Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [malware]

Malware is any software application which subverts the will of the legitimate owner of a computer, by means of force or subterfuge, with or without personal or monetary gain on the part of the creator.

-1
votes
1answer
39 views

How to delete browser malware?

I've got some malware so now my browser is sending requests to strange sites: Also if I click on any html element in a browser It may redirect me to unwanted pages I've tried to fix this using ...
0
votes
0answers
22 views

How to check for file handle for files and which process is modifying the file in real time using python on Windows? [on hold]

Currently, we are working on a Malware detection project specifically Ransomware detection. We are monitoring specific files, and we want to identify file handles and which processes are opening the ...
0
votes
0answers
50 views

Why might malware make a DNS request for an epoch time converter?

I am analyzing malware and I see that two executables when run in a sandbox made DNS requests for www.epochconverter.com Why would an attacker risk detection by making a network request to ...
0
votes
1answer
123 views

How do I investigate a suspicious link?

I made a RuneScape account about a week ago. I stupidly responded to a scam by clicking on a link provided to me in the game. I think I may have a keylogger, which would explain why my new account was ...
0
votes
2answers
87 views

I am getting “Your connection is not private” error and it disappears when I use a VPN

I use a Mac (running macOS Sierra). Yesterday I was watching a movie online from some not-so-trustworthy website and when I clicked the pause button, a tab appeared and suddenly disappeared. From ...
0
votes
0answers
53 views

Does psexec exist by default on all Windows 7 machines?

During a review of the registry editor, I found psexec and psloggedon installed upon my personal laptop. A few times, I have also observed my anti-virus restricting communication with a external ...
0
votes
2answers
102 views

Malware spreading through jump server and SSH data transfer

Can someone explain to me how jump servers mitigate the risk of malware infection please? Whilst I understand some of the benefits of having a jump server as an extra layer of defence i.e. ...
2
votes
1answer
91 views

Isolate Virtual Machines on host-only adapter- Malware Analysis

I am performing malware analysis on virtual box. I want only the VMs to communicate to each other. Using host-only adapters, I have installed a Windows7 VM (192.168.56.101) with default gateway (192....
4
votes
1answer
206 views

Lowercase 'w' seen in C:\windows application paths from wmic services list

In reviewing several Windows 7 computers built from the same image (using wmic services command), I'm seeing most all the Window services paths displayed as C:\windows not C:\Windows. The 'w' is ...
-1
votes
3answers
112 views

Malware question

A site hosting drive-by malware is configured with a domain name very similar to that of a major social networking website. What is the name of this type of attack?
0
votes
1answer
54 views

Installed sketchy Chrome extension - Potential malware infection?

So... Tired me was browsing through Ikea's website this morning and tried to use one of their visualisation tool. Got an error message saying that I was not running the lastest version of Adobe Flash. ...
1
vote
1answer
296 views

Can my father's smartphone be compromised?

My father said to me that he allowed installation of apps from unknown sources when he was asked to do it to go further with something (he said that don't remember when or what he was doing). In ...
0
votes
1answer
143 views

Is this a Malicious request?

I noticed there were over 550 malicious request rejected by the wordpress firewall but only this was accepted with HTTP 200 OK. This is the URL http://domainname.com//wp-admin/admin-post.php?...
1
vote
1answer
346 views

How a packed malware runs the unpacked code?

When we run a packed malware it will unpack the code in dynamically allocated heap memory and heap can be kept non executable and I find no purpose to make heap executable. So, how the malware ...
2
votes
1answer
100 views

How can user send malware code via input=file

After the file is uploaded via input=file it is converted to b64 standard. But what is the exact path the file is going through and where in javascript code we can catch that uploaded file. And if I ...
2
votes
1answer
139 views

How exactly do malicious ads run code?

Visiting quite a few malwaretisers (I think this is the term :) ), I get popups with address bar something like data:text/html;base64,PGh0bWw+PGJvZHk+...
3
votes
2answers
144 views

How this tracking (and more) was done using an image in an email?

As reported in the NY Times, there was some type of electronic spying in a high-profile military trial. Its claimed that the prosecutors were spying on the defense: The court-martial ... has been ...
1
vote
2answers
107 views

Is VirusTotal useful for finding malware in a WordPress database SQL export?

Does VirusTotal detect malware in an SQL export? I have an infected WordPress site. I removed the malware with various tools, however I know from experience, that sometimes it hides itself somewhere ...
1
vote
2answers
75 views

Can a rootkit write to a virtual memory of a kernel process and rewrite a instruction to jump into his own malicious code inside that process?

So lets say we have a rootkit on our system can this rootkit write something inside a kernel process? for example in windows, can a rootkit write to ntoskrnl process, changing some functions and ...
0
votes
1answer
73 views

What does the attached php malware do? [duplicate]

Found this on a WordPress server under the filename wp-includes/class-wp-image-editor-fd.php when WordFence picked it up as being an unexpected file. Link to source is here: https://pastebin.com/...
0
votes
1answer
166 views

read raw dump with WinDBG

Is it possible to convert a full raw dump memory and open it in WinDBG ? In order to inspect if they are no malwares, filter process who call particular API, dump each process in memory etc...
0
votes
0answers
42 views

Are there any known instances of Apple iOS exploits that can remotely install malware on a device unauthenticated?

Title. Are there any known instances of exploits targeting iOS (versions 11 and later) with the following characteristics?: Allows remote, unauthenticated installation of malware on the device. ...
9
votes
1answer
1k views

Sucuri detects malware on wordpress but I can't find the malicious code

Yesterday I got a report asking us to check some wordpress website because the person's antivirus blocked said web. I ran the Sucuri Site Check and it indeed detects malware: "Known javascript ...
3
votes
1answer
152 views

When to use which rootkit?

According to my understanding so far: a kernel-space rootkits runs in ring0 and use techniques such as syscalls a user-space rootkits runs in ring3 and uses techniques such as library injections ...
0
votes
1answer
108 views

Is it possible to provide malware from a router?

I received a disturbing mail containing the password for my desktop computer account. In this mail the hacker stated that he used a vulnerability in my router with CVE: CVE-2020-1672. After searching ...
0
votes
3answers
109 views

Is it safe to plug an SD card or USB flash drive in my sytem if I turn the write protection on using the switch?

I know that plugging in some random SD card or USB drive in a system can be a bad idea because you may get malware on your system. Now imagine you found a storage device either a memory card or ...
43
votes
4answers
9k views

Should one buy new hardware after a system compromise?

If there are places on a laptop malicious programs can leave elements, hooks, backdoors etc, in locations such as BIOS, device controllers, firmware etc - what confidence can one have in wiping the ...
1
vote
0answers
17 views

Can the Windows Event Log be edited by a malicious program? [duplicate]

Is it possible that a malware can edit the Windows Event Log to hide System Event Log entries (specifically 6005 and 6006, which indicate startup and shutdown respectively)? If it is not possible, ...
0
votes
1answer
149 views

How to inject a malware in a video

Is it possible to trigger an antivirus program to alarm by playing a video? I don't want to run malware, I only want the AV to do something. Can I put EICAR in the metadata? The video file shoudn't ...
1
vote
1answer
56 views

Executing vs Extracting PE32/PE32+ executable

If you have a malicious upon execution ("running" it / double clicking on it) .exe , would extracting its contents with something like 7-Zip utility mitigate its effects? Or can it still do harm?
2
votes
4answers
6k views

Sucuri giving false positive with their free online scanner because of an .htaccess RewriteRule

I'm not sure where to ask this Question - here, SO, Webmasters.SE, somewhere else? Please migrate if appropriate. tl;dr: The following rule in my .htaccess is causing Sucuri's free online scanner to ...
-1
votes
1answer
74 views

Hash to malware file generation

I was watching a video from one of the youtube channel on reverse engineering. One of the topic is how to get free malware for static analysis. During the discussion, it was mentioned that people can ...
0
votes
1answer
74 views

Is there a software that would scan the ports automatically, then predict if there are any malicious activity going on, on my Win10 PC? [closed]

I've got this malware(or spyware as Kaspersky detected), from the USB storage device by purely a lack of focus. After scanning and defecting all the drives that are connected to my computer with ...
0
votes
0answers
15 views

WMI ActiveScriptEventConsumer Creation Datec

So recently I've been trying to solve a ctf. I was able to determine WMI persistence mechanism is used with the aid of ActiveScriptEventConsumer& EventFilter classes. I believe finding the ...
0
votes
2answers
185 views

How to really identify malware (virus)?

How could we really know if a software is a malware (virus), for platforms like Windows or Android? How to identify it automatically if we do not have predefined datasets? For example, when the ...
1
vote
2answers
273 views

How to protect Windows Registery from being changed or from programs trying to add keys

This question is with regards to Windows Personal PC. How to protect Windows Registry from being changed or from programs trying to add keys? I understand that the following general good practices ...
0
votes
0answers
38 views

Protect LUKS encrypted HDD against boot sector key stealing attack

I have HDD with GPT, 1 MiB BIOS boot partition and LUKS encrypted volume group with data. When I boot the computer, GRUB asks for passphrase. However, I want to run some untrusted application which ...
1
vote
0answers
104 views

How to get malware campaign runners to use my mail honeypot?

I have a working mail honeypot but have yet to receive any malware. I've already tried submitting my domain to several unsubscribe forms, but it does not seem to have worked. Any suggestions would be ...
1
vote
3answers
9k views

Two Tasks Running With No Name

I don't know if this is the right place to post this question but I have two tasks that have appeared recently and are always taking up most of my CPU. They don't have a name and when I go to stop ...
0
votes
2answers
91 views

ML approach to malicious attachments using email contents

Based on my understanding of the field, it seems like there is a lot of attention paid to spam filtering based on the contents and metadata of an email, and there is considerable attention paid to ...
-1
votes
1answer
74 views

Can a rootkit hide its data in slack space of pages in memory instead of disk?

So I'm asking about Linux or Windows type of rootkit/malware is this possible? can a rootkit use the slack space in the pages of the memory instead of disk to hide data? if so, has this ever been ...
1
vote
2answers
109 views

Notepad++ updater had no tittle or info. Is this okay?

While updating Notepad++, the updater window showed no title or information. Is this okay from security point of view ?
33
votes
4answers
9k views

What is more safe for browsing the web: PC or smartphone?

The scenario is: somebody without concern about security is navigating through the web. This person will access doubtful websites, like adult content or media sharing, for example. Between a pc with ...
1
vote
1answer
113 views

How are malware able to start on boot on windows without administrator rights? [closed]

I know that a malware could create a new Run registry key to make itself start at boot, but an user could simply remove the registry key and reboot and that would stop the virus, but this is usually ...
-4
votes
1answer
63 views

After have all the Patches, NotPetya can still run? [closed]

NotPetya runs inmediatly after infection or can be there and being executed even do i have all the security patches?
0
votes
1answer
48 views

How to protect UEM (Unified Endpoint Management) agent on your endpoint

A lot of companies install a UEM agent on employee's laptop to keep track of the health status of the laptop. And they allow the laptop to connect to the internal network if this UEM sends back "...
1
vote
1answer
419 views

Antivirus warns about processes trying to access my webcam

For the last two weeks I am constantly getting notifications from my antivirus about attempts of using my webcam. I have always chosen "Block access", often after checking "remember for this ...
0
votes
2answers
368 views

Ways to hide injected dll?

So if I inject my dll to a pprocess (or all running processes, including AVs) and it hooks some functions, why can't I just simply hook the functions (WinAPI functions) that could detect my injection ...
-2
votes
2answers
92 views

Antivirus and malware fingerprints

I´m a student in IT security and I would like to know how the malware fingerprints work in common AntiVirus. I understand that when a malware is detected it's because the binary fingerprint is known ...
0
votes
0answers
35 views

I think I might be infected with some sort of remote access malware/keylogger and victim to hacker attack [duplicate]

I've learned about computers over the years but it hasn't been until recently where I really sat down and tried to learn about malware in-depth (like the registry and embedding in files, etc.). I've ...