Malware is any software application which subverts the will of the legitimate owner of a computer, by means of force or subterfuge, with or without personal or monetary gain on the part of the creator.

learn more… | top users | synonyms (1)

2
votes
1answer
119 views

Is it there any way to detect payloads generated by veil framework

While pentesting, I used to generate a malicious payloads using the veil framework. The generated payload bypasses antivirus & infects the target system. Is there any way to detect veil payloads ...
0
votes
2answers
78 views

What processes would indicate my computer is infected with malware?

If one opens Task Manager on a Windows machine and looks at all the processes that are currently running, are there any tell-tale signs that one of them is malware?
0
votes
2answers
59 views

Is there a full-disk-encryption OR file-encryption solution where a trojan can NOT extract the secret key (e.g. from RAM)?

Is there a full-disk-encryption OR single-file-encryption solution like an operating system or a combination of devices or services ... that make sure that the master-decryption-key can NOT be ...
4
votes
1answer
149 views

How do I use a directory of YARA files?

I'm going through the Malware Cookbook PEScanner and they want a path to my YARA files to search on. I currently have a directory full of YARA rules for known pieces of malware. What would be the ...
1
vote
2answers
102 views

Malicious email attachments analysis

I have a question regarding incoming emails with malicious attachments on my email server. So, my idea, in my ideal setup, is to have a machine aside running virtualization software. This would run ...
4
votes
1answer
363 views

Antivirus constantly detecting tmp files as threats

Recently my antivirus has been constantly detecting threats and it's always tmp files. I delete maybe 50 of these files each day. A few days ago it detected a trojan. Last week it detected many '.json'...
19
votes
5answers
3k views

Is it possible for a file that is non-executable and read-only to run malicious code?

On a POSIX system, is there a possibility for a file which is non-executable and read-only (aka with a mode 444) to run malicious code on a machine? If so, can you explain how it would do so?
4
votes
1answer
266 views

Is this VM-sandbox idea a good idea for testing viruses? [duplicate]

You want to look at some viruses, so you use something like VirtualBox to create a sandbox environment. But what if we change that environment a lot? What if we do: STEP ONE: Create a bootable flash ...
24
votes
2answers
2k views

How trustworthy is `sudo apt-get install (package name)` in Ubuntu?

One of the easy ways to install a program in Ubuntu Linux is to type a command in the terminal, but how do I know that the program is coming from a trusted source and not from somewhere dangerous? ...
3
votes
0answers
67 views

All Devices on Network Being Redirected to Malware Download [closed]

I have a curious problem. I received a compromised email from an address on my university's domain. Not realizing it was faked, I clicked a link in the email to a url on my university's domain, and ...
3
votes
2answers
108 views

How To Remove Possible Virus Files

See the original question. Using both AutoRun, where I disabled anything that wasn't verified or highlighted (that seemed suspicious), I looked at Process Explorer and found the above unverified. In ...
-1
votes
1answer
78 views

Griefing in the social circles of security experts? [closed]

When I was in college more than 15 years ago, I had some friends who were taking CS degrees with focus on Information Security. These folks knew how to write fuzzers, knew how use ring 0 debuggers, ...
5
votes
2answers
122 views

Can malicious software be installed inside Linux swap partition?

Is it possible for a virus of any kind to be installed inside Linux swap partition? If so, could it be transferred to the system even after formatting the Linux partition only and reinstalling the OS (...
27
votes
3answers
2k views

Are .dll files normally found in system32 but now in a user’s AppData folder always suspicious?

I recently had to read over some malware reports and associated logs for a confirmed malware detection and subsequent infection of a Windows asset. The logs clearly show .dll files in a user’s AppData ...
1
vote
1answer
98 views

Malware, RAT's and backdoors

Is there any kind of malware or RAT that cannot be gotten rid of by a thorough wipe with DBAN, flashing the BIOS and re-installing OS? More importantly, if you've been ratted and did all these things, ...
1
vote
0answers
15 views

Can attempting to extract an encrypted .rar file install a malware? [duplicate]

Recently, I have accidentally found myself on a phishing website that looked extremely similar to another website. From there I downloaded a .rar file and proceeded to extract it. However, the .rar ...
15
votes
3answers
3k views

Router being infected by malware

If you connect a computer that is infected with malware (the government grade, kernel infecting, extremely persistent, easily spreadable kind) to a router or modem, can the router or modem or its ...
4
votes
2answers
210 views

Are malicious drive-by-downloads detectable based on file type/mime type?

Drive-by-downloads are automatic downloads without user interaction. We provide a free service for uploading large files and notifying users by email (this one, something like ge.tt or WeTransfer). ...
-4
votes
2answers
87 views

php malware file-names [closed]

The following is a list malware php file-names that I found on my server some time ago, looking at the source these were clearly to allow a hacker to take full control of my server. I'm posting these ...
2
votes
0answers
87 views

Linux machine continuously transferring data over the network to random servers in china and across the globe [duplicate]

I have been using Linux for about 5 years now but I am not very skilled with the commands to monitor and figure out internal issues. I recently was having trouble with the Internet. My roommates were ...
4
votes
0answers
80 views

Detect malicious content on enourmous multi-site CMS [closed]

My Goal: My hope is to catch pages and content that would be flagged by Google Safe Browsing or others like it, except more proactive than waiting for a crawl by Google or being added to a ...
3
votes
0answers
127 views

Possible Windows 10 Malware [closed]

Data: There are a set of Windows 10 computers. Out of 8 of those computers, three were found to have had the Windows OS altered in an unexpected way. An advanced malware/spyware infection is ...
0
votes
3answers
97 views

How to successfully prevent advance persistent threats

With the topic of advance persistent threats (APT) getting common nowadays, how do you successfully prevent such an attack in the workplace? Do you have to purchase expensive tools, such as those from ...
1
vote
1answer
55 views

Social engineering attacks terminology

Let's suppose that a hacker send an email containing a Word document with a malicious macro to a sysadmin. Does this attack fall under the category of spear phishing?
1
vote
1answer
51 views

Terminology involving malware/virus/worm [duplicate]

What is the difference between "worms", "viruses", and "malware"? Some sources I've found said both viruses and worms infect files. But others say worms are stand alone programs, and are ...
0
votes
1answer
25 views

Covert Channel Bandwidth [closed]

I have designed a covert channel using ICMP protocol by making use of the data field when sending pings. I am trying now to analyize the bandwith of this channel but I don't know how. Any ideas?
0
votes
0answers
33 views

Where can I find a dataset of URLs of websites that diffuse malware? [duplicate]

In order to study some malware detection algorithms I am developping in my PhD, I would like to know where I could download a list of malware websites. Thank you
8
votes
3answers
763 views

Where Does ClamAV Get Its Virus Signatures?

I see that ClamAV has virus definition files which are mostly hash codes in md5, sha1, and sha256 formats, which either look at the whole file or what are called PE sections of an executable file. Of ...
0
votes
1answer
125 views

How do I remove a metasploit infection?

My brother in law sent me a link in a Facebook PM for dummy me to click on. I did, nothing happened, I thought nothing of it. Well he told my husband since I clicked on it he can now hack my Facebook ...
8
votes
2answers
366 views

Can a malware infect just by right clicking?

Someone I know got infected. He sent me the file to analyze. I downloaded the zip and it contained a scr file. I unzipped it and right-clicked to open it in Notepad++. It immediately got quarantined ...
1
vote
2answers
205 views

Implications of Intel's SGX extension for malware detection and white hat reverse engineering

Intel's new SGX extension is concerning. It allows the programmer to create enclaves in their program where the data is encrypted until it is used. This is apparently supposed to be used for cloud ...
-1
votes
1answer
182 views

Can Malware Infect Hardware/Firmware

So, my MacBook Pro packed it in over the weekend after I drunkenly vomited all over the keys. I brought it to the Apple store (without the hard drive installed) for an assessment. The results of this ...
2
votes
0answers
28 views

Can I trust LPS?

LPS protects against spyware/malware by booting an OS from trusted media without reading from hard drives. However, not all components are open source. How do I know the US DoD didn't include ...
2
votes
1answer
104 views

Data Leakage Prevention tips for regular home users

I am a "power user" with a limited knowledge of information security. I frequently store confidential documents on my computer. How can I protect these against a rootkit that gives an attacker ...
37
votes
5answers
4k views

Risk of tampering when hardware shipment is delayed

I am currently receiving an order of computer parts in the mail including an SSD. Tracking showed that the package arrived in my town on day X, and was originally scheduled for delivery on day X as ...
4
votes
2answers
132 views

Can single-purpose PCs be useful as a security measure in this situation?

In the context of a small scale operation, we are considering use of single special purpose PCs allocated to single security-sensitive tasks - for example, certain financial operations. The intended ...
1
vote
2answers
706 views

How to find why so many host are talking to an IP which is blacklisted

In my SIEM tool, I got multiple alerts for communication with malware sites from Palo Alto firewall. I have seen many outbound communications from internal IPs toward IP: 74.217.31.51 having host name:...
0
votes
1answer
58 views

Test the security of my Linux setup [closed]

I have a Ubuntu installation running in VirtualBox. I have made a few modifications to it (some kernel modules and startup scripts) that I hope would make it very secure. Is there anyway I can test ...
1
vote
4answers
119 views

What are cookies and cache?

While surfing on the Internet, I am often afraid that I may have downloaded some malware program along with some files on my computer. Furthermore, I have been told that the reason for that are ...
-1
votes
2answers
89 views

Need tool to detect malware in several pdfs in Windows environment [closed]

I am looking for a Windows product that could detect malware in several pdfs in Windows environment. I don't want to use Python and I don't want to use Stream Dumpler. I am looking for something ...
0
votes
0answers
376 views

Tradeadexchange everywhere. On my mac, android and every browser

The tradeadexchange malware seems to have infected me in every possible way. It pops up new tabs whenever I am browsing on my Mac or Android devices, and also in any browser-Firefox/Chrome/.. ...
0
votes
1answer
74 views

Malicious .scr file partially executed: sohanad?

I executed a .scr file, (without prior checking of the file ending, because the filename was longer than what the explorer showed) and there was a popup saying something. Instant realization that I ...
0
votes
1answer
104 views

Dealing with a malware infected server

I have a web server which is heavily infected by malware. That is, around 12 websites (Outdated CMS) are infected by PHP shells and XSS. My websites are banned and are not accessible anymore. I have ...
45
votes
3answers
5k views

Can USB drive infect my PC with malware if I don't allow any autorun.inf to run?

Assuming that I'm using a trusted USB flash drive (meaning that it's not some device that looks like a USB drive and whose purpose is to damage my PC), is it possible for my PC to get infected from ...
1
vote
4answers
545 views

iPad infected with virus (popup - admobinew.com)

This morning I was reading some news on some websites (I think one of them was haaretz.com) using my iPad (ios 9.0.1), I clicked on a news and I was redirected to some dodgy website and I started ...
1
vote
1answer
67 views

Access to email without antivirus [duplicate]

I am doing a test where we want to asses whether an email with a benign virus in it, exits a network. I need a means to receive the test emails I am sending from inside the network, without any ...
0
votes
1answer
112 views

Strange browsing problem, unknown images

When I open any site, I sometimes see unknown images replacing the original images on the website. They are not ads and can't be clicked. Just random images of people, cartoons etc. When I refresh ...
7
votes
2answers
276 views

Can malware infect more than one operating system?

Is is possible for malware to be written in a low-level language such as C or C++ and do the following: Infect a single operating systems(such as Windows) Detect other machines on the same network ...
0
votes
1answer
58 views

Why only Google warn us about attackers?

There are so many search engines like ask.com, yahoo.com and many more, but only Google warn us about attackers. Why so?
29
votes
3answers
3k views

Can malware be transmitted via a USB charger plugged into a wall socket?

I have a smart phone that I often plug into a wall socket for charging via a small adapter that rectifies the AC to DC power and transforms the voltage from line (120V or 240V) to 5 V DC, probably ...