Hot answers tagged

45

There are a number of different techniques, depending on the skill level of the malware author: Embedded metadata - compiled programs can contain details about their authors. This is most commonly seen in legitimate programs, and shows in the details screen if you look in Windows properties. Attackers who are out for fame might well put identifying details ...


25

Matthew's answer was excellent. There are a few other ways as well. Not a whole lot of malware authors are all that bright. For example, you can open a lot of executables in notepad and look for string data. I've seen countless authors who simply put their email address/server name, username, and passwords inside the programs in a string, and it literally ...


8

Can you get "hacked" by calling a number? I am curious if calling the number would do something to my phone. How could a hacker possibly access sensitive information just by tricking someone into calling. It could be a hack, or it could be a prelude to a hack. Here are some rough examples: If you call them, the spammer can find out if that phone ...


5

In my experience, though it is uncommon to find malware embedded in these fix it scripts and registry keys, it does happen. As such, I would highly recommend most users getting these types of patches and assistance from the vendor directly. An experienced security professional could download the fix it script or registry key, open it and view it first, ...


5

I'll be writing from the assumption that 2FA is used with two separate devices. A single device with 2FA doesn't make any sense to me considering the risks associated with malware. Is it possible to trick 2FA? Now, wouldn’t a malware residing on the user’s phone simply be able to generate the “Yes” tap? Yes, this is possible. Pretty much nothing ...


5

All numbers of the form 1-XXX-XXX-XXXX are American, in the sense of the Americas, but they won't all be domestic calls. Until you check the area code, all you know is that they're part of the North American Numbering Plan, which covers 20 different countries. So right off the bat, you might be making an international call, which could be expensive for you. ...


4

Pre-fetching as I understand it in Google Chrome performs things like DNS lookups and static content caching. In order to determine what static content to download, some parsing of the HTML document it pre-fetches must be conducted and it is known that browsers have been vulnerable to malicious HTML payloads in the past (Internet Explorer CSS and HTML ...


4

There is so many variables to this question with that been said but I'll provide an few scenarios. Scenario 1: User machine has been infected by an "virus.exe" which is executing under the user context "TokinRing" which is not an administrator account. You've decided to run an application "cool.exe" as an administrator account. Default windows security for ...


3

I wouldn't expect a reputable security advice site to intentionally link to live malware or contain live malware. There are plenty of sites out there that are less than reputable who will be visible in your search results if you do a search for "Halp, I'm infected with ABC" or "Is NotAVirusHonest.exe safe?". I'd be very careful about trusting both the ...


3

Do technical advice sites often link to malware? This seems very broad. How can we easily check the majority of these websites and find which advice is malicious, and which isn't? And then there's all the advertisements on the website. They can if they want. Contributors can if they want to. A far better method of deceiving you is making you believe ...


3

It really depends on developer of the ransomware. Ransomware itself is just malware requesting payment to get removed from your computer. To influence the victim to pay techiques such as preventing or making an particular task more difficult. The unlock code will be just an cryptography public/private key. So, the victim will only have the public key and ...


3

These are two quite different things. A little simplified: An AV is a piece of software that can (among other things?) scan your system to identify and attempt to isolate and remove threats like viruses or other malware. A sandbox on the other hand, is basically a context in which a piece of software can be run isolated from the rest of the world. Java ...


3

Standard protocol would be to wipe the hard drive(s) completely clean and install from known good read-only media. A malware also modifying the windows 7 copy on the recovery partition is conceivable. But whether or not the malware you have did that is something we can not tell you without looking at your machine.


2

It depends. If she's the only one user getting this sort of alert, chances are that her machine is infected. If many users report this issue, it's time to get your website checked. Also, if she's getting the alert from her legitimate anti-virus product, it could be the case of false-positive. A simple email to the anti-virus vendor would solve your ...


2

Maybe. In theory it might be that the (unknown) mail client you use already extracts information from the attachment when you simply hover over it. And the practice might not be that far away from this theory: There were several bugs in the past where the preview feature for mails could be used to execute malware, see Can malware be activated by previewing ...


2

By default there is no such functionality that could be exploited itself. What is possible and mostly done with attached PDF's but also possible with other file formats is to exploit vulnerablities in the viewer software. This is the only way to compromize a system through a non executeable file. But also in that case the success of the attack relies on the ...


2

BitLocker would possibly reduce the risk for old-school viruses that embed themselves directly in executable files. However, there is a whole class of USB vulnerabilities that exist at the hardware level, that lives below any partition or file system scheme. While it would protect against some viruses doing their thing, I'd consider investing in a hardened ...


2

I don't know about Zeus in particular, but generally speaking, it's easy to do this using debug APIs like VirtualProtectEx and WriteProcessMemory. Open a HANDLE to the target process, add some executable memory (with VirtualAllocEx), put some malicious code in there, re-map the virtual address of the executable code of the library that holds your target API ...


2

A simple short answer is that yes that does happen. A better answer is that before you download anything suspect you should really be verifying the source first. Lets say you have found a fixit tool for registry errors, lets call this tool "CCLeaner." Now, before I would consider downloading CCleaner from any source I would first google CCleaner to verify it ...


2

The best numbers I've found so far are in the Microsoft Security Essential Report 19 where they show at page 89 that with full real-time protection the infection rate is still at about 2..5%. Then there are numbers from the Cicso Annual Security Report 2016 where they claim a time to detection at about 20 hours, but adware and browser injections are at ...


1

There's no requirement in the Windows operating system to properly register all the components that the program is going to install, or to provide a means to uninstall. Largely this is a "gentleman's agreement", which is in the interests of legitimate software companies to follow, and they generally do. Malware authors have no interest, (and no requirement ...


1

Malware is not made to be easy to remove. That's the point. You should not even be able to tell that your computer was infected. The malware authors employs several techniques to make their software almost impossible to remove: encrypted code, multi-part software, self-healing components, and rootkit behavior. If you could just go to programs' list and ...


1

Malware isn't installed as a "program" like a game or a web browser. Malware can replace an existing program that gets executed when the computer is booted, so you'd never see anything was wrong, or hides in RAM, or many other options.


1

Routers are essentially pretty limited PCs. They have operating systems and they run software, so yes, they can catch malware via the regular attack vectors. Routers are susceptible especially to DDoS (tho rather in enterprise environment) and brute force attacks, weak credentials, outdated firmware and of course backdoors. So no, you can not easily tell if ...


1

My question is, why all the Ad-severing servers are termed as CnC in most reports like they claimed in this below report and how do we respond? Because the way advertisement is done today on the internet make it easy to use ads to serve malware or do social attacks. There is already the term Malvertisement for malware delivery through advertisements and ...


1

That depends a lot on the process who is used to conduct the exploit. If the elevated privilege process is the one being used, then any shellcode injected into the logical address space will have administrator privileges. So if a normal user starts, for example, Firefox as administrator and catches a malware using drive-by-download, the exploit will have ...


1

Worm:Win32/Goldrv!rfn is a trojan that installs Win32/Rootkit.Agent.HU malware. Installation: The trojan does not create any copies of itself. The trojan creates the following files: %windir%\­system32\­drivers\­symavc32.sys                       (167936 B, Win32/Rootkit.Agent.HU) %temp%\­_it.bat Installs the following system drivers (path, name): ...


1

Some website virus infections are only active when the user reaches the website from a search-engine. This is done by checking the referer. The idea is that normal users never type url's directly, only the owner of the website does that. And the virus does not want to alert the owner. So for my suggestion: do a google search for you website and access it ...


1

Beware that "stock" firmware/image can be infected too, especially if we're talking about some (usually cheap) chinese devices. Secondly, you could try to monitor it's traffic after reflashing/reimage it. But there's no real guarantee that it will not perform new, unwanted or undetected "things". If the manufacturer is a trusted one, there's little chance ...


1

The problem with someone being able to execute commands on your machine is that they don't really need a virus at that point. They can use perfectly legitimate tools/commands to obtain and retain ownership of your machine, so anti-virus is rather moot. The only "right" suggestion for what to do after being victim of an attack is to format the machine and ...



Only top voted, non community-wiki answers of a minimum length are eligible