
2k views

Pursuing a career in Malware Analysis

When I was a kid, I want to become a Malware Analyst and work in a Antivirus company. At that time, I love to try out different antivirus solutions and did a research project on Computer ...
1
vote
2answers
80 views

Any “cleaned” virus that's been successfully re-released?

Anti-malware software has to keep track of all bad software there is. To ease this load, it seems like a good idea to stop looking for threats that's been dead for years. Is there any example of some ...
0
votes
2answers
97 views

Do common malware compromise recovery partitions?

Just about now a friend of mine got compromised, actually she was compromised by various adware since long ago but she installed something (her browser was hijacked to deliver even more malware) and ...
2
votes
1answer
71 views

Strange requests coming from EA4350 Linksys routers

I have had two Linksys EA4350 Routers for a week or so being used internal my network as wireless access points, and all of a sudden I started noticing requests from them once per minute (care of my ...
0
votes
1answer
135 views

What is the difference between YARA and CLAMAV?

Can any one explain the difference between YARA and ClamAV ? Are they just two different ways of writing AV or Malware signatures ?
7
votes
1answer
235 views

Can virtual machines be used to isolate vulnerable software?

I have had a look at most of the previous questions about virtual machines (VMs) and they all appear to be focused on hosting malware in the VM and preventing it breaking out of the VM. What I can’t ...
0
votes
1answer
182 views

How to identify which storage USB device is BadUSB-free at store?

Are there certain things I can look for when buying a new external hard drive or flash drives to ensure that the one I purchase does not contain BadUSB? Would popular commercial brands, such as ...
2
votes
2answers
2k views

Is this a valid Windows update page

In my chrome browser if I google for Windows Update the first hit is windowsupdate.microsoft.com/‎ When I click on it I am redirected to ...
5
votes
1answer
504 views

Google Chrome browser warning for goo.gl

I am getting the solid red screen Chrome browser malware warning for Google's own URL shortening website, goo.gl as well as other sites such as bit.ly and delicious.com when I try to navigate there ...
-2
votes
1answer
111 views

Interesting security demos for beginners [closed]

I am thinking about a creating short security demo to get people interested in the security topic. I've had a couple of ideas just want to see if anyone has anything else interesting. Edit: I was ...
2
votes
1answer
478 views

Questions on reflected file download (RFD) attack

I read this article, and the whitepaper by security researcher Oren Hafif which mentions the following salient points: RFD, like many other Web attacks, begins by sending a malicious link to a ...
0
votes
0answers
45 views

Malware or exploit kit without escalation kit

Does anyone know of any malware or exploit kit that do not use a privilege escalation kit and just do malicious things with an unprivileged permission?
5
votes
1answer
381 views

Are the top ten flashlight apps maliciously stealing data and sending it to China, India, and Russia? [closed]

There's an interesting report from a company called SnoopWall that is detailed in this YouTube video from a Special Report with Bret Baier with Fox News. In the report "Cybersecurity Expert" Gary ...
1
vote
3answers
372 views

running malware - add exclusion?

I am having so many problems with my laptop and have 8 malicious items detected and 4445 non malware items detected is it better to quarantine or add exclusion I am Not sure what at exclusion means ...
1
vote
1answer
79 views

Live Boot Devices

Found this article on using Live Boot Devices to do sensitive tasks such as online banking. While the article discusses the benefits of avoiding a possibly compromised host OS, it doesn't mention ...
-5
votes
1answer
102 views

Becoming a malware analyst for Android or Windows?

Which would be considered for a person starting in malware analysis to go into, Android or Windows malware analysis? Which is easier? I prefer something that is easy and at the same time a good ...
2
votes
3answers
153 views

How are 1x1 pixel images used in a malicious context?

I have been analyzing malware and I am seeing many 1x1 png and gif files. What could these be used for?
1
vote
2answers
37 views

unprivileged or privileged malware for botnets

For those malwares which are used to organize botnets to DDOS a website, they just need to send and receive HTTP packets. Do they need to be privileged? If they dont need to be privileged, is it true ...
2
votes
1answer
150 views

Is it possible to get malware through an incoming video/audio stream? (e.g. Omegle, Skype etc.)

just a quick question. Is it possible for incoming video/audio streams to contain malware etc. through exploits in the transfer of the video/audio? Thanks in advance.
-1
votes
2answers
103 views

Open Source Malware Scanner/Cleaner [closed]

What is the best Open Source Malware Scanner/Cleaner? Malware-bites is good but it requires licensing for companies.
26
votes
4answers
14k views

Does a Virtual Machine stop malware from doing harm?

I would like to know if it is save for the host system of a virtual machine (VM - VirtualBox OSE in my case) to execute malware. Can a virus break out and read or write data from the host system? ...
1
vote
1answer
84 views

Recovering From Suspected MPEG Malware Attack

Against my better judgement I foolishly opened an MPEG video emailed to me from a friend's email address because the topic in the email was something we had recently discussed. I am fairly certain ...
4
votes
5answers
2k views

Strange android app … possibly a mass malware?

I started receiving on my android Samsung Galaxy note strange notifications in Mandarin (the language of the people of china). Once I click on the notification it opens my browser with a blank page ...
1
vote
1answer
137 views

Microsoft OneNote being detected as Malware

I am helping a friend install OneNote 2013 64-bit on their Windows 7 (64-bit, SP1) system. We went to the official Microsoft OneNote website, www.onenote.com, clicked on 'Windows' (just to the right ...
9
votes
2answers
3k views

How can a malicious URL affect a computer?

Many security experts advise not to click on malicious URLs. How can clicking a URL affect a computer's security? If a malicious file was downloaded and executed, then a computer's security may be ...