Tag Info

New answers tagged

2

Another things are crypters. Crypters are a software just like obfuscators that take in a malware and encrypts its data so that it becomes undetectable by any anti-malware programs. This crypters uses special encryption algorithm and a method to inject the malware directly into a already running program like explorer.exe without even touching the hard ...


4

There are many ways to do this. The term you are looking for is "rootkit" - that should send you down a rich road of research. As for specifics, the attacker could replace a core Windows program with an infected one so it always gets loaded when Windows starts up normally. Or, the attacker could infect the BIOS. These two methods are impossible for a normal ...


1

There are a few standard tests / questions to detect phishing: Most serious companies will never ask you for login data by email. Check if the URL is looking strange. (very long / with typo in main domain?) Check for HTTPS connection and look for certificate information and check this (click on the lock in the adress bar). Check if you can find a ...


1

how does one make a worm to send packets to execute bytes on a computer without the legitimate user downloading the Stuxnet? It has been widely publicised that Stuxnet used at least four 0day vulnerabilities in Windows to circumvent measures which otherwise might have prevented arbitrary code being executed without the user's knowledge. These were ...


3

I decoded the whole code by changing the eval function to var_dump. This gave me: string(133) "$_X=base64_decode($_X);$_X=strtr($_X,'123456aouie','aouie123456');$_R=ereg_replace('__FILE__',"'".$_F."'",$_X);eval($_R);$_R=0;$_X=0;" or formatted: $_X=base64_decode($_X); $_X=strtr($_X,'123456aouie','aouie123456'); $_R=ereg_replace('__FILE__',"'".$_F."'",$_X); ...


6

Ran it throught Closure Compiler and here's what it looks like: http://jsfiddle.net/q520kg51/1/ At first glance, it doesn't communicate with any remote service or use any HTML5 API. Here's part of the compiled code (I cut out the repretitive stuff) var a = ""; function b(e) { c += e } var c = "", d = "", d = "e"; b("fu"); d += "v"; b("nc"); d ...


15

You can decode the start of $_X: root@bt:~# echo -e ...


4

Once you format the code a little, like how I edited your question, it's easier to see what's going on. $OOO000000=urldecode('%66%67%36%73%62%65%68%70%72%61%34%63%6f%5f%74%6e%64' translates to $OOO000000=fg6sbehpra4co_tnd All of that is used to build the string: $OOO0000O0=base64_decode The eval section is base64 encoded and resolves to: ...


-1

I'm not a malware expert, but I know that blackhats tends to use a small spoofing technique by calling their malware a name that is used by the system, in order to not raise the user's attention. Also, all anti-viruses can be bypassed by performing different encoding methods that makes the malware undetectable. But of course, Anti-viruses companies are doing ...


3

Conficker was estimated to have 9 to 15 million concurrent infections at its peak. Mark Bowden does a good job telling its story in his book Worm: The First Digital World War. Other malware with high peak infections include MyDoom with 1 million, Storm with 1 to 10 million, and Zeus with 3.6 million in the US. For comparison, Cryptolocker was in the news ...


1

Because the software wants to intercept HTTPS communications without making your browser throw certificate errors. There are some legitimate uses for this, like parental controls/web filtering software, anti-phishing protection (where some software compares the URLs you're visiting against known malicious websites), etc. For example, Avast antivirus ...


0

An update yesterday to Avast Anti virus detected a root kit running on my machine, I removed that and removed all forwarded ports to be on the safe side, the attacks seem to have gone away but I will keep an eye on it, looks like there are some good tips here for potential security threats, thanks everyone for contributing.


2

Every single time I have seen something odd in the firewall logs, it has been completely benign behavior that comes to light after about an hour of total panic ;-) If your router is not set up to forward those ports and uPnP is not enabled then they must be started by some software on 192.168.1.58. Use netstat -a -n -o to show network activity including ...


1

Try getting free help from https://forums.malwarebytes.org/index.php?/forum/7-malware-removal-help/ , they have volunteers there that have you run security tools and post the logs, it is very effective and having read hundreds of cases, you are likely to find a solution there. You'll have to make an account first, but that is also free. I'd try installing a ...


3

First, the firewall will not identify it as an attack if the traffic is allowed. Second, in the logs, you can see the port numbers that the communication is destined for. You can correlate those ports with the binaries that are listening to those ports on your machine. Look for the netstat command for your OS and version. Third, you should configure your ...


1

I don't know how you should get rid of the eventual trojan virus, but as a start you should block and disable remote access! If you have any port forwards there could be a vulnerability then disable those too!



Top 50 recent answers are included