Tag Info

New answers tagged

2

Short answer: Yes. Why? Option 1: If the malware/virus is delivered via an application/file and the app/file is opened after you reinstalled Windows, then the virus/malware will be reactivated. Option 2: When you upgrade, you don't do a complete reinstall of Windows, you just update it(Eg. from Vista to 7). If this happen it's very likely that the virus ...


1

A better way to protect against cryptolocker is to set up a NAS, that will force versioning of files. With force, I mean that all Changes of files will be saved on the NAS, and the client has no way to affect this. Then you save all important data on this versioned NAS. If the cryptolocker encrypts your NAS, you simply tell the NAS to rollback the files ...


1

Since a virus infected PC has to download (encrypt) reupload the entire file, and repeat the process for every network drive, is is possible to detect this unusually high bandwidth event? Is there a way to respond to it (via QOS or something?) You're mistaken: the malware doesn't need to transfer the file. It uses asymmetrical encryption: the file is ...


1

All right, if you're on Windows 8, and if you have UAC enabled, you have good chances to kick the bastard out manually. From what you're saying, if you have UAC enabled, the virus didn't get admin rights. In that case, looking for rootkits and out-of-place services is not very useful (though if you've got as much services running as you say, mind, some of ...


0

It's entirely possible. There are a lot of examples of this, especially something like Stuxnet which was allegedly found in the wild in 2005 and disregarded but was found in 2010. Some earlier antiviruses would go by signatures and allow things like polymorphic viruses. This isn't as common lately, as heuristics and other technology has developed. All in ...


1

For every innovation that you might achieve to work towards undetectability, there are legions of security researchers working to discover your methods. The more sophisticated your methods, the more sophisticated the response. This is truly a self-defeating spiral for both sides. But, there is a theoretical "endgame" where one creates the "perfect" malware. ...


4

Obviously it can remain undetected for a long time, as there are several famous cases of malware having multi-year lifetimes. The key is stealth. The wider the malware is spread, the greater the odds it will be discovered. The more damage the malware causes, the faster the victim will look to fix it. The most successful malware refuses to spread to ...


1

The rdesktop client supports resource sharing with the -r switch. A local directory from the connecting PC can be shared with the remote server under a special share under \tsclient\<sharename> -r disk:<sharename>=<path>,... Redirects a path to the share \tsclient\ on the server (requires Windows XP or newer). The share name is ...


-1

Unfortunately reformating a hard drive does not wipe the drive or erase anything such as malware. This is a common misconception. A quick reformat marks all files in the MFT as having been deleted. A long format is a quick format plus it runs Check Disk. If you have malware on the drive you should consider wiping the drive before reformatting. Or remove the ...


2

One thing to bear in mind is that various shared resources can be enabled, sometimes by default - certainly in the Windows RDP client (I'm afraid I don't know the Linux client, but it's clear the protocol allows these shared resources.) For example, the clipboard is automatically shared between client and server by default, and local printers are made ...


3

As freddyb said, this seems to be a scam. I looked at the "removal tool" for the virus - it contains an executable that forks off into the background, renames itself to udevd, connects to 95.215.44.195:443 (that server seems to be down atm), sends the string FOG\n\n# and gives the server a reverse shell (by dup()ing the socket to fds 0,1,2, then executing ...


4

This virus alert is a scam. The goal is to get admins to download and execute special "removal tools", which are in fact the actual virus. Another note about how websites work and what you see in the access log: You can go to basically every website and append arbitrary parameters like ?cmd=foo&key=bar and the website will just load and ignore the ...


1

Assume that the download is malicious every time. Make sure you have antivirus software to scan it for threats every time, and realize that there may be nothing you can do to stop a threat from compromising your browser. Understand that even reputable sources of software can be compromised, and that you do not necessarily have to click "download" to ...


3

When you are downloading software from some site on the Internet, you have to see on what criteria, if any, you can establish trust and then determine if the basis for establishing trust is valid. First, consider if you trust the developer. Is the developer some anonymous person, or is it a company or person with a real name, real contact information, etc. ...


0

This IP address is showing at present via i2p in the TOR browser. Somebody is using an anonymous network to get some sort of information from your server, and probably also has code there to send other commands to it.


2

Deep down you don't , from a security perspective i have more software running on my phone than I could effectively ever review in my lifetime. My desktop machine would be 100,000 worse than that. so you have to trust where you get the software from, you can check to see if it has been tampered with. But that's still no guarantee ( for example a few years ...


0

You don't exactly need to store anything in the headset, there are plenty of "older" Bluetooth exploits. Assuming that there is a exploit in the Bluetooth hose ( aka the phone ) it could be possible to modify the headsets firmware to exploit it lets say "post pairing" remote code execution. From there it would be possible to download a second stage payload ...


1

It looks like that's trying to communicate with a previously-installed program. I'd guess (from cmd=info) that it's trying to see if install was completed. ip=1.2.3.4 (which I assume is your IP anonymized) is telling it what IP it is trying to talk to, in case the traffic would come back from another IP. It's probably nothing, just a scanner for some bit ...


1

Yes, but very unlikely. A bluetooth headset has a microcontroller, EEPROM with firmware, audio circuitry and bluetooth chip (which is itself a microcontroller with its own, distinct firmware implementing the bluetooth stack); I'm pretty sure there are manufacturers that combine all of these elements on a single physical chip. If you can find a ...


0

As far as I can see that it is impossible for malware (e.g. virus, spyware,etc) infects data in phone cell even to store it through a wireless system. This is two different cases; hardware and software. Based on my usage, no data transferred into a phone cell but byte of transfer recording (voice)through wireless headphone. When the data voice is being ...


13

From a theoretical standpoint, you are connecting to a remote machine and it is sending data back to your machine. While in the normal context, this is just display, location type data, it is possible that some sequence of bits could be processed in such a way that it causes an exploit in your rdesktop or other tool used to make the remote connection. With ...


1

You mention that the developer sells a public version of this application you were given. If you trust the public application then you can use androguard(androsim & androdiff) to figure out the similarity % between your new version and the public version. If say, they are 95% similar then you only have 5% of the code to inspect. Then you can even see ...


0

You could decompile the apk file using a variety of methods, one of which would be using apktool. Link here: https://code.google.com/p/android-apktool/wiki/ApktoolOptions Do note that you will not get java code from the decompilation but smali code which is not as simple to read. You would need to look through the code and judge for yourself if the app is ...


0

When it comes to allowing user file uploads, you must be very careful. This is just a list of things to start with, off the top of my head: Ensure that files cannot be executed by users Set up your PHP in such a way that it will not consider using the PHP file extension in the folders where PHP files exist. Make sure the permissions for the files are ...


-3

One minor technique I used is as follows. I had a chunk of C code that I wrote that looks at the first 4-8 bytes of any file and identifies the type. Because C was close to PHP, I ported that routine to PHP. In some other PHP code I compared that type to the extension. If there's a mismatch e.g. a JPG extension is actually a Microsoft EXE file, I rejected ...


0

When the file is uploaded, I would suggest to use finfo to determine what type of file it is, regardless of the file extension and perform specific actions depending on the result. If you decide that the upload folder should be somewhere in the document root, I recommend that you should disabled execution of PHP files for that specific folder. I would ...


1

Most common vectors: Drive by download - Download is forced on to your computer, and you may either be forced or tempted to execute a malicious file. You are just browsing and all of a sudden you get freebooks.pdf.dll, or worse a browser/OS flaw lets the download happen without you seeing it. Malicious advertisement with malicious javascript - Malicious ...


2

It's not about a hard-drive but it can help you to understand practical usage of firmware infecting: For example, when a software connects to your webcam, little led on your camera automatically turns on to inform you your webcam is sending data to your computer. Some manufacturers are smart, they connect that led to webcams power line so if camera turns on ...


2

There have been a few white papers and conference presentations on this, a quick google search would be a good start. However, this step by step explanation is pretty awesome: http://spritesmods.com/?art=hddhack


1

They do, you can lookup Metamorphic code(http://en.wikipedia.org/wiki/Metamorphic_code) and Polymorphic code(http://en.wikipedia.org/wiki/Polymorphic_code). They are techniques to make malware harder to detect by changing the code each time it's executed. Most AV-products rely on hashes, the other way to detect malware is by using heuristic scanning where ...


1

File hashes are by far not the most helpful method of detecting malware (unlike a couple of decades ago). Today, malware recognition (and sometimes classification) is heavily based on real-time heuristical analysis of its operations. This analysis deals with lots of data, which mostly consists of the system calls performed by the application, and their ...


0

In general, if your computer has been compromised, the safest thing to do is to wipe and re-image the machine (e.g. erase all data, format the drive, and re-install a clean OS). These days, it's very difficult to determine the extent of the compromise with the abundance of rootkits and persistent malware - destroying all the data and re-installing "known ...


1

I might have found a way to recover your files. My laptop was infected with Crypto 3.0 last week. I removed it with SpyHunter, but I thought I lost all my files after reading all the stories on the net. I didn't have a recent back-up. And all my tries to recover the files as recommended "restore old version" and ShadowExplorer faileduntil now. I went on ...


2

Is there a way to decrypt the files? SensorsTechForum suggests to try Kaspersky’s RectorDecryptor.exe and RakhniDecryptor.exe. However, I would not hold out much hope. As CryptoWall is very similar to CryptoDefense, you may be able to decrypt using the method here. Unfortunately, this only really applies if you were infected before April 1st 2014. ...


0

I'll do my best to deal with your first question, since people mainly discussed the second and third ones you asked--and respectfully those are simple matters of fact, and subordinate logic. Yes you can get malware/viruses (it is increasingly common, much more than Apple wants to admit), and therefore yes you want to protect yourself from that stuff. ...



Top 50 recent answers are included