Tag Info

New answers tagged

0

There are a few possibilities. First, if the loader can be discovered by a virus scanner. For this, it is necessary for the virus scanner to recognize the loader as a piece of known malware. Second, if there is a system in place to discover tampering with files, you might discover that the infected file was modified. Finally, if for some reason you are ...


3

You can't. You'll need to detect the loader, and either mark all files containing the loader as virus, or detect where T and the encrypted area is and decrypt the encrypted area to check whether the encrypted area contains the virus you are looking for.


10

A VST is just a DLL which exposes a specific interface. As such, it can contain arbitrary code, and can do anything that an EXE could do. Treat it as such. If you don't trust it, don't run it. Keep in mind that virus scanning will only protect you against known signatures, so something unknown or custom might still catch you out. Running the plugin through ...


0

Yes, it is very possible to gain remote code execution (RCE) via programs such as Skype. For example, there was a notorious exploit in the FreePBX client provided with the Elastix 2.2 platform which triggered by merely accepting a call, as can be seen here on youtube, which gives full code exeuction. Also looking through www.exploit-db.com shows you that ...


1

Tor provides you anonymity, but it will not protect you at all from malwares or any other security threats. All recommendation regarding network security must therefore be scrupulously respected in order to ensure your network safety. You do not mention it in your description, but be aware that your setup matches Whonix project, so if you do not want to ...


0

I'm setting up a physically isolated Tor system (with one computer serving as the workstation and another as a Tor gateway), ... I don't know what your "physically isolated" refers to, but since you have a work station connected to a Tor gateway I would assume that you plan to use the workstation to access the internet through the Tor gateway. In this ...


0

Generally, a virus just sitting there isn't an issue, but it's a problem waiting to happen. I have viruses on a dedicated PC just for analysis and forensics. Here is the paranoid answer: STUXNET was (in part) created by a vulnerability in the icon creation process when generating the icon for a file, where a buffer overflow occurred. I can assume that ...


0

I'll go against previous answer and say no you can't execute a program inside a Zip file without extracting it first. Windows explorer can open zip files and show it's content but it must decompress the program before execution. The zip file itself could in theory contain intentionally malformed data that in combination with a software bug can leads to ...


0

You should set the Security settings of your PC starting with whatever Browser you are using. (In your case, Firefox.) You can also set your AV Software to automatically scan any new item that is loaded/downloaded into your "Downloads" folder. This is usually called "On-Access Scanning."


1

To be safe from having mails that possibly harm your system through an attack you first need to know what attacks you want to be protected against. Mail body Attacks (like malicious HTML inside the mail) Protection options are Open Mail in plain text mode, in this mode None of the text is treated as having special meaning and is just show on the screen, ...


0

This is an old piece of malware. Though technology isn't a panacea, if you're having this problem it seems like your technical protection needs an update. If updated, I feel like offering that if it were easy to do this at a server it would already be implemented at the workstations: To identify files associated with CryptoLocker you need a signature, and ...


1

I disassembled the 64 bit binary and looked through the code and it appears to only download and email spam messages - it doesn't appear to attempt to compromise the system. The PHP code downloads and launches the 32bit or 64bit version of the spammer program depending on the system to /tmp/crond. The program will then download via HTTP the following items ...


1

Firstly I would like to explain differences between Viruses, Trojans and Malware. Malware - is the short form of Malicious Software. It is basically a software written to cause damage or infiltrate computer systems without the owner informed consent. It is general term used to represent various forms of intrusive, hostile and annoying code. Virus - is a ...


0

If by "virus" you mean "self replicating code" then of course it can be written in any language. Once upon a time, I wrote a virus that propagated via Pascal as an educational experiment to show this very point, actually. It consisted of an executable subroutine. What the subroutine did was: search the local disk for files with an extension of .pas copy ...


1

Yes your router might be infected with a Malware. The best way to find out is to disconnect your computer from the home network and connect to your mobile device using 3/4G (HotSpot) If you can browse the internet without ads then I suppose your router is compromised.


1

You could check your DNS Settings on your router and may reset it or change it to an Open one (Google, OpenDNS,..). Then you also need to prevent the attack from happening again. Measures to do that include: performing a factory reset to clear any settings left by the attackers installing the latest router firmware using a strong ...



Top 50 recent answers are included