Malware is any software application which subverts the will of the legitimate owner of a computer, by means of force or subterfuge, with or without personal or monetary gain on the part of the creator.
2
votes
4answers
347 views
How can I detect backdoors?
I have a machine running Mac OS X and I suspect there may be a backdoor installed.
I know that I could take it to a professional security firm for analysis, or nuke it from orbit, but I'm interested ...
2
votes
2answers
534 views
Need advice on linux server being hacked
I'm currently trying to find out how one of our centos servers was compromised. We were experiencing malware on our sites. After searching I finally found the malware injecting into the sites. As it ...
2
votes
3answers
179 views
How to test for presense of antivirus?
I want to test that when user uploads file, then it goes through up-to-date and properly configured antivirus. I think that to test for it I need some malware that is likely to be detected (it doesn't ...
2
votes
4answers
502 views
My website has been hacked, what do i do next? [closed]
So. I couldn't see any other question like this on Sec.Se so i thought i'd ask.
My public website www.foo.com has been hacked. The front page is sending it to be redirected to seoblog.fooblog.com in ...
2
votes
3answers
198 views
How hard it would be to infect a system with malware through a portable web browser
If I use a portable web browser on a USB device like
Google Chrome Portable how hard it would be to get infected by a malware/virus in the system to which the USB device is connected?
Google Chrome ...
2
votes
1answer
100 views
Trust linux images burned from untrusted systems
For securitys sake I'm assuming my system is successfully compromised after a targeted and/or non-targeted attack.
I've downloaded some linux images and burned them to do a re-install.
Since I can't ...
2
votes
3answers
142 views
How to identify the Java program that is maliciously accessing my web site from many client addresses?
For many years, my personal web site receives numerous pairs of hits that look like this, every day:
202.xx.xx.xx - - [22/Apr/2013:12:02:26 +0000] "GET / HTTP/1.1" 200 5923 "-" "Java/1.4.1_04"
...
2
votes
2answers
112 views
Security Practices by Employees in a Corporate Environment
Consider the following situation :
1. Somehow my boss's system got infected with a malware ( He visited one of the Java exploits website).
2. He sends a PDF document containing the requirement ...
2
votes
2answers
3k views
How does Remote Access Trojan / Backdoor Software work?
How does the RAT works? I understand it as once we surf the infected website, browser might download the trojan to our PC automatically. Will it executed and auto install in our computer?
I can't ...
2
votes
4answers
340 views
Detecting malware hidden in P2P traffic
Consider a network situation involving (only) Peer to Peer traffic in medium sized network.
For the sake of convenience, a simple P2P application like DC++ may be assumed, although I am aiming at a ...
2
votes
5answers
358 views
malware classification based on action
Where can I get info with a view to classify malware based on actions performed by the them. Eg. modifying registry files, copying themselves into other executable's etc.
2
votes
2answers
141 views
Example of malware that spreads via USB? [closed]
I'm messing with Mandiant Redline on Windows Server 2012 in a VM and I wanted to download a sample virus that spreads via USB and modify it to attack Mandiant Redline - I've never written malware ...
2
votes
2answers
112 views
Is interpreted malware easier to detect than compiled malware?
Is compiled code more of a security risk than interpreted code? I'm under the impression that it is due to the fact that compiled code can hide malicious code from malware scans.
2
votes
3answers
1k views
Javascript Malware: How does it work, and how can it be mitigated?
I am wondering how malware gets served through Javascript. I've noticed a few illegitimate pop-ups while visiting some financial websites. I wonder how malware exploits work against the application ...
2
votes
2answers
266 views
How do browser injections work?
I've heard many times that malware like Zeus, SpyEye and Citadel are able to do browser injections to steal credit card data. How do they do it? how do browser "injections" work? How are they able to ...
2
votes
1answer
111 views
Is there a tool that puts on a webserver some .html or .php files filled with popular malware like java drive-bys or other browser exploit payloads?
As mentioned in the title I'm looking for a tool that puts on a webserver some .html or .php files filled with popular malware like java drive-bys or other browser exploit payloads? Maybe there is ...
2
votes
1answer
138 views
Can a bad guy be judged for gaining access to sensitive information?
Assuming a hacker has sent to somebody a malware. It's a trojan (digitally signed by TeamViewer) which runs automatically when windows starts up and sends the login info to a web site using GET ...
2
votes
3answers
273 views
Strange file named Aview.exe - WinClient
Today I've just discovered some strange files on my Win 7 PC.
I was browsing through the Windows Firewall Inbound Rules and saw two ACCEPT rules for a program, Aview.exe.
It is located in ...
2
votes
1answer
460 views
What are the most common infection vectors for personal computers?
We have OWASP to tell us about common security vulnerabilities in webapps and such, but what are the most common infection vectors for personal computers?
A few example vectors:
Social engineering ...
2
votes
1answer
255 views
How to reverse engineer w32/malware!gemini?
How would you go about reverse engineering malware w32/malware!gemini. Recently I found it installed on my computer and would like to trace where the data is being sent. Thank you.
2
votes
1answer
574 views
How do you remove the Security Sphere malware?
My boss' computer has become infected with something called "Security Sphere". When googling for information on how to remove it I get many pages that have been optimized for the term "Security Sphere ...
2
votes
1answer
284 views
Can anyone give me more info on this sketchy url I recently visited, is it an attack site?
My girlfriend was browsing images on google when suddenly her browser redirected to this url:
defender-iies.co.cc/scan3/167
The site seemed to be posing as an anti virus, saying your computer is at ...
2
votes
2answers
127 views
How can I find the source of traffic allegedly originating from my IP address?
I have a problem that has been going on for at least 6 weeks.
I have Time Warner for my Internet provider and some websites hosted at GoDaddy.
From what GoDaddy tells me the reason I can not view ...
2
votes
2answers
155 views
Analyzing Network Anomalies for Malicious events
For a network security project we are listing to our network traffic of about 50-60 hosts. We aim at identifying malicious event within our network traffic by identifying network anomalies.
Our main ...
2
votes
2answers
275 views
Where can I find worm traffic sample?
I have a program that has to detect scanning activity of worms.
I need some samples of worms' traffic (pcap files) to try the program, and notes about the procedures which must be taken when running ...
2
votes
1answer
72 views
Seeing outboud connections to random domains, how do I isolate the app responsible?
Last night I loaded up Fiddler2 to do a little debugging and I saw three connections to domains like
hghefhhig
How can I go about isolating the application responsible?
I was thinking possibly ...
2
votes
1answer
76 views
What authentication threat data exists?
I recently read an article that said there was not much data on which authentication threat vectors were actually being exploited in the real world. Eg what percent of password theft was by ...
2
votes
1answer
94 views
How did DNSChanger rogue name servers work?
I know DNS changer, changes DNS server with its own Evil DNS server on an infected computer, then the DNS servers point to their own rogue nameservers and the nameservers change the ads on websites ...
2
votes
2answers
109 views
Preventing Client PC's from accessing C&C machines
At my office I find us constantly fighting with malware. All users run under the "user" level, we have McAfee and have recently reviewed the Best Practices guide to ensure we adhere to it, all of my ...
2
votes
3answers
122 views
Find changes and modifications made to system by application or virus,
I would like to use either Hyper-V or Vmware to take a Clean Base snapshot and a snapshot after an application or virus has made changes so I can then see what was changed between the two images.
...
2
votes
5answers
279 views
Can web application do anything to prevent risk from client-side malware?
Client side malware (keyloggers, screenscrapers etc.) is a great risk. It can't be effectively stopped from side of ordinary application. Only users themselves can do some measures to prevent risk ...
2
votes
1answer
200 views
Malware in browser extensions
How can I check if an extension/addon consist of malware code? Is it easy to detect if it collects sensitive data (like spyware), logging keystrokes and so on? Can AV recognize malware extension as ...
2
votes
1answer
160 views
how is BAT_VOBFUS (or similar) dangerous?
I was reading http://about-threats.trendmicro.com/malware.aspx?language=au&name=BAT_VOBFUS.SM earlier today after it turned up in a scan of a friends PC. I suppose I may be missing something vital ...
2
votes
2answers
326 views
New Undetected Virus?
I am having difficulty with my laptop right now. All of a sudden some partitions would contain a link to the previous contents of that partition. For example:
Before:
Partition T:\
...
2
votes
3answers
184 views
Sucuri giving false positive with their free online scanner because of an .htaccess RewriteRule
I'm not sure where to ask this Question - here, SO, Webmasters.SE, somewhere else? Please migrate if appropriate.
tl;dr:
The following rule in my .htaccess is causing Sucuri's free online scanner to ...
2
votes
1answer
167 views
Good tools for reverse engineering colaboratively?
Does anybody know a good set of tools for doing reverse engineering of binaries in a collaborative way?. My original idea is to disassemble a binary, allowing to add information about functions, ...
2
votes
1answer
83 views
Is there a website or free downloadable program to identify and remove malware from an ISO file?
Is there a website or free downloadable program that allows a user to identify and remove multiple types of malware from an ISO file?
2
votes
2answers
237 views
Can a malware jump from a virtual to the physical machine? [duplicate]
Possible Duplicate:
How secure are virtual machines really? False sense of security?
I found out that malware authors check if the hard drive volume name,
or network card MAC matches ...
2
votes
1answer
242 views
What is known about the sirefef/zeroaccess malware/botnet?
There appears to be an increase in p2p communication among botnets that has been attributed to the sirefef/zeroaccess malware botnet. What is known on this particular threat?
2
votes
1answer
277 views
Intepreting PE (Portable Executable) headers of suspicious malware files
I am starting up on malware analysis, and I am analyzing a file to see if it is packed or obfuscated.
Using PEview I am examining the .text, .rdata and .data headers.
I know that if there is a big ...
2
votes
1answer
183 views
Detecting Key Loggers
We know that key loggers are the most effective and most annoying means of getting compromised over login id/password on the web or any application.... and your whole privacy is breached.
Is there ...
1
vote
1answer
146 views
uninstall and reinstall after hacking [closed]
My computer has been hacked. If I uninstall and reinstall do I loose my files?
The facebook tech tried to sell me a number of pkgs ranged $149-$299 and told me that my account was hacked as was my ...
1
vote
2answers
203 views
How is it possible that a virus can infect the system if the browser is started with non-admin rights
If I open my web browser (for example firefox) in Windows 7 with activated UAC as normal user (non admin) a virus - which uses a security leak in my browser - will only gets privileges of the normal ...
1
vote
3answers
3k views
Multiple running instances of rundll32.exe
I've noticed that in the Task Manager of Windows 7, I have multiple running instances (2) of rundll32.exe. Does this necessarily means that my machine is infected by a malware as noted here: ...
1
vote
1answer
360 views
Firefox Desktop Shortcut Being Renamed
On my Vista PC the Firefox shortcut icon is being randomly renamed. The name changes to some variation of a recently visited URL. This unwanted action has survived several version updates. Of course I ...
1
vote
4answers
200 views
Can JavaScript be used to install malware?
Looking at the Pwn2Own contest got me thinking:
http://arstechnica.com/security/2013/03/pwn2own-carnage-continues-as-exploits-take-down-adobe-reader-flash/?comments=1
If you have all plugins turned ...
1
vote
2answers
163 views
Strange android app … possibly a mass malware?
I started receiving on my android Samsung Galaxy note strange notifications in Mandarin (the language of the people of china). Once I click on the notification it opens my browser with a blank page ...
1
vote
2answers
244 views
How to Secure My DropBox Installation?
I am sharing a DropBox Folder with by Friends for a project so that we can be updated with each other progress. But i was not very convince after reading the How secure is Dropbox?. What if one of my ...
1
vote
3answers
163 views
Any one know about UDP traffic on source port 26221?
On my captured network traffic i observe a flow having a source udp port of 26221 and have different destination udp ports. Some of these destination ports were standards IANA ports. The average ...
1
vote
1answer
96 views
Appilicability of Theoritical Computer Science/Formal methods in Malware research
I would like to know the importance of Theoritical CS/Formal methods in Malware research. Due to the large volume of new malware variants received per day (~50,000 samples/day according to McAfee), ...
