Tag Info

Hot answers tagged

47

A virus can't do anything by simply being present on your system as data. A virus is just a program, it must be executed by something. The trick is that that something does not have to be you clicking it. Computers do many things automatically without your attention. They accept requests for file transfers, remote desktop, provide details about their ...


42

It depends on the file format. Executables do not run themselves, unless some clever trick is employed (autorun.inf and .lnk were popular techniques a while ago). Nevertheless, MS11-006 demonstrates that clicking on an infected file is not always necessary (this exploit triggered when a thumbnail of the infected document was rendered by the system, for ...


25

No, a virus does not need to be clicked on or accessed by the user directly to infect a system. All the virus laden file needs to do is take advantage of a vulnerability in the program that is accessing it. Examples in Windows XP Security Bulletin MS11-006 documents a bug in the way thumbnails were produced by windows explorer to trick it into running ...


11

Sometimes opening a .txt , .jpg or .docx files leads to running a virus. How come is this possible ? To add to the answer to a similar question (thanks for finding it, Tcholas!): You are correct in thinking that a virus in and on itself is harmless. A virus sitting in a file somewhere is no immediate threat to your computer. But when you open a file ...


8

It depends. Typically trivial viruses require you to click on them (i.e. execute a file in some way). There should be no way to execute code without you double-clicking virus.exe or similar. In reality, a virus author can technically find a bug in windows (which isn't that improbable on XP) and cause trouble that way. For example, if there is a bug in the ...


7

One possibility is by exploiting overflow vulnerabilities. When opening the image, the software failure will "throw" the virus into unauthorised memory sections that may be executed by the system. Here you have a description by Symantec of a vulnerability that exploited Internet Explorer in this sense. Also, this question was answered in Stack Overflow.


7

It depends. I couldn't agree more with HackerCow's answer. There are lot of viruses that are different in the way they behave such as executing by click, auto-executing, auto-duplicating, etc. Once a virus enters your system, you are vulnerable no matter what the type or behavior it possesses. And as an obvious statement, we know that XP is not so great ...


7

There are just too many ways in which malware can persist on a Windows machine without touching the registry. For example: Windows Startup Folder Although it is the most simple and obvious to be found, still I am describing it here just to show that this technique doesn't require touching the registry. In Windows family of operating systems every user has a ...


5

Fiddler is a proxy server that runs locally on your machine. For this to work it needs to use the loopback network interface (localhost). In Windows 8 has a new runtime that allows for the running of Immersive Apps. For all Immersive Apps, Win8+ runs them in an AppContainer. All AppContainers are forbidden to use send network traffic to the localhost. ...


4

No. It is not always necessary to click on a virus. For instance. A virus may be dropped on your computer by a drive-by download. This is done when you visit a site which exploits a vulnerability in your browser, hence dropping malware on your system. This also allows a remote attacker to start the virus. Another example is a virus which will attach itself ...


4

One possibility is Unicode shenanigans. Unicode supports displaying many languages, including those written left to right, and those written right to left. One way it does this is using special characters, including [U+202E] (left-to-right override (LRO)). Windows supports Unicode, including in filenames. You see a file on your desktop: evilexe.txt. It ...


2

The page lists the affected systems and your windows 7 32bit is not included: Affected Avaya DefinityOne Media Servers Avaya IP600 Media Servers Avaya S3400 Message Application Server Avaya S8100 Media Servers Microsoft Windows 2000 Advanced Server SP1, SP2, SP3, SP4 Microsoft Windows 2000 Datacenter Server SP1, SP2, SP3, SP4 Microsoft Windows 2000 ...


2

Windows Credentials Yes, they are stored hashed within files in the c:\Windows\System32\Config\ directory. You will need the SAM and system files. However, a backup of these files may be stored in the Windows repair folder at c:\Windows\Repair\. If Windows is running and you need access to the locked files in the Config folder (for example you know the ...


2

To access the windows passwords, you'll need both the SAM and SYSTEM file from C:/WINDOWS/SYSTEM32/config On a Linux Distro, like Kali-linux, you can then use the command "bkhive SYSTEM bootkey" to get the bootkey from the system file. Then, use the command "samdump2 SAM bootkey > samdump.txt" to get the hash dump from the SAM file. If you open the file, ...


2

@ThatGuy Lets start by re-downloading the http and ftp links again now we can upload them to VirusTotal.com while you are uploading the files we should come up with the MD5 hashs of the files, after you have found the MD5s you should Google them to see if anything comes back with the same MD5 you need to Google them with quotes and without. If everything ...


1

IMPORTANT: Everything following is only part of my assumptions about this incident. Without further details of it nobody can tell you exactly what happened. What browser are you using? I know that some browsers don't safe the file immediately but create a temp file while downloading. It may be that the change from this tempfile to the normal file was not ...


1

Once someone has access to your server it's not your server anymore. Meaning that logs could be tampered with as well as binaries. There is a security log in Windows which allows you (if configured correctly) to: Account logon events Account management Directory service access Logon events Object access Policy change Privilege use Process tracking System ...


1

In general, drivers can access hardware (that's their point), meaning that they have enough privileges to do whatever they want with the machine. Some operating systems try to somehow constrain some drivers to only a specific subset of the hardware, but it is hard (e.g. if the hardware can do DMA then it takes some effort and some hardware support to ensure ...


1

I'm going to say no, with a symbolic link its only linking to a file on the system like a shortcut and all its designed to do is act as a bookmark for easy access from whatever location you put its shortcut at. In this case the only thing that COULD happen to your symbolic link is that if you don't put permissions other people on the system could potentially ...


1

Rate limiting is probably the only practical way to mitigate these attacks for most public-facing applications. And you're correct in that it's a security/UX tradeoff. Given the login form example alone, "your username or password is invalid" is a more secure (exposes less information) way to present info, but most public services have other endpoints to ...


1

Except for the few exceptions for viruses that can run on Wine and iyou have Wine installed, Linux generally won't be affected by Windows virus. Note though that Linux can be an asymptomatic carrier of Windows viruses. If you send other people a file infected Windows virus, their machine can catch the virus, even if the file looks fine on your Linux ...


1

This is not what Bitlocker is for. Full Disk Encryption (FDE) tools like Bitlocker are only meant to protect against off-line attacks. This is where the computer's operating system is not running. Examples might be if the disk is removed and mounted in another computer, or if the computer is booted from a LiveCD or similar. When the OS is running - ...


1

How do you validate the signature? If you can compromise the system files, chances are you can also compromise the root public keys being used to validate against and the files would still appear valid. Signed files only helps if the system is otherwise secure, if the system files themselves are corrupt, that is no longer a true statement and all pretense ...



Only top voted, non community-wiki answers of a minimum length are eligible