Tag Info

New answers tagged

1

Every single time I have seen something odd in the firewall logs, it has been completely benign behavior that comes to light after about an hour of total panic ;-) If your router is not set up to forward those ports and uPnP is not enabled then they must be started by some software on 192.168.1.58. Use netstat -a -n -o to show network activity including ...


0

Try getting free help from https://forums.malwarebytes.org/index.php?/forum/7-malware-removal-help/ , they have volunteers there that have you run security tools and post the logs, it is very effective and having read hundreds of cases, you are likely to find a solution there. You'll have to make an account first, but that is also free. I'd try installing a ...


3

First, the firewall will not identify it as an attack if the traffic is allowed. Second, in the logs, you can see the port numbers that the communication is destined for. You can correlate those ports with the binaries that are listening to those ports on your machine. Look for the netstat command for your OS and version. Third, you should configure your ...


1

I don't know how you should get rid of the eventual trojan virus, but as a start you should block and disable remote access! If you have any port forwards there could be a vulnerability then disable those too!


3

Yes. Just about every security feature of mobile operating systems is implemented in software. Complex software like that can will have bugs. Some of these bugs will be exploitable to give unauthorized access. This applies to any sufficiently complex software, because programmers are no more superhumanly perfect than anyone else.


1

From my past experiences, you can upload infected files to DropBox. They scan their servers for malware on a somewhat frequent basis. I've heard that they block copyrighted content from being shared/downloaded. So, every file uploaded is inspected. But to directly answer you question, yes, you can infect your computer if your friend accidently uploads a ...


1

Yes, it is possible. Just as you could get infected if one of your colleagues shared and infected Word Document file by email or a usb flash drive. (I am assuming that you are also triggering the payload by opening the infected document, executing the program, etc. A virus file residing in your hard drive won't infect you by its mere existence.) Dropbox ...


3

You are currently assuming hacking software and scripts are some kind of malware? Firstly this question appears quite unsupported as you have not provided much context. Secondly, no. if you are talking about malware than yes a hacker could infect them selves if they messed up but if they created the virus they would have found a ground-zero to distribute ...


4

Hackers won't really care about the tools being infected or not. They usually uses an environment that is not theirs anyway. Good hackers are also able to program the hacking tool by themselves, so they know it's not rigged. Since you mentioned the virus tag, I'll also develop on virus creation. You can do this using sandboxes (virtual machines) so that ...


3

The file in question does not exist (404). What the code does, is downloading the rep.jpg file as 83152553.exe. The code is equvalient with right-clicking on the link (http://.../rep.jpg), save as, save on harddrive, and then renaming rep.jpg to 83152553.exe , and then possibility executing the file. The reason its a JPG file is to circumvent upload ...


3

Does Android KitKat and later have sufficient default sandboxing to prevent malware from doing any harm How long is a piece of string? Ensuring confidentiality isn't the only goal of information security, if the App was to run a background service that constantly consumed significant CPU with the goal of draining your battery would that be a threat? ...


8

Each version of Android is incrementally stronger on this front than the previous, and Lolipop certainly pushes application sandboxing a step further than Kitkat, particularly with respect to inter-app isolation. Third-party "firewall" apps on Android are probably a bit over-hyped, and the level of protection they can offer without rooting is in my opinion ...


13

Yes. Stuxnet was being used to attack the Iranian nuclear facilities in 2007, but wasn't detected by AV or the public until June 2010. Part of its construction was designed to resist analysis by encrypting the payload against a value that could only be derived by a valid target system - it didn't appear to do anything particularly malicious outside of that ...


10

Yes, consistently. Viruses must be used and found before a definition is created. APT (Advanced Persistent Threats) are a huge deal in recent times where people will spend years developing viruses, called 0 day threats, for specific targets that will remain undetected for very long periods of time. Viruses like these are usually a product of nation states as ...


0

Lots of things are possible. If you totally wipe your hard drive and then install a totally clean version, it's still possible the trojan will persist (see @ott--'s answer). But if you do a clean reinstall, it's not terribly likely, IMO.


0

What prevents a trojan from infecting the BIOS? You can trick the user to reboot, run a nice animation of a chkdsk while you're flashing, then another reboot. Now you can even change the hard disk and you can't get rid of the trojan. Thinking more about it tells me that it has already been done.


2

Short answer: Yes. Why? Option 1: If the malware/virus is delivered via an application/file and the app/file is opened after you reinstalled Windows, then the virus/malware will be reactivated. Option 2: When you upgrade, you don't do a complete reinstall of Windows, you just update it(Eg. from Vista to 7). If this happen it's very likely that the virus ...


1

A better way to protect against cryptolocker is to set up a NAS, that will force versioning of files. With force, I mean that all Changes of files will be saved on the NAS, and the client has no way to affect this. Then you save all important data on this versioned NAS. If the cryptolocker encrypts your NAS, you simply tell the NAS to rollback the files ...


1

Since a virus infected PC has to download (encrypt) reupload the entire file, and repeat the process for every network drive, is is possible to detect this unusually high bandwidth event? Is there a way to respond to it (via QOS or something?) You're mistaken: the malware doesn't need to transfer the file. It uses asymmetrical encryption: the file is ...


1

All right, if you're on Windows 8, and if you have UAC enabled, you have good chances to kick the bastard out manually. From what you're saying, if you have UAC enabled, the virus didn't get admin rights. In that case, looking for rootkits and out-of-place services is not very useful (though if you've got as much services running as you say, mind, some of ...


0

It's entirely possible. There are a lot of examples of this, especially something like Stuxnet which was allegedly found in the wild in 2005 and disregarded but was found in 2010. Some earlier antiviruses would go by signatures and allow things like polymorphic viruses. This isn't as common lately, as heuristics and other technology has developed. All in ...


1

For every innovation that you might achieve to work towards undetectability, there are legions of security researchers working to discover your methods. The more sophisticated your methods, the more sophisticated the response. This is truly a self-defeating spiral for both sides. But, there is a theoretical "endgame" where one creates the "perfect" malware. ...


4

Obviously it can remain undetected for a long time, as there are several famous cases of malware having multi-year lifetimes. The key is stealth. The wider the malware is spread, the greater the odds it will be discovered. The more damage the malware causes, the faster the victim will look to fix it. The most successful malware refuses to spread to ...


1

The rdesktop client supports resource sharing with the -r switch. A local directory from the connecting PC can be shared with the remote server under a special share under \tsclient\<sharename> -r disk:<sharename>=<path>,... Redirects a path to the share \tsclient\ on the server (requires Windows XP or newer). The share name is ...



Top 50 recent answers are included