Malware is any software application which subverts the will of the legitimate owner of a computer, by means of force or subterfuge, with or without personal or monetary gain on the part of the creator.

learn more… | top users | synonyms (1)

2
votes
2answers
323 views

Convert PDF to plain text, remove malware?

Take a PDF, copy all, paste it into a .rtf document in textedit, --> make plain text. will this remove/nullify any malware from/in the pdf? In other words, if I open the PDF on one machine and convert ...
0
votes
1answer
64 views

What are features of a suitable tool for tracking and reporting security incidents? [closed]

What are features of a suitable tool for tracking and reporting security incidents? Is it a bad idea to have one central repository for tracking all types of incidents, from helpdesk issues, to ...
5
votes
1answer
173 views

Should veil framework produce packed and obfuscated binaries which bypass virustotal?

I have been working with the veil framework to test an internal IDS system I have in place. I have used a public malware sample which produces an 8/53 hit score on Virustotal and run it through the ...
3
votes
1answer
172 views

malware attack on my website may have started a SOCKS server - please advise [duplicate]

A website I do some volunteer work for was recently one of those affected by a wordpress plugin vulnerability. Following advice in the answer to this question, which contains details of the attack, ...
2
votes
1answer
315 views

How is the file overlay read by an exe/virus?

According to what I know ,Overlay is the part of PE file that is not covered by the PE header and therefore isn't part of the virtual image in the Loaded PE. My question is if the overlay is not ...
3
votes
3answers
101 views

Remove pdf malware by re-printing to new pdf or text extract?

Consider you have a suspicious pdf file that might contain malware. Would it be sufficient to either: (1) open the pdf file in a virtual environment and let the pdf viewer or pdf-creator program ...
4
votes
1answer
310 views

How to protect against viruses that takes files as hostages by encrypting them?

Today I was infected by CoinVault, a new malware similar to CryptoLocker I believe. Before today I was unaware of this entire type of malware. Fortunately I was protected by offline backups, but I ...
1
vote
2answers
138 views

Can folders [alone] have viruses?

I know that files can be infected, but can a Folder itself have a virus/trojan?
1
vote
1answer
164 views

Executed malicious exe file. Help please [closed]

windows 8.1 Im not very computer savvy i was wondering if someone could help me out with this. So I downloaded an exe file then ran it as administrator. It turns out it was a virus. Yeah I'm a genius. ...
3
votes
1answer
242 views

Does malware which infects the BIOS/ Firmware always need 'root' access to do so?

There are very few hardened Operating Systems who restrict or totally disable Terminal 'root' access for the user. Would this feature prevent persistent BIOS rootkits from writing into BIOS or ...
3
votes
4answers
253 views

Can my phone be affected by malware through mobile phone signal?

My phone is newly bought. Can a hacker actually scan the mobile phone signal around me, detect it, and put virus/malware into my phone THROUGH the mobile phone signal of my mobile service provider? ...
3
votes
2answers
112 views

How to securely install software on Ubuntu?

How to install a software like Sublime Text on Ubuntu 14.04 LTS and mitigate against a MITM attack? There is a PPA available, but the PPA must be added manually. I don't see any PGP keys or MD5 ...
0
votes
1answer
190 views

How is Thread local storage used by malware/Virus?

I have been told that code in TLS is run before the entry point of an exe is reached ,so if one puts a breakpoint on this TLS address he/she could debug the behavior of the virus.Can Fiber local ...
3
votes
4answers
330 views

Could a compromised WP database cause re-infection without the hacker needing to login into WP?

Is it possible that a compromised WordPress database could somehow be used to re-infect a website? I'm not talking about the hacker decoding user passwords and login into WP. I'm talking about the ...
2
votes
2answers
429 views

Malware removal: Iframe injected javascript

My Joomla! website is infected by an iframe injected malware, according to Sucuri SiteCheck: To remove the malware, does it suffice to remove the infected file site/media/system/js/caption.js? Or ...
1
vote
1answer
86 views

How to analyze why Chrome downloaded a particular file?

I had a very few Chrome tabs open (see appendix) and other safe websites. Suddenly, without any prompt or action from me, chrome starts downloading the file "NEW!_iPhone7_LEAKED_PHOTO.JPG.exe" which ...
2
votes
4answers
749 views

Can visiting a malicious website infect an iOS or Android device?

Can visiting a malicious website infect an iOS or Android device? We're talking about visiting such sites via a browser. We're not talking about downloading any malicious apps. Thanks!
1
vote
2answers
166 views

Viewing an infected file via FTP and code editor won't infect my PC right?

My apologies this may sound like a paranoid question... Recently my friend's website was infected by malware. With her permission, I FTP into her account to have a look and found some malicious PHP ...
0
votes
2answers
426 views

How did piratebay.se search engine get in Chrome as an “other search engine”

I have an IT client with a user who had piratebay.se/... listed within his Chrome's (v39, 64-bit, OS X, 10.10.1) "Other Search Engine" section. I know a user could manually add it and suspect the ...
0
votes
1answer
181 views

Where can I download the Sony hack malware (for analysis)? [closed]

I want to analyze the Sony hack Malware as there have been a lot of stories on who is responsible; from the US government implicating North Korea to news articles stating it's an inside job. The fact ...
0
votes
2answers
119 views

Only HTTP(S) port is open. Why do I need to worry about unpatched software?

Unpatched software poses no risk by themselves. They're only problematic when someone exploits it. How could malware get into my system if I do have unpatched software in general and I'm connected to ...
1
vote
1answer
101 views

Why is there a path to a .pdb file in an exe I am trying to reverse?

My query is ,if I'm seeing a .pdb path in a exe(VC++) what conclusion can I draw from it.Why does the exe have these paths and does it have significance in malware analysis? eg ...
2
votes
2answers
166 views

Connecting trusted and untrusted networks

We have two domains that are isolated. First domain is the Corp LAN, the second is an hostile untrusted network with untrusted clients that could contain malware. Clients on the untrusted network ...
0
votes
2answers
217 views

What is the best resource to learn malware analysis? [closed]

I am looking for a resource that helps learn malware analysis. I know about the practical malware analysis book but i am looking for something other than a book. For example a Site or video tutorials. ...
1
vote
2answers
123 views

Limitations of botnets [closed]

My question is very closely related to this question but I didn't find my answer there. Specifically, I'm interested in whether the C2 server can modify aspects/properties of the malware and, if so, ...
1
vote
2answers
166 views

What are the security threats when Googling and surfing when my Gmail account is open?

Suppose I log to my Gmail account. After that, I use Google to search for random websites and visit some. Are there any security threats on my Gmail account when Googling and surfing the net while it ...
5
votes
1answer
350 views

Exploit SoakSoak injected in Wordpress

I have recently received an attack to my website and Google is warning visitors to not load the page. The malware is located in wp-includes/js/swfobject.js of my Wordpress and I had deleted it but ...
8
votes
2answers
167 views

AV detection of signed malware

With the massive Sony leaks (including their private keys/certificate), i was wondering: How do major AVs deal with signed binaries? ie: Does it influence their detecting ability of the signed ...
4
votes
1answer
99 views

Would DLL hijacking work with load-time linking?

I was wondering if DLL hijacking would work with all types of linking or just run-time linking. I hear that malware uses it and wanted to know how it works
2
votes
1answer
239 views

What does this potentially malicious code do? [closed]

While reading a website called 4chan/b/ someone posted this code snippet, i was wondering what it does when executed? it appears to be C code, how harmful is it? This is the full post: Run a live ...
2
votes
0answers
137 views

Is the process Wslxrqjet.exe, tagged 'Google Chrome', malicious?

Multiple instances (between 3 and 15) of this of this process Wslxrqjet.exe are running on my Windows 8 system at all times. Windows Task Manager 'Description' field for all instances is "Google ...
-3
votes
1answer
928 views

Remote UAC bypass and Microsoft does not regard it as security Boundry [closed]

Microsoft has tremendously increased the security of Windows 8.1 but i found a technique to bypass UAC remotely I know that if User belongs to local group Administrators he is not given full Admin ...
2
votes
2answers
421 views

Prevent a file from being encrypted

Is it possible to prevent a file from being encrypted, or at least being easily decrypted in case of encryption? For instance; with the Crypto Locker malware attacking users, could you set up a ...
22
votes
3answers
2k views

Linux-based Turla trojan

There are several articles describing the newly discovered Linux-based Turla trojan. But basically, all these articles repeat the same, very limited, information. Can anybody provide more details, ...
2
votes
1answer
420 views

what is the difference between dll hooking and dll injection [duplicate]

I am confused and would like to know the difference between DLL injection and DLL hooking? I am familiar with its use in malware and I know that key-loggers use it. I also know that SetWindowsHooKEX ...
2
votes
1answer
172 views

what is the difference between dll hijacking and dll injection

I am confused. I would like to know if dll hijacking and dll injection are the same or are they different. I know that some malware use it to do malicious things. thank you in advance
1
vote
1answer
214 views

Polymorphic/Metamorphic malware is written on low-level or high-level languages?

As a part of a course I study polymorphic/metamorphic malware. Every single paper and article I've stumbled upon mentions the techniques used by a malware to achieve polymorphism/metamorphism but non ...
0
votes
2answers
167 views

How CryptoPHP: Sneaky malware works?

This malware is hidden in pirated themes and plug-ins for CMS . the ‘social.png’ file confirmed we had found the backdoor; as it contained a big blob of obfuscated PHP code . My question is how ...
2
votes
1answer
134 views

How Regin hides running instances of itself?

I have been reading Symantec & Kaspersky Labs analysis of the Regin malware. According to Symantec [Stage 2] can also hide running instances of Stage 1. Once this happens, there are no ...
1
vote
2answers
101 views

Any “cleaned” virus that's been successfully re-released?

Anti-malware software has to keep track of all bad software there is. To ease this load, it seems like a good idea to stop looking for threats that's been dead for years. Is there any example of some ...
0
votes
1answer
271 views

What is the difference between YARA and CLAMAV?

Can any one explain the difference between YARA and ClamAV ? Are they just two different ways of writing AV or Malware signatures ?
0
votes
1answer
368 views

How to identify which storage USB device is BadUSB-free at store?

Are there certain things I can look for when buying a new external hard drive or flash drives to ensure that the one I purchase does not contain BadUSB? Would popular commercial brands, such as ...
7
votes
1answer
300 views

Can virtual machines be used to isolate vulnerable software?

I have had a look at most of the previous questions about virtual machines (VMs) and they all appear to be focused on hosting malware in the VM and preventing it breaking out of the VM. What I can’t ...
0
votes
0answers
49 views

Malware or exploit kit without escalation kit

Does anyone know of any malware or exploit kit that do not use a privilege escalation kit and just do malicious things with an unprivileged permission?
2
votes
1answer
186 views

Strange requests coming from EA4350 Linksys routers

I have had two Linksys EA4350 Routers for a week or so being used internal my network as wireless access points, and all of a sudden I started noticing requests from them once per minute (care of my ...
2
votes
3answers
798 views

running malware - add exclusion?

I am having so many problems with my laptop and have 8 malicious items detected and 4445 non malware items detected is it better to quarantine or add exclusion I am Not sure what at exclusion means ...
2
votes
3answers
314 views

How are 1x1 pixel images used in a malicious context?

I have been analyzing malware and I am seeing many 1x1 png and gif files. What could these be used for?
1
vote
2answers
50 views

unprivileged or privileged malware for botnets

For those malwares which are used to organize botnets to DDOS a website, they just need to send and receive HTTP packets. Do they need to be privileged? If they dont need to be privileged, is it true ...
12
votes
1answer
388 views

Malicious PDF Analysis

I have been analyzing a PDF I suspect to contain malicious content. For the most part, I've always trusted automated tools to determine if a PDF was safe to open. However, my eyes have been opened to ...
3
votes
2answers
315 views

Is it possible to get malware through an incoming video/audio stream? (e.g. Omegle, Skype etc.)

just a quick question. Is it possible for incoming video/audio streams to contain malware etc. through exploits in the transfer of the video/audio? Thanks in advance.