All Questions
2,591 questions
0
votes
0
answers
190
views
What is the steps to be taken when you suspect a linux malware has infected your computer?
Using Linux is a different beast entirely but sometimes malware can blend as seemingly harmless system binaries like this post
Bpfdoor
Like this post which documents a highly evasive Linux malware.
...
- 119
1
vote
1
answer
734
views
What is a safe way to display malicious URLs in research PDFs?
Is there a convention or safeguard to show malicious URLs in a paper if they are relevant to the topic?
Some PDF viewers parse the text for URLs, which makes removing the hyperlink alone insufficient. ...
- 13
2
votes
2
answers
377
views
File sharing with compromised Windows machine
I want to connect a known to be compromised Windows machine to the network for file sharing, it has lots of pirated software installed therefor not secure. Can it be isolated so that nothing can ...
- 21
0
votes
4
answers
1k
views
If your router gets hacked, can the hacker acquire your RSA private key to decrypt HTTPS and view full URL's?
In order to decrypt HTTPS you need the public key and the private key. How can a hacker acquire the private key?
What exactly does he have to do to get it? I read that they use packet sniffers like ...
- 11
0
votes
1
answer
307
views
Non executable virus?
Bitdefender detected
.class -- File path: ...\tetra-1.12.2.jar => .../GuiStats.class -- Threat name: Java.Trojan.GenericGBA.31135
.tif -- File path: ...\crash-81154...60f8.tif -- Threat name: ...
0
votes
1
answer
481
views
unknown (malicious?) code and file in public dir (Laravel 5.8, apache/cPanel) [duplicate]
I have a Laravel 5.8 app in a server running Apache/2.4.53 (cPanel) and PHP 7.4 (ea-php74) and i have VPS root WHM/cPanel access there. as any Laravel project, the "public" directory is web ...
-1
votes
1
answer
195
views
Malware from Android text?
Lots of questions!
I clicked a scam USPS link on my phone while half asleep. The website loaded and a small window popped up immediately and I quickly backed out of my browser but briefly saw the site ...
0
votes
1
answer
374
views
How can a backdoor install a Chrome extension?
I read this: https://duo.com/decipher/malicious-chrome-extension-backdoor-uncovered-in-malware-campaign#:~:text=One%20of%20these%20is%20a,system%20and%20installing%20the%20extension. I quote this part ...
- 1
2
votes
3
answers
8k
views
If someone knows your wifi password can they hack your router?
What exactly can someone do if they know your Wifi password? Can they only see which sites you visit or can they do more? Are they able to hack(router) and do malicious things with your router just by ...
- 21
3
votes
2
answers
1k
views
Has malware detected mitmproxy and similar tools used to intercept and analyze malicious traffic?
When trying to analyze malware, have there been cases where malware detected the use of mitmproxy and ceased operation?
If that has happened, would it be a good idea to be constantly using a proxy as ...
- 1,675
57
votes
3
answers
12k
views
Does open source "protestware" represent a security risk?
Since the beginning of the Ukraine-Russian war, a new kind of software was created, which is called "protestware".
In the best case, the devs only add some (personal) statements about the ...
- 1,512
1
vote
2
answers
177
views
What are the issues with running a seemingly trustworthy python script from a stranger?
For context: in Sweden, the "end" of COVID has caused a huge buildup in passport applications, as everybody wants to resume travelling. However, due to the poor performance and general UX of ...
- 111
2
votes
1
answer
382
views
Does malware ever check CPUID?
CPUID is an instruction that identifies CPU type and features.
Has there ever been a case of either targeting or the opposite - ignoring of specific CPUIDs by malware in the wild?
- 1,675
3
votes
1
answer
1k
views
Has there ever seen a recorded case of a M.2 infected SSD firmware?
Was there ever been out-in-the-wild or any kind of detected firmware rootkit in an M.2 SSD?
- 1,675
2
votes
2
answers
6k
views
Microsoft Defender flagged Surfshark.exe as "Misleading:Win32/Lodi"
Can this be safely ignored?
VirusTotal shows that Microsoft is the only security vendor that flagged this file as malicious. I did not modify my Surfshark installation in any way, except for an update ...
0
votes
1
answer
209
views
safely storing untrusted files on a trusted machine
given a collection of files (text and binary) that are likely to have been modified by a resourceful and motivated adversary in a targeted attack, is there a security risk to copying that collection ...
- 1
2
votes
1
answer
487
views
How to protect yourself from firmware viruses
What componets of a PC do firmware viruses and rootkits infect? Secure boot is supposed to protect you from these types of viruses. Although, it doesn't protect you against rootkits in UEFI firmware ...
- 607
0
votes
1
answer
155
views
Has there ever been a case of dangerous industrial malware, which would destroy motherboards and similar PC components and how to protect [duplicate]
I heard many years ago from word of mouth that this kind of malware exists, which could for example blow up capacitors in your PC.
Has such malware or something even remotely similar ever existed?
...
- 1,675
0
votes
1
answer
142
views
How does a malware usually figures if the machine is used for malware analysis?
Lately I've read a blog post for an advanced malware, that has a dropper that ensures that the victim machine is not used for malware analysis and if that's the case terminates.
So I'm thinking that ...
- 1
0
votes
2
answers
229
views
Is this weird folder "Up8d76c_31187" a windows thing?
I noticed it becaue one of these exe's started running after a BSOD.
Putting one of the exe's into VirusTotal gives it a 3/70. How can I examine this further?
Edit: Other exe's are worse: VirusTotal ...
- 103
0
votes
1
answer
744
views
How to store malware for analysis?
I am planning on analysing some malware samples dynamically using a sandbox tool and a target Windows VM. The host (physical machine) runs Ubuntu and in it are the sandbox and target VM.
So far I only ...
- 1,157
1
vote
0
answers
284
views
What is the difference between malware signatures and malware artifacts?
I am trying to analyse some malware samples but I am trying to understand the differen between malware signatures and malware artifacts. As far as I understand (and from what I've understood from this ...
- 31
0
votes
1
answer
270
views
The practicality that a home network / router gets compromised
I know that it's theoretically possible that a router can be hacked, and malware can be spread throughout a network merely by being connected to it.
However, I'm wondering what exactly the chances of ...
2
votes
0
answers
585
views
Can unzipping archive by itself cause malware execution? [duplicate]
It it possible to execute a malware just by unzipping a malicious zip archive? Like a malware would target some vulnerability in zip decompression routine. How common such an exploit would be in the ...
- 53
8
votes
2
answers
3k
views
Clamav identifies Certbot files as infected
I ran Clamav on an Ubuntu 20.04 machine and it identified ten Certbot files as infected.
/snap/certbot/1670/lib/python3.8/site-packages/pip/_vendor/distlib/t32.exe: Win.Malware.Generic-9937882-0 FOUND
...
- 183
0
votes
1
answer
23k
views
Can my android phone get hacked if I share my hotspot?
I lent my mobile data to someone's computer and was not in the room while they were using it.
Suppose they wanted to gain control/access to my android device. How easy would it be? As far as I know, ...
- 29
1
vote
2
answers
2k
views
What's the likelihood of a compromised computer compromising others on the network?
Today my grandparents connected to my WiFi, the password was given to them by my partner. Well, after looking at their PC, we established that they hired someone who has installed loads of stuff on ...
- 11
1
vote
4
answers
480
views
Is doc file really modifying registry in Windows?
Been given a .docx file to check whether it has a virus or something, ran McAfee and SuperAntiSpyware on it and results came back negative so I though it was good and proceeded to open it, just a file ...
- 11
1
vote
1
answer
1k
views
How to locate a malicious script in the Linux system
I would like to ask for some directions to trace back to the original (malicious) script on my system (Ubuntu Server). I would try to be more specific if needed. If the question does not fit this ...
- 131
0
votes
1
answer
379
views
Do viruses spread by infecting other files on an infected machine?
Suppose malware lands and executes on a computer. Could this malware attempt to spread further by writing itself to data files (images, pdfs, docs) and hoping that the owner would transfer or upload ...
- 53
0
votes
1
answer
482
views
Preventing Windows from seeing/tampering with linux drive
Is there a way to prevent a Windows 10/11 system to access/modify/delete data from a secondary linux drive?
I understand I can encrypt the linux drive, but wouldn't the windows system be still able to ...
- 1
2
votes
0
answers
892
views
Can a virus infect windows 10 bootable media?
I created a bootable windows 10 usb from my friend's computer. I used the official tool from microsoft. I was dumb enough to not check my friend's computer beforehand (turns out he had Utorrent Web ...
- 29
0
votes
1
answer
3k
views
Can two antivirus softwares work on one android phone?
Scenario: You have one antivirus installed on your phone. You suspect that your phone might have malware on it so you do a system scan and your AV doesn't find anything. So you decide to download ...
- 1
0
votes
0
answers
32
views
How to permanently remove DDE Exploit:O97M/DDEDownloader.C? Do I need to nuke my computer? Is it safe to not do so? [duplicate]
1Starting yesterday windows defender has found and quarantined 5 copies (pic 1) of the following threat (pic2) Exploit:O97M/DDEDownloader.C see here.
I tried contacting Microsoft tech support but they ...
- 1
0
votes
1
answer
206
views
Malware dropper uses "^" character in syntax of cmd.exe before calling mshta.exe to download file?
I found a malicious Excel file that was using an embedded HTA program as its dropper to download a powershell program from a malicious IP. The dropper was on a hidden sheet in the file. After ...
- 1
-1
votes
1
answer
447
views
Infecting files on GitHub
Suppose one uploads (carelessly or purposefully) a file with a malicious payload to their Github account (some pdf document, picture, etc.). Could this payload somehow be executed on the Github ...
- 53
0
votes
2
answers
119
views
Will setting up an installation on an SD card in this way prevent changes to the operating system?
I want to set up an SBC, e.g. Raspberry Pi, Banana Pi, to work as close as possible to a computer running a Live Distro. I'm intending to use this to inspect suspicious or infected storage drives and ...
- 983
1
vote
1
answer
3k
views
Mp4 virus scanners
I used to download a lot of mp4's from untrusted sources. But I discovered that they could contain malware. I would like to know if there are any methods to clean or to check video files for malware.
- 11
1
vote
2
answers
915
views
Is it safe to view infected word documents in office online?
Can viewing and editing a potentially infected microsoft word document (with images inside) on a web-based platform like office online (OneDrive) infect my pc? How does the browser running on my ...
- 53
1
vote
2
answers
909
views
How do I activate a malware inside a virtual machine?
I have been doing research on malware detection and my current setup is: one host OS (Ubuntu 18.04) and one guest OS (Ubuntu 18.04) inside VirtualBox. I have downloaded and executed some malware (...
2
votes
2
answers
685
views
How to create a safe environment in Windows 10 for high-performance programs?
My friend handed me a .exe file of an old game we want to play together. My laptop has important files, so I do not want to install it immediately. I am still sceptical that he might not know it ...
- 21
0
votes
0
answers
272
views
Sextorsion then Trojan
I received an email containing blackmail about videos that the hacker said he recorded. He said that he recorded the user of the laptop masturbating and he is asking for money to delete them otherwise ...
- 1
1
vote
3
answers
2k
views
Mistyped "google" and came to a suspicious page with a browser hijacker
I misspelt google as "googe" (very dumb, yes). It took me to a page that asked me to enter my birthdate. The URL was something along the lines of luj dott proasdf dott com
After going to ...
- 111
-1
votes
1
answer
96
views
Win10* OS-Shell Bluepill Attack likely [duplicate]
I'm running a seemingly normal Win10 system with updated drivers, both through standard Windows Updater and manual patching if a new driver is available.
The Dell logo flashes multiple times per boot.
...
0
votes
0
answers
317
views
How to isolate Windows10 Virtual machine from w10 host (virtualbox) for malware analysis [duplicate]
My goal is to find malware that performs network activities and captures the traffic with Wireshark. I have a Windows 10 laptop host machine and VirtualBox which has virtual Windows 10 machine.
I am ...
0
votes
2
answers
246
views
Someone accessed my phone application in Android 10 and dialled some codes to do some transactions while I was using the Tor browser [closed]
I was accessing some sites with the Tor browser. I got the URLs from some site and was hitting them one by one just to explore. Suddenly pages stopped responding but the internet was working fine. ...
- 103
0
votes
1
answer
669
views
Are there security risks to enabling 32-bit applications to run on Windows 10?
I'm installing an old game (32-bit) on my laptop (Windows 10 64-bit). This guide suggests enabling 32-bit applications to run with Internet Information Services (ISS), with the following steps:.
In ...
- 23
0
votes
1
answer
721
views
Do pdf files pose a higher security risk than regular image files (png, jpeg, etc.)?
Do pdf files pose a higher security risk than regular image files (png, jpeg, etc.)? In my understanding is that most image files don't carry any security risk because all exploits were fixed, but ...
user242249
1
vote
0
answers
706
views
A PDF ran GetAdaptersAddresses. Should I be concerned?
I received and opened a PDF that ran:
GetTickCount
IsDebuggerPresent
SetWindowsHookExW
Sleep
GetAdaptersAddresses
These are the 2 files it wrote:
C:\Windows\ServiceProfiles\LocalService\AppData\...
- 11
0
votes
2
answers
511
views
Bought a new Laptop. Can't reset. Is it Safe?
I recently bought a new laptop from a third-party seller on new egg. The seller states that it is "upgraded": "*We sell computers with upgraded configurations. If the computer has been ...
- 3