Tag Info

Hot answers tagged

29

You can install an antivirus if you want. It should not hurt your machine, but don't expect much protection for your system and don't consider yourself entirely safe. The efficacy of antivirus software is very relative, and they're mostly in use to avoid propagate old malware especially if you have Windows machines in your ecosystem. You should expect a ...


27

This is possible thanks to OLE (Object Linking and Embedding) technique. It is intended to share information between applications that run on Microsoft Windows operating system. Mainly, it allows to embed objects in documents. Official Microsoft Documentation explains the benifits of OLE. But as any other concept, it could be used for a neferaious ...


19

Yes there are known attacks of this type. The site you are trying to visit is one. That's why your browser is telling you not to visit the page. Javascript files included on pages are always executed by the browser. That's what Javascript does. Whether or not it has the necessary privileges to do something malicious is where the battle is at. It is unlikely ...


11

Sometimes opening a .txt , .jpg or .docx files leads to running a virus. How come is this possible ? To add to the answer to a similar question (thanks for finding it, Tcholas!): You are correct in thinking that a virus in and on itself is harmless. A virus sitting in a file somewhere is no immediate threat to your computer. But when you open a file ...


7

One possibility is by exploiting overflow vulnerabilities. When opening the image, the software failure will "throw" the virus into unauthorised memory sections that may be executed by the system. Here you have a description by Symantec of a vulnerability that exploited Internet Explorer in this sense. Also, this question was answered in Stack Overflow.


7

In order to do any damage to your computer or data stored on it, the page would have to either exploit a security vulnerability in software on your computer or prompt you with an additional confirmation dialogue. The warning may be due to the page exploiting a security vulnerability for which there is not yet a patch available, so the warning should be ...


5

Reduce your exposure within System Preferences > Sharing close everything you don't need. To give you a practical example, in my case, everything is off. Shut off netbios: cd /System/Library/LaunchDaemons /usr/bin/sudo launchctl unload -w com.apple.netbiosd.plist ps ax | grep 'PID|netbiosd' This might highly reduce network noise. Scan for residual ...


5

Media files should be relatively safe, because they usually don't contain any executable code. There have been a few exploits in the past which caused specific media players/viewers to do unwanted stuff when opening an especially crafted file. But... these exploits usually target very obscure formats which often aren't properly tested and when you keep ...


5

The threat a virus impose in your system is, ideally, independent of its programming language because viruses exploit vulnerabilities in operating systems, applications, APIs etc. In this sense, a Javascript virus is as dangerous as any other virus. Also, for web applications, JavaScript is one of the main attack vectors in techniques such as cross-site ...


4

I understand this to be a question about how botnet operator controls zombies. Most of not-so-good trojans use a set of Command-and-Control (C&C) servers, which they poll periodically via e.g. plain HTTP. IIRC this is the case for Zeus-like trojans. These can be brouht down easily by taking control over the C&C servers and e.g. issuing self-destroy ...


4

This is a very broad question. As you have not really talked about the type of encryption whether it be file based or memory based and so on. Short answer: No, Just because it uses encryption doesn't mean it will be undetectable. Long answer: It will however be likely to be undetectable until the AV vendor manually reverse engineers and generate some form ...


4

One possibility is Unicode shenanigans. Unicode supports displaying many languages, including those written left to right, and those written right to left. One way it does this is using special characters, including [U+202E] (left-to-right override (LRO)). Windows supports Unicode, including in filenames. You see a file on your desktop: evilexe.txt. It ...


4

Most drive by malware downloads first start out with javascript. A quick search shows this as a good simple example: var OSName="Unknown OS"; if (navigator.appVersion.indexOf("Win")!=-1) OSName="Windows"; if (navigator.appVersion.indexOf("Mac")!=-1) OSName="MacOS"; if (navigator.appVersion.indexOf("X11")!=-1) OSName="UNIX"; if ...


4

Yes it can. Whether a file is malicious or not, does not depend on the file extension (in this case PDF). It depends on the vulnerabilities in the software which will be parsing it. So for example, PDF reader that you are using potentially contains a buffer overflow vulnerability, then an attacker can construct a special PDF file to exploit that ...


3

It seems strange that odd behavior only occurs when using Skype. If there was a RAT (remote administration Trojan), which can include key logging functions, your computer would be compromised across the board. The loading/processing cursor icon might not be signalling malware at all, its strange that you would suddenly think this is a sign of a virus. If ...


3

Many things can go wrong with file uploads. If by "infected" images, you mean images which will trigger arbitrary code execution on your visitors' machines, I'd say that you're probably okay (but an antivirus sweep can't hurt). However, there are other things to look for when implementing an image-hosting website (or a file hosting website). You said that ...


3

We cannot comment on the possibility of a latent infection of your computer. We do not have enough information, and this is not an infection-removal forum. But, we can talk about your bigger questions. To know if you have privacy is tricky. You can't prove a negative (no one has seen my communication, or everyone has seen none of my communication), but you ...


3

The domain is 1e100.net but the whois entry you show is for le100.net, with an l, not a 1 (if these appear to be the same for you, then choose a better font). The 1e100.net domain is a lot more legitimate, and its name is some sort of joke. Indeed, if you do a whois request on it, you get: Domain Name: 1e100.net Registry Domain ID: (...) Registrant ...


3

What you could do is use a anti-virus LiveCD, boot from that and scan the drive with the suspect files. Alternatively, you could upload files to VirusTotal, but that is a one-by-one scenario.


3

Yes, no, maybe so. There are a couple major things in play here. Javascript is a full fledged programming language. This did not use to be the case in it's infancy as a crutch for DHTML (Dynamic HTML, whatever that was!). As a full fledged language with a full blown interpreter/compiler it is really no different than other most other languages software is ...


3

There are lots of ways for malware to hook into Windows auto start. There are simple cases where the registry is modified to load modules on start. Here is the a list of auto start locations in the registry. And a bit more info on Windows startup paths. There are more advanced techniques, Target a driver. Drivers are loaded fairly early on in the boot ...


2

The problem is largely in the effectiveness of the dynamic analysis. How do you define malware? What does malware always do that normal programs never do? (Hint: there is no answer to this question) Well-written malware can look innocent and perfectly legitimate programs can look dangerous. Here's a simple example: the malware might try to join your ...


2

Unfortunately, installing addons is not the only way. There have been a number of javascript methods over the years, many of which are no longer supported by most browsers. However there is at least 1 method still possible that works on modern IE browsers: http://msdn.microsoft.com/en-us/subscriptions/ms531418(v=vs.85).aspx There are probably others.


2

Simple answer: No Any attack which compromises your machine could add toolbars to your browser. However, this is a very different type of attack, and to be honest, any attacker who has full control of your machine is likely to do worse things, like making you part of a botnet, adding keystroke loggers etc.


2

May be able to clarify if you provide an operating system. If you are seeing suspicious traffic originating from your machine to some suspicious hostnames, you should try to see what files/programs are running on your machine producing the traffic. It is possible that they are not malicious, but if they are, there has to be some application ...


2

Essentially, you need to control the execution environment of the apps. There's no magic about it. A couple of solutions that come to mind: You could somehow set all the binaries that worry you as setuid/setgid (that does not mean they must be owned by root, as far as I know). Linux normally prevents attaching to a setuid/setgid process. Please do verify ...


2

To avoid a whois service from using your input for domain squatting, you should always use the whois service of the official operating entity of that top level domain. For .com, this is VeriSign.


2

Writing entries to the Run subkey is the most common technique used by malware to launch itself automatically. The Autoruns tool shows you what programs are configured to run during system bootup or login. It lists executables that run, DLLs loaded into Internet Explorer and other programs, and drivers loaded into the kernel. So you can compare the hash of ...


2

Long answer: Nothing you've described "post OS reinstall" sounds abnormal - with the borderless nature of the internet, it's not surprising that lots of your legitimate traffic seems to be going to servers in other countries (or without DNS entries). While applications which utilize UPnP to function may put you at higher risk for intrusion or exploitation ...


2

If your upload form are not secured and not verified lots of things about the files wich is trying to be uploaded on your server , yes you can upload an infected image. You intercept the http header like tamper data or other tools , and you can modify the extension of your file and other parameters : example : ...



Only top voted, non community-wiki answers of a minimum length are eligible