Tag Info

New answers tagged

1

What browser does he use? I've had users that have experienced similar issues, and one of the first places I check is the extensions running on all installed browsers. You can find pretty good clues as to the name of the program you need to remove in order to stop the pop-ups. Check his installed programs for anything that might be out of place too. If my ...


0

You can try: netstat -abn Which will show the process, if available. You can also try: netstat -aon Which will show the PID which you can then lookup in the task manager. However, it may not show up in either of those places depending upon how stealthy it is. If it doesn't show up there are techniques to use things like Logman logging Winsock ...


0

Microsoft's TCPView will show the link between processes and network connections: https://technet.microsoft.com/en-us/library/bb897437.aspx


2

The way you convert a jpg to a bmp would be to essentially decompress the jpg and write it as a bmp. To convert one archive format to another you'd have to decompress the original first and then compress in the new format. Whether this is "safer" or not depends on whether the tool you're using to automatically decompress has different vulnerabilities to the ...


3

Being able to convert an archive from one format to another without decompressing it is very rare. Different formats use different file structures and algorithms that are incompatible and you'll be forced to decompress the source format at some point. When conversion by decompression is done, many of the vulnerabilities could be exploitable. The attack ...


3

I worked at antivirus industry 12 years ago, so I'll try to explain, but it is possible that my knowledge is a bit outdated. Each serious antivirus vendor has antivirus lab, whose work is split to: detect new viruses and develop solutions for them: signatures, behavioral patterns for heuristic detection, specialized detection code, sometimes cleaning code ...


0

The antivirus product have different techniques to check if a given file is malicious or not. The most common technique is to check the file signature against the virus database. If there is a match then the file is considered malicious else not. Antivirus products examine a file and create a signature of it, depending upon the characteristics of the file. ...


0

From my experience with Trojans such as Cryptowall everything attached with a drive letter is substitutable to attack. Personally I lost everything including my cloud backup as it encrypted all files, even those sitting in the cloud. The best solution to protect your data is non-network connected mediums such as tape or Blue-Ray (small backups). Tape being ...


0

In your case, I would backup all my files if it's not already done (It's the only reliable solution against ransom-ware). According to http://www.sentinelone.com/blog/anatomy-of-cryptowall-3-0-a-look-inside-ransomwares-tactics/ you can look at HKCU/Software/(CUUID)/(sorted 2nd half of CUUID)/(FullFilePath) = (Volume Serial Number) And you will see ...


1

The two previous posts give great advice. Here are the areas I would focus on: 1. C and Assembly Languages - Critical you know Assembly like a second language 2. Debuggers - WinDBG and gdb - A debugger will be your best friend 3. Windows and Linux Internals - You must know exactly how the target system works so you can identify exactly what the malware ...


0

Your book list is a great start. pss' advice to look at the job specs is great as well as his other points. There is nothing like doing, though. To start doing, I suggest starting with crackme (reverse engineering) exercises and some packet analysis exercises. Not only will you learn about malware analysis, you will learn a whole lot about related ...


0

A malware analyst is supposed to be able to perform deep analysis of a malware and provide a signature so that the antivirus software can detect that malware. (This is the reason why antivirus software companies would like to hire you) In order to analyse a malware you might need to have knowledge of reverse engineering. Reverse engineering is a huge topic ...


1

The easiest way is to ring your ex-employer and ask them is they sent you the email. If they say no, then you know it is a virus or similar and delete it with no further thought. If they say yes then you can go ahead and scan the attachment for a virus.


2

Virus Total and malwr and both good sites to submit suspicious files. Virus total will tell you if the file is flagged by any antivirus. Malwr will give you more detailed analysis (this may/may not be of interest to you). Note that you're submitting files to an online community, so don't submit anything that is potentially proprietary/secret.


0

If the adversary that had installed the keylogger or screen reader were accessing them from another device on LAN, using a VPN could protect you. You would need firewall rules that allowed traffic only via the VPN tunnel, and did not allow connections to other devices on LAN. Even if the adversary could intercept on LAN, they would see only encrypted VPN ...


1

VPNs are not going to provide you any protection against keylogging/screen grabbing malware, all a VPN does is encrypt traffic between one point and another. Once the traffic exits the VPN it will then continue onto its destination whether that is a legitimate system or a hackers command and control system. It will not prevent you from getting malware in the ...



Top 50 recent answers are included