Malware is any software application which subverts the will of the legitimate owner of a computer, by means of force or subterfuge, with or without personal or monetary gain on the part of the creator.
1
vote
3answers
126 views
How to Detect Zimbra Sniffing Trojan
I am a sys admin of our system, we are running zimbra as email server in our environment. I got the following message from the CEO.
"Everytime I send or receive an email - I get a SPAM ads a few ...
1
vote
1answer
78 views
Compromised server with psyBNC - what are our next steps?
One of our VPS servers has an install of psybnc on it. The install has been present for quite some time, and has now been brought to our attention. We have backups, but they also have psybnc on them. ...
1
vote
3answers
151 views
Where can I find information on existing viruses?
As part of my research, I have created a small malware corpus which I'm conducting my tests against. I would like to categorize them based on Metamorphic / Polymorphic / etc.
I am not sure if this is ...
1
vote
1answer
292 views
Cuckoo Sandbox python errors after task submission
I'm New to Cuckoo Sandbox. Why am I getting this error?
I don't understand. If there is something wrong, can anyone please explain how to setup Cuckoo Sandbox? My setup works very well before I ...
1
vote
1answer
157 views
SNMP trap by legitimate program?
Is there any way to tell if this SNMP trap is something created by a legitimate program?
Update: Hex Dump
0000000: 30 82 00 ec 02 01 00 04 06 70 75 62 6c 69 63 a4 82 00 dd 06 82 00 09 2b 06 ...
1
vote
1answer
240 views
DNS query through squid? [closed]
My IDS picked up our squid proxy server doing a dynamic DNS request. I wasn't aware squid passed DNS requests from the client to the internal DNS server. Is this possible?
Snort Alert:
ET POLICY ...
1
vote
0answers
35 views
Problem: Restrictions in effect on computer. Asking me to contact my system administrator [migrated]
This started happening when I had to restart my computer for an exam so I can get it working faster. When I rebooted it, it stopped giving me the option to do alt-F4 to be able to shut down, ...
1
vote
1answer
429 views
Android apk malware
I was browsing some website last night and that website suddenly sent me an apk called 'browser_update_install.apk', DrWeb light detect it and was able to delete it.
My question here is about the apk ...
1
vote
0answers
31 views
vbs agent kz trj [duplicate]
Possible Duplicate:
Index page has been compromised, suspicious files are showing up
I have vbs agent kz trj one my laptop. my httpd.exe and mysql.exe is infected and deleted from Xampp. ...
1
vote
0answers
79 views
The point which distinguish metamorphic and polymorphic algorithms? [closed]
I am writing a paper about malware and code obfuscation and I realize at the and these abstractions have not got a bordered definition and it is really hard to emphases the point between them, so I ...
1
vote
1answer
404 views
on stack execution on windows 7 :: metasploit :: meterpreter :: executable crypter
I posted this on stackoverflow, was advised to move it to security section.
I was writing an executable crypter as an exercise with goal of Antivirus evasion, now the problem is the final executable ...
1
vote
0answers
108 views
Hidden Registry Strings - possible rootkit? [closed]
Win server 2003 R2 SP2 - no noticeable issues on the machine. When I create new strings in regedit, I hit refresh and they are gone! I try to re-add and it complains the string already exists.
I am ...
1
vote
2answers
715 views
How do I figure out how malware infected my server, and the subsequent sites on the server?
I recently was in charge of fixing our server at work, and cleaning the sites on it. We were infected with some malware that injected some code into some of our clients websites. Apparently, there was ...
0
votes
3answers
151 views
Using a VM to access internet when malware blocks internet access?
My computer was recently infected by some malware which had blocked internet access. I had a virtualization software with an OS in it. Surprisingly, I could access the internet from the VM. I know ...
0
votes
2answers
99 views
Filehosting - Malicious or not? [closed]
I see a lot of file hosting services like rapidshare, mediafire etc. But, I wonder if some of them are malicious or not. Rapidshare seems okay, but there are many (obscure) sites like the ones below ...
0
votes
2answers
125 views
How isolated are 2 operating systems on 1 harddisk?
Lets say I have 2 windows dual booting on the same harddrive (windws 7), How isolated are they?
I am thinking that there should be up to date antiviruses software on both Windows, and they should be ...
0
votes
1answer
70 views
How does duqu implement its dll files in PNF file format?
As you know files with PNF extension are associated with bitmap file type, from technically point of view how did authors of duqu implement this? as I concluded it is possible to make dlls in any ...
0
votes
2answers
309 views
Infected usb flash drive detection and cleaning
Want to know what all type of malware infections are their that hides themselves in a pendrive completly and infects machine silently.How to detect this type of malware as they cannot be seen.
How to ...
0
votes
2answers
142 views
Somehow unexpectedly my computer got infected with malware
So I consider myself a pretty conscious computer user.
I run Windows 7 SP1 Pro 64bit and I update it.
For surfing on the web I use Firefox 20.0.1 - I keep it updated. I also have NoScript and AdBlock ...
0
votes
2answers
316 views
Regedit shows strange chinese characters in my system - should I be worried?
I suspect that my system has been hacked into. I see huge drops in free hard disk space for a while and then the space returns to near old values. A few days ago, when i clicked 'my computer', i saw ...
0
votes
4answers
134 views
Infection I can't shut down, disguises process as scvhost.exe [closed]
A little while ago my home machine got hit and I was able to clean out just about everything except this one process. I can't find the origin but it shows in my process manager as scvhost.net by the ...
0
votes
1answer
176 views
How securely use Firefox Add-on to prevent steal data?
The videos (first and second) demonstrate how a Firefox extension can collect login information used to login to websites such as Facebook.
After installing this tool/maleware as Firefox Add-on, I ...
0
votes
1answer
202 views
What is the purpose of this malware code?
This is the code that I found on my client's website:
?><noindex><nofollow>
<iframe src="htxp://atluscomdnsup23.ikwb.cxm/main.php?page=1f1214ff37a3022d" height="0" width="0" ...
0
votes
1answer
115 views
Stopping js malware injection on our Wordpress site
This had been added to our wordpress site, specifically in the footer.php.
hxxp://pkktjuchlrv.peguards.cc/02b31ac5iq/get.js
It is malware as defined by google, i belive it is tracking code.
We have ...
0
votes
2answers
135 views
No where to run, no where to hide - suggestions to improve personal security needed
I think that as a windows user, I have no where to run and no where to hide.
In the windows world no matter how many precautions I take, I can get infected by -
1 - Drive by on legal and popular ...
0
votes
2answers
132 views
Is it possible to detect infection in PSP Go game console?
My PSP is acting like it could possibly be infected. It is locking up and then turns off during game play. There are also problems during games that could be related. This is a replacement PSP ...
0
votes
1answer
157 views
Can the FiddlerCore library be used for Malware (e.g. MitM attacks)?
I've used the excellent Fiddler web debugging software before and have recently come across the Fiddler Core headless .NET library which gives you all the abilities of Fiddler in library form. It's ...
0
votes
2answers
78 views
Should a host based firewall have an API accessible to other applications?
Some people are hesitant to use Windows Firewall because it allows software to alter its state via an API. The benefit of this is that the Firewall configuration can be centrally manged in GPO.
On ...
0
votes
1answer
90 views
Changing malware trends in VM
I recently came (Dunno, since when it was happening) to know that malwares can detect if they are running inside a VM like Vmware, and thus can change their behaviour.
So my question is how the ...
0
votes
3answers
362 views
DNS queries with hex string that is a SHA1 of a domain name! Is it a malware?
My computer does a lot of queries to strange domains such as:
56cea5c2b408989ab067adcb787d0f99209bbe07.mydomain.com
The strange thing is that 56cea5c2b408989ab067adcb787d0f99209bbe07 is the SHA1 of ...
0
votes
4answers
78 views
0
votes
2answers
275 views
Is a VPN the only way to protect against rogue Wifi access points MITM attacks?
Given that it's very easy set up a rogue access point and MITM that connection, is a VPN to a trusted host the only real way to secure my browsing and other TCP/UDP actions?
This question relates to ...
0
votes
1answer
48 views
File directory deletion [closed]
So I heard this guy talkin about how one time he deleted someone's windows directory remotely. He claimed to have gotten into the system and deleted it such that the files are all still there, but the ...
0
votes
1answer
2k views
In Metasploit, how to use a custom exe as payload?
Question was once on a mailing list but wasn't answered. I want to use a custom exe as a payload in metasploit. For example when I use exploit/multi/browser/java_atomicreferencearray and want to ...
0
votes
2answers
312 views
Online virus scanning service with remote file submission?
I have some links that contain hacking tool and whatnot and I want to pass them to a virus scanning service. The thing is that I don't want to download them to my pc and upload them to their service, ...
0
votes
1answer
41 views
Indexed link is taking to google brazil [closed]
It's happening in FF and Safari - Chrome works fine.
That, if I search for courfleurie.com in one of the two browsers, and when I click on the link, there, I am taken to google.com.br
I can visit ...
0
votes
0answers
100 views
How can I find out what is doing a “Trojan.Agent-252697” [closed]
I've scanned my computer with clamAV which has found one file infected with Trojan.Agent-252697. I've of course immediately removed the file, but I have no idea how can I find out what does this ...
0
votes
0answers
146 views
Android plankton [closed]
Have anybody experience with analysing of android malware ?
I have tried to understand the Plankton malware. Main difference between plankton and "ordinary" malware is that the "ordinary" malware ...
0
votes
0answers
78 views
Exhaustive list of abuse notifications that organizations get [closed]
What are the different types of abuse notifications that organizations get? Here are some I could get off the web, but would be good to identify if someone already has a list of "types of abuse" ...
0
votes
0answers
1k views
Is Palida Narrow a real font? [closed]
There is a newish piece of malware out there called Gauss. One thing it does is attack computers in the Middle East. Another thing it apparently does is install a font named Palida Narrow. Speculation ...
0
votes
2answers
498 views
Is there any known Malware for Windows Phone 7?
I cannot find anything on google that indicates there has been cases of malware on Windows Phone 7, doe's anyone know if this is true?
-1
votes
2answers
1k views
Malware or buggy software gives Low Disk Space warning
Since a few days, I am getting an alert that in my c drive disk space is low. When I verified, free space in my c drive was decreasing hour by hour and there was a stage when it simply said that 0 mb ...
-1
votes
3answers
160 views
How to find & remove twitter spambot?
Sometimes i can see that i've "retweeted" some tweets , that i actually didn't. And all of them spam to some gaming & pharma websites. I've got windows 7 64bit, norton internet security , using ...
-1
votes
2answers
82 views
Inspecting “tidynetwork” element in chrome to find its origin on my laptop [closed]
Anyone heard of the "TidyNetwork" virus/malware? Is it possible to determine the origin of the ad that is created on web pages by Tidy by inspecting the element using developer tools? I am using ...
-1
votes
2answers
108 views
What information is sought by malware researchers and those reverse engineering malware?
I have seen many write-ups on "malware research", what information are they trying to gather?
Is it the origins of the malware? Or its behavior patterns? Or something else?
-1
votes
1answer
68 views
how malware is added to android app [closed]
I'm working on securing apps from malware attack in project. I just want to know how app is repackaged with malware. Because for reverse engg. we've apktool, dex2jar, Java decompiler. But how ...
-1
votes
1answer
84 views
What websites do you visit for up to date Malware info? [closed]
I'm expanding my understanding of Malware a lot more, as it's currently 0! I know how it behaves and propagates most times, but I don't have a clue about the latest threats out there, what it ...
-1
votes
1answer
108 views
What are some current attacks or malware that exist? [closed]
I was recently asked in an interview to talk about some types of malware that currently exist and what their methodology is. I spoke about the most obvious piece, Stuxnet, and it didn't really help my ...
-2
votes
6answers
743 views
Use PHP to check uploaded image file for malware?
I want my users to be able to upload a photo. Currently I am not checking the uploaded photo for problems of any kind, although I do limit the size to 32k.
Is there any way for me to check uploaded ...
-2
votes
1answer
587 views
Can't figure out how to get rid of Snap.do [closed]
Every time I start Chrome there is the Snap.do page that seems to be set as the homepage no matter how many times I've changed the homepage settings on Chrome and I've removed Snap.do from extensions ...
