Malware is any software application which subverts the will of the legitimate owner of a computer, by means of force or subterfuge, with or without personal or monetary gain on the part of the creator.

learn more… | top users | synonyms

3
votes
5answers
2k views

How can I find the source of traffic allegedly originating from my IP address?

I have a problem that has been going on for at least 6 weeks. I have Time Warner for my Internet provider and some websites hosted at GoDaddy. From what GoDaddy tells me the reason I can not view ...
2
votes
1answer
109 views

Tagged website malware

A common occurance I've found when doing forensics on compromised websites is a pattern like this: <span>Clean code here</span> <!--0c0a22--> ... malware code here ... ...
3
votes
1answer
42 views

OS reinstallation security contribution

For an average user (doing on-line payments, etc.), would it be useful to periodically conduct a OS re-installation of his computer to improve security? How often would that be and how much extra ...
2
votes
3answers
301 views

Should I trust URL based on file extension like this: http://example.com/image.jpg

I created a slideshow and mentioned that user must not trust URL based on file extension, however, I got some claims against that, because URL's like this should be safe: ...
4
votes
1answer
168 views

Securing a Site: Diversity over Simplicity?

This question was derived from my off-topic questioning here: Does Centralisation Decrease the Probability but Increase the Damage of Exploits? Like before, I suspect this may be overly abstract as a ...
0
votes
1answer
300 views

What does it mean by the 'Hash of a malware'?

I have just recently started to delve into the topics of malware. In my hunt for malware binaries, I came across certain responses that it is not easy to grab binaries based on malware names like ...
3
votes
1answer
435 views

Why does broad based malware use XOR obfuscation?

As per title... The malware can easily be de-obfuscated if it was obfuscated using common and known XOR techniques. Why don't malware authors use any other method that make it much harder to ...
5
votes
6answers
6k views

Can i get 100% protection from virus by using Deep Freeze?

I have recently installed an application called 'Deep Freeze' that works by "freezing" the state of an operating system and working off delta disks. Rebooting deletes the deltas and reverts back to ...
-2
votes
1answer
111 views

Infection risk downloading one’s own file from Gmail

Say you boot into Linux from a brand new Live USB. The USB is write protected. The memory stick has never been exposed to the Web in its life. You surf all day on Firefox building your library of ...
2
votes
3answers
945 views

Malware not showing up in virus scan

I have some malware on my computer at work that I'm having a hard time getting rid of. I'm only interning there over the summer, so I'm guessing that it was downloaded by the previous user because I ...
0
votes
1answer
930 views

Why aren't sophisticated Malware written with .NET [closed]

I've been trying to research malware techniques lately, as malware analysis intrigues me. I've got a pretty heavy background in .NET, and based on my 7+ years in .NET, I feel that I could write a ...
1
vote
1answer
2k views

How to check if your computer has a backdoor installed on it? [closed]

Just some time ago I had this unusual popup from Malwarebytes Anti-Malware (MBAM): I did a quick Google of the IP address and found this thread where the OP is complaining of MBAM blocking ...
3
votes
1answer
331 views

Find malware in browser extensions

How can I check if an extension/addon consist of malware code? Is it easy to detect if it collects sensitive data (like spyware), logging keystrokes and so on? Can AV recognize malware extension as ...
0
votes
1answer
409 views

How securely use Firefox Add-on to prevent steal data?

Some videos on YouTube demonstrate how a Firefox extension can collect login information used to login to websites such as Facebook. After installing this tool/malware as Firefox Add-on, I observed ...
33
votes
2answers
10k views

How secure is the Windows 8 included Anti Virus known as Windows Defender?

How secure is the new Windows 8 anti virus known as Windows Defender? Does it have a protection against malware which uses UAC bypass/process injection/rootkits/process persistence/running the binary ...
2
votes
1answer
171 views

What anti-keylogging programs can you use when using a public PCs

Are there anti-keylogging programs that can keep you safe while you are using a public PC terminal? Do they exist and what are these? I like to know that I am safe when entering data on a public PC ...
2
votes
1answer
1k views

Windows PE file and Malwares

Trying to understand how and why any virus, malware, worm and code injections are successful after all in a Windows Portable Executable format. I was going through the PE structure documentation, ...
6
votes
3answers
4k views

Finding spam sending scripts?

What are the tips for finding email spam sending scripts? I ask because usually I hit a wall in shared hosting environments, so I ask this question as a way to get some insight from others. What I ...
13
votes
6answers
4k views

Finding a specific malware sample for malware analysis purposes

I wish to analyze the changes made by a specific virus. For example, Win32.Sality. Where can I get the sample of this, or other similar, malware for testing?
2
votes
1answer
446 views

How Browsers prevents Malware and Phishing attacks

I want to know how phishing and malware protection features are implemented in modern browsers like Chrome, Firefox, IE etc. Are these features heuristic based, or do browsers maintain a list of ...
-10
votes
2answers
359 views

What are the security risks of pirating video or music?

In the case of pirating multimedia, be it video or music, which problems may be caused by the video or music file itself? Could a video or an audio file be used to spread malware? I'm talking about ...
-1
votes
2answers
316 views

My Computer hacked?

I have Window 7 and believe it has been hacked. On two occasions, as I was reloading my operating system, I got a message that my computer had been counterfeited. I get the impression that my computer ...
0
votes
2answers
1k views

Stopping js malware injection on our Wordpress site

This had been added to our wordpress site, specifically in the footer.php. hxxp://pkktjuchlrv.peguards.cc/02b31ac5iq/get.js It is malware as defined by google, i belive it is tracking code. We have ...
11
votes
3answers
5k views

Do I really need an Anti-Virus software if I'm careful about where I browse?

A friend told to me the following: I don't use Anti-Virus software at all, I am just careful about where I go and what I click on. I've also heard this from other people as I've repaired their ...
-1
votes
2answers
172 views

my websites got infected with a malware i cannot get any info on [closed]

we have a server, on which we host about 30 sites. these are test sites for our customers. most of them are not even indexed by google. some run on php, some on nodejs, some on ruby. all of them that ...
1
vote
2answers
509 views

Does keylogger see CTR+C and CTRL+V? [duplicate]

E.g. if I copy something from the email from my hosting company (name, password etc.) and paste it to the ftp client or some online form in the browser, do the keylogger get this name or password? ...
8
votes
2answers
11k views

Advice on what to do after being hacked?

After running a system scan earlier today, I found that my computer had been infected by a trojan horse. My reason for running the scan was because Windows kept shutting down and then recovering. ...
4
votes
1answer
570 views

Malicious script analysis

Could somebody tell me what can this malicious code do? I see that in the beginning it turns off the error reporting and logging. Then something with get post method and files stuff. But I am not ...
3
votes
1answer
197 views

What is the security purpose behind the “enable editing” of MS Word?

Whenever I open MS Word documents from my email, they open in "Protected View" with edit options disabled by default. As per my understanding, the hyperlinks used in the main document would be linked ...
10
votes
2answers
374 views

How do you visit a link without risking your computer?

I got a link from: http //61.19.247./~naowit/dustin.html (removed the last digits so you don't accidentally click it! (they were 192)), which was masked as a youtube.com link via email. Now I'm not ...
-1
votes
1answer
160 views

Malware persistence past a drive wipe? [duplicate]

Are there any known instances of malware persisting past a drive wipe and reinstall, through modified bios, or firmware on one of the machine components?
9
votes
3answers
673 views

Reason for writing Self-Decrypting Virus

What is the rationale behind writing a self-decrypting virus? By this I mean a virus that has it's payload encrypted, decrypts at runtime and runs it. How does this protect the virus from antivirus ...
11
votes
2answers
2k views

What does this injected code do?

One of my sites has just been hacked as this code has been inserted into random(?) files and places within the files. Does anyone understand what it is trying to do? I would welcome anything that may ...
1
vote
2answers
2k views

Somehow unexpectedly my computer got infected with malware

So I consider myself a pretty conscious computer user. I run Windows 7 SP1 Pro 64bit and I update it. For surfing on the web I use Firefox 20.0.1 - I keep it updated. I also have NoScript and AdBlock ...
3
votes
2answers
723 views

Example of malware that spreads via USB? [closed]

I'm messing with Mandiant Redline on Windows Server 2012 in a VM and I wanted to download a sample virus that spreads via USB and modify it to attack Mandiant Redline - I've never written malware ...
0
votes
2answers
201 views

Filehosting - Malicious or not? [closed]

I see a lot of file hosting services like rapidshare, mediafire etc. But, I wonder if some of them are malicious or not. Rapidshare seems okay, but there are many (obscure) sites like the ones below ...
7
votes
3answers
287 views

How can I circumvent the lack of Java updates?

Just imagine you have a bunch of computers which need Java for some important software and you can't just switch to another vendor because all are using Java in this field of technology. If you start ...
0
votes
4answers
145 views
2
votes
1answer
1k views

how is BAT_VOBFUS (or similar) dangerous?

I was reading http://about-threats.trendmicro.com/malware.aspx?language=au&name=BAT_VOBFUS.SM earlier today after it turned up in a scan of a friends PC. I suppose I may be missing something vital ...
1
vote
6answers
6k views

Use PHP to check uploaded image file for malware?

I want my users to be able to upload a photo. Currently I am not checking the uploaded photo for problems of any kind, although I do limit the size to 32k. Is there any way for me to check uploaded ...
6
votes
4answers
633 views

How can Antivirus differentiate between a Trojan and a normal remote desktop application software?

RAT (Remote Access Tool, e.g. Sub7) are considered malicious by Antivirus software. How can it distinguish between such patches and a client application for commercial software like NetSupport ...
5
votes
1answer
138 views

Integrity check against package repository?

I have a Debian installed. When there are security updates, I review and install them as soon as possible and think about using automatic updates. From time to time I want to boot from a clean boot ...
4
votes
1answer
346 views

Exploited by newbie3viLc063s

My debian server got exploited by some scriptiekiddie who used Newbie3viLc063 http://pastebin.com/jma8JRG1 . Scriptkiddie uploaded logo_php.png to my server (My permissions sucked :s) and he did run ...
2
votes
2answers
132 views

Security Practices by Employees in a Corporate Environment

Consider the following situation : 1. Somehow my boss's system got infected with a malware ( He visited one of the Java exploits website). 2. He sends a PDF document containing the requirement ...
-2
votes
1answer
1k views

Can't figure out how to get rid of Snap.do [closed]

Every time I start Chrome there is the Snap.do page that seems to be set as the homepage no matter how many times I've changed the homepage settings on Chrome and I've removed Snap.do from extensions ...
2
votes
2answers
261 views

Is interpreted malware easier to detect than compiled malware?

Is compiled code more of a security risk than interpreted code? I'm under the impression that it is due to the fact that compiled code can hide malicious code from malware scans.
-1
votes
1answer
114 views

how malware is added to android app [closed]

I'm working on securing apps from malware attack in project. I just want to know how app is repackaged with malware. Because for reverse engg. we've apktool, dex2jar, Java decompiler. But how ...
-2
votes
1answer
111 views

Why isn't AV software configured to recognize installed program vulnerabilities?

Background (not necessary to read): I've used a few different major AV programs day-to-day over the years, and not one has ever informed me I was running code with known vulnerabilities. Not only ...
8
votes
1answer
277 views

Is there a public database of mutex names that are associated with malware?

I remember seeing something like this a while back, and it'd be incredibly useful for a project I'm working on. Essentially there was a list of mutex names, with a list of malware identifiers (e.g. ...
7
votes
6answers
1k views

Using linux to combat windows flash drive malware?

I just put an old flash drive which i used with a windows machine into my linux. I noticed many files, mostly exes which were never visible in windows (my windows does not hide hidden files and ...