Malware is any software application which subverts the will of the legitimate owner of a computer, by means of force or subterfuge, with or without personal or monetary gain on the part of the creator.

learn more… | top users | synonyms (1)

3
votes
2answers
414 views

How does “Ransomware” Work?

So I am wondering how Ransomware files work. I know Ransomware encrypts all files with AES-256 for speed but where does RSA come in? Apparently RSA is slow to encrypt files so it uses AES-256 first ...
0
votes
1answer
75 views

Virus: Images get replaced on website [closed]

I have installed Windows 7 again on my laptop with Chrome as browser. The problem is that on different websites I visit, the actual images of the website get replaced with out of context images. It ...
1
vote
1answer
72 views

How to protect Windows Registery from being changed or from programs trying to add keys

This question is with regards to Windows Personal PC. How to protect Windows Registry from being changed or from programs trying to add keys? I understand that the following general good practices ...
5
votes
1answer
460 views

Is Adobe Flash Player installer redirect due to a malware?

When I go to http://get.adobe.com/flashplayer/ 'Install Now' will redirect me to their homepage without downloading the update or any explanation. What could be going on? Is some malware ...
0
votes
2answers
157 views

Our users get a trojan horse alert on our site, but we don't. What do we do?

A user of our website got a trojan horse alert when she tried to get to our website. But myself and some other friends got no alert whatsoever and can go on the website and download files without ...
2
votes
2answers
94 views

xcodeghost infection in a byod device

We detected network traffic from a device infected with xcodeghost trying to reach a known bot command and control address. Obviously, we removed the device from the network. The user removed two ...
1
vote
0answers
30 views

iLivid infection/ iLivid behaviour analysis

Although lots of surveys and reports have been done on iLivid by lots of malware analyzers, I decided to inspect iLivid independent of previous research. I have read lots of reports about iLivid but ...
3
votes
4answers
200 views

Can my computer get infected if I hover the mouse to check the thumbnail of an e-mail attachment?

So, today an user sent me an e-mail about a suspicious e-mail. When I opened it to check it, I accidentaly hovered the mouse over the "doc.jpg" and it opened the image thumbnail. I never bothered to ...
0
votes
0answers
23 views

What's the Safest Way to Open / View Email Attachments? [duplicate]

I'm aware that opening email attachments is a great way to let malware onto my computer. Friends and relatives often send me videos as attachments, so I'm wondering if there's a way to download and ...
7
votes
5answers
4k views

Browser hijacked - how to fix and prevent?

For the second time in a month, my work PC has been infected with malware that is hijacking my Google search results in Firefox. A search for the URL hijacked searches end up at turns up nothing on ...
1
vote
0answers
151 views

How Skype Click to Call plugin is used to send spam?

My friend had Skype Click to Call plugin installed within browser on Mac OSX. And his Skype account started to send some automatic spam messages linking to lose weight websites (via goo.gl) without ...
0
votes
2answers
60 views

How to reinstall Win7 from a D-drive on an infected laptop

The laptop is infected with some sort of bad stuff (virus? Trojan? malware? etc). I am thinking of wiping it clean and reinstal Win7 "from scratch". I am running Win7 from an HP Probook, which has a ...
1
vote
0answers
70 views

Detecting Malcode in Excel and Word Documents

There are a bunch of tricks to circumvent potentially malicious macros in office documents you receive. My question is how do I [forensically] detect if there are malicious macros in the documents? ...
27
votes
2answers
3k views

Identifying the author(s) of a piece of malware

When a new piece of malware appears, people can try to determine where it comes from, and who its authors could be. How do security experts attempt to identify the authors of a new publicly disclosed ...
8
votes
2answers
11k views

Can Keyloggers get passwords from Windows 7/8 Logon Screen?

If yes, do you know some examples of Keyloggers capable of perform this? EDIT: I mean when logon in the windows right after power on the PC and/or when locked with Win+L.
0
votes
2answers
205 views

Difference between antivirus and sandbox?

When reading about how antivirus and sandbox work, my understanding is that an AV scans a file to see whether it matches with known viruses signatures. Sandbox can be used to obtain the behaviors of a ...
1
vote
0answers
31 views

Access android internal storage for full passive deep malware scan?

Is it possible to passively (with a computer) view/scan all content on an android mobile device's internal storage without crackopen/damaging it? For a deep malware scan of the whole storage of the ...
0
votes
0answers
17 views

Resource of malware source code written in C/C++ [duplicate]

I've started to study malware analysis and have dissected a few binaries. However, I'd like to view the source code of some malware (C/C++) in order to get better insight. I am mainly interested in ...
4
votes
1answer
76 views

Reducing risk for malware exposure from USB storage devices

I have a somewhat hypothetical situation where I need to re-image a machine using a USB thumb drive, however I cannot be certain that the drive itself is malware free. It is the only thumb drive that ...
0
votes
1answer
79 views

When NtUnmapViewOfSection is called?

I'm analyzing an executable and I see that it created a process child and within it there was a call to NtUnmapViewOfSection. I know that this method is almost always malicious and can be used for ...
1
vote
1answer
39 views

What is the purpose of enclosing process spawning?

This file/script is supposed to scan for outdated Node modules and prompt the developer to update them, however I believe it is malware. The instructions were to download the file, set the executable ...
3
votes
3answers
189 views

opening random extensions with notepad

I get files with random extensions sometimes in order to bypass corporate firewalls. Usually I would just ask the other party what it is that I just received. Other times I get curious and open the ...
3
votes
6answers
159 views

What to do with possibly infected files that need to be kept

I have retrieved some old pictures/videos (mp4, many types of avi) of some old events that I want to keep, the problem is that these files have been sitting in confirmed infected machine for a very ...
1
vote
1answer
130 views

How can I send a file with DLL to Cuckoo Sandbox?

I want to submit an executable for analysis in Cuckoo Sandbox. The file must be in the same folder with a DLL I have. How can I request Cuckoo to test my exe and make it run properly? (i.e exe and ...
15
votes
6answers
1k views

Methods of mitigating threats from keyloggers

I am concerned about keyloggers being installed on my system and transmitting sensitive data out of our network. Is there a common method that such malware uses to send its collection back to the ...
0
votes
2answers
141 views

How does malware install itself as a service without requiring user's credential?

I order to understand malware, I've tried to create a toy-example myself. However, I don't understand how the malware install itself on the computer as a service, without the credentials of the user. ...
1
vote
0answers
31 views

cuckoo sandbox - PID exit

I hope someone could help me I've played with cuckoo for a while however I've just done a new installation and it all works however it will not run the binary i would like to scan. the PID exits ...
-5
votes
2answers
37 views

Can a login page be configured to target specific user [closed]

Can a website be configured to only download malware onto a system if a specific user logs in.
1
vote
0answers
84 views

Does this pdf file embeds an exploit or malware?

So a friend of mine was sent a phishing attack(Which was tailored for him and he fell for it) which also downloaded this pdf file: hxxps://www.dropbox.com/s/qw9mcw9p3pmc5j5/resume.pdf?dl=0 and he ...
2
votes
1answer
97 views

Is it there any way to detect payloads generated by veil framework

While pentesting, I used to generate a malicious payloads using the veil framework. The generated payload bypasses antivirus & infects the target system. Is there any way to detect veil payloads ...
0
votes
2answers
75 views

What processes would indicate my computer is infected with malware?

If one opens Task Manager on a Windows machine and looks at all the processes that are currently running, are there any tell-tale signs that one of them is malware?
24
votes
2answers
2k views

How trustworthy is `sudo apt-get install (package name)` in Ubuntu?

One of the easy ways to install a program in Ubuntu Linux is to type a command in the terminal, but how do I know that the program is coming from a trusted source and not from somewhere dangerous? ...
4
votes
1answer
212 views

Is this VM-sandbox idea a good idea for testing viruses? [duplicate]

You want to look at some viruses, so you use something like VirtualBox to create a sandbox environment. But what if we change that environment a lot? What if we do: STEP ONE: Create a bootable flash ...
4
votes
1answer
218 views

Antivirus constantly detecting tmp files as threats

Recently my antivirus has been constantly detecting threats and it's always tmp files. I delete maybe 50 of these files each day. A few days ago it detected a trojan. Last week it detected many ...
0
votes
1answer
57 views

Test the security of my Linux setup [closed]

I have a Ubuntu installation running in VirtualBox. I have made a few modifications to it (some kernel modules and startup scripts) that I hope would make it very secure. Is there anyway I can test ...
0
votes
2answers
54 views

Is there a full-disk-encryption OR file-encryption solution where a trojan can NOT extract the secret key (e.g. from RAM)?

Is there a full-disk-encryption OR single-file-encryption solution like an operating system or a combination of devices or services ... that make sure that the master-decryption-key can NOT be ...
3
votes
2answers
107 views

How to know the time of compilation

I've read that a malware found by kaspersky was compiled at the moscow time zone. How they know the time of compilation ?
1
vote
2answers
85 views

Malicious email attachments analysis

I have a question regarding incoming emails with malicious attachments on my email server. So, my idea, in my ideal setup, is to have a machine aside running virtualization software. This would run ...
19
votes
5answers
3k views

Is it possible for a file that is non-executable and read-only to run malicious code?

On a POSIX system, is there a possibility for a file which is non-executable and read-only (aka with a mode 444) to run malicious code on a machine? If so, can you explain how it would do so?
14
votes
4answers
1k views

Skype called someone and connected to them with no action on my part. What do I do?

This happened to me today, September 12, at about 6pm. Any ideas about what happened, what's going on, and what I should do? I was at home alone with my 2 year old -- I was feeding her dinner. All of ...
55
votes
7answers
5k views

Is it safe to install malware in a VM

Is it safe to install malware in virtual machines? I would like to investigate malware, but I don't want to infect my own computer. Can I install the malware in a VMWare VM, maybe even without ...
18
votes
4answers
37k views

Can a PDF file contain a virus?

Could a PDF file contain any type of malware?
3
votes
0answers
62 views

All Devices on Network Being Redirected to Malware Download [closed]

I have a curious problem. I received a compromised email from an address on my university's domain. Not realizing it was faked, I clicked a link in the email to a url on my university's domain, and ...
3
votes
1answer
79 views

How To Remove Possible Virus Files

See the original question. Using both AutoRun, where I disabled anything that wasn't verified or highlighted (that seemed suspicious), I looked at Process Explorer and found the above unverified. In ...
5
votes
4answers
259 views

Steps after getting hit with malware or browser exploits on Xubuntu

Well, today I was browsing the internet and I suddenly got redirected to a chinese hosted malware site and firefox started going crazy. I checked the url on virustotal with my phone and it found other ...
1
vote
1answer
289 views

Network setup for malware analysis lab in a corporate view

I am planning to setup a malware analysis lab in the Incident Response team of the company I work for. As I am basically a malware analyst I some how managed to get up with the malware analysis lab ...
4
votes
3answers
885 views

What do I do, I got a virus warning on a webpage

I went to the web address (hxxp://www.asanka.com) (WARNING: BE CAREFUL WHEN VISITING) on Safari, then suddenly I got a warning message [image below] What do I do? I'm freaked out. I have a lot of ...
-1
votes
1answer
75 views

Griefing in the social circles of security experts? [closed]

When I was in college more than 15 years ago, I had some friends who were taking CS degrees with focus on Information Security. These folks knew how to write fuzzers, knew how use ring 0 debuggers, ...
67
votes
6answers
37k views

Should I get an antivirus for Ubuntu?

Considering the recent thread regarding anti-virus for the Mac I wonder how many of the arguments put forth are relevant today to Linux systems, specifically Ubuntu. There are no known Ubuntu ...
5
votes
2answers
112 views

Can malicious software be installed inside Linux swap partition?

Is it possible for a virus of any kind to be installed inside Linux swap partition? If so, could it be transferred to the system even after formatting the Linux partition only and reinstalling the OS ...