Malware is any software application which subverts the will of the legitimate owner of a computer, by means of force or subterfuge, with or without personal or monetary gain on the part of the creator.

learn more… | top users | synonyms (1)

5
votes
6answers
9k views

Can i get 100% protection from virus by using Deep Freeze?

I have recently installed an application called 'Deep Freeze' that works by "freezing" the state of an operating system and working off delta disks. Rebooting deletes the deltas and reverts back to ...
5
votes
4answers
6k views

Writing malware in java?

To me, it seemed like malware could never be written in java. Those who taught me java said it was "secure" and did not allow "low-level access" like c,c++. But, I discovered that it can be done - ...
5
votes
6answers
510 views

How to protect the company VIPs

Environment: small engineering company (<50 employees) and everyone is local administrator on their computer, including everyone in the management group. Setup: Some standard security features are ...
5
votes
4answers
1k views

Can malware hide their network activity from Resource Monitor (perfmon)?

Is it possible for malware to hide their network activity from tools like the Resource Monitor that ships with windows? How much effort is it for a malware developer to implement such functionality? ...
5
votes
1answer
957 views

Malicious script analysis

Could somebody tell me what can this malicious code do? I see that in the beginning it turns off the error reporting and logging. Then something with get post method and files stuff. But I am not ...
5
votes
2answers
198 views

A compromised USB

Assuming that a given USB drive is compromised(infected), what's the best way to deal with it? I mean, obviously, the solution is to nuke(format) the drive. But for that, the device needs to be ...
5
votes
4answers
376 views

Besides MBR & BIOS, is it possible for a rootkit to stay persistant after a format of the harddrive?

If a system becomes infected and does not have any other storage units besides the one hard drive. Is it there any other way for a rootkit to stay on the system besides infecting the BIOS OR the MBR ...
5
votes
2answers
190 views

Is it possible to infect an e-mail by accident?

Sometimes, my friends send me e-mails. I know that they don't care that much about computer security (while I care). I know that they don't know how to create an infected e-mail (no reason for doing ...
5
votes
1answer
816 views

Downloading suspect files into quarantine?

Are there any tools out there or methods available to download a suspect file for analysis without having to worry about being infected?
5
votes
3answers
7k views

Javascript Malware: How does it work, and how can it be mitigated?

I am wondering how malware gets served through Javascript. I've noticed a few illegitimate pop-ups while visiting some financial websites. I wonder how malware exploits work against the application ...
5
votes
2answers
76 views

Can malicious software be installed inside Linux swap partition?

Is it possible for a virus of any kind to be installed inside Linux swap partition? If so, could it be transferred to the system even after formatting the Linux partition only and reinstalling the OS ...
5
votes
2answers
346 views

What are ways I can analyze malware in an infected machine, not just clean it?

I often run into infected devices in my environment and would like to learn more about the specific infections that have gotten in. What are the best tools and techniques I could use to do this? I ...
5
votes
2answers
292 views

What applications are at risk from “Backwards Unicode Names” and what are the mitigations?

There is a vulnerability where some applications (such as explorer.exe) respond to Unicode characters that change the direction of the text (right-to-left vs left-to-right). This may be used to mask ...
5
votes
7answers
454 views

Malicious Websites

Just wanted to get everyone's opinion on this. In Information Security, you get various alerts about particular machines on your network going to sites and/or IPs that have been flagged as ...
5
votes
2answers
109 views

Security of Windows Processes using “RunAs A Different User”

I've struggled to find much information on this topic. What I'm interested in is the following: Scenario A user is logged into a Windows (7, 8.1, etc) workstation as a standard non-administrative ...
5
votes
4answers
819 views

How to keep Mac secure from viruses, malware and keyloggers?

How can I download and install software and make sure that it is not infected with viruses, malware or a keylogger? Also, I heard that Macs "don't get viruses". Is this true? Is it a good practice to ...
5
votes
1answer
44 views

Does prefetching/preloading in web browsers pose a security risk?

Today I googled the name of a domain that was reportedly serving up malware. My search results came up (with the compromised domain at the top of the list) and within seconds my AV gave an alert ...
5
votes
1answer
4k views

Hiding process from Task Manager [closed]

What technique is used to hide a process from Task Manager? I'm currently researching ways I can do this in C++. Is this process called hooking? ...
5
votes
1answer
1k views

When and Why does Chrome display malware detection warning?

Google Chrome contains malware detection feature. When user visits some site, browser may display warning that site contains malware. What does it mean that site contains malware? Does it mean that ...
5
votes
2answers
963 views

How to detect infected machines on my wifi?

I currently live in a building with around 40-50 other tenants (mostly students) and we all share one connection to the Internet using one of 3 wifi routers that are spread throughout the building. ...
5
votes
1answer
141 views

Video site requests Adblocker to be shut off, next day I have 3 “weird” bookmarks

I was on a site trying to view a video and the site requested that I turn off my adblocker to view the video. So I did and then the next day I noticed that I had 3 "weird" bookmarks in my bookmark ...
5
votes
1answer
968 views

Can I isolate a specific computer on my network?

My brother gets malware infections practically every week. Apparently he had a infection over the past 24 hours, I only noticed it because I checked the router logs and saw a massive amount of network ...
5
votes
3answers
165 views

Best practice for home router configuration

Having read about the large number of routers infected by Wifatch, I've realised I don't know how to check whether my router has been infected with this or more malicious malware or what I'd do about ...
5
votes
3answers
259 views

Does Gmail's 'preview' feature for documents in the browser prevent malware?

I'm concerned about opening attached Word documents and other files (images, PDFs, etc). Gmail has a feature that previews these in the browser for you in a popup, without leaving the Gmail screen - ...
5
votes
2answers
233 views

Malware: extract private keys from smartcard?

We all appreciate smartcards because they secure private keys so they don't get exposed to the world. But in a production-environment it's often the case that smartcards are staying inserted for a ...
5
votes
1answer
423 views

Exploit SoakSoak injected in Wordpress

I have recently received an attack to my website and Google is warning visitors to not load the page. The malware is located in wp-includes/js/swfobject.js of my Wordpress and I had deleted it but ...
5
votes
1answer
4k views

What happened with badBios [duplicate]

Maybe some of you remember that in November 2013 the respected researcher Dragos Ruiu claimed that he was infected by some super advanced virus that no one ever heard of before. Experts agreed that ...
5
votes
2answers
2k views

How Do I Troubleshoot a Browser Hijack on a Mac?

My Mac is getting weird redirects with Safari and Chrome, however not with Mozilla Firefox. Since I cannot find software to do malware removal on Apple products or any good information, I am at a loss ...
5
votes
4answers
252 views

Steps after getting hit with malware or browser exploits on Xubuntu

Well, today I was browsing the internet and I suddenly got redirected to a chinese hosted malware site and firefox started going crazy. I checked the url on virustotal with my phone and it found other ...
5
votes
2answers
352 views

Average time before a malware gets detected in the world

I am actually working on a scolar presentation about Careto malware. I was really impressed by the time it took to discover it (at least 6 years, according to some compilation stamps), so to improve ...
5
votes
1answer
445 views

Is Adobe Flash Player installer redirect due to a malware?

When I go to http://get.adobe.com/flashplayer/ 'Install Now' will redirect me to their homepage without downloading the update or any explanation. What could be going on? Is some malware ...
5
votes
1answer
183 views

Integrity check against package repository?

I have a Debian installed. When there are security updates, I review and install them as soon as possible and think about using automatic updates. From time to time I want to boot from a clean boot ...
5
votes
2answers
194 views

Malware known for stealing private ssh keys

The ssh private key file, stored under ~/.ssh/id_rsa in many *nix distros, is typically owned by the user, allowing any program invoked by that user to read the file, and perhaps upload it to a remote ...
5
votes
1answer
2k views

Are the top ten flashlight apps maliciously stealing data and sending it to China, India, and Russia? [closed]

There's an interesting report from a company called SnoopWall that is detailed in this YouTube video from a Special Report with Bret Baier with Fox News. In the report "Cybersecurity Expert" Gary ...
5
votes
1answer
964 views

Google Chrome browser warning for goo.gl

I am getting the solid red screen Chrome browser malware warning for Google's own URL shortening website, goo.gl as well as other sites such as bit.ly and delicious.com when I try to navigate there ...
5
votes
1answer
113 views

What method could a white-box attacker use to track the deletion of memory / files?

A rather theoretical question: Assuming there is memory with a malware inside it. The malware's goal is to detect if a legit application is about to delete contents of the memory. If recognized, the ...
5
votes
1answer
485 views

Cufon or Prototype as an attack vector for Blackhole exploit kit?

I've been asked to look into the security of a client site that's apparently throwing antiviral messages when visited. Specifics: It's being detected as a Blackhole exploit kit inside of a Cufon ...
5
votes
1answer
483 views

In the light of recent information about RarVM, can we still trust RAR files?

See: http://blog.cmpxchg8b.com/2012/09/fun-with-constrained-programming.html https://github.com/taviso/rarvmtools It would seem according to these two sources that rar files can contain custom ...
5
votes
1answer
3k views

What can I do to make sure my computer isn't infected with FinSpy?

What steps have been taken by common free software OS distributions to protect against it? What can Windows users do? What ways are there to rid a system of it?
5
votes
1answer
176 views

The Economics and White Hat Nature of NSS ExploitHub

This question is about the economic model employed by NSS with their ExpoitHub exploit marketplace (site link) and whether it jives with the white hat claims of the company. The company has made news ...
5
votes
2answers
179 views

Are malware detection rulesets publicly discoverable?

I am uncertain about how public malware detection rulesets are? By a "ruleset" I mean the rules, usually written in Yara, that malware detection engines use to determine whether a file or memory ...
4
votes
2answers
2k views

Could a malicious JS file pointed on URL/URI attack the browser/computer?

I found some website blacklisted on Google. I mean when you try to visit them, you get something like shown on this picture: After a small search, I found that some of them have a malicious ...
4
votes
5answers
413 views

Why wasn't the flame malware flagged by firewalls?

Why didn't any firewalls catch the flame malware siphoning out all of that data? I thought there was firewall software that looks for "suspicious" activity?
4
votes
4answers
448 views

Malware that uses http as a covert channel

I'm working on a http traffic analyzer and I need a collection of malware, which uses http as a way to get commands and respond, to analyze their network behaviour. Is there any database of malware, ...
4
votes
2answers
651 views

Can one get infected through visiting a site with a PHP script on it and if yes, how?

I can imagine a clientside JavaScript that gets executed in a vulnerable browser to do some harm, but how can this be done with PHP? Since it's serverside it shouldn't have access to the visitor's ...
4
votes
3answers
165 views

Duqu and other reference material for security people

I would like to read more on Duqu and similar exploits when they appear. The problem is that most references from google are for laymen. Isn't there a reference website or... that reports on these ...
4
votes
2answers
277 views

Is this powershell script an infection?

While I was sitting in front of the computer not using it,my Windows 10 machine quickly flashed a few terminal windows, and then gave me a Windows Security popup, asking for my password. I have no ...
4
votes
4answers
1k views

Site constantly getting infected

I am the webmaster of some websites running Typo3, 2 of which are getting infected constantly. These 2 sites are being owned by the same client. Something happens on those 2 sites that causes ...
4
votes
2answers
493 views

Can malware provide hidden remote access to a user's desktop?

Is there a possibility that malware on a computer could be providing remote access to an external party without the computer user being aware? I.e., some kind of hidden active remote access tool? ...
4
votes
5answers
4k views

Strange android app … possibly a mass malware?

I started receiving on my android Samsung Galaxy note strange notifications in Mandarin (the language of the people of china). Once I click on the notification it opens my browser with a blank page ...