Tag Info

New answers tagged

1

Beyond the tools that Kyle mentions if you need something you need to run from time to time check out BriMorLabs Live Response Collection it might be able to provide you all the data you could use to start to do a root cause analysis on the system.


0

As said by @schroeder, a malware/spyware alerting the user with a beep pretty much nullifies its purpose. Probably what you hear is a alert/notification sound, so you should disable it. See also here: https://forums.motorola.com/posts/bb23abb559


2

Live response is a common and accepted practice today. A number of commercial and open source tools can gather volatile data, because immediately pulling the system off of the network can also be disruptive to the forensic validity of your evidence. The key is not "don't change anything", but rather "be able to explain and have documentation for any ...


0

I have been suffering from this virus for last seven days, but in my android tablet. I have formatted my tablet three times in three days, but problem reoccurs just after installing the browser. It is correct that it alters your DNS server address. I have read a post somewhere in the xda forums that gave me hint about this: go to wifi settings and find the ...


0

If your router is affected and you're facing different issues on your devices (android has no ads, computer does) may check/change your DNS settings on both devices and on the rooter. I think you android phone uses a different DNS server as your PC. Your PC propably uses your Router as DNS Server (e.g. 196.168.1.1) and your android uses a 3rd party DNS like ...


0

This does not appear to be an OS/browser related issue. I would recommend you to read this http://www.quora.com/How-do-I-stop-AdsMatte-spam-popups-and-ads What it says: I believe all your default gateways is "192.168.1.1" Open this from your PC. If you can't open it, the the solution below must work: I believe you should know about it first(skip ...


1

I ran into this issue not too long ago. If you have done a clean OS install then it is likely that your Chrome settings have been tampered with, infected, auto-backed up, and restored once you log into Chrome again after the clean install. You can try and reset your Chrome settings. It actually took me hitting this more than once and manually inspecting my ...


37

A zero-day attack is an attack that relies on an undisclosed vulnerability in the design or implementation of a system in order to violate its security. Most commonly, such attacks consist of using zero-day exploits to access information systems or execute code on privileged systems. Such exploits are called 'zero-day' because security administrators have ...


0

Yes, it is very possible to gain remote code execution (RCE) via programs such as Skype. For example, there was a notorious exploit in the FreePBX client provided with the Elastix 2.2 platform which triggered by merely accepting a call, as can be seen here on youtube, which gives full code exeuction. Also looking through www.exploit-db.com shows you that ...


1

But the US has great consumer credit card protection. Call your CC company and tell them that you didn't authorize the charges. You cannot be held liable for more than $50 of invalid charges though most companies will not even charge you that. You may have to eat one $29.97 charge. You definitely need to cancel your card. If anything from limi1.com was ...


3

I hate to say it, but it sounds like you got tricked. It's a common scam for a pop-up to claim you have malware or viruses and "offer" you a to fix it for some fee. In reality you are usually paying for the privilege of giving hackers full control over your computer (if you installed software for them, that is). Second, limi1.com doesn't appear to have ...


1

Tor provides you anonymity, but it will not protect you at all from malwares or any other security threats. All recommendation regarding network security must therefore be scrupulously respected in order to ensure your network safety. You do not mention it in your description, but be aware that your setup matches Whonix project, so if you do not want to ...


0

I'm setting up a physically isolated Tor system (with one computer serving as the workstation and another as a Tor gateway), ... I don't know what your "physically isolated" refers to, but since you have a work station connected to a Tor gateway I would assume that you plan to use the workstation to access the internet through the Tor gateway. In this ...


0

It looks like your website is hacked / compromised and the attacker must have injected some malicious script into your website index for monetary gain through ads or for other profits. There is also a possibility that the source website from where it is loading the content is also hacked / compromised. What I can suggest you is: It is necessary to identify ...


2

The commenter, paj28, is correct: don't submit these to VirusTotal. Test them against the HIPS and AV systems you are specifically targeting in a VM-guest environment. I prefer using Vagrant along with the Packer and Boxcutter tools to "mock up" things in a lab. Hyperion is great, but don't combine it with Pescrambler necessarily. You only need one cryptor, ...


0

Generally, a virus just sitting there isn't an issue, but it's a problem waiting to happen. I have viruses on a dedicated PC just for analysis and forensics. Here is the paranoid answer: STUXNET was (in part) created by a vulnerability in the icon creation process when generating the icon for a file, where a buffer overflow occurred. I can assume that ...


3

Unfortunately I would have to agree with the poster named "Freedom" who has made the observation that you cannot trust U.S.-manufacturered, -owned or -designed systems. The Snowden revelations proved far beyond a reasonable doubt that not only the NSA (but a long list of other "alphabet-soup" U.S. surveillance state entities), long ago declared war against ...


0

I'll go against previous answer and say no you can't execute a program inside a Zip file without extracting it first. Windows explorer can open zip files and show it's content but it must decompress the program before execution. The zip file itself could in theory contain intentionally malformed data that in combination with a software bug can leads to ...


0

You should set the Security settings of your PC starting with whatever Browser you are using. (In your case, Firefox.) You can also set your AV Software to automatically scan any new item that is loaded/downloaded into your "Downloads" folder. This is usually called "On-Access Scanning."


0

A lot of botnet are actually "commercial" software, in the sense that you have to pay like a licence to get them (even underground commerce remains a commerce... actually you may even find that botnet developers actually offer paid support for their tools!). However, you may find older botnets or versions (ie. software widely known by current anti-viruses) ...


2

Yes the risk is very big. NSA is know to put spyware on hardware before shipping (see here), NSA is know to ignore the US constitutions and spy on calls and internet activity of US citizens so do you really think they care about foreigners? If they seize your laptop and you ever get your hands back on it, throw it on the trash its junk now. I can bet ...


4

Though you might expect this if traveling to certain countries, this question hinges on whether we should trust the authorities (or a specific person, still an opinion) and somewhat separately known capabilities (which are broad). An essential answer is the risk you're willing to accept. You could say you can't trust your device if it ever leaves your ...


2

Though it's better in the sense that communication is automatically between two windows (and you can hope the object disappears after it's transferred), I'm voting no¹ because: It uses Automation, its interface is public It's not thread-safe (so it's global) Windows in Windows can be hooked The only protection I saw was at the process level: you ...


0

Check the router DNS settings. I suspect that the infected laptop changed the DNS settings of your router to use malicious DNS server¹ that return fake entries for pagead2.googlesyndication.com. The virus should not have been able to do that (it should have required a password they don't have), but sometimes routers have holes that allow changing the ...


0

It seems to be a DNS issue, as others have said. Whether your router is infected or was reconfigured by malware is a difficult question to answer. I hope this will at least give you a prtial answer. Investigate your DNS settings. First, open a command prompt. In windows, click start menu, type cmd. Right click CMD and select "Run as administrator" if that ...


-1

An infection of your router is unlikely. ISP's have been known to inject their own ads though. You might want to try changing your router's DNS to use the DNS servers of a third party, such as Google's public DNS or OpenDNS. If you do this and the ads go away, you have isolated the issue. If not, it lies somewhere else.


7

First things first If you suspect your server has been compromised, you should be implementing an Incident Response plan. There are lots of resources out there for putting a plan together, including a recently released "Criminal Division Guidance on Best Practices for Victim Response and Reporting Cyber Incidents" from the US Justice Department. Before you ...


0

Definitely a rogue file, most likely a shell. Key indicators: $name = ''; // md5 Login $pass = ''; // md5 Password $lol = $_GET['lol']; $osc = $_GET['osc']; base64 filename $name and $pass are used to protect access to shell $lol and $osc are variables that pass GET data (most likely) through something like passthru() base64 is used to ...


0

If the entire network block is marked as malicious by Google, a lot of innocent sites will end up marked as malicious, as you have seen. If you are sure that the site you want to visit is not malicious, you can navigate to them and nothing bad will happen. That message is just a warning. Your web filtering software (if installed and updated) can protect ...


-3

According to Google: Of the 148000 site(s) we tested on this network over the past 90 days, 3065 site(s), including, for example, yxdown.cn/, 97sky.cn/, cr173.com/, served content that resulted in malicious software being downloaded and installed without user consent. The malicious software usually is Cross-site scripts (XSS), these are scripts that can ...


6

Yes, this is rogue. This script will execute any PHP code passed as plm12345plm POST parameter. This means, an attacker can execute arbitrary PHP and -- depending on the server configuration -- further code on your server. The first GIF89a line is likely placed to bypass basic file verification during upload of the script as a GIF image. If the file could ...


4

Yes, this is a PHP web shell. Eval should be the red flag. Basically, if the user can access this file on your server, they may be able to execute OS commands. If you have properly implemented your site, the attacker should not be able to trick PHP into executing the code in what I am assuming is a .GIF file. However, if I were you I would batten down ...


0

It's unclear from your question if the hard drive content was properly deleted. Re-installing the OS certainly doesn't guarantee that the drive has been wiped out. If the drive was pulled out of the infected computer and replaced or properly wiped out on another machine then it would be plausible to ignore the possibility that malware is still present on it. ...


9

This can be done using techniques like: Docker virtual Machines Jails Clusters (out of scope for home use) The trick here is to NOT use a single user environment like Windows. but use a environment where you could safely test any file without risk of infection. So you need a READ-ONLY Environment (full OS, not just the location being tested) which makes ...


1

Firstly I would like to explain differences between Viruses, Trojans and Malware. Malware - is the short form of Malicious Software. It is basically a software written to cause damage or infiltrate computer systems without the owner informed consent. It is general term used to represent various forms of intrusive, hostile and annoying code. Virus - is a ...


2

Is the only place to store the code ready for execution, inside the EXIF data segments of a JPEG image? Not necessarily. However, it is much more likely that a bug exists inside the EXIF processing code. JPEG processing code for the actual image is pretty standard, using tried and tested algorithms. It is the EXIF processing which is more bespoke per ...


1

Such code would of necessity exploit a buffer overflow or other data-to-code jump trick. As such, it will only be effective against a limited range of hardware. So you can run a JPEG lint checker written for, say, ARM in a virtualized device. The exploit will be uneffective against the emulated CPU, which will then be able to report on the JPEG structure.... ...


2

This is the easy case for anti-virus software. However, do not suppose that a malware has to be unencrypted to be executable. Polymorphic code brings self-decryption to malwares, it can be helped by Metamorphism to ensure that even the very start of the decryption routine, since there must be indeed a unencrypted starting point, does not present any ...


4

Not necessarily. Malicious self-executing code take advantage of bugs affecting the code of some software handling the data. You refer to a bug in the way EXIF has to be processed, but the picture data also has to be handled by the software and the code handling this data might also have bugs which could potentially be exploited. Removing EXIF data will ...


1

No, malicious code in your PHP file is not a virus or a trojan. Most end user anti-malware tools do not scan for these types of things. The malicious actions in your web app may be legitimate commands that make sense in a different context. You may want to look into static code analysis tools which analyze code for software design errors.


0

I see 3 red flags right away : first one is that you use WHM, which is a bad idea (just like its little friend cPanel and its colleagues Plesk, Kloxo, etc) - I wouldn't be surprised if there are extreme vulnerabilities in these piles of garbage that would allow root-level access to the server without even compromising any user accounts. the second one is ...


1

I have now deleted the folder and all files it contained. I've also killed all the processes. Did you make copies of the files, or simply delete them? Because without them there's really no way to tell you anything definite about them. You should not assume you've cleaned everything out or blocked all access to the attacker. Your best bet is to ...


1

If you use FTP for access to files on your website, you need to be very careful. If you store your FTP usernames and passwords on your local computer using software like FileZilla, your website can be compromised if malicious software or a Trojan is installed on your computer. Never store credentials on your local computer. Additionally, you should use ...


4

I would suggest that you look into the direction of Trusted Computing. It won't "defend" you, but it might help you ensure that you are booting in a known/secure environment. There is a load of information available here, just search for TXT and trusted computing. But for starters, you can ensure this by using a platform with a TPM and Intel TXT, then go ...


1

Not true exactly - bios can be overwritten. This is how bios upgrade tools work. Another minor correction: the BIOS doesn't operate on a lower level than the OS, at least on modern systems. That would mean that the OS uses BIOS API calls to handle the hardware. But it is not so, the OSes have a nearly bios-independent software stack. The last well-known OS ...


2

If you really want to do this, the method with the least stability impact is to disable on-access protection, URL protection, email scanning, and everything else that scans at the time of potential infection. Note that this is "method with least stability impact", not "best method". By configuring your system this way, you ensure that you will be infected ...


0

Your hard drive would become a major bottleneck plus all the conflicts between the separate AV's. One AV should work, and then run the occasional Trend Micro's Housecall (or something equivalent) http://housecall.trendmicro.com/ will also download their latest updates and is a free scan. Just don't click on popups and don't download sketchy ...


2

Installing multiple AVs is a very bad idea as the antiviruses will conflict with each other, will take unnecessary space on your hard drive and may cause system instability.I suggest you go with a well known antivirus that satisfy your needs and if ever you need to scan a file using multiple AV then use a free service like VirusTotal Here is a sample ...


1

Yes it is possible although newer bios has code signature protection which make this attack unprobable. The BIOS is tied to the computer architecture in this case x86/x64 and it's end goal is to load the OS. So no matter the OS even no OS you can flash (write) the BIOS. However, the BIOS is not a malware delivery channel. For any useful work (accessing ...



Top 50 recent answers are included