Tag Info

Hot answers tagged

21

If your devices can connect to the internet (without redirection to Adulttube.info) through 3/4G then I suppose your router is infected with a trojan (Trojan:32/DNSChanger) https://www.f-secure.com/v-descs/dnschang.shtml Trojan :32/DNSChanger compromised the router weak default password using brute-force attacks. The Trojan then changed the routers DNS ...


15

You can decode the start of $_X: root@bt:~# echo -e ...


6

Ran it throught Closure Compiler and here's what it looks like: http://jsfiddle.net/q520kg51/1/ At first glance, it doesn't communicate with any remote service or use any HTML5 API. Here's part of the compiled code (I cut out the repretitive stuff) var a = ""; function b(e) { c += e } var c = "", d = "", d = "e"; b("fu"); d += "v"; b("nc"); d ...


4

If I understand your question correctly, anti-virus will report a file as malicious even if that file cannot be executed on the machine it is on. For instance, a Windows-only virus found on a Mac can still be identified by anti-virus as malicious. This is a good thing because you might pass on those files to others. Malicious is malicious, even if there ...


4

There are many ways to do this. The term you are looking for is "rootkit" - that should send you down a rich road of research. As for specifics, the attacker could replace a core Windows program with an infected one so it always gets loaded when Windows starts up normally. Or, the attacker could infect the BIOS. These two methods are impossible for a normal ...


4

Once you format the code a little, like how I edited your question, it's easier to see what's going on. $OOO000000=urldecode('%66%67%36%73%62%65%68%70%72%61%34%63%6f%5f%74%6e%64' translates to $OOO000000=fg6sbehpra4co_tnd All of that is used to build the string: $OOO0000O0=base64_decode The eval section is base64 encoded and resolves to: ...


3

Conficker was estimated to have 9 to 15 million concurrent infections at its peak. Mark Bowden does a good job telling its story in his book Worm: The First Digital World War. Other malware with high peak infections include MyDoom with 1 million, Storm with 1 to 10 million, and Zeus with 3.6 million in the US. For comparison, Cryptolocker was in the news ...


3

I decoded the whole code by changing the eval function to var_dump. This gave me: string(133) "$_X=base64_decode($_X);$_X=strtr($_X,'123456aouie','aouie123456');$_R=ereg_replace('__FILE__',"'".$_F."'",$_X);eval($_R);$_R=0;$_X=0;" or formatted: $_X=base64_decode($_X); $_X=strtr($_X,'123456aouie','aouie123456'); $_R=ereg_replace('__FILE__',"'".$_F."'",$_X); ...


2

If you really want to do this, the method with the least stability impact is to disable on-access protection, URL protection, email scanning, and everything else that scans at the time of potential infection. Note that this is "method with least stability impact", not "best method". By configuring your system this way, you ensure that you will be infected ...


2

Installing multiple AVs is a very bad idea as the antiviruses will conflict with each other, will take unnecessary space on your hard drive and may cause system instability.I suggest you go with a well known antivirus that satisfy your needs and if ever you need to scan a file using multiple AV then use a free service like VirusTotal Here is a sample ...


2

Another things are crypters. Crypters are a software just like obfuscators that take in a malware and encrypts its data so that it becomes undetectable by any anti-malware programs. This crypters uses special encryption algorithm and a method to inject the malware directly into a already running program like explorer.exe without even touching the hard ...


1

There are a few standard tests / questions to detect phishing: Most serious companies will never ask you for login data by email. Check if the URL is looking strange. (very long / with typo in main domain?) Check for HTTPS connection and look for certificate information and check this (click on the lock in the adress bar). Check if you can find a ...


1

how does one make a worm to send packets to execute bytes on a computer without the legitimate user downloading the Stuxnet? It has been widely publicised that Stuxnet used at least four 0day vulnerabilities in Windows to circumvent measures which otherwise might have prevented arbitrary code being executed without the user's knowledge. These were ...


1

Because the software wants to intercept HTTPS communications without making your browser throw certificate errors. There are some legitimate uses for this, like parental controls/web filtering software, anti-phishing protection (where some software compares the URLs you're visiting against known malicious websites), etc. For example, Avast antivirus ...



Only top voted, non community-wiki answers of a minimum length are eligible