Malware is any software application which subverts the will of the legitimate owner of a computer, by means of force or subterfuge, with or without personal or monetary gain on the part of the creator.

learn more… | top users | synonyms (1)

0
votes
2answers
189 views

Prevent a file from being encrypted

Is it possible to prevent a file from being encrypted, or at least being easily decrypted in case of encryption? For instance; with the Crypto Locker malware attacking users, could you set up a ...
2
votes
1answer
201 views

what is the difference between dll hooking and dll injection [duplicate]

I am confused and would like to know the difference between DLL injection and DLL hooking? I am familiar with its use in malware and I know that key-loggers use it. I also know that SetWindowsHooKEX ...
2
votes
1answer
108 views

How Regin hides running instances of itself?

I have been reading Symantec & Kaspersky Labs analysis of the Regin malware. According to Symantec [Stage 2] can also hide running instances of Stage 1. Once this happens, there are no ...
13
votes
6answers
5k views

How do I safely inspect a suspicious email attachment?

I received a pretty blatantly spammy email to my Gmail account. I'm not really sure how it made it through the spam filters, since it has all of the telltale signs. The FROM field is spoofed as ...
1
vote
1answer
119 views

what is the difference between dll hijacking and dll injection

I am confused. I would like to know if dll hijacking and dll injection are the same or are they different. I know that some malware use it to do malicious things. thank you in advance
1
vote
1answer
107 views

Polymorphic/Metamorphic malware is written on low-level or high-level languages?

As a part of a course I study polymorphic/metamorphic malware. Every single paper and article I've stumbled upon mentions the techniques used by a malware to achieve polymorphism/metamorphism but non ...
10
votes
1answer
305 views

Malicious PDF Analysis

I have been analyzing a PDF I suspect to contain malicious content. For the most part, I've always trusted automated tools to determine if a PDF was safe to open. However, my eyes have been opened to ...
0
votes
2answers
132 views

How CryptoPHP: Sneaky malware works?

This malware is hidden in pirated themes and plug-ins for CMS . the ‘social.png’ file confirmed we had found the backdoor; as it contained a big blob of obfuscated PHP code . My question is how ...
9
votes
6answers
2k views

Pursuing a career in Malware Analysis

When I was a kid, I want to become a Malware Analyst and work in a Antivirus company. At that time, I love to try out different antivirus solutions and did a research project on Computer ...
1
vote
2answers
93 views

Any “cleaned” virus that's been successfully re-released?

Anti-malware software has to keep track of all bad software there is. To ease this load, it seems like a good idea to stop looking for threats that's been dead for years. Is there any example of some ...
0
votes
2answers
101 views

Do common malware compromise recovery partitions?

Just about now a friend of mine got compromised, actually she was compromised by various adware since long ago but she installed something (her browser was hijacked to deliver even more malware) and ...
2
votes
1answer
81 views

Strange requests coming from EA4350 Linksys routers

I have had two Linksys EA4350 Routers for a week or so being used internal my network as wireless access points, and all of a sudden I started noticing requests from them once per minute (care of my ...
0
votes
1answer
159 views

What is the difference between YARA and CLAMAV?

Can any one explain the difference between YARA and ClamAV ? Are they just two different ways of writing AV or Malware signatures ?
7
votes
1answer
258 views

Can virtual machines be used to isolate vulnerable software?

I have had a look at most of the previous questions about virtual machines (VMs) and they all appear to be focused on hosting malware in the VM and preventing it breaking out of the VM. What I can’t ...
0
votes
1answer
222 views

How to identify which storage USB device is BadUSB-free at store?

Are there certain things I can look for when buying a new external hard drive or flash drives to ensure that the one I purchase does not contain BadUSB? Would popular commercial brands, such as ...
2
votes
2answers
2k views

Is this a valid Windows update page

In my chrome browser if I google for Windows Update the first hit is windowsupdate.microsoft.com/‎ When I click on it I am redirected to ...
5
votes
1answer
523 views

Google Chrome browser warning for goo.gl

I am getting the solid red screen Chrome browser malware warning for Google's own URL shortening website, goo.gl as well as other sites such as bit.ly and delicious.com when I try to navigate there ...
-2
votes
1answer
113 views

Interesting security demos for beginners [closed]

I am thinking about a creating short security demo to get people interested in the security topic. I've had a couple of ideas just want to see if anyone has anything else interesting. Edit: I was ...
2
votes
1answer
548 views

Questions on reflected file download (RFD) attack

I read this article, and the whitepaper by security researcher Oren Hafif which mentions the following salient points: RFD, like many other Web attacks, begins by sending a malicious link to a ...
0
votes
0answers
47 views

Malware or exploit kit without escalation kit

Does anyone know of any malware or exploit kit that do not use a privilege escalation kit and just do malicious things with an unprivileged permission?
5
votes
1answer
511 views

Are the top ten flashlight apps maliciously stealing data and sending it to China, India, and Russia? [closed]

There's an interesting report from a company called SnoopWall that is detailed in this YouTube video from a Special Report with Bret Baier with Fox News. In the report "Cybersecurity Expert" Gary ...
1
vote
3answers
528 views

running malware - add exclusion?

I am having so many problems with my laptop and have 8 malicious items detected and 4445 non malware items detected is it better to quarantine or add exclusion I am Not sure what at exclusion means ...
1
vote
1answer
79 views

Live Boot Devices

Found this article on using Live Boot Devices to do sensitive tasks such as online banking. While the article discusses the benefits of avoiding a possibly compromised host OS, it doesn't mention ...
2
votes
3answers
173 views

How are 1x1 pixel images used in a malicious context?

I have been analyzing malware and I am seeing many 1x1 png and gif files. What could these be used for?
1
vote
2answers
40 views

unprivileged or privileged malware for botnets

For those malwares which are used to organize botnets to DDOS a website, they just need to send and receive HTTP packets. Do they need to be privileged? If they dont need to be privileged, is it true ...
2
votes
1answer
176 views

Is it possible to get malware through an incoming video/audio stream? (e.g. Omegle, Skype etc.)

just a quick question. Is it possible for incoming video/audio streams to contain malware etc. through exploits in the transfer of the video/audio? Thanks in advance.
-1
votes
2answers
120 views

Open Source Malware Scanner/Cleaner [closed]

What is the best Open Source Malware Scanner/Cleaner? Malware-bites is good but it requires licensing for companies.
26
votes
4answers
14k views

Does a Virtual Machine stop malware from doing harm?

I would like to know if it is save for the host system of a virtual machine (VM - VirtualBox OSE in my case) to execute malware. Can a virus break out and read or write data from the host system? ...
1
vote
1answer
94 views

Recovering From Suspected MPEG Malware Attack

Against my better judgement I foolishly opened an MPEG video emailed to me from a friend's email address because the topic in the email was something we had recently discussed. I am fairly certain ...
4
votes
5answers
2k views

Strange android app … possibly a mass malware?

I started receiving on my android Samsung Galaxy note strange notifications in Mandarin (the language of the people of china). Once I click on the notification it opens my browser with a blank page ...
1
vote
1answer
151 views

Microsoft OneNote being detected as Malware

I am helping a friend install OneNote 2013 64-bit on their Windows 7 (64-bit, SP1) system. We went to the official Microsoft OneNote website, www.onenote.com, clicked on 'Windows' (just to the right ...
9
votes
2answers
3k views

How can a malicious URL affect a computer?

Many security experts advise not to click on malicious URLs. How can clicking a URL affect a computer's security? If a malicious file was downloaded and executed, then a computer's security may be ...
0
votes
2answers
182 views

When MBR pirates grin as an indication of absolute pleasure!

Someone, have no idea who, really worked my computer, and placed some rootkit, all-knowing, all-smashing malware something and I simply cannot keep Windows OS clean in a multiboot configuration with ...
-1
votes
1answer
142 views

Home PC has been compromised remotely and even after cleaning my PC repeatedly, the problem still comes back, help please? [closed]

I'm a regular guy running two small franchise businesses with a basic understanding of computers etc, (very basic really), but I am certain my home network has been hacked and I am finding lots of new ...
4
votes
1answer
2k views

What happened with badBios [duplicate]

Maybe some of you remember that in November 2013 the respected researcher Dragos Ruiu claimed that he was infected by some super advanced virus that no one ever heard of before. Experts agreed that ...
0
votes
1answer
134 views

How to ensure a second hand computer is safe to use [duplicate]

I'm planning to buy a second hand computer (2012 Mac mini, which is no longer available in stores). Because I'm not sure if there is any malware in the computer so I will perform hard format several ...
0
votes
0answers
22 views

Infer encoding mechanism from n-grams distance

I have a series of obfuscated strings which across the set of strings have regions of high variance and regions of low variance (implying some encoding mechanism as opposed to an encryption procedure ...
3
votes
5answers
166 views

Windows: Any method to enforce user confirmation before the browser opens a URL requested by an external desktop app?

A robust outgoing firewall will protect against desktop applications directly connecting to the internet without your permission. However, as the browser is a generally authorized application for ...
3
votes
1answer
127 views

Dos Attack and other malwares!

I have been experiencing DoS attacks: ack scan and rst scan. Now I know these are supposed to be normal and the internet works that way but I experience severe internet disconnection when that ...
1
vote
1answer
46 views

Javascript file detection

One common technique I use is xor bruteforcing on binary data. In this case, I would like a heuristic approach to determine whether or not any possible candidate plaintexts are javascript. This rules ...
0
votes
2answers
211 views

Fake phone call

I have a problem, getting call from known numbers and when he lifts it, no one is speaking from other side! Well, the awkward part is, the call is from known numbers only, but if I ask the person ...
5
votes
7answers
29k views

Scanning for files than have been encrypted by CryptoLocker

I am just asking in case someone has already done the analysis. A customer has a large set of network drives that were mapped to a CryptoLocker infected machine. The infection itself has been treated. ...
14
votes
1answer
1k views

Why do exploit kits use droppers?

I've been looking into the structure of the online criminal underground, which consists of exploit kits, droppers, and malware payloads. What is the function of the dropper in this pipeline? Why ...
1
vote
2answers
262 views

Will Ad Block Plus block the ads that give someone Cryptowall 2.0?

Now I already know that making sure your browser plugins are either non-existent or up-to-date is one way of being on the safe side against ransomeware like Cryptowall 2.0; but since clicking ads are ...
2
votes
2answers
625 views

What agency digitally signed Cryptowall 2.0 so that it can run without being detected?

What agency issued a digital signature for the Cryptowall 2.0 ransomware virus? Is it too early to tell? As far as I know this is how Microsoft planned to prevent malware, by adding a digital ...
1
vote
2answers
116 views

Help understanding malware infection

I'm kind of a newbie to security and need help fully understanding how I would infect myself inadvertently. Let's say I was to download a .zip file attached to an email and I unzipped the contents. ...
1
vote
2answers
87 views

Manual malware / adware analysis after SEP scan

My company currently gets malware alerts from several source's i.e. Symantec Endpoint Protection and FireEye. When these alerts are triggered, a manual process of logging onto the user's machine is ...
1
vote
3answers
235 views

Malware stole an executable file on my computer? Seems unlikely

If you don't want to read all of the details, skip to the bottom; I'll make a summary. I created a computer program as a proof of concept (I threw it together in 12 hours, so I wrote it in Visual ...
18
votes
7answers
1k views

Why do malware creators use such clever technologies for such silly purposes?

Some days ago I got infected by a malware, probably something new and very clever, as it went in unstopped and no scanning tool was able to detect it afterwards (see this question). It was a ...
2
votes
1answer
771 views

How Do I Troubleshoot a Browser Hijack on a Mac?

My Mac is getting weird redirects with Safari and Chrome, however not with Mozilla Firefox. Since I cannot find software to do malware removal on Apple products or any good information, I am at a loss ...