Malware is any software application which subverts the will of the legitimate owner of a computer, by means of force or subterfuge, with or without personal or monetary gain on the part of the creator.

learn more… | top users | synonyms (1)

3
votes
3answers
3k views

Can malware physically damage a hard drive?

I recently responded to an incident of supposed malware infection. The symptoms were simply, "My computer freezes at random times." The response ended with replacement of the physical hard drive and ...
-1
votes
2answers
169 views

Fake Microsoft Security Department [duplicate]

some Indian man called home saying that he's calling from some Windows Security Department, and there are about 16 other people connected to my computer and the're doing illegal things on my computer. ...
1
vote
1answer
119 views

Is it “cross-platform attack” if first OS is not attacked at all?

I am analyzing a mobile application, which has embedded files(Worms) to attack a desktop OS. But this application does not do any harm to the mobile platform. Mobile is just a medium to deliver ...
1
vote
0answers
90 views

HTTP GET Request to a webpage that does not exist [closed]

I am seeing a machine is making a HTTP GET request to webpage (ex: www.sample.com/1.png), proxy devices respond with status code 407 (proxy auth required). But when I checked for the site via ...
2
votes
2answers
100 views

Is it safe to store a file in a temporary folder before it has been scanned for a virus?

I'm working on an application that makes use of the Symantec Protection Engine to scan uploaded files. I'm having issues with my files after they have been scanned. One possible solution I've seen ...
1
vote
1answer
57 views

Apps that require user to install advertised apps in order to get activated

I am analyzing a mobile application, and I am not sure if it is just an adware/greyware or does it enter the category of malwares. This app does not really do any harmful activity. But it forces user ...
-1
votes
1answer
77 views

Can malware “upload” itself to the actual mobile base station and regain back to another phone?

My question is can a malware from my affected phone "upload" itself to the ACTUAL REAL mobile base station from the service provider, and regain back to my another phone with the same number (same ...
6
votes
4answers
6k views

Are there faux/fake malicious websites to test web reputation services similar to EICAR?

Antivirus writers have agreed for their software to recognize a standard "fake" virus file - the EICAR file, to let users check, that the software is up and running. Are there any equivalent test ...
11
votes
5answers
287 views

Security of root terminal (su -) when logged into X

I often log into X as normal user (of course), open terminal and switch to root: su - I have then a terminal owned by user but effectively with root privileges. Are there any security issues in ...
1
vote
0answers
79 views

Detecting reflective DLL injection any other ways?

any way to detect it? maybe using mcafee hips rules? Are there any known Techniques to detect it ? like walking the VAD tree or something?
1
vote
2answers
116 views

Which security measures does PyPI and similar third-party software repositories take?

PyPI is a third-party software repository for Python packages. Everybody can upload packages to it (see The Python Package Index (PyPI)). How does PyPI prevent people from uploading malware? When I ...
3
votes
1answer
425 views

Odd requests from Apache logs

I've been monitoring some weird activity in the access logs for my site and I've noticed a couple of weird attempts against the server. I'm wondering if anyone has seen these before. It's an Apache ...
2
votes
2answers
317 views

Convert PDF to plain text, remove malware?

Take a PDF, copy all, paste it into a .rtf document in textedit, --> make plain text. will this remove/nullify any malware from/in the pdf? In other words, if I open the PDF on one machine and convert ...
5
votes
6answers
486 views

How to protect the company VIPs

Environment: small engineering company (<50 employees) and everyone is local administrator on their computer, including everyone in the management group. Setup: Some standard security features are ...
4
votes
2answers
1k views

How do browser injections work?

I've heard many times that malware like Zeus, SpyEye and Citadel are able to do browser injections to steal credit card data. How do they do it? how do browser "injections" work? How are they able to ...
0
votes
2answers
3k views

Trying to get rid of hackers who have access to all my devices [closed]

What is the best way to go about getting rid of hackers that have gained access to all my personal computers, (both old and recently purchased) phones, and even random computers I use to simply get ...
0
votes
1answer
64 views

What are features of a suitable tool for tracking and reporting security incidents? [closed]

What are features of a suitable tool for tracking and reporting security incidents? Is it a bad idea to have one central repository for tracking all types of incidents, from helpdesk issues, to ...
13
votes
5answers
567 views

What is the risk of giving USB drives as promotional items by a healthcare provider

There have been a couple of instances where malware infected USB drives have been given away unknowingly as promotional items at conferences, e.g., IBM in 2010. Besides this, if a healthcare company ...
3
votes
1answer
172 views

malware attack on my website may have started a SOCKS server - please advise [duplicate]

A website I do some volunteer work for was recently one of those affected by a wordpress plugin vulnerability. Following advice in the answer to this question, which contains details of the attack, ...
29
votes
7answers
16k views

Is making a clean install enough to remove potential malware?

Is formatting the disk and reinstalling the system from scratch (to Ubuntu) enough to remove any potential hidden software spyware, keyloggers etc.? Or can something still persist installed in the ...
11
votes
3answers
878 views

Skype called someone and connected to them with no action on my part. What do I do?

This happened to me today, September 12, at about 6pm. Any ideas about what happened, what's going on, and what I should do? I was at home alone with my 2 year old -- I was feeding her dinner. All of ...
2
votes
1answer
304 views

How is the file overlay read by an exe/virus?

According to what I know ,Overlay is the part of PE file that is not covered by the PE header and therefore isn't part of the virtual image in the Loaded PE. My question is if the overlay is not ...
3
votes
1answer
316 views

Sticky keys on RDP

A recent report on page 18 states that: [black hats] have even leveraged [systems administration tools] as a means of maintaining additional persistence via setting “sticky keys” for RDP sessions. ...
3
votes
2answers
111 views

How to securely install software on Ubuntu?

How to install a software like Sublime Text on Ubuntu 14.04 LTS and mitigate against a MITM attack? There is a PPA available, but the PPA must be added manually. I don't see any PGP keys or MD5 ...
3
votes
3answers
96 views

Remove pdf malware by re-printing to new pdf or text extract?

Consider you have a suspicious pdf file that might contain malware. Would it be sufficient to either: (1) open the pdf file in a virtual environment and let the pdf viewer or pdf-creator program ...
4
votes
1answer
303 views

How to protect against viruses that takes files as hostages by encrypting them?

Today I was infected by CoinVault, a new malware similar to CryptoLocker I believe. Before today I was unaware of this entire type of malware. Fortunately I was protected by offline backups, but I ...
3
votes
4answers
242 views

Can my phone be affected by malware through mobile phone signal?

My phone is newly bought. Can a hacker actually scan the mobile phone signal around me, detect it, and put virus/malware into my phone THROUGH the mobile phone signal of my mobile service provider? ...
0
votes
1answer
184 views

How is Thread local storage used by malware/Virus?

I have been told that code in TLS is run before the entry point of an exe is reached ,so if one puts a breakpoint on this TLS address he/she could debug the behavior of the virus.Can Fiber local ...
1
vote
2answers
138 views

Can folders [alone] have viruses?

I know that files can be infected, but can a Folder itself have a virus/trojan?
1
vote
1answer
157 views

Executed malicious exe file. Help please [closed]

windows 8.1 Im not very computer savvy i was wondering if someone could help me out with this. So I downloaded an exe file then ran it as administrator. It turns out it was a virus. Yeah I'm a genius. ...
6
votes
7answers
2k views

Safe to connect to external drive?

A customer provided an external drive (USB 2.0 and Firewire 800 connections), and wants me to copy files onto the drive. The drive is not new. I have no particular reason to suspect the customer ...
1
vote
2answers
161 views

Viewing an infected file via FTP and code editor won't infect my PC right?

My apologies this may sound like a paranoid question... Recently my friend's website was infected by malware. With her permission, I FTP into her account to have a look and found some malicious PHP ...
2
votes
2answers
158 views

Connecting trusted and untrusted networks

We have two domains that are isolated. First domain is the Corp LAN, the second is an hostile untrusted network with untrusted clients that could contain malware. Clients on the untrusted network ...
0
votes
2answers
418 views

How did piratebay.se search engine get in Chrome as an “other search engine”

I have an IT client with a user who had piratebay.se/... listed within his Chrome's (v39, 64-bit, OS X, 10.10.1) "Other Search Engine" section. I know a user could manually add it and suspect the ...
0
votes
1answer
177 views

Where can I download the Sony hack malware (for analysis)? [closed]

I want to analyze the Sony hack Malware as there have been a lot of stories on who is responsible; from the US government implicating North Korea to news articles stating it's an inside job. The fact ...
0
votes
2answers
119 views

Only HTTP(S) port is open. Why do I need to worry about unpatched software?

Unpatched software poses no risk by themselves. They're only problematic when someone exploits it. How could malware get into my system if I do have unpatched software in general and I'm connected to ...
1
vote
1answer
101 views

Why is there a path to a .pdb file in an exe I am trying to reverse?

My query is ,if I'm seeing a .pdb path in a exe(VC++) what conclusion can I draw from it.Why does the exe have these paths and does it have significance in malware analysis? eg ...
0
votes
2answers
215 views

What is the best resource to learn malware analysis? [closed]

I am looking for a resource that helps learn malware analysis. I know about the practical malware analysis book but i am looking for something other than a book. For example a Site or video tutorials. ...
1
vote
2answers
123 views

Limitations of botnets [closed]

My question is very closely related to this question but I didn't find my answer there. Specifically, I'm interested in whether the C2 server can modify aspects/properties of the malware and, if so, ...
5
votes
1answer
345 views

Exploit SoakSoak injected in Wordpress

I have recently received an attack to my website and Google is warning visitors to not load the page. The malware is located in wp-includes/js/swfobject.js of my Wordpress and I had deleted it but ...
8
votes
2answers
162 views

AV detection of signed malware

With the massive Sony leaks (including their private keys/certificate), i was wondering: How do major AVs deal with signed binaries? ie: Does it influence their detecting ability of the signed ...
17
votes
6answers
3k views

Becoming a malware analyst?

So, I'm currently 16 and am considering a career in IT when I finish school. The thing that has intrigued me the most while growing up is malware. I've come across it so often and have often had to ...
2
votes
1answer
232 views

What does this potentially malicious code do? [closed]

While reading a website called 4chan/b/ someone posted this code snippet, i was wondering what it does when executed? it appears to be C code, how harmful is it? This is the full post: Run a live ...
2
votes
0answers
136 views

Is the process Wslxrqjet.exe, tagged 'Google Chrome', malicious?

Multiple instances (between 3 and 15) of this of this process Wslxrqjet.exe are running on my Windows 8 system at all times. Windows Task Manager 'Description' field for all instances is "Google ...
-3
votes
1answer
891 views

Remote UAC bypass and Microsoft does not regard it as security Boundry [closed]

Microsoft has tremendously increased the security of Windows 8.1 but i found a technique to bypass UAC remotely I know that if User belongs to local group Administrators he is not given full Admin ...
2
votes
1answer
408 views

what is the difference between dll hooking and dll injection [duplicate]

I am confused and would like to know the difference between DLL injection and DLL hooking? I am familiar with its use in malware and I know that key-loggers use it. I also know that SetWindowsHooKEX ...
2
votes
1answer
134 views

How Regin hides running instances of itself?

I have been reading Symantec & Kaspersky Labs analysis of the Regin malware. According to Symantec [Stage 2] can also hide running instances of Stage 1. Once this happens, there are no ...
15
votes
6answers
7k views

How do I safely inspect a suspicious email attachment?

I received a pretty blatantly spammy email to my Gmail account. I'm not really sure how it made it through the spam filters, since it has all of the telltale signs. The FROM field is spoofed as ...
2
votes
1answer
170 views

what is the difference between dll hijacking and dll injection

I am confused. I would like to know if dll hijacking and dll injection are the same or are they different. I know that some malware use it to do malicious things. thank you in advance
1
vote
1answer
202 views

Polymorphic/Metamorphic malware is written on low-level or high-level languages?

As a part of a course I study polymorphic/metamorphic malware. Every single paper and article I've stumbled upon mentions the techniques used by a malware to achieve polymorphism/metamorphism but non ...