New answers tagged

1

If the cache length lets say is 10.1kb well then the memory block will look something like this (Lets say the whole block is 30kb [Notice the middle block is our PP cache]): |~~~~~9.95kb~~~~~|~~~~~~10.1kb~~~~~|~~~~~~9.95kb~~~~~~| Now lets use the exploit, our data will look like this (Notice we just ran over 9kb of the next segment!): |~~~~~9.95kb~~~~~|~~~...


2

When checking quickly, I saw several instances of the exact opposite issue: Kaspersky blocking any connection to user's router's IP. The most probable explanation is that Kaspersky actually blocks known malicious IPs (given that you use the right product, ie. at least Kaspersky Internet Security and no the standalone anti-virus), but with two main ...


0

Nuke from orbit ... your system has been compromised and should not be trusted anymore. Wipe everything and start with a new, fresh system. The virus / malware probably plays with your hosts-file and disables anti-virus or security websites (this one is doing a lazy job, since you seem to be able to surf here...). But as you dont know, where the virus sits ...


1

Found a website called VXHeaven where I can download a very huge number of viruses (260k). If the malware are working and not broken and not each of them are compressed, I will mark this as the answer for my question. Btw. special thanks to tlng05 for those sites, they could help other people, and they helped me in my research to find VXHeaven with the ...


4

A quick Google search turned up this post which links to a number of malware sample databases: Contagio Malware Dump: Free; password required KernelMode.info: Free; registration required Malshare: Free Malware.lu’s AVCaesar: Free; registration required MalwareBlacklist: Free; registration required Malware DB: Free Malwr: Free; registration required Open ...


2

Interesting idea, but that instruction doesn't do what you think it does. From Wikipedia: In the x86 computer architecture, HLT (halt) is an assembly language instruction which halts the central processing unit (CPU) until the next external interrupt is fired. Interrupts are signals sent by hardware devices to the CPU alerting it that an event occurred ...


1

There is a file named aescn.dylib, which is part of Avira Free Mac Security, but I don't know if the hash you quoted coincides with that of the legitimate file. You can find the SHA256 of that file by submitting the link to download the specific version of Avira (from the Avira website) to VirusTotal, and clicking on aescn.dylib under the "Contained files" ...


1

Allowing a user to add trusted roots to your app might be an option. This should be easier than guiding them through whitelisting your app with Avast, because you'll be able to design the user interface to help the user complete this task. This also has the advantage that your product will be compatible with corporate networks where they often MITM ...


5

Right, when you're dealing with devious malware, it's very hard to determine whether you've completely removed it. Rootkits are pieces of malware that change core OS components (either on disk or in memory) to make normal OS functions return false data to hide the malware and/or its effects. Malware can conceivably modify the boot process to essentially ...


0

Users submit samples of infected files to Clam AV that are processed by Cisco/Sourcefire personnel working on the Clam AV project. Virus Total and other AV industry sources also share infected files with the Clam AV project. Finally, the Cisco/sourcefile people share with Clam AV what they have learned on their end.


2

I've been writing malware for professional security tests for more than 20 years. Evasion of AV detection is one of the common requirements of our customers. The approach depends on which scanning mechanism shall be evaded. Pattern-based detection is very simple in the AV environment. This is like a regular expression which tries to identify a common part ...


0

To detect processing hollowing , you can use compare PE header disk vs memory since it will be executed on a normal thread http://www.adlice.com/runpe-hide-code-behind-legit-process/ To detect dll injection you can do a vad walking, or stack tracing: Look for article called : "Walking the VAD Tree" & "Scanning Process Memory for Injected Code"



Top 50 recent answers are included