Malware is any software application which subverts the will of the legitimate owner of a computer, by means of force or subterfuge, with or without personal or monetary gain on the part of the creator.

learn more… | top users | synonyms

6
votes
4answers
548 views

Has my network/computer been breached?

I'm not sure if this is the right site to ask, so I apologise if it isn't, but here goes. A while ago I started noticing some odd behaviour. My Gmail account was compromised, it seemed, and I had to ...
5
votes
6answers
4k views

Can i get 100% protection from virus by using Deep Freeze?

I have recently installed an application called 'Deep Freeze' that works by "freezing" the state of an operating system and working off delta disks. Rebooting deletes the deltas and reverts back to ...
5
votes
7answers
2k views

How to safely view a malicious PDF?

I have a PDF with important information that may contain malware. What would be the best way to view it?
5
votes
2answers
978 views

Why should I restrict the content type of files be uploaded to my site?

We are building an application where users can upload resumes in our system for our administrators to download. We are having a debate about restricting the content type of the files that can be ...
5
votes
4answers
600 views

Can malware hide their network activity from Resource Monitor (perfmon)?

Is it possible for malware to hide their network activity from tools like the Resource Monitor that ships with windows? How much effort is it for a malware developer to implement such functionality? ...
5
votes
3answers
2k views

What programming language is Stuxnet written in?

I was listening to a story about Stuxnet and was curious if anyone knew what language it was written in? Is the source code for Stuxnet available anywhere?
5
votes
3answers
629 views

Phishing virus found on server

I recently had a call from BELL concerning a virus on our Linux ( Debian ) Server. Apparently Google emailed our client about an Italian Database found on our server that was doing phishing. They ...
5
votes
2answers
1k views

How can a malicious URL affect a computer?

Many security experts advise not to click on malicious URLs. How can clicking a URL affect a computer's security? If a malicious file was downloaded and executed, then a computer's security may be ...
5
votes
2answers
5k views

Can Keyloggers get passwords from Windows 7/8 Logon Screen?

If yes, do you know some examples of Keyloggers capable of perform this? EDIT: I mean when logon in the windows right after power on the PC and/or when locked with Win+L.
5
votes
2answers
1k views

How would I go about rebuilding the IAT of a packed executable?

When executables are packed with a tool such as UPX, the real code and data sections are encrypted or obfuscated, then loaded into memory using an injected decrypter stub. This makes static analysis ...
5
votes
1answer
336 views

Downloading suspect files into quarantine?

Are there any tools out there or methods available to download a suspect file for analysis without having to worry about being infected?
5
votes
2answers
235 views

What applications are at risk from “Backwards Unicode Names” and what are the mitigations?

There is a vulnerability where some applications (such as explorer.exe) respond to Unicode characters that change the direction of the text (right-to-left vs left-to-right). This may be used to mask ...
5
votes
7answers
341 views

Malicious Websites

Just wanted to get everyone's opinion on this. In Information Security, you get various alerts about particular machines on your network going to sites and/or IPs that have been flagged as ...
5
votes
2answers
173 views

How does the predator network prevent outside control by an attacker?

I read several articles saying some of the command and control fleet for the US robotic attack planes may have been infected with a virus. Does this command and control system communicate with the ...
5
votes
3answers
1k views

Are there faux/fake malicious websites to test web reputation services similar to EICAR?

Antivirus writers have agreed for their software to recognize a standard "fake" virus file - the EICAR file, to let users check, that the software is up and running. Are there any equivalent test ...
5
votes
1answer
634 views

When and Why does Chrome display malware detection warning?

Google Chrome contains malware detection feature. When user visits some site, browser may display warning that site contains malware. What does it mean that site contains malware? Does it mean that ...
5
votes
6answers
574 views

Safe to connect to external drive?

A customer provided an external drive (USB 2.0 and Firewire 800 connections), and wants me to copy files onto the drive. The drive is not new. I have no particular reason to suspect the customer ...
5
votes
1answer
115 views

Integrity check against package repository?

I have a Debian installed. When there are security updates, I review and install them as soon as possible and think about using automatic updates. From time to time I want to boot from a clean boot ...
5
votes
1answer
439 views

How to detect infected machines on my wifi?

I currently live in a building with around 40-50 other tenants (mostly students) and we all share one connection to the Internet using one of 3 wifi routers that are spread throughout the building. ...
5
votes
1answer
255 views

Cufon or Prototype as an attack vector for Blackhole exploit kit?

I've been asked to look into the security of a client site that's apparently throwing antiviral messages when visited. Specifics: It's being detected as a Blackhole exploit kit inside of a Cufon ...
4
votes
5answers
379 views

Why wasn't the flame malware flagged by firewalls?

Why didn't any firewalls catch the flame malware siphoning out all of that data? I thought there was firewall software that looks for "suspicious" activity?
4
votes
3answers
129 views

Duqu and other reference material for security people

I would like to read more on Duqu and similar exploits when they appear. The problem is that most references from google are for laymen. Isn't there a reference website or... that reports on these ...
4
votes
4answers
583 views

Site constantly getting infected

I am the webmaster of some websites running Typo3, 2 of which are getting infected constantly. These 2 sites are being owned by the same client. Something happens on those 2 sites that causes ...
4
votes
4answers
365 views

Malware that uses http as a covert channel

I'm working on a http traffic analyzer and I need a collection of malware, which uses http as a way to get commands and respond, to analyze their network behaviour. Is there any database of malware, ...
4
votes
2answers
450 views

Can one get infected through visiting a site with a PHP script on it and if yes, how?

I can imagine a clientside JavaScript that gets executed in a vulnerable browser to do some harm, but how can this be done with PHP? Since it's serverside it shouldn't have access to the visitor's ...
4
votes
2answers
2k views

Need advice on linux server being hacked

I'm currently trying to find out how one of our centos servers was compromised. We were experiencing malware on our sites. After searching I finally found the malware injecting into the sites. As it ...
4
votes
1answer
394 views

Malicious script analysis

Could somebody tell me what can this malicious code do? I see that in the beginning it turns off the error reporting and logging. Then something with get post method and files stuff. But I am not ...
4
votes
2answers
164 views

What is the state of the Windows Update certificate after Flame?

May 28, The Flame malware is discovered in Iran and by Kaspersky Labs. June 5, Dan Goodin (Ars Technica) points out that Flame had hijacked WindowsUpdate, spreading signed malware through that ...
4
votes
4answers
1k views

Is online banking more secure on iOS than a desktop computer?

Does Apple's iOS provide a more secure environment for online commerce (banking or shopping) than Windows or Mac OS X? Since the only software that can run on iOS must be vetted by Apple, the ...
4
votes
4answers
3k views

Browser hijacked - how to fix and prevent?

For the second time in a month, my work PC has been infected with malware that is hijacking my Google search results in Firefox. A search for the URL hijacked searches end up at turns up nothing on ...
4
votes
1answer
293 views

Exploited by newbie3viLc063s

My debian server got exploited by some scriptiekiddie who used Newbie3viLc063 http://pastebin.com/jma8JRG1 . Scriptkiddie uploaded logo_php.png to my server (My permissions sucked :s) and he did run ...
4
votes
2answers
296 views

How can I recognize and find file(s) dropped by malware?

Suppose I am doing malware analysis. How can I recognize if, during the analysis process, a piece of malware dropped a file in my system, and if so, the path of the file? What are the procedures, ...
4
votes
1answer
360 views

Is Window's system restoration useful for getting rid of malware?

If your computer has been infected with some kind of malware, could a restoration of the system, using the tool provided by windows, help you getting rid of that malware? We should suppose that it ...
4
votes
1answer
175 views

German police malware “Staatstrojaner” general question

In the case of the recent find by CCC, how exactly would the malware used by German police for internet wiretapping work? In default mode, it takes screenshots of active windows, it logs data and ...
4
votes
1answer
157 views

Securing a Site: Diversity over Simplicity?

This question was derived from my off-topic questioning here: Does Centralisation Decrease the Probability but Increase the Damage of Exploits? Like before, I suspect this may be overly abstract as a ...
4
votes
2answers
393 views

What is disk encryption worth? Threat of proprietary Bios, SMM, optionrom, TPM etc?

Supposing there is private/secret data on a machine (i.e a x86 arch) the most reasonable thing to me would be to encrypt this data, so to protect it. I understand that the purpose of ...
4
votes
2answers
4k views

Security Alert - Office File Validation - how to decide whether to proceed?

Recently, when opening a Microsoft Word document that came from a trusted source, I received the following warning message: The warning message is titled "Security Alert - Office File Validation". ...
4
votes
2answers
461 views

Has anyone else seen commands embedded in an ICMP echo request?

My IPS recently detected a type 8 ICMP packet (echo request) with an unusual payload. The echo request command a fragment of a command that looked like part of a route add. Here's a PCAP of the ICMP ...
4
votes
1answer
2k views

Looking for URL Blacklists of Malicious Websites [closed]

Is there a maintained list of URLs that contain malicious content. These URLs may be involved in Phishing, Scams, Viri, or other Malware. Please indicate in your answer if the list is freely ...
4
votes
1answer
344 views

How dangerous is a virus introduced to a malicious website in chrome?

I am using Google's Chrome browser under Linux (Ubuntu) 64 bit for web browsing. If I a virus uses for example a leak in the flash player, the virus will get the privileges of the user who started ...
4
votes
1answer
356 views

In the light of recent information about RarVM, can we still trust RAR files?

See: http://blog.cmpxchg8b.com/2012/09/fun-with-constrained-programming.html https://github.com/taviso/rarvmtools It would seem according to these two sources that rar files can contain custom ...
4
votes
1answer
138 views

The Economics and White Hat Nature of NSS ExploitHub

This question is about the economic model employed by NSS with their ExpoitHub exploit marketplace (site link) and whether it jives with the white hat claims of the company. The company has made news ...
4
votes
1answer
2k views

What can I do to make sure my computer isn't infected with FinSpy?

What steps have been taken by common free software OS distributions to protect against it? What can Windows users do? What ways are there to rid a system of it?
3
votes
4answers
2k views

Writing malware in java?

To me, it seemed like malware could never be written in java. Those who taught me java said it was "secure" and did not allow "low-level access" like c,c++. But, I discovered that it can be done - ...
3
votes
2answers
177 views

Where a sysadmin deletes a company's data, why can't they just restore from backups

As an example, in the UBS Duronio case, Mr. Duronio executed code that deleted everything in its path, but isn't there a backup server? Why was UBS hit by the loss of data? If the backup is available, ...
3
votes
4answers
574 views

Strange android app … possibly a mass malware?

I started receiving on my android Samsung Galaxy note strange notifications in Mandarin (the language of the people of china). Once I click on the notification it opens my browser with a blank page ...
3
votes
3answers
312 views

I found a malicious website embedded in Malware spam. What should I do?

An email is using social engineering to get users to click on a malicious URL that downloads javascript and then runs malicious code. Who should I report these malicious URLs to? (Microsoft ...
3
votes
4answers
3k views

How can I detect backdoors?

I have a machine running Mac OS X and I suspect there may be a backdoor installed. I know that I could take it to a professional security firm for analysis, or nuke it from orbit, but I'm interested ...
3
votes
1answer
265 views

I accidentally installed an adware filled Firefox [solved]

I installed Firefox using a download site, rather than the correct site. After running and installing Firefox I noticed my Chrome had an addon called swift browser added to it by a third party. After ...
3
votes
3answers
1k views

Malware infections from visiting or using YouTube

Is it possible to be infected by viruses or other malware while visiting YouTube? What kind of measures do the YouTube staff take to prevent viruses and malware?