Malware is any software application which subverts the will of the legitimate owner of a computer, by means of force or subterfuge, with or without personal or monetary gain on the part of the creator.

learn more… | top users | synonyms (1)

9
votes
1answer
123 views

In VMs, do shared folders reduce security effectiveness?

VirtualBox offers the option of using shared folders, others probably offer the same thing. I am not sure whether the host is directly accessing the memory of the guest, or if there some process which ...
2
votes
0answers
72 views

Open source firmware as mitigation against firmware persistent malware?

I am concerned about the threat of persistent malware entrenched in device firmware. I am not familiar with the intricacies of firmware security, so I am turning to SE for help. I recently learned of ...
2
votes
2answers
102 views

Disabling downloads in the browser; are there any benefits?

I was playing around with the security settings in my browser (IE) after being attacked by malware. I noticed an option to disable downloads. If I were to disable downloads, and re-enable them when ...
131
votes
5answers
16k views

How can USB sticks be dangerous?

We all know the story of the USB drive left outside a power plant which was found by a worker and inserted into a computer to see the contents which then allowed a hack to ensue. Here is my question, ...
1
vote
2answers
94 views

why would keyloggers be used for stealing money less often than banking malware?

I read Kaspersky statistic and I saw this image : Why would keyloggers be used for stealing money less often than banking malware?
3
votes
2answers
311 views

Why Antivirus Detects Simple Java Program as Trojan?

Just now I was testing a very simple code in java when I noticed a strange thing.......... On Compiling the program My antivirus detected it as trojan and deleted the jar file....... Further it is not ...
1
vote
2answers
307 views

Where should I start looking if an internet provider has notified me of malware? [closed]

I got an email earlier today from my internet service provider telling me there's some sort of malware on one of the ips in my home, and it had asked me to download some antivirus software. The ...
4
votes
4answers
179 views

Should I format storage after buying it?

I've just bought a new (unused) external HDD. Should I format it or is it save to use it directly? Did it already happen that a device was infected before the first customer use? Will formatting ...
18
votes
3answers
789 views

How Do Rootkits & Other Low-Level Malware Still Manage to Load on Systems Protected by Secure Boot (and TB/MB)?

Let me try asking my question this way... Let's say that I'm a offensive cyber Bad Guy working for a foreign state-sponsored Advanced Persistent Threat unit. My unit is charged with, say, stealing ...
1
vote
1answer
48 views

Techniques exclusive to my malicious version of my own benign program?

Do any special techniques become available to me when writing the malicious version of a program, when I myself am also the person programming the legitimate program? (Any measure I could take with ...
5
votes
2answers
235 views

Is it possible to infect an e-mail by accident?

Sometimes, my friends send me e-mails. I know that they don't care that much about computer security (while I care). I know that they don't know how to create an infected e-mail (no reason for doing ...
2
votes
2answers
94 views

xcodeghost infection in a byod device

We detected network traffic from a device infected with xcodeghost trying to reach a known bot command and control address. Obviously, we removed the device from the network. The user removed two ...
1
vote
1answer
73 views

Protecting users with browser extension. Is it possible, if the machine is already infected?

Assume a trojan acquired admin privilege on a Windows 7 machine. How easy is it for the trojan to replace/hijack/modify a browser extension without user knowing it? Is it possible? I am thinking of ...
5
votes
3answers
193 views

Best practice for home router configuration

Having read about the large number of routers infected by Wifatch, I've realised I don't know how to check whether my router has been infected with this or more malicious malware or what I'd do about ...
2
votes
2answers
308 views

Automatic redirection to another website

As soon as I open a webpage, I am redirected to another site. I have an antivirus on my PC, but it has not been able to do anything to stop this. I have reseted my browser settings (Chrome) and ...
3
votes
1answer
43 views

A single site for reporting unknown virii

I have just received an email with an unknown virus. I happily passed through my scanners. I have checked it's still unknown to all of 4 anti-viruses I have an access to. I have already reported it ...
1
vote
3answers
124 views

My Hacked(?) Wordpress Sites

Hi all I'm using a shared hosting and my hosting company is saying my sites have unwanted codes and in report: Your account had been used to attack our/other servers! Your account holds malicious ...
2
votes
2answers
161 views

How to find a process that is sending HTTP HEAD requests

When I was using fiddler for testing a web Client(capturing non-browser traffic only), it captured the below by coincidence. Is there any way that i can found out which process is doing this? I am on ...
6
votes
1answer
90 views

Methods to Monitor Ads For Malware on Mobile Devices

I've noticed that malware being introduced to a mobile application or web application through advertisements, unknown to the developer of the application, is becoming increasingly popular. I've been ...
3
votes
1answer
146 views

Someone is injecting malware into my website

My website was hacked last year and someone had uploaded a script which was hogging up all CPU and load avg went up to 30+ till our hosting provider temporally suspended the account, that was a few ...
2
votes
1answer
97 views

How Is It Possible That an App Connects to 0.0.0.142 IP Address? [closed]

I regularly review connections being established from apps in my phone to external services. Lately, I found Facebook connecting to 0.0.0.142. So I deleted Facebook for Android app. Now, I just found ...
2
votes
0answers
59 views

Novicorp WinToFlash Lite, spyware etc

I used Novicorp WinToFlash Lite on Windows 7 to create a Windows 10 bootable USB memory stick. While creating the USB drive, I noticed that WinToFlash wrote something like adding blahblah files to ...
0
votes
2answers
160 views

Media players (vlc, spotify and windows media player) don't work after a virus attack [closed]

I just got attacked by a couple of viruses while my laptop was completely unprotected. I installed the necessary programs and tried to get most of the symptoms to go away. I also think I deleted most ...
0
votes
1answer
1k views

PHP mallware attack [duplicate]

I'm desprate because my site has been attacked by some malware that adds code below on every php files. I tried to edit and chmod the infected file but its coming back. Scanning with ClamAV found ...
2
votes
2answers
319 views

Can a BIOS or UEFI infection transfer to other storage drives without the OS presence?

I am already aware that a BIOS or UEFI malware "activate" only in the OS environment. Is it possible though that a spread mechanism be activated without the presence of the OS, so that it would infect ...
2
votes
1answer
80 views

Thousands of files (png, pdf, tex, java, cpp, etc.) deleted on Mac OS X Yosemite

Yesterday, I noticed that, starting at 12:40, many thousands files had been automatically deleted from my drive. The computer is a Macbook Pro with a recent version of Mac OS X Yosemite. Since many ...
6
votes
1answer
61 views

Relationship between http time response and geo-location

I have a lot of pcap files about traffic generated by malware, this include vast kind of packets like TCP UDP and more important HTTP. Whereas is possible I have the geo-locations related to the IP ...
2
votes
1answer
60 views

apparmor alternative for MacBook [closed]

Does anyone know an alternative to apparmor for Mac? Every time I use winebottler my MacBook gets Windows viruses. Wanted to protect my Mac from it.
1
vote
4answers
142 views

Redirection Malware Infection

I have AVG Antivirus installed on my PC. My PC is infected with some kind of bonjovi redirection malware. It randomly opens up a new tab in Chrome and loads porn sites. I have had this infection in ...
3
votes
1answer
408 views

How does Cryptolocker propagate?

One of the computers in my office has been compromised by Cryptolocker. Once informed, my immediate response was to disconnect the computer from the network - though there was a period of a few hours ...
-2
votes
1answer
75 views

Virus that scans hard drive for utility bill + ID? [closed]

Is it possible a virus or malware could scan a hard drive to find ID documents etc and upload them? Randomly some old files were re-uploaded to Dropbox without any updates to them or modifications. ...
3
votes
2answers
244 views

Reaction to spam from acquaintance

It often happens that I receive an email like this: From: acquaintance@herbal-viagra.com To: me@domain.com Hi, me@domain.com -- Check this out: http://herbal-viagra.com -- ...
5
votes
3answers
472 views

Is this powershell script an infection?

While I was sitting in front of the computer not using it,my Windows 10 machine quickly flashed a few terminal windows, and then gave me a Windows Security popup, asking for my password. I have no ...
3
votes
1answer
108 views

How to verify .plist and .kext files are legitimate?

While scouring through tons of logs generated during an audit of a Mac filesystem after a potential malware infection, and I am wondering if there are any better ways to verify that all kernel ...
0
votes
2answers
185 views

Many suspicious requests are going from my browser whenever open any site

Whenever I open any site there are so many suspicious request are shown in my network panel of browser. I scan my system with many antiviruses too, but still facing the same issue. And sometimes I ...
4
votes
2answers
847 views

Malware (adware?) infection on linux

Recently I've get stuck with a malware(adware/virus ?) which I can't remove. here is the condition: I'm using Linux (Archlinux), it's uptodate and I don't install any packages outside standard repos ...
0
votes
2answers
185 views

Malicious favicon icon?

Is it possible for a favicon icon to be malicious so that you get the virus by just looking at the icon in the search results of a search engine like DuckDuckGo that displays the favicon icons for all ...
1
vote
2answers
106 views

Confused about whether or not I'm infected

I want to upgrade to Windows 10 (I have 7) and then probably do a clean install as well. I'm not sure because I'm really confused now. I don't know what to believe anymore. It's very important to know ...
3
votes
1answer
73 views

Host based code injection defense vs anti virus?

Recently I came across a paper titled Host-based code injection attacks: A popular technique used by malware. Another paper titled "Bee Master: Detecting Host-Based Code Injection Attacks", suggests ...
41
votes
5answers
11k views

Accidentally came across the source code for some malware, what to do?

I accidentally, the other day, went to a dodgy site, and today I discovered that in my cache there lay a text file. And after reading the contents of the file, I have deduced that it is the source ...
4
votes
2answers
141 views

Phishing/Malware redirection through AdExchange on Android

Issue: Yesterday I discovered a strange behaviour in the Chefkoch.de App. During the search for recipe, Firefox opens up with a (German) phishing warning screen. This happened not only on this ...
6
votes
8answers
259 views

Difference between virus and trojan?

To my current understanding: a virus is a program that does not self replicate and relies on the host file being spread, it has malicious intent. A trojan is a program that is run be deceiving the ...
2
votes
2answers
2k views

Why does Google Safe Browsing keep detecting malware on my website?

We provide a freemium service to upload large files and download them later on. Using ClamAV, we scan every file for viruses after it is uploaded and before it can be downloaded. The file is deleted ...
4
votes
2answers
145 views

What is a “roving” backdoor?

What is a "roving" backdoor? I understand the general concept of a backdoor. Emphasis on keyword qualifier: "roving"...
3
votes
2answers
224 views

My IP address switched suddenly and then switched back

Sometimes I look at the login history of my blog account (a Tumblr blog) to make sure no one else is logging in (because I have private posts that I want to keep private). Even though today I ...
1
vote
1answer
284 views

Network setup for malware analysis lab in a corporate view

I am planning to setup a malware analysis lab in the Incident Response team of the company I work for. As I am basically a malware analyst I some how managed to get up with the malware analysis lab ...
8
votes
3answers
290 views

Why is the victim a server instead of a client?

I just finished creating my own remote administration tool "a server to multiple client one" using System.Net.Socket, - "Watch Dogs fan :P" then I try to search on google how they make or design ...
0
votes
3answers
1k views

Is mgicinjs.info a virus or malware site? How to get rid of it?

Today, I noticed that almost all of my web project (published or in localhost) have a set of weird script references in their pages: And they are all automatically generated - they don't appear in ...
12
votes
1answer
236 views

New social engineering tactic that uses printer serial numbers?

We have been getting a new kind of scammer-esque call every couple weeks here at the office (I work at an enterprise web application development company). Basically, the flow of events is this: ...
4
votes
1answer
515 views

Why did this attack use 0.0.0.0 as IP address and why did it work?

Working through this exercise in network forensics, the attacker used a buffer overflow exploit to send commands to the victim's command prompt. The commands open an FTP session and download some ...