Malware is any software application which subverts the will of the legitimate owner of a computer, by means of force or subterfuge, with or without personal or monetary gain on the part of the creator.

learn more… | top users | synonyms (1)

98
votes
11answers
13k views

Is there any way to safely examine the contents of a USB memory stick?

Suppose I found a USB memory stick lying around, and wanted to examine its contents in an attempt to locate its rightful owner. Considering that USB sticks might actually be something altogether more ...
17
votes
3answers
628 views

How Do Rootkits & Other Low-Level Malware Still Manage to Load on Systems Protected by Secure Boot (and TB/MB)?

Let me try asking my question this way... Let's say that I'm a offensive cyber Bad Guy working for a foreign state-sponsored Advanced Persistent Threat unit. My unit is charged with, say, stealing ...
8
votes
1answer
116 views

In VMs, do shared folders reduce security effectiveness?

VirtualBox offers the option of using shared folders, others probably offer the same thing. I am not sure whether the host is directly accessing the memory of the guest, or if there some process which ...
3
votes
5answers
1k views

Can any dangerous file(Virus, Trojan, Malware, etc) cause harm inside a zip or rar?

I am using Windows 8.1 pro with Mozilla Thunderbird for my email requirements. I have my Thunderbird set to auto download all email attachments, however upon runnning a Virus scan I am seeing many ...
2
votes
0answers
47 views

Open source firmware as mitigation against firmware persistent malware?

I am concerned about the threat of persistent malware entrenched in device firmware. I am not familiar with the intricacies of firmware security, so I am turning to SE for help. I recently learned of ...
2
votes
2answers
89 views

why would keyloggers be used for stealing money less often than banking malware?

I read Kaspersky statistic and I saw this image : Why would keyloggers be used for stealing money less often than banking malware?
4
votes
4answers
165 views

Should I format storage after buying it?

I've just bought a new (unused) external HDD. Should I format it or is it save to use it directly? Did it already happen that a device was infected before the first customer use? Will formatting ...
1
vote
2answers
172 views

Where should I start looking if an internet provider has notified me of malware? [closed]

I got an email earlier today from my internet service provider telling me there's some sort of malware on one of the ips in my home, and it had asked me to download some antivirus software. The ...
3
votes
2answers
204 views

Why Antivirus Detects Simple Java Program as Trojan?

Just now I was testing a very simple code in java when I noticed a strange thing.......... On Compiling the program My antivirus detected it as trojan and deleted the jar file....... Further it is not ...
1
vote
1answer
41 views

Techniques exclusive to my malicious version of my own benign program?

Do any special techniques become available to me when writing the malicious version of a program, when I myself am also the person programming the legitimate program? (Any measure I could take with ...
9
votes
3answers
260 views

Why is the victim a server instead of a client?

I just finished creating my own remote administration tool "a server to multiple client one" using System.Net.Socket, - "Watch Dogs fan :P" then I try to search on google how they make or design ...
5
votes
2answers
187 views

Is it possible to infect an e-mail by accident?

Sometimes, my friends send me e-mails. I know that they don't care that much about computer security (while I care). I know that they don't know how to create an infected e-mail (no reason for doing ...
2
votes
4answers
1k views

Detecting malware hidden in P2P traffic

Consider a network situation involving (only) Peer to Peer traffic in medium sized network. For the sake of convenience, a simple P2P application like DC++ may be assumed, although I am aiming at a ...
1
vote
1answer
67 views

Protecting users with browser extension. Is it possible, if the machine is already infected?

Assume a trojan acquired admin privilege on a Windows 7 machine. How easy is it for the trojan to replace/hijack/modify a browser extension without user knowing it? Is it possible? I am thinking of ...
8
votes
5answers
1k views

Is disabling auto-run enough to protect against malicious code from removable media automatically infecting a machine?

If I block auto-run on a windows machine, is this enough to protect it from malicious code (assuming I don't run any files manually)? Or are there known vulnerabilities that may cause infection?
3
votes
2answers
785 views

What agency digitally signed Cryptowall 2.0 so that it can run without being detected?

What agency issued a digital signature for the Cryptowall 2.0 ransomware virus? Is it too early to tell? As far as I know this is how Microsoft planned to prevent malware, by adding a digital ...
1
vote
3answers
109 views

My Hacked(?) Wordpress Sites

Hi all I'm using a shared hosting and my hosting company is saying my sites have unwanted codes and in report: Your account had been used to attack our/other servers! Your account holds malicious ...
3
votes
1answer
41 views

A single site for reporting unknown virii

I have just received an email with an unknown virus. I happily passed through my scanners. I have checked it's still unknown to all of 4 anti-viruses I have an access to. I have already reported it ...
2
votes
2answers
101 views

How to find a process that is sending HTTP HEAD requests

When I was using fiddler for testing a web Client(capturing non-browser traffic only), it captured the below by coincidence. Is there any way that i can found out which process is doing this? I am on ...
19
votes
4answers
5k views

Malwares source repositories. Where? [closed]

As the best way to learn is to read the code, do you know where I can find malware/virus/whatever source code to read?
8
votes
4answers
197 views

Does it matter which platform a file is scanned on for malware?

Different operating systems use different file types and file systems. Does it make a difference to a virus scan which system it is being run on and what type of malware it's looking for? I ask ...
2
votes
1answer
94 views

How Is It Possible That an App Connects to 0.0.0.142 IP Address? [closed]

I regularly review connections being established from apps in my phone to external services. Lately, I found Facebook connecting to 0.0.0.142. So I deleted Facebook for Android app. Now, I just found ...
2
votes
1answer
116 views

Someone is injecting malware into my website

My website was hacked last year and someone had uploaded a script which was hogging up all CPU and load avg went up to 30+ till our hosting provider temporally suspended the account, that was a few ...
5
votes
4answers
374 views

Besides MBR & BIOS, is it possible for a rootkit to stay persistant after a format of the harddrive?

If a system becomes infected and does not have any other storage units besides the one hard drive. Is it there any other way for a rootkit to stay on the system besides infecting the BIOS OR the MBR ...
12
votes
1answer
185 views

Where is the best place to get descriptions of malware?

I'm looking for a source of descriptions of 1990s to early 2000s malware; I have searched for a very long time yet found very little. I require information such as payload activation dates, files ...
2
votes
0answers
45 views

Novicorp WinToFlash Lite, spyware etc

I used Novicorp WinToFlash Lite on Windows 7 to create a Windows 10 bootable USB memory stick. While creating the USB drive, I noticed that WinToFlash wrote something like adding blahblah files to ...
0
votes
2answers
106 views

Media players (vlc, spotify and windows media player) don't work after a virus attack [closed]

I just got attacked by a couple of viruses while my laptop was completely unprotected. I installed the necessary programs and tried to get most of the symptoms to go away. I also think I deleted most ...
0
votes
1answer
919 views

PHP mallware attack [duplicate]

I'm desprate because my site has been attacked by some malware that adds code below on every php files. I tried to edit and chmod the infected file but its coming back. Scanning with ClamAV found ...
3
votes
2answers
1k views

Why does Google Safe Browsing keep detecting malware on my website?

We provide a freemium service to upload large files and download them later on. Using ClamAV, we scan every file for viruses after it is uploaded and before it can be downloaded. The file is deleted ...
2
votes
2answers
238 views

Can a BIOS or UEFI infection transfer to other storage drives without the OS presence?

I am already aware that a BIOS or UEFI malware "activate" only in the OS environment. Is it possible though that a spread mechanism be activated without the presence of the OS, so that it would infect ...
2
votes
1answer
65 views

Thousands of files (png, pdf, tex, java, cpp, etc.) deleted on Mac OS X Yosemite

Yesterday, I noticed that, starting at 12:40, many thousands files had been automatically deleted from my drive. The computer is a Macbook Pro with a recent version of Mac OS X Yosemite. Since many ...
14
votes
3answers
61k views

Is it possible to make a phone call appear to come from another phone, even to the network provider?

Quick Question Is it possible that I could call a mobile number, but have the call forwarded through another number active on a different phone that someone else has? I have had unlimited access to ...
8
votes
2answers
907 views

Does the Mebromi BIOS flashing rootkit mean APTs for personal computers are here?

With the recent discovery of the Mebromi BIOS firmware virus/MBR rootkit in the wild are we now actually in the age of Advanced Persistent Threats (APT) for personal computers and does that imply ...
6
votes
1answer
60 views

Relationship between http time response and geo-location

I have a lot of pcap files about traffic generated by malware, this include vast kind of packets like TCP UDP and more important HTTP. Whereas is possible I have the geo-locations related to the IP ...
7
votes
2answers
498 views

Do Javascript malware signatures exist?

Are there signatures for malicious JavaScript codes as they exist for other viruses/worms/trojans developed in other programming languages ? If so, are these JavaScript malware signatures defined ...
4
votes
2answers
663 views

Malware (adware?) infection on linux

Recently I've get stuck with a malware(adware/virus ?) which I can't remove. here is the condition: I'm using Linux (Archlinux), it's uptodate and I don't install any packages outside standard repos ...
15
votes
4answers
2k views

How is a worm different from a virus?

In spite of various online articles, I'm a bit unclear on the distinction between a "worm" and a "virus". Two related questions-- Is there a useful and clear distinction here or no? If so, what is ...
1
vote
5answers
960 views

Isolate two hard drives with two operating systems

I would like to install a second hard drive on my laptop and use it as something like a sandbox, just for games and home, and the other for work and sensitive data only. Both hard drives have windows ...
2
votes
1answer
50 views

apparmor alternative for MacBook [closed]

Does anyone know an alternative to apparmor for Mac? Every time I use winebottler my MacBook gets Windows viruses. Wanted to protect my Mac from it.
7
votes
4answers
8k views

Are there faux/fake malicious websites to test web reputation services similar to EICAR?

Antivirus writers have agreed for their software to recognize a standard "fake" virus file - the EICAR file, to let users check, that the software is up and running. Are there any equivalent test ...
3
votes
2answers
118 views

Phishing/Malware redirection through AdExchange on Android

Issue: Yesterday I discovered a strange behaviour in the Chefkoch.de App. During the search for recipe, Firefox opens up with a (German) phishing warning screen. This happened not only on this ...
2
votes
1answer
211 views

How does Cryptolocker propagate?

One of the computers in my office has been compromised by Cryptolocker. Once informed, my immediate response was to disconnect the computer from the network - though there was a period of a few hours ...
-3
votes
1answer
46 views

Virus that scans hard drive for utility bill + ID? [closed]

Is it possible a virus or malware could scan a hard drive to find ID documents etc and upload them? Randomly some old files were re-uploaded to Dropbox without any updates to them or modifications. ...
1
vote
0answers
66 views

unsolved issues with dynamic malware analysis? [closed]

I am trying to identify some known unsolved issues currently present in Dynamic Malware analysis. Going further I plan to work on resolving some of the identified issues. After reading some research ...
4
votes
2answers
237 views

Reaction to spam from acquaintance

It often happens that I receive an email like this: From: acquaintance@herbal-viagra.com To: me@domain.com Hi, me@domain.com -- Check this out: http://herbal-viagra.com -- ...
4
votes
2answers
266 views

Is this powershell script an infection?

While I was sitting in front of the computer not using it,my Windows 10 machine quickly flashed a few terminal windows, and then gave me a Windows Security popup, asking for my password. I have no ...
2
votes
2answers
143 views

How to track down and remove Mac malware that is calling out?

Little Snitch periodically brings up a dialog that says: Terminal via node wants to accept an incoming connection from X on port 3000 (remoteware-cl). X are different IPs in eastern europe. A full ...
98
votes
8answers
67k views

How secure are virtual machines really? False sense of security?

I was reading this CompTIA Security+ SYO-201 book, and the author David Prowse claims that: Whichever VM you select, the VM cannot cross the software boundaries set in place. For example, a ...
21
votes
3answers
1k views

Are official browser add-ons really safe?

Almost any browser addon/extension that I install on my Chrome or Firefox (be it Firebug, RESTClient, ...) warns me, saying: It [the add-on] can: Access your data on all website Access ...
3
votes
1answer
66 views

How to verify .plist and .kext files are legitimate?

While scouring through tons of logs generated during an audit of a Mac filesystem after a potential malware infection, and I am wondering if there are any better ways to verify that all kernel ...