Malware is any software application which subverts the will of the legitimate owner of a computer, by means of force or subterfuge, with or without personal or monetary gain on the part of the creator.

learn more… | top users | synonyms (1)

12
votes
5answers
2k views

Unknown process on my ubuntu machine communicating over multiple ports with UDP proto

I have a Django web application where the web app and the postgresql database are hosted on two separate Ubuntu-based machines. On my Database machine (and not my web application), if I run sudo ...
12
votes
3answers
3k views

Am I protected from USB autorun malware on Windows 7?

As far as I know, the autorun.inf problem (the possibility of automatically executing code when a USB stick is plugged in) was solved through Windows Updates for XP, and on 7 it is no longer possible ...
12
votes
2answers
6k views

Sites being redirected to adult site in all devices [closed]

From past couple of days, we are facing this issue where sites are automatically being routed to an adult site, although we get a 404 Not Found HTTP error. First guess is obviously that my system is ...
12
votes
2answers
5k views

How can a malicious URL affect a computer?

Many security experts advise not to click on malicious URLs. How can clicking a URL affect a computer's security? If a malicious file was downloaded and executed, then a computer's security may be ...
12
votes
3answers
42k views

How serious is InstallIQ?

Background: Recently I've seen hits for InstallIQ a "potentially unwanted application" from ESET. From what I can find it seems like this is an installer wrapper that asks people to install other ...
12
votes
2answers
2k views

Where do I find JavaScript malware?

I am looking for JavaScript malware. I need it just for local tests on my computer for a project I am working on. Are there any Internet resources where I could find this?
12
votes
2answers
26k views

Advice on what to do after being hacked? [duplicate]

After running a system scan earlier today, I found that my computer had been infected by a trojan horse. My reason for running the scan was because Windows kept shutting down and then recovering. ...
12
votes
1answer
2k views

How to study the packets sent by a keylogger

One of my friends runescape account got hacked through key-logger. He downloaded a runescape gold generator from a file sharing site and tried to use it. I have a strong doubt that it is a key-logger. ...
12
votes
7answers
2k views

Pursuing a career in Malware Analysis

When I was a kid, I want to become a Malware Analyst and work in a Antivirus company. At that time, I love to try out different antivirus solutions and did a research project on Computer virus/...
12
votes
4answers
863 views

What would happen if one of the popular Linux repositories is hacked?

Even though most people consider downloading your Linux software from you own distribution's repositories as safe, thinking about the scenario where a repository gets hacked sounds thrilling. What ...
12
votes
1answer
219 views

Stack Exchange's javascript is malicious

I have, recently, discovered a rather annoying problem: every first-click I have on any Stack Exchange site creates an advertisement popup. This happens on my desktop, laptop, phone and even a VM. I ...
12
votes
1answer
240 views

New social engineering tactic that uses printer serial numbers?

We have been getting a new kind of scammer-esque call every couple weeks here at the office (I work at an enterprise web application development company). Basically, the flow of events is this: ...
12
votes
4answers
6k views

Detecting reflective DLL injection

In the past few years, malware (and some pen-test tools like Metasploit's meterpreter payload) have begun to use reflective DLL injection (PDF) to load a DLL into the memory of a process. The benefit ...
12
votes
2answers
473 views

How do you visit a link without risking your computer?

I got a link from: http //61.19.247./~naowit/dustin.html (removed the last digits so you don't accidentally click it! (they were 192)), which was masked as a youtube.com link via email. Now I'm not ...
12
votes
1answer
190 views

Where is the best place to get descriptions of malware?

I'm looking for a source of descriptions of 1990s to early 2000s malware; I have searched for a very long time yet found very little. I require information such as payload activation dates, files ...
11
votes
2answers
3k views

What does this injected code do?

One of my sites has just been hacked as this code has been inserted into random(?) files and places within the files. Does anyone understand what it is trying to do? I would welcome anything that may ...
11
votes
6answers
2k views

Ads appearing in our application when they should not be

I received a strange issue reported by one of my web application users. Apparently they are getting "ads" within the browser window when using my application. I didn't add advertisements at all. It's ...
11
votes
3answers
2k views

How to deobfuscate this PHP malware?

Two days ago a file called "images.php" appeared on a friend's server, which he noticed because it caused errors. The file contained the following. This code is of unknown origin and presumed to be ...
11
votes
5answers
844 views

Can a mobile phone battery contain malware?

It has 3 terminals and is presumably a smart battery. I bought it on ebay recently for $2.74 USD and that included postage from China to Australia. It would normally retail for maybe $40 - $50. The ...
11
votes
3answers
1k views

Reason for writing Self-Decrypting Virus

What is the rationale behind writing a self-decrypting virus? By this I mean a virus that has it's payload encrypted, decrypts at runtime and runs it. How does this protect the virus from antivirus ...
11
votes
2answers
1k views

Does Android have sufficient app sandboxing?

In a previous question in InfoSec, I asked about how to determine the safety of a sideloaded Android app that requires root permissions. Now I would like to ask a related, but different question: Is ...
11
votes
5answers
330 views

Security of root terminal (su -) when logged into X

I often log into X as normal user (of course), open terminal and switch to root: su - I have then a terminal owned by user but effectively with root privileges. Are there any security issues in ...
11
votes
3answers
1k views

Retrieve files from possibly infected USB

I work in a lab environment, and save data to a shared PC. This PC is not networked, and so the only way to get the data from that PC to my own, is through USB. The lab director has mentioned that the ...
11
votes
6answers
3k views

weird visitors to my website

For the last three months I have thousands of real visitors to a single page on my website. Those visits are recorded in Google Analytics and count as page views in adsense reports, but they are fake: ...
11
votes
2answers
468 views

concrete real-life examples where grsecurity prevented an exploit

From theoretical point of view, grsecurity kernel patch looks like a great hardening tool. Most importantly, PaX seems like a good idea. Do these theoretical advantages have indeed practical effect ...
10
votes
6answers
51k views

Scanning for files than have been encrypted by CryptoLocker

I am just asking in case someone has already done the analysis. A customer has a large set of network drives that were mapped to a CryptoLocker infected machine. The infection itself has been treated. ...
10
votes
1answer
1k views

unauthorized logging into my computer

I ve been suspecting someone logging into my computer because a couple of times, during the user log on screen I saw "Signed in remotely from.." The first timeIi saw some of my pictures copied on ...
10
votes
4answers
2k views

How would you analyze an image to find out if there are scripts embedded in it?

How would you analyze an image to find out if there are scripts or possible malware embedded in it? What tools / methods to use?
10
votes
2answers
968 views

Effectiveness of flattening a PDF to remove malware

I'm currently looking at ways to prevent malicious PDF files at the network boundary. This will include virus scanning - but there are known limitations to that. I see a common approach is to flatten ...
10
votes
2answers
2k views

Malware known to use port knocking to evade detection by network scanners?

Are there any known cases of malware in the wild that utilize port knocking on a backdoor to evade detection by network scanners?
10
votes
3answers
301 views

How to identify and analyze malware that checks for security tools before running?

I've been reading about the ZeroAccess and looking into some bot's code source* and I found this piece of code which checks if filemon is running in the infected computer before running the bot. ...
10
votes
3answers
411 views

CSP Reports: Ignoring Client Malware

I'm seeing a lot of Content Security Policy (CSP) reports raised because of client-side malware. Many have "blocked-uri" entries like randomstring.cloudfront.net, something.akamaihd.net and so on. I ...
9
votes
5answers
8k views

Is it possible for a phone to be transmitting even while turned off and the battery removed?

Is it technically or theoretically possible for any part of a mobile phone's circuitry to be still on and transmitting even while turned off and the battery has been removed? If so, how? I am ...
9
votes
7answers
18k views

How can I prevent viruses/malware from infecting my flash drive?

I've a pen drive that I carry to the college lab . It seems all the systems in lab is infected. I need to be able to write to the drive, so I can't simply write protect it. Everytime I insert a ...
9
votes
5answers
814 views

Is there anything I can do about IDN homograph attacks?

I have been reading about IDN homograph attacks, and I cannot think of any better way than Tell my users not to trust emails asking for passwords, etc Buy all domains similar to mine (expensive and ...
9
votes
1answer
2k views

Does analysing Malicious code in gdb pose a security risk?

I have encountered a Malicious Shell-Code & i have ported the shellcode into a compatible C Code which can run the shellcode, i compiled it using gcc -fno-stack-protector -z execstack shellcode.c ...
9
votes
2answers
537 views

How do AV vendors choose malware names?

If you take a look at McAfee's recent malware page, you'll see that the names in the "Malware name" column aren't very human-readable: Downloader.a!cnz, W32/Autorun.worm.bgh, FakeAlert-SecurityTool.fx,...
9
votes
1answer
124 views

In VMs, do shared folders reduce security effectiveness?

VirtualBox offers the option of using shared folders, others probably offer the same thing. I am not sure whether the host is directly accessing the memory of the guest, or if there some process which ...
9
votes
0answers
894 views

How to isolate persistent pop-up browser hijack [closed]

There's a persistent browser pop-up affecting Mozilla Firefox which has evaded a number of security pre-cautions and attempts to find a remove it. It's gone on for at least 3 months. The pesky pop-up ...
9
votes
1answer
238 views

Is NoScript bad? [closed]

I just came to know about NoScript, but after installing it opened the author's homepage with an advert for 'SpeedUpMyPC' that pointed to a UniBlue website, which I found fishy. Googling turned up ...
8
votes
5answers
1k views

Is disabling auto-run enough to protect against malicious code from removable media automatically infecting a machine?

If I block auto-run on a windows machine, is this enough to protect it from malicious code (assuming I don't run any files manually)? Or are there known vulnerabilities that may cause infection?
8
votes
2answers
2k views

Will completely wiping your hard drive remove all malware? [duplicate]

I recently bought a new computer. Now I want to convert my old PC into a Linux system. However, I want to start completely fresh and not bring over any malware. I am already planning to wipe ...
8
votes
6answers
2k views

Using linux to combat windows flash drive malware?

I just put an old flash drive which i used with a windows machine into my linux. I noticed many files, mostly exes which were never visible in windows (my windows does not hide hidden files and ...
8
votes
5answers
3k views

Browsing on a USB OS (Linux) safe from malware?

Let's say I have a computer. It's a personal computer - the one you'd typically find in homes. In this scenario, it's running Windows XP SP3, although it could run 7, Vista, etc. I have a USB drive ...
8
votes
3answers
2k views

Nmap indicates that “telepathstart” and “telepathattack” are listening on ports 5010 and 5011 of my Linux box. What are these?

I have a linux box on my network which, according to Nmap, contains two services called telepathstart and telepathattack listening on ports 5010 and 5011. From the same box, I am receiving inbound ...
8
votes
3answers
1k views

How does a root kit work inside a virtual machine?

In my class, we are discussing virtual machine based root kits. I've research root kits, but could not find any information specifically talking about how root kits work inside of virtual machines ...
8
votes
2answers
2k views

Why should I restrict the content type of files be uploaded to my site?

We are building an application where users can upload resumes in our system for our administrators to download. We are having a debate about restricting the content type of the files that can be ...
8
votes
3answers
5k views

What programming language is Stuxnet written in?

I was listening to a story about Stuxnet and was curious if anyone knew what language it was written in? Is the source code for Stuxnet available anywhere?
8
votes
4answers
15k views

Security issues with allowing Dropbox installations on client PC's in our organisation

Does anyone know if there is any good reasons not to allow Dropbox installations on our client PC's? All the PC's have antivirus installed and running. I know it is an additional attack vector to ...
8
votes
3answers
295 views

Why is the victim a server instead of a client?

I just finished creating my own remote administration tool "a server to multiple client one" using System.Net.Socket, - "Watch Dogs fan :P" then I try to search on google how they make or design ...