Tag Info

Hot answers tagged

46

No Quarantine is nothing but a place to store the infected/suspicious files. When you quarantine a file it is deleted from the actual place and moved to the quarantine location (to the path that your anti-virus program has for them). This is something like keeping a zombie inside a jail. Obviously it is not a threat as long as you don't open the cage. In ...


14

I think the authors real point is not the safety of a file once quarantined but rather what happens if the user says "no"? Does the system leave it where it is - a potentially big risk, or does it erase it - a potentially big risk. Without knowing what action will be taken if you don't quarantine, or indeed without explaining what quarantine means, the user ...


12

If you are looking for malware to study and understand how it works metasploit is great. The framework is open source so you can study how it works. You can search the metasploit database. I'm not sure what exactly you're looking for when you say "JavaScript Malware" but if you mean JavaScript that could compromise users who view a site CVE-2012-3993 ...


9

If you have a phone with a removable main battery, you can try this: Disable the cellular network, GPS, WiFi, Bluetooth etc on your phone by turning them off manually and then putting the phone into flight mode. Make a note of the current time shown on the phone and on your PC by writing it down on paper. Shut down the phone, remove the main battery and ...


6

So, users are asked a pretty tough question: Do you want this file or do you want to be safe? It's not even a matter of informed decisions, here... Users don't have a degree in computer science and currently don't have the tools to stay secure. Users don't have time and effort to waste for informed decisions. This point has been debated over and over again. ...


5

You must define "transmitting". There are two categories; active and passive. Active transmissions require relatively large amounts of power to actually send out data whereas passive transmissions require little to no added power and could represent a NFC transmission such as an RFID chip being read by a scanner. There are also some theoretical ...


5

Try BeEF framework, It is specifically useful for a wide range of web browsers and has tested methodologies. Once the main javascript file is loaded in the client browser(Through cross site or any other means), an attacker can perform full control of the client system depending upon the available browser specific exploits.


5

I choose for quarantine because of false positives: the AV software can incorrectly flag a file as maliciuous or unwanted. If it's quarantined, you can retrieve if from the quarantine and usually tell the AV to ignore the file from then on. You could not do that if the file has been deleted.


4

The idea of having the "quarantine" option when an antivirus detects an infected file is to avoid false positives. If by chance the antivirus software wrongly flags a file as "bad" when the file is actually something you need, like a critical program (for example Explorer.exe in Windows) such that deleting it might cause the computer to stop working, ...


4

What are the dangers of sending a file to quarantine? There is a slight possibility that the malware scanner falsely tags a valid system file as infected. Sending that file to quarantine could render your system unusable until the file is restored. This has happened on occasion with some major vendors of antivirus for a specific release of definitions. ...


4

There are just too many ways in which malware can persist on a Windows machine without touching the registry. For example: Windows Startup Folder Although it is the most simple and obvious to be found, still I am describing it here just to show that this technique doesn't require touching the registry. In Windows family of operating systems every user has a ...


3

Users of applications cannot. They can only try to not have rogue apps running on their systems. In this case we have an app that is normally harmless or even (attempts to be) beneficial unless it detects you're approaching a juicy login. Some, each alone insufficient, ways of "protecting": do not install untrusted apps or from untrusted sources. pay ...


3

Run the following command on the box to find the PID of any UDP traffic on the machine. > netstat -a -p udp -o You can use findstr to filter the results by looking for specific port numbers (remember, it appears to be shifting, so play with your filter) > netstat -a -p udp -o | findstr 51400 Once you have the PID, use taskman to find the ...


2

An excellent question, from previous experience a virus rewrote my Windows bootloader and the virus was remove later by my antivirus, consequently leaving the OS unbootable. Quarantining virus/malware is more advisable in my opinion due to if the file needs to be recovered later it can. The idea of quarantine is like ("trapping a zombie in a jail") e.g. ...


2

Maybe., Maybe not. Honestly Just an icon is not enough to identify that you have a threat or not. And not any key logger or malware will show itself to the target its presence(unless it was a buggy one). Possible explanation for the Mystery Icon: could be an unwanted software that got installed along with any of the softwares you installed. could be some ...


2

Interesting question. In short I would say it is safe at least as your laptop/desktop are safe. Explanation: mobile OS are far more advanced in their security architecture than your good old windows OS is. Having said that it really depends on your device, OS and how you use it. For example devices I would consider safe without any hesitation are ...


2

check your chrome extensions - you might have accidentally installed a malicious extension


2

The market for a penetration testing lab is probably a tiny subset of the market for penetration testing services and an even tinier subset of the market for information security. I'd encourage you to do your own investigation by reaching out to potential prospects, but a resource which may be of use is the Delling Institute. See: ...


2

No, even with any internal capacitors or small secondary batteries, there isn't enough power to get off even a small amount of transmission. Transmission simply requires too much power, even for relatively short range given the type of transmitter in the phone. It would be possible to design a system where the phone could receive a command to do ...


1

As an immediate patch, you should run such an application in a separate X server on a different VT. This is the only way you can guarantee that the app does not use the X API to spy on other clients. You may also try your hand at XSELinux but I know of very few people in the world who know how to run it, and it usually severely limits what your target app ...


1

I would demonstrate a simple SQL injection, it's always nice to see the look on people's faces when you attack a website with a browser as your only weapon. Setup a simple site with a login page and then show them how you can expose the admins password by simply adding few characters to the url. After you get the admin's password delete the entire site. ...


1

What you've described sounds like your router's DNS settings have been changed to use servers under the control of your attackers. You can confirm this by disabling the proxy server. If you disable the proxy and the problem goes away then wipe the proxy machine and start again - it's the only way to be sure. You can reset the DNS server settings to what ...


1

There are unpowered transmitters (or rather powered by the receiver), such as NFC and RFID tags, and with enough specialized hardware, it may be possible to read/send a very small amount of information (and repeat for a very low bandwidth communication), but these would be extremely limited without a battery or capacitor (note: while most capacitors do have ...


1

No, this is definitely a scanner trying various URLs on the server to see which URL it can find. For example, if it finds "/phpmyadmin/scripts/setup.php" it knows you have phpmyadmin installed, and where it's installed. The attacker can then find the version, and run a known exploit to get access. As for how they found it, it could be several ways: ...


1

Had this problem and it went away after I removed the following browser extension: AS Magic Player 1.0.0 As mentioned above, check your extensions thoroughly, even if you trust them try disabling one at a time to figure out which is causing the issue.


1

It is technically possible for malware to infect your live USB if you create that live usb from the infected pc. Personally, I would never consider doing what you are asking to restore a system because you can never be sure you've gotten rid of all malware. However, you can attempt to create the live usb and restore your pc and once restored, simply compare ...


1

Try heuristic scanning tools. It's basically putting it all in a sandbox and watch it do it's thing. IF you're adventurous an technically inclined, you also can scan it with forensics tools and get that data visible for inspection. I found a cool book in google books here. If that's too long winded, you could just turn off data execution on your box and any ...


1

The "firmware attack" is not an issue of the USB protocol, but results from the fact that apparently some manufacturers allow the firmware of their device to be manipulated via USB. This is not part of the USB standard and cannot be fixed by altering the USB standard.


1

I agree with the rest of the posts saying that a malware is not dangerous if quarantined and if it stays in the quarantine. But I'd like to add a qualifier - this is only true if the software works as intended. Antivirus software, just like any other software out there, especially software that has loads of code to parse untrusted data is bound to have ...



Only top voted, non community-wiki answers of a minimum length are eligible