Malware is any software application which subverts the will of the legitimate owner of a computer, by means of force or subterfuge, with or without personal or monetary gain on the part of the creator.

learn more… | top users | synonyms (1)

4
votes
1answer
62 views

Regarding malware and hardware

Bit of a weird one, hope this is the appropriate venue: I've just purchased some Ethernet-over-power adapters that were returned to and repackaged by a brick and mortar retailer. I'm trying to be ...
4
votes
2answers
93 views

Notifying users of a possible security breach

Yesterday, a coworker informed me that a user had opened a malicious e-mail containing a .dotm document which she could not open. I undertook the usual steps to prevent the malware from spreading to ...
4
votes
2answers
139 views

Phishing/Malware redirection through AdExchange on Android

Issue: Yesterday I discovered a strange behaviour in the Chefkoch.de App. During the search for recipe, Firefox opens up with a (German) phishing warning screen. This happened not only on this ...
4
votes
3answers
488 views

Does Gmail's 'preview' feature for documents in the browser prevent malware?

I'm concerned about opening attached Word documents and other files (images, PDFs, etc). Gmail has a feature that previews these in the browser for you in a popup, without leaving the Gmail screen - ...
4
votes
2answers
726 views

How do cryptographic algorithms help hackers to bypass Antivirus software?

I was wondering how do hackers use cryptography for bypassing antivirus software. I don't have some deep understanding on how antivirus software works, but I know that every antivirus has base of ...
4
votes
1answer
359 views

Does malware which infects the BIOS/ Firmware always need 'root' access to do so?

There are very few hardened Operating Systems who restrict or totally disable Terminal 'root' access for the user. Would this feature prevent persistent BIOS rootkits from writing into BIOS or ...
4
votes
1answer
216 views

Where to submit collected malware from my honeypot?

wondering if you could help me. i setup the Dionaea honeypot and have collected 6 or 7 malware files. Unfortunately upon checking the Dionaea logs it keeps giving the error "Couldn't resolve host" for ...
4
votes
2answers
826 views

Can a malware jump from a virtual to the physical machine? [duplicate]

Possible Duplicate: How secure are virtual machines really? False sense of security? I found out that malware authors check if the hard drive volume name, or network card MAC matches ...
4
votes
2answers
7k views

Security Alert - Office File Validation - how to decide whether to proceed?

Recently, when opening a Microsoft Word document that came from a trusted source, I received the following warning message: The warning message is titled "Security Alert - Office File Validation". ...
4
votes
2answers
619 views

Has anyone else seen commands embedded in an ICMP echo request?

My IPS recently detected a type 8 ICMP packet (echo request) with an unusual payload. The echo request command a fragment of a command that looked like part of a route add. Here's a PCAP of the ICMP ...
4
votes
1answer
71 views

Reducing risk for malware exposure from USB storage devices

I have a somewhat hypothetical situation where I need to re-image a machine using a USB thumb drive, however I cannot be certain that the drive itself is malware free. It is the only thumb drive that ...
4
votes
1answer
60 views

How do I use a directory of YARA files?

I'm going through the Malware Cookbook PEScanner and they want a path to my YARA files to search on. I currently have a directory full of YARA rules for known pieces of malware. What would be the ...
4
votes
1answer
159 views

Antivirus constantly detecting tmp files as threats

Recently my antivirus has been constantly detecting threats and it's always tmp files. I delete maybe 50 of these files each day. A few days ago it detected a trojan. Last week it detected many ...
4
votes
2answers
832 views

Malware (adware?) infection on linux

Recently I've get stuck with a malware(adware/virus ?) which I can't remove. here is the condition: I'm using Linux (Archlinux), it's uptodate and I don't install any packages outside standard repos ...
4
votes
1answer
210 views

Can source javascript files be infected from a developer's machine?

First a little bit of background, About two weeks back one of the developers in my team said they were seeing advertisement popups and links appearing all over the web app we were developing, when ...
4
votes
1answer
102 views

What security problems does copying .Xauthority to another user present?

If I want to use a GUI application with another user (example: webbrowser), I can copy the .Xauthority file to that given user's home then I can "su - user" and start the GUI app. Question: but what ...
4
votes
2answers
250 views

Is there a way to check for “hollow” processes, or malware hidden within “normal” processes

I recently came across an article on the The Verge, which centers around the concept of commercial malware production and how it's used around the world. The article introduced me to a number of ...
4
votes
1answer
131 views

Would DLL hijacking work with load-time linking?

I was wondering if DLL hijacking would work with all types of linking or just run-time linking. I hear that malware uses it and wanted to know how it works
4
votes
2answers
1k views

How can I recover files encrypted by Android ransomware?

My Samsung Galaxy Note II was infected by a virus called the "FBI virus." Fortunately, I've managed to remove the malware but my problem now is that all my files have been encrypted. How can I ...
4
votes
1answer
598 views

How dangerous is a virus introduced to a malicious website in chrome?

I am using Google's Chrome browser under Linux (Ubuntu) 64 bit for web browsing. If I a virus uses for example a leak in the flash player, the virus will get the privileges of the user who started ...
4
votes
0answers
79 views

Detect malicious content on enourmous multi-site CMS [closed]

My Goal: My hope is to catch pages and content that would be flagged by Google Safe Browsing or others like it, except more proactive than waiting for a crawl by Google or being added to a ...
4
votes
0answers
197 views

Enabling virutalization, addressing the bluepill risk?

Background to this question is the ambivalence I assume with virtualization. Also to start directly with clarity: the term bluepill should here be a placeholder to denote "malware that uses ...
4
votes
2answers
1k views

How can NSA implants and backdoors be detected? [closed]

It has been a while now since the Snowden revelations of various NSA malware and backdoors. For instance: March 12, 2014: NSA has developed implants to take over targeted computers’ microphones ...
3
votes
5answers
1k views

How will microvirtualisation change the security field, if at all?

Will this reduce the number of exploitable vulnerabilities in common operating systems? Will the only path in be to exploit the VM itself? Marketing blurb from Bromium's website below. ... ...
3
votes
4answers
1k views

does switching to linux remove existing computer virus

if you change from a malware/spyware infected windows setup to a linux setup will infections migrate to linux if they were on the computer? (when you are hacked/infected is it the op system that is ...
3
votes
2answers
236 views

Where a sysadmin deletes a company's data, why can't they just restore from backups

As an example, in the UBS Duronio case, Mr. Duronio executed code that deleted everything in its path, but isn't there a backup server? Why was UBS hit by the loss of data? If the backup is available, ...
3
votes
3answers
3k views

How to check if URL/ IP belongs to a zeus bot

I have a set of URL's which might be Zeus hosts / C&C servers since my security appliance says so. Is there a way to check if these really belong to Zeus?
3
votes
1answer
2k views

Is bit.ly a malware distributor?

I clicked this link http://girlsguidetosurvival.wordpress.com/ Chrome gave me this warning - Attackers currently on bit.ly might attempt to install dangerous programs on your computer that ...
3
votes
3answers
372 views

I found a malicious website embedded in Malware spam. What should I do?

An email is using social engineering to get users to click on a malicious URL that downloads javascript and then runs malicious code. Who should I report these malicious URLs to? (Microsoft ...
3
votes
2answers
381 views

Can the USB standard be altered to prevent the “firmware attack”? [duplicate]

Wired, and others are reporting on a research paper by Karsten Nohl and Jakob Lell. The paper apparently shows how any USB device (not just memory sticks) can be infected with malware at the firmware ...
3
votes
6answers
159 views

What to do with possibly infected files that need to be kept

I have retrieved some old pictures/videos (mp4, many types of avi) of some old events that I want to keep, the problem is that these files have been sitting in confirmed infected machine for a very ...
3
votes
1answer
522 views

I accidentally installed an adware filled Firefox [solved]

I installed Firefox using a download site, rather than the correct site. After running and installing Firefox I noticed my Chrome had an addon called swift browser added to it by a third party. After ...
3
votes
2answers
9k views

Does Chrome OS Allow Executable Files?

My company has some real security issues and I am wondering if using Chrome OS can be some solution to my problem. Typical Windows computers seems all to vulnerable to attacks from malicious images ...
3
votes
4answers
2k views

Can visiting a malicious website infect an iOS or Android device?

Can visiting a malicious website infect an iOS or Android device? We're talking about visiting such sites via a browser. We're not talking about downloading any malicious apps. Thanks!
3
votes
1answer
551 views

Is this code harmful? Why?

Code: http://pastebin.com/kJ8ZGP82 That code gets retrived from http://ui.sidepage.co for every HTTP page I visit (not HTTPS) and load it into the body tag of the page. Is it harmful in any way? ...
3
votes
3answers
610 views

How hard it would be to infect a system with malware through a portable web browser

If I use a portable web browser on a USB device like Google Chrome Portable how hard it would be to get infected by a malware/virus in the system to which the USB device is connected? Google Chrome ...
3
votes
2answers
381 views

How does “Ransomware” Work?

So I am wondering how Ransomware files work. I know Ransomware encrypts all files with AES-256 for speed but where does RSA come in? Apparently RSA is slow to encrypt files so it uses AES-256 first ...
3
votes
4answers
30k views

How to check if computer is controlled remotely

My laptop has windows 7 installed. One Saturday night I couldn't fall asleep and was just lying in bed. Then suddenly at around 2 in the morning I heard the fan of the laptop start up and lights on ...
3
votes
2answers
1k views

Example of malware that spreads via USB? [closed]

I'm messing with Mandiant Redline on Windows Server 2012 in a VM and I wanted to download a sample virus that spreads via USB and modify it to attack Mandiant Redline - I've never written malware ...
3
votes
5answers
2k views

How can I know if my PC is getting infected?

I have installed an antivirus, but as no antivirus is perfect, what can I do to diagnose if my PC is getting infected? For example, keeping a close eye on what programs and tasks run when I turn my ...
3
votes
2answers
685 views

Why do I get AV alerts when browsing a web page?

I'm using the latest version of Firefox and Windows is up to date. When I was browsing a webpage and clicked a link the browser displayed "connection has been reset" and AVAST poped-up saying "Alert!" ...
3
votes
2answers
207 views

Potentially unsafe files on second hard drive, how to get my files back?

I have my files on a second hard drive (disconnected for now). This drive was connected to a system infected with Virus:W32/Virut. I have formatted my main hard drive and reinstalled Windows XP. Now I ...
3
votes
2answers
815 views

What agency digitally signed Cryptowall 2.0 so that it can run without being detected?

What agency issued a digital signature for the Cryptowall 2.0 ransomware virus? Is it too early to tell? As far as I know this is how Microsoft planned to prevent malware, by adding a digital ...
3
votes
3answers
315 views

Domain Name Thefts

Due to past experiences, I have learned that when I'm contemplating purchasing a suitable domain name, I should NOT do so by searching on the websites of domain registrars (GoDaddy, name.com, etc.). ...
3
votes
1answer
143 views

Recovering from malware in the registry

I'm a trainee who writes malware samples to later be tested. A basic piece I wrote in C++ kills explorer.exe, taskmgr.exe and repeats this every second. I used a bit of code to add my application ...
3
votes
2answers
945 views

Online virus scanning service with remote file submission?

I have some links that contain hacking tool and whatnot and I want to pass them to a virus scanning service. The thing is that I don't want to download them to my pc and upload them to their service, ...
3
votes
3answers
151 views

What kind of email attack is this?

I received the following invoice_scan_nHl8GB.js as an email attachment from a spoofed email address/infected PC zipped in a E.zip. Strangely the sender's address is not properly spoofed, probably ...
3
votes
2answers
242 views

Reaction to spam from acquaintance

It often happens that I receive an email like this: From: acquaintance@herbal-viagra.com To: me@domain.com Hi, me@domain.com -- Check this out: http://herbal-viagra.com -- ...
3
votes
1answer
73 views

Host based code injection defense vs anti virus?

Recently I came across a paper titled Host-based code injection attacks: A popular technique used by malware. Another paper titled "Bee Master: Detecting Host-Based Code Injection Attacks", suggests ...
3
votes
2answers
112 views

How to sanitize archive files?

I am looking for a way to make sure that a particular archive file does not contain any sort of malicious code. From time to time new vulnerabilities pop up (e.g. gzip, 7zip) so I though a good idea ...