New answers tagged

0

Nuke from orbit ... your system has been compromised and should not be trusted anymore. Wipe everything and start with a new, fresh system. The virus / malware probably plays with your hosts-file and disables anti-virus or security websites (this one is doing a lazy job, since you seem to be able to surf here...). But as you dont know, where the virus sits ...


1

Found a website called VXHeaven where I can download a very huge number of viruses (260k). If the malware are working and not broken and not each of them are compressed, I will mark this as the answer for my question. Btw. special thanks to tlng05 for those sites, they could help other people, and they helped me in my research to find VXHeaven with the ...


2

There are methods of stealing browser-saved passwords so you need to assume that your browser is always vulnerable. At a very minimum, you should set a browser master password and enable encryption to stored passwords. You can also look into using something like KeePass which allows you to store encrypted passwords where you choose (i.e. hard drives, ...


5

You should assume so no matter what* When your system gets compromised you must assume that it has compromised any accounts stored on the system. You should go about changing the passwords for any accounts used on that computer in any place. You have no control over the virus, and you have no control how programs store your data so you don't know if your ...


4

A quick Google search turned up this post which links to a number of malware sample databases: Contagio Malware Dump: Free; password required KernelMode.info: Free; registration required Malshare: Free Malware.lu’s AVCaesar: Free; registration required MalwareBlacklist: Free; registration required Malware DB: Free Malwr: Free; registration required Open ...


2

This is not Javascript breaking out of a browser's vm/sandbox but rather an executable that runs with full local user privileges that happened to be written in Javascript... There's nothing to harden as local Javascript app platforms like NW.js are designed to allow exactly that and like all other platform/frameworks they can be used for good as well as for ...


3

The most important thing to consider here is that this type of JavaScript malware does not run in a browser. It runs in a special runtime called NW.js which gives powerful NodeJS API's not found in a browser. While NW.js shares many technologies with the Chromium browser, it is not a browser but a type of native wrapper for making desktop apps, and this ...


3

This sounds very much like your server was compromised, and someone is using it to spread malware with the help of drive by downloads. Consider taking your site offline, as it might be infecting your visitors with malware. To make sure that this is actually the case, I would recommend the following: Ask the person responsible for the site if she knows ...


0

If they're standard headphones with an analogue audio cable, then they can't transmit malware. If they've got a digital connection such as HDMI, they can theoretically transmit malware but a vulnerability in the headphones would have to be exploited by the device transferring the malware to the headphones, and the malware on the headphones would then have to ...


0

You might be able to identify known malware and exploit fragments with a malware scan. This might address your concerns quickly and easy. But if it was a more professional attack this might not be possible. If you assume your computer is compromised you might have to re-format the device and re-install the operating system. This action would be mandatory in ...


12

Potentially, yes -- but it depends! Quite a number of Android devices (and potentially a lot of others) enable access on a serial UART console on the headphone jack during boot (a nice wrapup also exists on pentestpartners.com). You don't need a lot of electronics (and space requirements) to build a headphone that can (ab)use UART access to do something evil,...


1

There is a file named aescn.dylib, which is part of Avira Free Mac Security, but I don't know if the hash you quoted coincides with that of the legitimate file. You can find the SHA256 of that file by submitting the link to download the specific version of Avira (from the Avira website) to VirusTotal, and clicking on aescn.dylib under the "Contained files" ...


1

The way I see it, you are asking if an Android phone infected with an Android malware could store data on your headset infect your iOS device The first question has already been answered quite clearly. The second however hasn't been answered. If Android code could possibly run on iOS, well a lot of programmers would be so satisfied. One could argue that ...


7

Something that looks like headphones and plugs into the headphone jack could be evil -- it could fry your audio chip by pushing electric current beyond normal limits. But without extra software already on the device, it can't save data to the hard drive of the device.


4

No, you can't give your Android phone malware by using Apple earbuds. Pretty much, earbuds, like any headphones, are just two small speakers each soldered to two wires that complete the circuit between the earphone and the headphone jack. Some headphones have a volume switch, small microphone, playback control (pause/play, stop, rewind, fast forward, etc.) ...


4

Speakers and microphones are essentially the same thing: a vibrating element controlled by an electronics signal. Because of that, you can turn a speaker into a microphone quite easily by messing with the cables. In theory, a modified headset equipped with bluetooth or a data cable (like the upcoming Lightning-connected earpieces might be) could spoof a ...


3

No, it is not possible because a common jack cable headphone lacks 3 things that are necessary for a malware infection: Storing data Executing code Transferring data This is something we might see coming onto headphones in the future. For example USB-headphones might come with such features which would make a malware infection and propagation possible.


80

I doubt there is a way to store any information (thus transfer information) on regular headphones. Some more advanced models (such as noise canceling) have some processing ability and firmware, but I don't see it as a viable attack vector.


12

As far as I can establish, these headphones don't have memory, so they would not be able to store malware. Also, the datastream should only be from the computer or mobile to the headphones. Even if an attacker managed to put malware on the headphones, it would be hard to send the malware to another computer or mobile. If it were a headset (i.e. with a ...


39

While I would not say "impossible", I can say that you don't need to worry. Headphones do not have any storage that could be used to store malware. Also, they usually do not actively send much data to the phone they are plugged into that could be used. For example, only send sound data if there is a mic, and maybe some simple play/stop/skip/volumeup/down ...


4

No. Viruses can infect any commonly used bootable media. The spread of this type of viruses became thwarted (in addition to better protection mechanisms) because of a change in media usage patterns. Floppy disks in their golden age were used as a medium for live OS (booting and running), software distribution and for data exchange. Nowadays you use: ...


5

Right, when you're dealing with devious malware, it's very hard to determine whether you've completely removed it. Rootkits are pieces of malware that change core OS components (either on disk or in memory) to make normal OS functions return false data to hide the malware and/or its effects. Malware can conceivably modify the boot process to essentially ...


5

Yes, it is possible for a malware to infect the Windows partition while your are using Linux - source: it happened to me. This was many years ago when I was starting with Linux. The dualboot system was currently running under Linux, and I wanted to exchange files between two computers using Samba. Since there were some problems with it, I removed all ...


7

In many Ubuntu dual-boot setups it is possible to run code as an unprivileged user which has the ability to write to the Windows partition. Because, if you can do it with the file manager without getting asked for a system password a malware could mount the windows partition too with the same kind of helper. And if the malware setups a file into the ...


1

The other answers explain pretty well why Windows malware won't run on Ubuntu. However there are some languages like Java, and most interpreted languages which are cross platform like PHP, Python, Ruby, etc, and malware written in any of those languages will execute just fine on Windows, Mac, Linux, and even BSD. Assuming the malicious code can run ...


12

If you had two viruses in play, one that infected Linux with a payload to infect Windows, then it could conceptually happen. However, a native Windows virus cannot run in Linux at all. The reason why nothing would happen has to do with something known as the "Application Binary Interface", or "ABI" for short. In Windows, most system calls are performed ...


3

If the Windows partition is mounted, then any user with permission to write to that mount can change any file as they please, without the normal restrictions or permissions that would be enforced when Windows is booted. This could allow a malicious user to replace critical system files in order to infect Windows. That being said, I don't think there is any ...


2

Well actually Removable media is a subset of physical media. Its the old "a cube is always a beam, but a beam is not always a cube." thing. Boot sector viruses have been know to be spread through: Hard Disks Floppy Discs CD/DVD/Blu-ray Discs Tape's Cartridge's BIOS and Secondary BIOS infections PCI equipment (I only know of lab-experiments like this, but ...


3

The short answer, albeit deceiving without the long answer: Yes, a cookie can carry a virus. Yes, it is possible to get such a virus by merely visiting a website delivering the cookie. In the above paragraph, replace "a cookie" with "any file, data, or anything else," and replace "visiting a website" with "possessing," and the statement still holds true. ...


0

Do Forensics. Capture the traffic of your local network. Analyze the traffic, site any anomalous connection, is there any machine/s communicating with Malicious Domains or IPs? From that stand point, you can locate the compromised computer/s. Isolate those machines, capture images. (Date/Time, Drives, Caches, Memory etc...) Capture System Logs, see who ...


-2

The question of whether or not cookies can be dangerous or spread viruses has to do with whether or not a file is an "executable" one. In theory, if an executable cookie was set with malicious contents, then it is possible that it could affect your computer with a virus and open a proverbial can of worms. This is a fairly rare occurrence and one that I have ...


4

Theoretically they can, as Anders already mentioned. The "problem" is that they won't be executed by the browser. However, another software/malware on your computer could. Which would be particularly dangerous, because anti virus programs most likely won't detect the cookie or the executing software on their own when carried out in separate files.


10

In addition to Anders' excellent answer, there was a vulnerability in Internet Explorer 5 and 6 which allowed a malicious cookie to be set that could then read or set other sites cookie values. Article here. An information disclosure vulnerability related to the handling of script within cookies that could allow one site to read the cookies of ...


3

The cookie itself does not do damage, but it may contain code used by executables. A tactic of some viruses is to store the cookie with some partial code and that code will be alter run by a virus-like application. Example: cookie stores decryption key for an executable that bypasses initial scans due to being well encrypted. Then the .exe is using the key ...


89

You can put any text strings into a cookie, so in theory you could put some kind of code there. But for code to do any harm something needs to run it. The web browser does not interpret the content of cookies as code and does not try to run it, so cookies should not be dangerous. (If you have heard cookies being referenced in security related discussions, it ...


6

Cookies can only transfer TEXT values, meaning it cannot harm your computer stand-alone, but it can contain very important informations, that can be used against you if stolen. Read about Session hijacking, and you will understand what specificaly the exploiter can use it for.


0

Users submit samples of infected files to Clam AV that are processed by Cisco/Sourcefire personnel working on the Clam AV project. Virus Total and other AV industry sources also share infected files with the Clam AV project. Finally, the Cisco/sourcefile people share with Clam AV what they have learned on their end.


0

Scanning packed files like archives is very resource intensive. Many administrators limit the amount of (recursive) unpacking to preserve resources. Malware authors know that and like to pack, archive and encrypt files multiple times. This increases the chance of causing false-negatives. If you want to deal with such files, you have to unpack and analyze ...


1

There are several ways such an ad-injecting malware might work and it does not even need to be installed on your system. Common ways are: Browser extension: there were several prominent cases where common browser extension were sold and went malicious. These probably can do anything, including manipulating data accessed by https. Local proxies. In this ...


2

You can try rebooting in safe-mode and uninstall. Tap F8 during bootup to open Advanced Boot Options, choose safe-mode and go uninstall Avira. That is assuming you have a legacy Avira application and not a virus impersonating it.


2

You should be okay. It is one of the oldest tricks in the book. The practice is refereed to as Malvertising. The idea is to make it appear the machine is compromised or having issues. They then usually direct you to a fix or a recommended program. However those are actually the real malware. And they may be ransomware, adware, bots, a remote admin tool, or ...


0

This is probably an example of the fake malware detected malware, trying to trick you into downloading and installing a "cleaner" that is actually malware.



Top 50 recent answers are included