Malware is any software application which subverts the will of the legitimate owner of a computer, by means of force or subterfuge, with or without personal or monetary gain on the part of the creator.

learn more… | top users | synonyms

64
votes
10answers
5k views

How do you explain the necessity of “nuke it from orbit” to management and users?

When a machine has been infected with malware, most of us here immediately identify the appropriate action as "nuke it from orbit" - i.e. wipe the system and start over. Unfortunately, this is often ...
53
votes
8answers
26k views

How secure are virtual machines really? False sense of security?

I was reading this CompTIA Security+ SYO-201 book, and the author David Prowse claims that: Whichever VM you select, the VM cannot cross the software boundaries set in place. For example, a ...
40
votes
5answers
2k views

What cryptographic flaw was exploited by Flame, to get its code signed by Microsoft?

Today, Microsoft released a security advisory warning that the "Flame" malware exploited a weakness in a cryptographic algorithm used by Microsoft Terminal Server Licensing Service, and was thereby ...
39
votes
5answers
3k views

Is it safe to install malware in a VM

Is it safe to install malware in virtual machines? I would like to investigate malware, but I don't want to infect my own computer. Can I install the malware in a VMWare VM, maybe even without ...
37
votes
3answers
2k views

Mars Curiosity Rover Security

Does the software in the Mars Curiosity Rover have any security features built-in? I can't imagine how someone would hack into it, but if the rover does indeed have some protection against malicious ...
28
votes
2answers
6k views

How secure is the Windows 8 included Anti Virus known as Windows Defender?

How secure is the new Windows 8 anti virus known as Windows Defender? Does it have a protection against malware which uses UAC bypass/process injection/rootkits/process persistence/running the binary ...
24
votes
3answers
2k views

Stack Overflow is www.doioig.gov/? If not, then could I be infected

Great! I made a post recently where I mentioned that my system might be infected. Now something new came up. When I search for Stack Overflow on Google, I see that the URL is www.doioig.gov/. When I ...
22
votes
5answers
1k views

Why would malware try to remove other malware?

Recently my php-based website got infected with malware (probably by a stolen ftp password). Basically, every 30 minutes a file frame_cleaner_php.php was uploaded, a HTTP-GET was done on it to execute ...
21
votes
6answers
1k views

Why are vulnerabilities and lack of security possible in computers?

I have heard about computer vulnerabilities, virus, malware, etc. Why are these threats possible? Why doesn't the computer just do the things it is supposed to? Why do some people write malware, ...
21
votes
4answers
8k views

Does a Virtual Machine stop malware from doing harm?

I would like to know if it is save for the host system of a virtual machine (VM - VirtualBox OSE in my case) to execute malware. Can a virus break out and read or write data from the host system? ...
21
votes
2answers
647 views

Cohen's problem

Fred Cohen determined theoritically that viral detetction is an undecidable problem. Can anyone provide an intuitive reasoning for that? Background Fred Cohen experimented with computer viruses ...
20
votes
6answers
2k views

Best practices for handling computer viruses

I realize this question may be quite broad (and hopefully not a violation of the FAQs), but I'm interested in hearing how many of you handle a computer infected with Malware. In a small-to-medium ...
20
votes
2answers
1k views

From a technical standpoint, how does the zero-day Internet Explorer vulnerability discovered in September 2012 work?

I'm looking for an answer that explains the issue from the prespective of a developer/engineer. What is exactly being exploited and why does it work? Please note that I am not looking for ...
20
votes
6answers
3k views

Malicious Links that Respond to Browsers but not curl or wget

There are some emails with links to people's cracked websites with a malware download Like this kind of email: fake DHL pack station email ... the links often take the form of: http:// ...
19
votes
6answers
4k views

Is making a clean install enough to remove potential malware?

Is formatting the disk and reinstalling the system from scratch (to Ubuntu) enough to remove any potential hidden software spyware, keyloggers etc.? Or can something still persist installed in the ...
19
votes
2answers
12k views

Can you get virus just by visiting a website in chrome

I've recently read Google Chrome: The End of Drive-By Downloads. Is it true to say that drive-by-downloads are history in Google Chrome? So if I have a link (from a spam email) I can right-click >> ...
19
votes
4answers
25k views

How to inject executable, malicious code into PDF, JPEG, MP3, etc.?

I wanted to know if its generally possible to inject executable code into files like PDFs or JPEGs etc., or must there be some kind of security hole in the application? And if so, how would one do ...
19
votes
4answers
1k views

Are anti-virus companies companies regularly committing software piracy?

As Mikko Hypponen highlighted in a recent tweet, anti-Virus companies collect and store both samples of malicious software and samples of legitimate software: This got me to thinking, what ...
18
votes
4answers
2k views

Reverse engineering malware/viruses

Assuming a machine has malware, regardless of how it got there, one thing I would like to learn to do is to take the binary file and reverse engineer it to see what the malware is doing/has already ...
17
votes
4answers
533 views

Malware - are removal tools acceptable or is bare metal re-install the only safe option?

I see a number of companies offering "malware removal" services. I see some software that claims to be able to remove malware from an infected machine. Is using a removal software tool to 'clean' an ...
16
votes
5answers
909 views

Why would a virus writer bother to check to see if a machine is infected before infecting it?

I was looking at the tripartite structure of a virus, and it seems to check to see if a computer is infected before infecting it with the virus. Would this be an attempt to use files that are already ...
16
votes
6answers
1k views

What are the security implications of people downloading addons, wrongly thinking that they are safe?

I recently learned about a plugin for Firefox called Fire Sheep, which was featured on the Security Now podcast. I downloaded F.S. and began examining it. To my surprise it includes C++ code that must ...
16
votes
6answers
577 views

How to deal with a person who gets easily fooled by internet and mail scams?

alternative title: How to deal with a person who has gotten paranoid and doesn't want to go online anymore? A person, who has over the years been scammed many times, by bad spam/fraud emails, and ...
16
votes
3answers
650 views

Why do rootkits hide in drivers?

A lot of rootkits for Windows (maybe even Linux?) do hide in drivers. Why is that? One reason I can think of is that using a driver they run in kernel mode and have full system access, but aren't ...
16
votes
2answers
818 views

Malware that can survive BIOS re-flashing

The well-respected security consultant Dragos Ruiu is reporting that he has been infected with mysterious malware that can survive re-installation of the OS and re-flashing of the OS. In other words, ...
15
votes
3answers
632 views

Are official browser add-ons really safe?

Almost any browser addon/extension that I install on my Chrome or Firefox (be it Firebug, RESTClient, ...) warns me, saying: It [the add-on] can: Access your data on all website Access ...
15
votes
5answers
1k views

Becoming a malware analyst?

So, I'm currently 16 and am considering a career in IT when I finish school. The thing that has intrigued me the most while growing up is malware. I've come across it so often and have often had to ...
15
votes
4answers
2k views

Malwares source repositories. Where?

As the best way to learn is to read the code, do you know where I can find malware/virus/whatever source code to read?
15
votes
3answers
3k views

Recommendations for honeypot software

A couple of us wanted to setup a honeypot/honeynet with the goal of learning; not planned to be in a production environment. What's a good recommendation for a high interaction or low interaction ...
14
votes
2answers
530 views

Is there a real possibility of getting malware by “drive-by”?

I know malware can be gotten by downloading and running stuff, but is there a real possibility of just viewing a webpage or clicking a link and getting one? Assuming using only Firefox / Chrome and ...
13
votes
6answers
1k views

Finding a specific malware sample for malware analysis purposes

I wish to analyze the changes made by a specific virus. For example, Win32.Sality. Where can I get the sample of this, or other similar, malware for testing?
13
votes
4answers
966 views

How is a worm different from a virus?

In spite of various online articles, I'm a bit unclear on the distinction between a "worm" and a "virus". Two related questions-- Is there a useful and clear distinction here or no? If so, what is ...
13
votes
2answers
951 views

Can Windows malware harm a Linux computer when it's executed with Wine?

I am an (Ubuntu) Linux user. Sometimes, I have to use Wine for running Windows executables. I would like to know if Windows malware (virus, trojan, worm,...), i.e. malware that was not intended to ...
13
votes
6answers
886 views

Why do malware creators use such clever technologies for such silly purposes?

Some days ago I got infected by a malware, probably something new and very clever, as it went in unstopped and no scanning tool was able to detect it afterwards (see this question). It was a ...
13
votes
2answers
10k views

Is it possible to make a phone call appear to come from another phone, even to the network provider?

Quick Question Is it possible that I could call a mobile number, but have the call forwarded through another number active on a different phone that someone else has? I have had unlimited access to ...
12
votes
5answers
932 views

Can a .sh file be malware?

Can a .sh file be a virus or something harmful? Is it like .exe files on Windows? If yes can someone read this script and tell me if it safe and is it effect any how on gpg security. It gives me an ...
12
votes
3answers
618 views

URL Shortening - How to verify if it is a non-malicous URL?

Again, I must mention that I have just started to learn about security. So, please bear with my newbie questions. If I receive a shortened URL from somewhere, say in an my-email or in a social media ...
12
votes
5answers
771 views

Methods of mitigating threats from keyloggers

I am concerned about keyloggers being installed on my system and transmitting sensitive data out of our network. Is there a common method that such malware uses to send its collection back to the ...
12
votes
5answers
414 views

What is the risk of giving USB drives as promotional items by a healthcare provider

There have been a couple of instances where malware infected USB drives have been given away unknowingly as promotional items at conferences, e.g., IBM in 2010. Besides this, if a healthcare company ...
11
votes
5answers
750 views

Detection and analysis of unknown malware

Suppose I have a binary which is suspicious. How can I determine whether it is malicious, and if it is, reverse-engineer how it works and what it does? For example, maybe using static analysis? Are ...
11
votes
2answers
2k views

What does this injected code do?

One of my sites has just been hacked as this code has been inserted into random(?) files and places within the files. Does anyone understand what it is trying to do? I would welcome anything that may ...
11
votes
5answers
703 views

Checking if notebook is clean of hardware spyware

Are there any simple steps one can follow to verify if a notebook is clean from hardware spyware? What should be looked for? How should it look? If any visual tutorials with photographs are ...
11
votes
3answers
4k views

Can home routers get infected?

I am behind a router(linksys that runs dd wrt on it) and I was infected with sality. I'm curious, can my router get infected too? If yes, how can I remove the infection? I used the search bar but ...
11
votes
2answers
461 views

Could once infected machine be ever trusted again?

I'm just about to switch to a new SSD drive, so I figured it's a good occasion for a really, really fresh start. I reconsidered every installed piece of software, uninstalled lots of crap ...
11
votes
3answers
32k views

How serious is InstallIQ?

Background: Recently I've seen hits for InstallIQ a "potentially unwanted application" from ESET. From what I can find it seems like this is an installer wrapper that asks people to install other ...
11
votes
3answers
217 views

Retrieve files from possibly infected USB

I work in a lab environment, and save data to a shared PC. This PC is not networked, and so the only way to get the data from that PC to my own, is through USB. The lab director has mentioned that the ...
11
votes
6answers
1k views

weird visitors to my website

For the last three months I have thousands of real visitors to a single page on my website. Those visits are recorded in Google Analytics and count as page views in adsense reports, but they are fake: ...
10
votes
1answer
2k views

Oligomorphism vs polymorphism vs metamorphism in malware

What is the difference between these three? As I understand it, polymorphic malware code actually is always the same, and it's just that it appears to be different (through encryption, data ...
9
votes
5answers
1k views

How do I safely inspect a suspicious email attachment?

I received a pretty blatantly spammy email to my Gmail account. I'm not really sure how it made it through the spam filters, since it has all of the telltale signs. The FROM field is spoofed as ...
9
votes
5answers
1k views

Detecting malware-infected USB drives

I'm about to distribute some relatively cheap promotional usb drives to some of my company's clients. I'm fairly confident the company I purchased them from wouldn't intentionally implant malware on ...