New answers tagged

2

You should NOT. First, you don't know if the file is trustable, you got it from some "source". It is never advisable to install APKs from untrustworthy sources, especially on your primary device. Second, it contains a known vulnerability. Third, it is an offline game, and it requires full internet connection(it may be because of ads, but you never know ...


0

The programme in the screenshots was called Tencent. I found a file location in its options, dug around and got and got the name from there. I had to reboot in safe mode, to kill the processes as it restarts itself automatically, then uninstall the application, delete the files and remove the app data. Followed this video guide. Tencent Removal Guide The ...


0

The Malware creator might use the various points of redirection to change the behaviour of the script after it has been deployed to its target, maybe all systems are under the attackers control and he chooses to redirect different targets to different locations. Another possible answer is that the attacker prepared for the loss of access to one of the (most ...


-2

Honestly do not know if it is malicious or not, but it is used in TOR browser to prevent scripts, and I've seen it work within the TOR browser when booted into Tails OS and it doesn't appear to do anything but prevent scripts from running. I would definitely watch what you click though, as I did notice an advertisement/link for the "speed up my pc" junk ...


5

The message means that Facebook has received some unusual requests from your computer, like for example a large number of attempts to guess passwords for different accounts or attempts to post spam. So Facebook assumes that you have some kind of malware on your computer and recommends you to install a malware scanner to get rid of it. For more information ...


3

My question is has the malware installed proxy server on my pc? Based on your description this is very likely. How the malware has done this? Use of proxy is only a registry setting or similar (i.e. browser profile) setting and can be changed by a process (no manual interaction required). How to resolve this issue? Unless you have ...


-1

Before going brief ,I have noted the following things from your question : You were visiting the mirror site of some malicious website The official link differs from the url which you have downloaded I was able to reproduce the problem while analysing the mirror site and it was flagged as malware as per the virustotal report Now as you haven't ...


3

I'm afraid wiping the machine, changing all your passwords from another good machine, doing a fresh install from known good install media, and restoring the data (carefully) from backups really is the only solution guaranteed to clean your machine. In the trade we call this "nuke it from orbit", and the reason it is the only way to be sure is that you ...


0

First of all if your system really is infected it is hard to trust it again. But you could try to remove this adware with antimalwarebytes and with hitman PRO. The HTTPS error you get is the same I got while using bullguard. This could be because of your AV protection. I highly recommend you check your safe browsing section of your AV. If this did not help ...


6

Probably the best low-impact solution is to use multiple disks. OSX supports it already. You could keep a regular disk plugged in, and use the second disk on a weekly basis (keeping it unplugged and in a safe location). If your backup gets compromised you only risk losing a week's worth of work. Also, keep your backups encrypted!


0

It depends which malware - if you've got a good idea of the behaviour of the particular strain of malware that you're testing, then internet access shouldn't be a problem. Of course you have to have confidence that running it won't attack any internet hosts, for example, from other reputable reports on the malware analysis. There will always be VM breakouts ...


4

You need to make one adjustment to your conclusion: So, I see Windows 10 gets more infected than Windows 98 Should be So, I see Windows 10 gets more infected than Windows 98 by the programs I tried You cannot make general comments about Windows based on the small sample set of software and malware you tried, especially since you indicate that ...


5

There is one flaw in your premise that since those malware ran on windows 10 but not on 98 and hence windows 98 is safe. By that logic, I can say that my shell script cleared the contents of a linux box but not windows and hence windows is more secure. Edit: Modern operating systems are the primary targets for attackers as most of the users use them. If the ...


2

Your 1) Can I test malware in VirtualBox with access to the Internet within the VM without harming my host computer or any of the other computers on my network? You wouldn't want to. Suppose the malware you are analyzing is deisgned to immediately target say a bank or government machine. You could set yourself up for huge liabilities. On the one side of the ...


1

The problem you will actually have, when using a VM, is that most malware will refuse to open its payload so you won't get a lot of research done. Researchers using VMs to dissect malware are all too common, and most malware nowadays actively prevents it by looking for clues that it's running in a VM, and staying dormant if it finds them. Keep that in mind ...


3

1/3/4/7-Access to the Internet? Not a good idea as depending on what it does, your VM could release it "into the wild". Running it in a VM should be perfectly fine if it is not connected to the internet. This answer from The Bear will go into a lot more detail regarding the malware escaping a VM. Here 2-Formatting should be fine for 99% of malware. Some can ...


-1

Open your browser's development window, and look for requests in the network tab. This could be a WordPress plugin loading something from a 3rd party, it could be your browser preloading links or it could be one of your browsers add-ons/plugins/extensions loading something. It's nearly impossible to say with the information provided. You could also try ...


1

Another reasonably useful dataset that i've come across is: AndroMalShare - http://sanddroid.xjtu.edu.cn:8080/ (The domain name has changed at some point but can be found also at http://202.117.54.231:8080/#home ... and if not, the project seems to go as "AndroMalShare Project" ... so just Google that)


3

Uploading a virus won't infect something. Interpreting the virus in the interpreter the virus was meant to exploit will (i.e. Acrobat opening a PDF; the OS launching an x86_64 binary; etc). This is something to think about when you evaluate your threat model. The importance of extensions File extensions are only hints to handling instructions. Only Windows ...


2

Drive-by downloads are a real threat. These enable a website to exploit a 0-day vulnerability in your browswer to execute malicious code on your system. Note that sometimes websites are hacked to behave maliciously without the website's owners being malicious. While browser manufacturers work to fix security problems quickly, the 1534 publicly announced ...


1

I had this same issue about 2-3 weeks ago, with the same site coming up after running several scans with Roguekiller. Prior to that the browsers would lock up or work very intermittently, (Firefox, Chrome, Edge, IE , Opera, ect.) Using a web browser in a game, running a VM or Tor worked, but even Tor would lock up after an hour. This was on Win 10 64bit, ...


0

It's difficult to tell just based on this. More information would be needed to make any solid conclusions. If you really want to tell if it's compromised; reboot the system, use netstat to view any active connections. If a rootkit is installed, then you should see an unrecognized connection. The hard part is weeding this connection out amongst all the ...


0

You don't mention what phone it is, when the problem started or where you got it in the first place. I've found that some of the cheaper Android phones and tablets for sale on Amazon come with malware embedded in the firmware itself which installs all sorts of adware and helpful Chinese "utilities," even after deleting all the responsible apps and non-stock ...


4

An increasingly common attack is to use your Google Play Store credentials to force apps onto the device via the web page for the app. If you are seeing apps install automatically this is the likely source. In any event if you got malware on your phone, you really need to change your Google credentials and reset any 2fa tokens or app-specific passwords ...


0

Tell management getting a virus is like getting an STD, and just running an antivirus program without fixing the damage is like just wearing condoms from then on.


0

Simple. YouTube has a comments section, description box, and in-video annotations. This means anyone can post URL's on YouTube so clicking the "wrong" URL posted by someone else can potentially lead to malware or a virus.


0

It depends on your definition of typical - that is a moving target. We have now seen the first instance of ransomware named Petya that, rather than encrypting the files, encrypts the Master File Table and the Master Boot Record (MBR). And the MFT essentially manages all file information. If you encrypt the MFT, you don't have to encrypt the files (much ...


44

Your website www.sheba.xyz is hosted on a shared system together with lots of others. This means that all use the same IP address, 166.62.28.88. Unfortunately, not all of the sites on this IP address play nice, which means that this IP address got reported as a cause of trouble. Unfortunately it is not only Checkpoint which reports this site as bad, but ...


8

As far as I know, you don't "circumvent" the false positives, you have to contact Check Point and let them know who you are and work with them to get the false positive fixed, maybe they know something you don't, or you know something they don't.


1

As far as I know typical ransomware, like the (in)famous Locky virus for example, encrypt files depending on their file extension and across all local and remote drives. To break it down: The ransomware will scan the system for Local drives (System drive, secondary drive, USB drive and so on) Remote drives (Network shares like samba, nfs and so on) Files ...


0

Think about the attack from an attacker's point of view. Should I only encrypt where they MIGHT store information, or should I encrypt everything but what I know takes to make the OS run? So the short of it is they encrypt all but certain locations, the known operating system folders. Since those are extremely well known of course, they can simply exclude ...


0

The malware content of the files themselves do not get executed, if that's what you are asking, so you will not be affected by the analysis of the malware traffic. Although, as @steffenullrich points out, it is possible to craft a malicious pcap file that is designed to exploit vulnerabilities in Wireshark or its plugins.


3

Wireshark is a complex beast and often bugs in the various protocol specific dissectors can be found which also might lead to remote code execution, see Dissecting Wireshark: I Know What You Captured Last Summer. But while this might cause code execution when using a pcap from an untrusted source or with malformed protocol data in it, a well formed pcap ...


14

In addition to Angel's response, As seen in the popular ransomware variations that you mentioned, the encryption is done on a file by file basis where one file is encrypted and then the plain-text version of the file is removed, then the ransomware moves to the next file. It may start parallel threads to encrypt several files but the outcome is the same for ...


1

Others mentioned that just retrieving a URL can provide crucial information to the host; usual the information is that you have read an email. That said, I assume that one option to inspect a web page securely which is not too uncomfortable or complicated is to open the URL in a text based browser like lynx (under Windows perhaps in a cygwin environment). ...


0

I like @Robert Mennell's answer, but I'll add that there is one way to see what the site is running, and that is to yank the disk and inspect it in another machine. That way, you're less likely to be impacted by a rootkit that's causing the OS to lie to you. Of course, the drive firmware could be lying to you, but that's a pretty specialized rootkit.


3

It's hard to inspect websites by analyzing their source code, because some sites have hidden codes in it. You might want to try reputation based analysis. You can add an add-on to your browser to analyze the site before you click it. Example of it is wot, a plug-in (web of trust). https://www.mywot.com/ You can also send the URL to a free URL Scanner. ...


12

Visiting a malicious site is often a hit or miss because you're talking to THEIR software that THEY control. You have no real control over it no matter what you do. It could appear non malicious for a long time, and then hit you. It could try to hit you as soon as you visit it. It could... Because there are literally infinite possibilities of how a site ...


31

Why not just send the URL to Virustotal? Accessing a malicious website can be tricky. Using curl, wget, links -dump can be tricky depending on how the malicious content is served up. For example: <IfModule mod_rewrite.c> RewriteEngine On RewriteCond %{HTTP_USER_AGENT} RewriteCond %{HTTP_USER_AGENT} ^.*(winhttp|libwww\-perl|curl|wget).* [NC] ...


2

I recently reviewed a student's homework assignment that was written in Python, that: Creates a new temporary directory/folder Does some stuff in that folder Moves the output file to the parent directory/folder Deletes the temporary folder Well at least thats what he thought it did. It actually deletes whatever the current directory is, including the ...


2

I've taken a look at the website and I couldn't find any evidence that it has been hacked - however, this does not necessarily mean that the site is clean. Norton claims that your site is a Web Attack: Mass Injection Website and has therefore put the site on a blacklist. This blacklist seems to be used by other services (like sucuri and maybe the company ...


0

I'm an expert on this particular issue and I can assure you that No, you do NOT need to worry about Skype compromising the security of your computer. Skype should be the LEAST of your worries. The most important thing to remember for the security of your computer is: Don't open any file attached to an email UNTIL you have verified who it came from, you know ...


10

They will mostly be file-by-file. Thus, if you are “lucky”, you may find yourself with only some folders infected. There are several reasons for this: Easy to code. Just iterate through every file repeating an encryption routine. Suitable for external programs. Sometimes the ransomware is using a third-party program that works on files for performing the ...


0

Yes this can be done in IPTables by blacklisting known bad addresses. See the following related post for more details: Blacklisting IP addresses -- when should we take action?


2

If you have your system set up so that only connections to your bank (eg. www.bank.com and www.bankcompany.net IPs) were possible, a redirect to a third site wouldn't load. The exploiit would need to be hosted on the same site as your bank (which is admittedly rare). As with many security solutions, it's possible that some bank update makes the website not ...



Top 50 recent answers are included