Malware is any software application which subverts the will of the legitimate owner of a computer, by means of force or subterfuge, with or without personal or monetary gain on the part of the creator.

learn more… | top users | synonyms (1)

2
votes
4answers
1k views

My website has been hacked, what do i do next? [closed]

So. I couldn't see any other question like this on Sec.Se so i thought i'd ask. My public website www.foo.com has been hacked. The front page is sending it to be redirected to seoblog.fooblog.com in ...
2
votes
3answers
208 views

How to test for presense of antivirus?

I want to test that when user uploads file, then it goes through up-to-date and properly configured antivirus. I think that to test for it I need some malware that is likely to be detected (it doesn't ...
2
votes
4answers
761 views

How would a keylogger bypass Wireshark sniffing?

I often see malicious keyloggers being advertised as having anit-wireshark feature. Meaning their data can't be sniffed. Is it possible to do so? How would they do it? My guess is that they just ...
2
votes
2answers
151 views

Security Practices by Employees in a Corporate Environment

Consider the following situation : 1. Somehow my boss's system got infected with a malware ( He visited one of the Java exploits website). 2. He sends a PDF document containing the requirement ...
2
votes
3answers
495 views

How hard it would be to infect a system with malware through a portable web browser

If I use a portable web browser on a USB device like Google Chrome Portable how hard it would be to get infected by a malware/virus in the system to which the USB device is connected? Google Chrome ...
2
votes
2answers
194 views

Google DNS in Firewall logs

I was viewing my firewall logs and come across the IP 8.8.8.8. Further check reveals it belongs to Google DNS. And such traffic has been going out from some of our LAN segment PCs. From here on, how ...
2
votes
4answers
598 views

Can visiting a malicious website infect an iOS or Android device?

Can visiting a malicious website infect an iOS or Android device? We're talking about visiting such sites via a browser. We're not talking about downloading any malicious apps. Thanks!
2
votes
2answers
850 views

Antivirus settings: delete or quarantine the file?

I understand that most antiviruses by default quarantine infected files. I have changed it to remove all infected files immediately. Would this cause more harm than good?
2
votes
4answers
604 views

How to identify the Java program that is maliciously accessing my web site from many client addresses?

For many years, my personal web site receives numerous pairs of hits that look like this, every day: 202.xx.xx.xx - - [22/Apr/2013:12:02:26 +0000] "GET / HTTP/1.1" 200 5923 "-" "Java/1.4.1_04" ...
2
votes
1answer
133 views

Trust linux images burned from untrusted systems

For securitys sake I'm assuming my system is successfully compromised after a targeted and/or non-targeted attack. I've downloaded some linux images and burned them to do a re-install. Since I can't ...
2
votes
3answers
265 views

How are 1x1 pixel images used in a malicious context?

I have been analyzing malware and I am seeing many 1x1 png and gif files. What could these be used for?
2
votes
1answer
588 views

How Browsers prevents Malware and Phishing attacks

I want to know how phishing and malware protection features are implemented in modern browsers like Chrome, Firefox, IE etc. Are these features heuristic based, or do browsers maintain a list of ...
2
votes
2answers
13k views

How does Remote Access Trojan / Backdoor Software work?

How does the RAT works? I understand it as once we surf the infected website, browser might download the trojan to our PC automatically. Will it executed and auto install in our computer? I can't ...
2
votes
3answers
196 views

Domain Name Thefts

Due to past experiences, I have learned that when I'm contemplating purchasing a suitable domain name, I should NOT do so by searching on the websites of domain registrars (GoDaddy, name.com, etc.). ...
2
votes
2answers
107 views

Is loopback interface protected from sniffing?

I'm trying to understand what are the risks derived from unprotected communications within the same device, by the use of the loopback interface. I've verified it is possible to capture packets, with ...
2
votes
3answers
354 views

How could an iPhone be transmitting abnormal loads of data without apparently running anything?

My iPhone has sent/received 900MB in 15 days from "com.busuu.japanese.a" I got this information from Onavo, which 'compresses' my data. I have never heard of Busuu until today. It is a language ...
2
votes
3answers
1k views

Malware not showing up in virus scan

I have some malware on my computer at work that I'm having a hard time getting rid of. I'm only interning there over the summer, so I'm guessing that it was downloaded by the previous user because I ...
2
votes
1answer
1k views

Windows PE file and Malwares

Trying to understand how and why any virus, malware, worm and code injections are successful after all in a Windows Portable Executable format. I was going through the PE structure documentation, ...
2
votes
4answers
945 views

Detecting malware hidden in P2P traffic

Consider a network situation involving (only) Peer to Peer traffic in medium sized network. For the sake of convenience, a simple P2P application like DC++ may be assumed, although I am aiming at a ...
2
votes
5answers
535 views

malware classification based on action [closed]

Where can I get info with a view to classify malware based on actions performed by the them. Eg. modifying registry files, copying themselves into other executable's etc.
2
votes
2answers
741 views

Online virus scanning service with remote file submission?

I have some links that contain hacking tool and whatnot and I want to pass them to a virus scanning service. The thing is that I don't want to download them to my pc and upload them to their service, ...
2
votes
2answers
295 views

Convert PDF to plain text, remove malware?

Take a PDF, copy all, paste it into a .rtf document in textedit, --> make plain text. will this remove/nullify any malware from/in the pdf? In other words, if I open the PDF on one machine and convert ...
2
votes
1answer
227 views

What does this potentially malicious code do? [closed]

While reading a website called 4chan/b/ someone posted this code snippet, i was wondering what it does when executed? it appears to be C code, how harmful is it? This is the full post: Run a live ...
2
votes
1answer
790 views

Questions on reflected file download (RFD) attack

I read this article, and the whitepaper by security researcher Oren Hafif which mentions the following salient points: RFD, like many other Web attacks, begins by sending a malicious link to a ...
2
votes
3answers
141 views

Known windows malware propagated via unmounted iPhone

Last week I was told by our security department that my PC (running windows 7) was infected by a trojan and that it needed to be re-imaged. So re-imaged it was! Given the fact that I had been using ...
2
votes
1answer
135 views

Sonar power saving. Attacks and how to mitigate

I recently came upon a program called Sonar power saving that uses speakers and microphone to put the computer in power saving mode as long as you move away from the screen. ...
2
votes
2answers
294 views

Is interpreted malware easier to detect than compiled malware?

Is compiled code more of a security risk than interpreted code? I'm under the impression that it is due to the fact that compiled code can hide malicious code from malware scans.
2
votes
2answers
296 views

How does duqu delete itself?

I'm curious to know how Duqu deletes itself. From technical point of view and generally, how can an executable delete itself while is running? Does Duqu use a specific procedure to do this?
2
votes
1answer
162 views

Is there a tool that puts on a webserver some .html or .php files filled with popular malware like java drive-bys or other browser exploit payloads? [closed]

As mentioned in the title I'm looking for a tool that puts on a webserver some .html or .php files filled with popular malware like java drive-bys or other browser exploit payloads? Maybe there is ...
2
votes
1answer
161 views

Can a bad guy be judged for gaining access to sensitive information?

Assuming a hacker has sent to somebody a malware. It's a trojan (digitally signed by TeamViewer) which runs automatically when windows starts up and sends the login info to a web site using GET ...
2
votes
3answers
171 views

Are externally referenced libraries (CDN's) a security issue?

Today I read about an alleged malware attack targeting jQuery.com A german blogger who is what I would call an expert on IT security stated that Any website that is working with ...
2
votes
3answers
337 views

malware - How to listen to and close malicious ports?

I have a Windows 8.1 machine that seems to be acting weird and getting slow day by day. I believe that it may be a victim of Remote access Trojan(RAT) infection. How do I listen to ports on my PC and ...
2
votes
1answer
257 views

I need help identifying the cause of weird outbound traffic from my network

I have some weird traffic heading outbound from my network. It is being blocked by the firewall from exiting and I'm not sure what the source is. I've looked at the machine and don't see anything ...
2
votes
1answer
179 views

Skype is doing funny things when I type or click, does this necessarily mean malware may be in my computer?

I'm new to the IT Security Stack Exchange! This is my question: I've Skype installed on my Windows 7 computer. In the last few months I've noticed my mouse cursor blinks (I mean it shows that cursor ...
2
votes
1answer
1k views

How to detect infected devices on your local network [closed]

Today I read about a researcher who bought a digital TV recorder and connected it to the internet - probably using port forwarding to enable attackers to connect to the recorder. After a while someone ...
2
votes
2answers
4k views

How do worms spread over LAN? [duplicate]

I've been researching LAN recently, and I came across a post talking about viruses spreading over LAN, and I was wondering, how is this possible? Would it not be a huge security issue to allow files ...
2
votes
1answer
250 views

Where's the virus in this web site?

I made my friend go to this web site and it immediately infected his machine with malware (AntiVirus SecurityPro). It happened just by going to the front page. It seemed the malware started up, but ...
2
votes
1answer
1k views

how is BAT_VOBFUS (or similar) dangerous?

I was reading http://about-threats.trendmicro.com/malware.aspx?language=au&name=BAT_VOBFUS.SM earlier today after it turned up in a scan of a friends PC. I suppose I may be missing something vital ...
2
votes
3answers
761 views

Strange file named Aview.exe - WinClient

Today I've just discovered some strange files on my Win 7 PC. I was browsing through the Windows Firewall Inbound Rules and saw two ACCEPT rules for a program, Aview.exe. It is located in ...
2
votes
2answers
2k views

What are the most common infection vectors for personal computers?

We have OWASP to tell us about common security vulnerabilities in webapps and such, but what are the most common infection vectors for personal computers? A few example vectors: Social engineering ...
2
votes
1answer
414 views

How to reverse engineer w32/malware!gemini?

How would you go about reverse engineering malware W32/Malware!Gemini. Recently I found it installed on my computer and would like to trace where the data is being sent.
2
votes
1answer
639 views

How do you remove the Security Sphere malware?

My boss' computer has become infected with something called "Security Sphere". When googling for information on how to remove it I get many pages that have been optimized for the term "Security Sphere ...
2
votes
1answer
486 views

Can anyone give me more info on this sketchy url I recently visited, is it an attack site?

My girlfriend was browsing images on google when suddenly her browser redirected to this url: defender-iies.co.cc/scan3/167 The site seemed to be posing as an anti virus, saying your computer is at ...
2
votes
1answer
59 views

Is drag-and-drop safer than using the clipboard when it comes to protecting sensitive data from keyloggers?

I noticed that multiple password-locker applications recommend that you use the drag-and-drop feature to transfer passwords to login forms instead of copying the passwords to the clipboard or having ...
2
votes
2answers
89 views

Determining safety of Android APK executable that requires root

On my request, a developer gave me a new version of his Android app to test. The app requires root permissions. I do not know the developer personally. I have no specific reasons to trust or ...
2
votes
2answers
100 views

Is it safe to store a file in a temporary folder before it has been scanned for a virus?

I'm working on an application that makes use of the Symantec Protection Engine to scan uploaded files. I'm having issues with my files after they have been scanned. One possible solution I've seen ...
2
votes
2answers
144 views

Connecting trusted and untrusted networks

We have two domains that are isolated. First domain is the Corp LAN, the second is an hostile untrusted network with untrusted clients that could contain malware. Clients on the untrusted network ...
2
votes
1answer
133 views

How Regin hides running instances of itself?

I have been reading Symantec & Kaspersky Labs analysis of the Regin malware. According to Symantec [Stage 2] can also hide running instances of Stage 1. Once this happens, there are no ...
2
votes
2answers
657 views

What agency digitally signed Cryptowall 2.0 so that it can run without being detected?

What agency issued a digital signature for the Cryptowall 2.0 ransomware virus? Is it too early to tell? As far as I know this is how Microsoft planned to prevent malware, by adding a digital ...
2
votes
2answers
259 views

Attacker able to install screen capturing software in Windows 7 guest account

I am operating in a guest account of Windows 7. Could an attacker that got onto my PC through malware I installed, install a video program that records everything I do and send the result back to his ...