New answers tagged

1

There's no requirement in the Windows operating system to properly register all the components that the program is going to install, or to provide a means to uninstall. Largely this is a "gentleman's agreement", which is in the interests of legitimate software companies to follow, and they generally do. Malware authors have no interest, (and no requirement ...


1

Malware is not made to be easy to remove. That's the point. You should not even be able to tell that your computer was infected. The malware authors employs several techniques to make their software almost impossible to remove: encrypted code, multi-part software, self-healing components, and rootkit behavior. If you could just go to programs' list and ...


1

Malware isn't installed as a "program" like a game or a web browser. Malware can replace an existing program that gets executed when the computer is booted, so you'd never see anything was wrong, or hides in RAM, or many other options.


0

That depends a lot on which privileges the malware has on your PC. Since the initial malware was started as a process on your computer, it will run with the privileges of the respective account - if you are logged in as administrator, it will run with admin privileges. If not, it might still escalate to get those. And usually the first thing malware does ...


2

A simple short answer is that yes that does happen. A better answer is that before you download anything suspect you should really be verifying the source first. Lets say you have found a fixit tool for registry errors, lets call this tool "CCLeaner." Now, before I would consider downloading CCleaner from any source I would first google CCleaner to verify it ...


3

I wouldn't expect a reputable security advice site to intentionally link to live malware or contain live malware. There are plenty of sites out there that are less than reputable who will be visible in your search results if you do a search for "Halp, I'm infected with ABC" or "Is NotAVirusHonest.exe safe?". I'd be very careful about trusting both the ...


3

Do technical advice sites often link to malware? This seems very broad. How can we easily check the majority of these websites and find which advice is malicious, and which isn't? And then there's all the advertisements on the website. They can if they want. Contributors can if they want to. A far better method of deceiving you is making you believe ...


5

In my experience, though it is uncommon to find malware embedded in these fix it scripts and registry keys, it does happen. As such, I would highly recommend most users getting these types of patches and assistance from the vendor directly. An experienced security professional could download the fix it script or registry key, open it and view it first, ...


0

What I would do is: Close all apps in the App Switcher. Close all tabs in Safari. Ensure "Block Pop-ups" is enabled in Settings > Safari and "Clear History and Website" while you're there. Go to Settings > General > Device Management and delete any profiles you don't recognize. Clear the RAM on the iPad. Hold down the power button until the "Slide To Power ...


1

Routers are essentially pretty limited PCs. They have operating systems and they run software, so yes, they can catch malware via the regular attack vectors. Routers are susceptible especially to DDoS (tho rather in enterprise environment) and brute force attacks, weak credentials, outdated firmware and of course backdoors. So no, you can not easily tell if ...


1

My question is, why all the Ad-severing servers are termed as CnC in most reports like they claimed in this below report and how do we respond? Because the way advertisement is done today on the internet make it easy to use ads to serve malware or do social attacks. There is already the term Malvertisement for malware delivery through advertisements and ...


0

I'd call it bad programming if you actually overwrite Windows' default DLLs. Putting them in another location than System32 is a way to: Use an exact DLL version without depending on the system. (Example: Direct 9's DLLs aren't included by default on Windows 10, and any game that depends on that crashes) Update executables without admin rights (Firefox ...


4

There is so many variables to this question with that been said but I'll provide an few scenarios. Scenario 1: User machine has been infected by an "virus.exe" which is executing under the user context "TokinRing" which is not an administrator account. You've decided to run an application "cool.exe" as an administrator account. Default windows security for ...


1

That depends a lot on the process who is used to conduct the exploit. If the elevated privilege process is the one being used, then any shellcode injected into the logical address space will have administrator privileges. So if a normal user starts, for example, Firefox as administrator and catches a malware using drive-by-download, the exploit will have ...


4

Pre-fetching as I understand it in Google Chrome performs things like DNS lookups and static content caching. In order to determine what static content to download, some parsing of the HTML document it pre-fetches must be conducted and it is known that browsers have been vulnerable to malicious HTML payloads in the past (Internet Explorer CSS and HTML ...


1

Worm:Win32/Goldrv!rfn is a trojan that installs Win32/Rootkit.Agent.HU malware. Installation: The trojan does not create any copies of itself. The trojan creates the following files: %windir%\­system32\­drivers\­symavc32.sys                       (167936 B, Win32/Rootkit.Agent.HU) %temp%\­_it.bat Installs the following system drivers (path, name): ...


5

I'll be writing from the assumption that 2FA is used with two separate devices. A single device with 2FA doesn't make any sense to me considering the risks associated with malware. Is it possible to trick 2FA? Now, wouldn’t a malware residing on the user’s phone simply be able to generate the “Yes” tap? Yes, this is possible. Pretty much nothing ...


0

I was always under the impression that these injections were just injecting html which would render another control. For example, when the victim browses to www.bankingwebsite.com they are presented with a login screen that normally asks only for cardnumber and password. Suppose we also want their CCV, expiry date and their mothers maiden name. We can ...


2

I don't know about Zeus in particular, but generally speaking, it's easy to do this using debug APIs like VirtualProtectEx and WriteProcessMemory. Open a HANDLE to the target process, add some executable memory (with VirtualAllocEx), put some malicious code in there, re-map the virtual address of the executable code of the library that holds your target API ...


0

Worms will often give themselves randomized names to avoid user detection, you won't find many worms that will names themselves "IAMAVIRUS.worm". It's impossible for us to tell what the worms would do without seeing their inner workings, but to be honest you should probably just remove them from your machine if Windows Defender flags them.


0

There are many things that are connected through USB on a pc, even more so on a laptop. An attacker could scan for other vulnerable usb chips in your keyboard, webcam, mouse etc. and infect these as well. At this point clearing the HDD won't help you anymore as your webcam is now infected and will happily reinstall any malware or backdoor the attacker ...


1

The problem with someone being able to execute commands on your machine is that they don't really need a virus at that point. They can use perfectly legitimate tools/commands to obtain and retain ownership of your machine, so anti-virus is rather moot. The only "right" suggestion for what to do after being victim of an attack is to format the machine and ...


1

Hybrid encryption. They use a Hybrid Cryptosystem. The general idea is this: Generate random AES key. Use that AES key for bulk encryption. Encrypt AES key with built-in public RSA-key. Delete AES key from disk. Display RSA-encrypted AES-key to user in ransom note. Here's a nice blog post with an in depth look: 2016-01-24, Adam (@cyberclues), ...


1

Check on another device to see if the same behaviour occurs. I don't believe removal of malware is the scope of this forum. However, I'd recommend you do an virus scan, check your BHOs and Addins on your browser.


3

It really depends on developer of the ransomware. Ransomware itself is just malware requesting payment to get removed from your computer. To influence the victim to pay techiques such as preventing or making an particular task more difficult. The unlock code will be just an cryptography public/private key. So, the victim will only have the public key and ...


0

Are you facing this problem while using a wifi connection? If yes, please make sure other devices connected to the same wifi router are working properly. I am experiencing a similar issue in my home. My desktop computer with Fedora 23 is affected, together with all wifi devices sharing the same router. I have read in the avgforums that manually resetting the ...


1

You might want to install a Host-based Intrusion Prevention System (HIPS), create a correlation that matches your desire and block the action and also provide an alert/notification about the activity. But this might be an administrative burden as you have to always monitor for false positives.


1

Some website virus infections are only active when the user reaches the website from a search-engine. This is done by checking the referer. The idea is that normal users never type url's directly, only the owner of the website does that. And the virus does not want to alert the owner. So for my suggestion: do a google search for you website and access it ...


1

Beware that "stock" firmware/image can be infected too, especially if we're talking about some (usually cheap) chinese devices. Secondly, you could try to monitor it's traffic after reflashing/reimage it. But there's no real guarantee that it will not perform new, unwanted or undetected "things". If the manufacturer is a trusted one, there's little chance ...


2

It depends. If she's the only one user getting this sort of alert, chances are that her machine is infected. If many users report this issue, it's time to get your website checked. Also, if she's getting the alert from her legitimate anti-virus product, it could be the case of false-positive. A simple email to the anti-virus vendor would solve your ...


2

Maybe. In theory it might be that the (unknown) mail client you use already extracts information from the attachment when you simply hover over it. And the practice might not be that far away from this theory: There were several bugs in the past where the preview feature for mails could be used to execute malware, see Can malware be activated by previewing ...


-4

The Government, FBI specifically if I recall correctly, (therefore also the NSA and CIA) openly uses software that can do this, at least on certain systems. If I recall correctly, they can infect you without even hovering or opening, just sending the attachment. This has been known for years, if you want a source, you will have to do some googling yourself. ...


0

No because there exist a shortest path (of attack) and a dead end. The thumbnail image is computed by your client E-mail reader from the original attachment. Hence an eventual attack code will have to go through this image filter. There are 2 possibilities at this level: this filter contains flaws permitting an attack, this filter was correctly coded ( :) ...


2

By default there is no such functionality that could be exploited itself. What is possible and mostly done with attached PDF's but also possible with other file formats is to exploit vulnerablities in the viewer software. This is the only way to compromize a system through a non executeable file. But also in that case the success of the attack relies on the ...


0

Re-installing your hard drive is most likely your best option. The D partition will only be usable if you have the OS-specific recovery media. If you feel the problem is worth trying to track down, you might learn something. Here is a list of some tools that could come in handy: CCleaner - clean unnecessary files, sorts registry problems, change startup, ...


3

Standard protocol would be to wipe the hard drive(s) completely clean and install from known good read-only media. A malware also modifying the windows 7 copy on the recovery partition is conceivable. But whether or not the malware you have did that is something we can not tell you without looking at your machine.


0

TL;DR: ChromeOS is vulnerable to BadUSB, but this is probably not a big security concern. BadUSB works by installing malicious code in a USB device controller. This can allow one type of device to impersonate another. For example, a thumb drive may impersonate a keyboard; one that starts typing commands right when it is plugged in. While operating systems ...


0

Firstly, go into Chrome -> Settings -> Search Engine and check the search engine. There is a malicious search engine bug that google is yet to fix involving JS execution via the Default Search Engines feature. Then, grab everything from /data/data/com.android.chrome/. The chrome cache is in a directory named cache under this directory. Next, wipe the ...


25

Matthew's answer was excellent. There are a few other ways as well. Not a whole lot of malware authors are all that bright. For example, you can open a lot of executables in notepad and look for string data. I've seen countless authors who simply put their email address/server name, username, and passwords inside the programs in a string, and it literally ...


45

There are a number of different techniques, depending on the skill level of the malware author: Embedded metadata - compiled programs can contain details about their authors. This is most commonly seen in legitimate programs, and shows in the details screen if you look in Windows properties. Attackers who are out for fame might well put identifying details ...


0

I know that a keylogger called Micro keylogger records passwords from Windows 7/8 Logon Screen. However, it doesn't work when logon in the windows right after power on the PC. It works when logon in the windows from sleep mode/log off.


1

AntiVirus (AV) software operates based on the idea that you can decide what is bad, detect which programs do bad things, and kill/uninstall them. Reactive security systems like AV software require very good knowledge about the threats you're facing, or about the difference between malicious and normal behaviour. That makes them costly and imprecise. ...


3

These are two quite different things. A little simplified: An AV is a piece of software that can (among other things?) scan your system to identify and attempt to isolate and remove threats like viruses or other malware. A sandbox on the other hand, is basically a context in which a piece of software can be run isolated from the rest of the world. Java ...


2

BitLocker would possibly reduce the risk for old-school viruses that embed themselves directly in executable files. However, there is a whole class of USB vulnerabilities that exist at the hardware level, that lives below any partition or file system scheme. While it would protect against some viruses doing their thing, I'd consider investing in a hardened ...


0

NtUnmapViewOfSection (and the corresponding NtMapViewOfSection) are function calls used by Windows kernel-mode drivers to manage shared memory. These functions can be used to share memory between kernel space and user space: for example, a driver could use them to communicate with a user-space configuration tool.


0

Any serious virus probably wouldn't want to bet on the victim having all those languages installed. The script doesn't appear to be malicious at all, I ran it in a VM and it went about as expected. Its almost certainly some kind of joke. The filename is the sha512 hash of an empty string (checked here).


0

If you have to do this on a regular basis create a script that outputs the first line of the file. This will prevent any issues involving exploits targeted for notepad. Here's an example: https://stackoverflow.com/questions/130116/windows-batch-commands-to-read-first-line-from-text-file


0

The best solution is a mix of what everyone has already mentioned. Encrypt all suspect files to prevent any accidental infection Create a disposable vm Move suspect files into vm, decrypt, upload to virus total to scan, then convert video with a command line converter, one at a time. Repeat the whole process on another disposable vm, just to be safe and ...


0

Cuckoo creates a folder with a randomly generated name (So it changes every time you run a new analysis) in the root of C:\ which it uses to store the submitted file, among other things. What you could probably do is create a zip file containing both your executable and your DLL file, then submit that zip to Cuckoo. When the analysis is run Cuckoo's zip ...


0

@OP I may have TL;DR too much, sorry but hope it helps anyway: This is what your antivirus software's quarantine was designed for. If you can't trust that you can always 7z the files under high compression with a password(password to keep the idiots from extracting it) I use the 7zip method all the time, usually, I change the file extensions before zipping ...



Top 50 recent answers are included