Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [malware]

Malware is any software application which subverts the will of the legitimate owner of a computer, by means of force or subterfuge, with or without personal or monetary gain on the part of the creator.

1
vote
2answers
129 views

Does 2-Factor Authentication protect against malware?

My question has to do with whether 2-Factor Authentication protects against a compromised system (malware). There are a couple of scenarios in which I wonder whether it does: Every time you login to ...
-1
votes
0answers
31 views

*push-apple.com.akadns.net Pushing Malware to IOS & Mac?

Bear in mind it looks like Apple Push Notification Service is a gateway for pushing viruses and malware to users devices, if I am not mistaken, just look here: https://www.virustotal.com/gui/ip-...
15
votes
4answers
4k views

Skype called someone and connected to them with no action on my part. What do I do?

This happened to me today, September 12, at about 6pm. Any ideas about what happened, what's going on, and what I should do? I was at home alone with my 2 year old -- I was feeding her dinner. All of ...
0
votes
1answer
63 views

Will browser isolation solution protect our enterprise from Flash and JavaScript exploits and fileless malware?

Since we didn't see any pentest done to bypass on such solution, we don't really know if it worth purchasing such type of solution. Will this really protect us from Flash and JavaScript exploits, ...
2
votes
0answers
74 views
+50

What security isolation exists between VDI instance to VMware Horizon to ESX?

I read about malware that was able to escape the VM and get to the VMware Horizon host and then to hypervisor ESX, but I am not sure what security controls exist to prevent malware from jumping to ...
1
vote
4answers
94 views

The safest way to transfer files to an offline test environment

I'm wondering what the best tactic is to transfer dangerous files from an internet connected machine to an offline, separated from the web, virtual machine. Why should I do that? Because I want to ...
1
vote
0answers
12 views

When Google removes malicious apps from their Play Store, are users notified? [migrated]

This Check Point Research article describes over 200 malicious apps on the Google Play Store that were downloaded over 100 million times. Google has now removed the apps from their Play Store. But ...
0
votes
1answer
89 views

What does this malware php file does and what should be done about it? [duplicate]

Can someone please help me understand this code, what it does and what kind of encoding is it? Can this be automatically removed through ssh (there are many, many more similar files found). <?php $...
1
vote
1answer
67 views

How did antivirus vendors find malware to include in traditional AV signatures?

Forgive me if it's a silly question, but I'm genuinely curious. How do traditional AV (signature-based only) vendors get the malware to analyse and include in definition files? Also, what's the ...
1
vote
1answer
454 views

svchost.exe has strange outbound tcp connections

I installed comodo firewall and svchost.exe has some strange outbound tcp connections. I have turned off the p2p windows update in advanced update settings. Ip lookup shows connections are to ...
175
votes
11answers
30k views

Search for military installed backdoors on laptop

My laptop was confiscated by the military institute of my country and they made me to give them all my passwords (I cannot tell you the name of my country). They did not give it back to me for one ...
3
votes
2answers
106 views

Watching movie from a potentially infected device

I went on holiday with a friend. He filmed and made a movie from our trip. He put the movie on my usb key. I was about to plug this, but realised my friend does not have good security practices, so ...
2
votes
0answers
37 views

Eventviewer empty logs with English written in Cyrillic Greek

So a while ago I entered my event viewer on windows 10 and I noticed a bunch of weird entries. They look like they where written in English but with the use of Cyrillic and Greek alphabets. I am ...
2
votes
2answers
158 views

Are most warez malicious?

There are many big torrent uploaders, some marked as 'VIP' or 'Trusted' and whatnot with many seeders and good reviews. How likely is it that their software is malicious with some kind of evasive ...
1
vote
1answer
731 views

Does GHIDRA have a debugger?

Does GHIDRA have a debugger attached for dynamic analysis of application?
0
votes
1answer
104 views

Random Chrome Notifications and Strange Source Code

My elderly parents are receiving chrome notifications from a strange URL on their iMac: (https://s1.snc.com.ru:443) Example Messages • Pending Payment: Paypal Has Sent You $65,900 • Clean your mac....
2
votes
1answer
110 views

Possible Phishing Attempt?

I ran into a strange situation today. I use an iPhone. Today I got a text from an unknown number starting from +65. The message was that your one time Wifi password is xxxx and it’s valid for only 10 ...
1
vote
0answers
35 views

Receiving constant TX RX from Amazon servers upon router restart and ensues [closed]

I had reason to believe my computer was compromised so I used Wireshark and found out that upon restarting my router and before router opens ports with internet provider it systematically tries to ...
1
vote
4answers
12k views

Regedit shows strange chinese characters in my system - should I be worried?

I suspect that my system has been hacked into. I see huge drops in free hard disk space for a while and then the space returns to near old values. A few days ago, when I clicked "my computer", I saw ...
0
votes
0answers
16 views

Is VMWare workstation really safe? [duplicate]

I want to try to run some malwares in VMWare and I am a little bit afraid. Is it really safe? Is there any option that malware can get into my main PC?
0
votes
0answers
4 views

Is my webcam hardwired? [migrated]

I want to know if my webcam LED can be controlled by software (malware) or if it is hardwired. My understanding is that if a webcam's LED is hardwired it cannot be turned on by a hacker without the ...
2
votes
0answers
30 views

Isolate Virtual Machines on host-only adapter- Malware Analysis

I am performing malware analysis on virtual box. I want only the VMs to communicate to each other. Using host-only adapters, I have installed a Windows7 VM (192.168.56.101) with default gateway (192....
2
votes
3answers
181 views

Malware Analysis

What would be a good approach for testing malware or bad url's from things picked up from my SIEM to validate them? I was told to setup a VM for these tests but don't want it to hit the internal ...
7
votes
1answer
3k views

What are non-standard ports and protocols [closed]

I am new to the security field and reading about how to check if an application is secure. One of the checks involves finding out if the app uses non-standard security ports and protocols. However, ...
0
votes
2answers
81 views

What are some examples of known scenarios of network attacks?

For example, it is possible that someone could spread malware with insecure wifi access point, but I don't realize how sending a bunch of network packets can result into a compromised computer if the ...
0
votes
2answers
12k views

What is cloudfront.net AdWare?

Here is some information I research about cloudfront.net AdWare: I've seen several topics talk abou this malware: Cloudfront.net Malware According to this article: How to remove CloudFront.net ...
2
votes
1answer
83 views

What features would you use to detect a backdoor or a bot installation?

I was reading a document about logging and analysis. The document talks about statistical analysis and machine learning techniques to detect some attack scenarios. For instance, If you want to detect ...
46
votes
5answers
9k views

Does adding a password to BIOS prevent malware from infecting it?

I'm looking into ways of hardening a computer's security. One of the things is the BIOS. Does adding a password to the BIOS prevent malware from infecting it? I have seen this article: Protecting ...
0
votes
1answer
94 views

Triaging malicious URLs

I'm quite new to the security field and learning my ways on how to triage certain events. One such alert that I see is "Phishing" when a user clicks on a malicious link. As far as triaging to see if ...
0
votes
0answers
100 views

How do I satisfy a requirement to scan text files for malware?

We have a requirement (on our closed network) to scan any file(s) introduced on the system for content that will do something "bad". (Bad is not the exact wording, just the intent.) This started when ...
-3
votes
1answer
88 views

Bank sites are protected by their own adblocking software

I do not currently have any adblocking software or extension. Ads are flourishing on foxnews and some other sites but not on my banks page. Do banks use some their own addblocking software?
86
votes
5answers
23k views

Can a malware power on a computer?

I've just downloaded and executed a piece of malware on my computer. I don't have much time right now, so I just powered it off (turned it off via the Start menu), hoping that it won't be able to ...
2
votes
3answers
3k views

Large amount of foreign IPs hitting out firewall, is this automated scans or are we under attack?

I just got put in charge of a network. In the logs on our firewall I noticed that we had a large amounts of machines trying to connect to port 53 as well as about a dozen other ports. Are these ...
0
votes
1answer
113 views

badBIOS reflashing

This is not a has-badBIOS-pwn3d-me post, so don't worry about any paranoid rants. Having read a thorough analysis/debunking of the alleged evilware, I certainly understand that the technology badBIOS ...
16
votes
5answers
6k views

KeePass security local malware

Can a malware that infected your local computer compromise a KeePass database stored locally in any way? If yes, what's the point for KeePass to have such strong security mechanisms if it cannot ...
11
votes
2answers
4k views

Can BIOS malware be installed from OS?

Can an OS vulnerability be exploited to install BIOS/UEFI/firmware malware (such as a keylogger)? I know BIOS is a "deeper" level than the OS. I know firmware based keyloggers exist. I know they can ...
5
votes
3answers
502 views

How can scammers inject pop-ups onto target computers?

My grandfather recently fell for a telephone scam. I won't go into details into how the scam worked; it's sufficient to say that he sent them over $2000 worth of iTunes gift card codes. The scammers ...
10
votes
3answers
2k views

Can you directly view a malicious PDF on Linux?

There have been questions on safe viewing of malicious PDFs on OS. I would like to know if it's okay to directly open them to view them in a Linux OS because the OS is said to be secure and malware-...
6
votes
1answer
10k views

Is ExpressVPN using hidden trackers or spyware?

I have ExpressVPN installed and keep getting strange warnings from Malwarebytes anti-malware. First odd fact is that XVPND.exe is always running, even after a reboot. I have set ExpressVPN to not ...
7
votes
4answers
9k views

Possible to detect packed executable?

A packer is a way of obfuscating an executable program, i.e., transforming so the result is still executable and has the same effect when run, but looks different (so it won't be detected by static ...
0
votes
1answer
82 views

How to analyze and track what data a software sends?

How can i track which program sends data over my network and can i see the contents of it? If we have a AV software installed in a VM , can we see what it's sending from your pc when doing a scan?
0
votes
1answer
211 views

Google Chrome Linux with Activity of Unknown Device

I've recently noticed a strange comportment on my Google Chrome Browser with GMail, where suddenly appeared a connected Unknown Device, with a double connection and with the same IP than mine, looking ...
1
vote
4answers
1k views

How can I sandbox a Wine application on Linux?

I would like to run Microsoft Office programs such as Word but do not trust them, nor should anyone. Without running a virtual machine, is there a good way to sandbox a windows application to run on ...
3
votes
4answers
3k views

What is the difference between a backdoor and a rootkit?

I was reading the "What is a rootkit ?" post and I'm confused about the difference between a rootkit and a backdoor. As I understood it, both : Are a piece of code written by the attacker and ...
5
votes
2answers
221 views

Is it possible for a virus to be embedded in a image and can this image execute on Android Oreo by just opening the image?

I am aware that on Windows this is very much possible. But is it possible on Android (latest OS with all the security updates)? Can you install a virus/malware/spyware by just clicking on an image? ...
1
vote
0answers
50 views

How is someone accessing my google account? [closed]

Two weeks ago I got a notice from Amazon that there was a suspicious charge on my account. My Amazon password is randomly generated, and not used anywhere else so my assumption was my Google Account ...
9
votes
2answers
1k views

Does the Mebromi BIOS flashing rootkit mean APTs for personal computers are here?

With the recent discovery of the Mebromi BIOS firmware virus/MBR rootkit in the wild are we now actually in the age of Advanced Persistent Threats (APT) for personal computers and does that imply ...
146
votes
20answers
38k views

Has it been mathematically proven that antivirus can't detect all viruses?

What analysis was Bruce Schneier referencing when he wrote: Viruses have no “cure.” It’s been mathematically proven that it is always possible to write a virus that any existing antivirus program ...
3
votes
1answer
97 views

Why must Meltdown use probe array?

This is code snippet of Meltdown assembly language code: 1. ; rcx = kernel address, rbx = probe array 2. xor rax, rax 3. retry: 4. mov al, byte [rcx] 5. shl rax, 0xc 6. jz retry 7. mov rbx, ...
0
votes
1answer
104 views

Can I detect malware download using Wireshark?

I have been working on Wireshark lately. I am learning about malware behavior, but I am curious to know whether methods exist to detect malware download (via drive-by download) on systems. Anti-...