Malware is any software application which subverts the will of the legitimate owner of a computer, by means of force or subterfuge, with or without personal or monetary gain on the part of the creator.

learn more… | top users | synonyms (1)

7
votes
1answer
2k views

Why is my debugger detected as a Trojan by anti-virus software?

I'm trying to use a deugger (namely OllyDbg) to analyze some exe files. However, all the versions I downloaded from the Internet are considered as Trojans by some anti-virus software. (I use ...
7
votes
2answers
8k views

Is Buzzdocks a security threat?

A BuzzDock toolbar suddenly appeared in my Chrome browser. I definitely did not install it nor do I remember installing any crapware. It is not unknown to the internet community (Example 1, Example ...
7
votes
4answers
912 views

How can Antivirus differentiate between a Trojan and a normal remote desktop application software?

RAT (Remote Access Tool, e.g. Sub7) are considered malicious by Antivirus software. How can it distinguish between such patches and a client application for commercial software like NetSupport ...
7
votes
2answers
269 views

How serious is a local virus in terms of network security

My colleague got a notification on his machine of a possible virus (through the virus scanner that is installed by default on all machines). He called up the tech department, and they simply told him ...
7
votes
3answers
3k views

Any additional security with large blacklisting hosts file?

I run Windows with a pretty hefty c:/windows/system32/drivers/etc/hosts file obtained from http://winhelp2002.mvps.org/hosts.htm. I update this file as regularly as I remember and layer it with ...
7
votes
1answer
292 views

Javascript phishing attack sucker: Do I need to be worried? [closed]

So, I'm an idiot. I opened a javascript phishing attack file. I would really, really appreciate some help with decoding the Javascript to figure out whether I'm in trouble, and what sort. I'm on OS X ...
7
votes
3answers
336 views

Risk of spyware on seized devices

This question (Prevention measures against laptop seizure at US borders) addresses a number of techniques for securing data while crossing borders. Perhaps the most useful advice was to simply not ...
7
votes
1answer
658 views

Can a malware steal the content of the clipboard? [duplicate]

Is there any malware that can steal the content of the clipboard?. E.g. say you have a text file with say private info or passwords, and you copy this data to paste on say another text file on a ...
7
votes
2answers
503 views

Do Javascript malware signatures exist?

Are there signatures for malicious JavaScript codes as they exist for other viruses/worms/trojans developed in other programming languages ? If so, are these JavaScript malware signatures defined ...
7
votes
5answers
2k views

Malware code added when site viewed externally

Please see second followup at the bottom! (Now with added real malicious code! ...ish) Prompted by this question, I've noticed that my university's student charity organisation has an interesting ...
7
votes
5answers
4k views

Browser hijacked - how to fix and prevent?

For the second time in a month, my work PC has been infected with malware that is hijacking my Google search results in Firefox. A search for the URL hijacked searches end up at turns up nothing on ...
7
votes
2answers
314 views

Where can I find good resources on reversing web malware?

I am wondering where I can find a good site with resources on reversing web malware like javascript, flash, html5, and any other stuff that is designed to attack the clients. Does anyone have any ...
7
votes
3answers
2k views

Windows: unknown program/service etc. sends HTTP request to download a file; how can I find the origin of that request?

The firewall of my company has detected and blocked a repetitive (every 15 min) HTTP request from a PC, which tries to start a download of a file called ..._chrome_installer.exe(or so) from the host: ...
7
votes
3answers
295 views

How can I circumvent the lack of Java updates?

Just imagine you have a bunch of computers which need Java for some important software and you can't just switch to another vendor because all are using Java in this field of technology. If you start ...
7
votes
3answers
4k views

Exactly how secure is VM browsing?

I generally do all of my web browsing in a VM. I have one "safe" VM running Ubuntu that has guest services installed. I generally only go to sites I deem are trustworthy here. I also have an "unsafe" ...
7
votes
4answers
2k views

Has my network/computer been breached?

I'm not sure if this is the right site to ask, so I apologise if it isn't, but here goes. A while ago I started noticing some odd behaviour. My Gmail account was compromised, it seemed, and I had to ...
7
votes
3answers
6k views

Finding spam sending scripts?

What are the tips for finding email spam sending scripts? I ask because usually I hit a wall in shared hosting environments, so I ask this question as a way to get some insight from others. What I ...
7
votes
2answers
542 views

Process authentication for Linux

Is there any possibility to authenticate a running process in Linux to be sure that this is the original/right one? I know that an Linux operating system is only that secure like the way you use it. ...
7
votes
1answer
350 views

Can virtual machines be used to isolate vulnerable software?

I have had a look at most of the previous questions about virtual machines (VMs) and they all appear to be focused on hosting malware in the VM and preventing it breaking out of the VM. What I can’t ...
7
votes
2answers
158 views

Where Does ClamAV Get Its Virus Signatures?

I see that ClamAV has virus definition files which are mostly hash codes in md5, sha1, and sha256 formats, which either look at the whole file or what are called PE sections of an executable file. Of ...
6
votes
4answers
5k views

What does this malicious PHP script do? [closed]

Somebody hacked my site and uploaded this script (template46.php) to my webroot and its content is: <?php $vIIJ30Y = Array('1'=>'F', '0'=>'j', '3'=>'s', '2'=>'l', '5'=>'M', ...
6
votes
4answers
590 views

Would running VMs inside of VMs be a more secure way to study viruses, etc?

I was reading this post on SuperUser, and it made me wonder about security. I've read somewhere else that some viruses/malware/whatever CAN break outside of a VM... and then infect the host OS. BUT, ...
6
votes
8answers
207 views

Difference between virus and trojan?

To my current understanding: a virus is a program that does not self replicate and relies on the host file being spread, it has malicious intent. A trojan is a program that is run be deceiving the ...
6
votes
3answers
206 views

Is it safe to attach a potentially malicious hard drive to a Solaris machine?

We bring in hard drives from un-trusted sources and would like to ensure that they will not contain any harmful content. What kind of risk is there for Solaris? As in, if Solaris is running, and I ...
6
votes
2answers
2k views

Can a piece of malware/virus inject itself into an ISO

Let's say that I have an infected PC. I download a copy of the Windows ISO(obviously clean) and burn it to an USB. Is it possible that the malware on my computer can inject itself in this process/ISO ...
6
votes
4answers
13k views

How can I detect backdoors?

I have a machine running Mac OS X and I suspect there may be a backdoor installed. I know that I could take it to a professional security firm for analysis, or nuke it from orbit, but I'm interested ...
6
votes
1answer
621 views

Google showing spam links on my site

When I search the name of my site on Google, I see site links description which are spammy and not related to my site. Sometimes when I click I get redirect to phishing sites. But I have used many ...
6
votes
2answers
3k views

How would I go about rebuilding the IAT of a packed executable?

When executables are packed with a tool such as UPX, the real code and data sections are encrypted or obfuscated, then loaded into memory using an injected decrypter stub. This makes static analysis ...
6
votes
3answers
3k views

attack/abuse notification email template

I'm building a template for use when sending "abuse" notifications to ISPs, hosting providers, etc., for when attacks originate from their netblock. Are there examples of templates used for this ...
6
votes
4answers
4k views

What are the best ways to fake a web server

I was wondering if anyone had some insight into the best way to fake a web service response rather than setting up a web server. For instance, while doing dynamic analysis of malware it's useful to ...
6
votes
3answers
277 views

Spamming exploits without user detection

So I asked this question because I had thought that attackers would have a way to identify client software, because surely if 100 different exploits were spammed against a users machine they would ...
6
votes
3answers
1k views

How could malware like Stuxnet be detected?

Stuxnet and others in this list of state-of-the-art Internet worms had certain features that they were very stealthy in leaking out the information they harvested. Thus it managed to go under the ...
6
votes
7answers
2k views

Safe to connect to external drive?

A customer provided an external drive (USB 2.0 and Firewire 800 connections), and wants me to copy files onto the drive. The drive is not new. I have no particular reason to suspect the customer ...
6
votes
3answers
942 views

Phishing virus found on server

I recently had a call from BELL concerning a virus on our Linux ( Debian ) Server. Apparently Google emailed our client about an Italian Database found on our server that was doing phishing. They ...
6
votes
1answer
1k views

How can one create one's own anti-virus scan server at home? [closed]

I suppose that every one used a service such as virustotal.com, anubis.iseclab.org, or any other service that could provide the same objective to scan same files. So my question is how can I make ...
6
votes
3answers
775 views

Malware nomenclature

If there a generally agreed upon naming convention for types of malware/virus? For example, are there agreed upon terms for virus, trojan, worm and the like? If one exists could someone explain it or ...
6
votes
1answer
49 views

Are Push 2FA methods safe from Android and iOS Malware?

I am doing a survey on various 2FA solutions, and recently I came across “Push” 2FA (e.g Duo Security). In this solution, the site (e.g. a banking site) pushes a notification to the user’s mobile ...
6
votes
3answers
1k views

What methodologies are useful when reverse-engineering malware / shellcode?

Whilst I'm familiar with reverse engineering techniques from a technical standpoint, I've never found a good methodology for approaching and dissecting malware / shellcode. I've found hundreds of ...
6
votes
3answers
3k views

Possible to detect packed executable?

A packer is a way of obfuscating an executable program, i.e., transforming so the result is still executable and has the same effect when run, but looks different (so it won't be detected by static ...
6
votes
3answers
2k views

How do browser injections work?

I've heard many times that malware like Zeus, SpyEye and Citadel are able to do browser injections to steal credit card data. How do they do it? how do browser "injections" work? How are they able to ...
6
votes
2answers
311 views

How does the predator network prevent outside control by an attacker?

I read several articles saying some of the command and control fleet for the US robotic attack planes may have been infected with a virus. Does this command and control system communicate with the ...
6
votes
2answers
486 views

Statistics on purposes of viruses/malware

Are there any resources that analyze the purpose or goal or the major viruses/malware out in the wild today? For example, what percentage are used to construct botnets (for DDoS or something else)? ...
6
votes
2answers
254 views

Example of malware in the wild?

I'd like to test an application that detects malware on my network. In order to do that, I have a Windows VM set up that I'd like to infect with malware. But for the life of me, I can't seem to find ...
6
votes
2answers
540 views

How a malware executes remote payload

Let's assume a malware was installed (on a UNIX-based platform) with some social engineering tricks. The original installed code itself may be benign, but the only malicious activity is that the ...
6
votes
1answer
4k views

ISP glitch or a malware? Has this ever happened to you?

Brief background: I consider myself a relatively paranoid power-user, if not an absolute pro. I regularly update my AV and keep up with all the latest updates on my Windows 7 machine. But what ...
6
votes
1answer
263 views

Should veil framework produce packed and obfuscated binaries which bypass virustotal?

I have been working with the veil framework to test an internal IDS system I have in place. I have used a public malware sample which produces an 8/53 hit score on Virustotal and run it through the ...
6
votes
1answer
60 views

Relationship between http time response and geo-location

I have a lot of pcap files about traffic generated by malware, this include vast kind of packets like TCP UDP and more important HTTP. Whereas is possible I have the geo-locations related to the IP ...
6
votes
1answer
86 views

Methods to Monitor Ads For Malware on Mobile Devices

I've noticed that malware being introduced to a mobile application or web application through advertisements, unknown to the developer of the application, is becoming increasingly popular. I've been ...
6
votes
3answers
222 views

find if 0-day flash bug was exploited (on a particular machine)

There have been several critical 0-day exploits in the past days/weeks in Flash alone. Nobody knows how long the 0-days have been exploited, and it is reasonable to expect that there are 0-days being ...
6
votes
7answers
11k views

How safe/secure are banking applications on Android phones?

I have a mobile banking application installed on my phone which allows me to pay for things, transfer money using my phone from my account to another etc. How safe or unsafe is this application? For ...