Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange
Make your voice heard. Take the 2019 Developer Survey now

Questions tagged [malware]

Malware is any software application which subverts the will of the legitimate owner of a computer, by means of force or subterfuge, with or without personal or monetary gain on the part of the creator.

1
vote
0answers
19 views

Malware abusing SSH agent active keys

I am thinking about this lately a lot, so I wanted to get someone else's opinion. Let's say that I have an SSH key agent (e.g. Pageant or ssh-agent) running in background with loaded keys (keys were, ...
1
vote
1answer
158 views

Qubes OS or TENS for security? Is Qubes a good idea for a total beginner? [closed]

What would be the most appropriate to use for as much security as possible? TENS looks very simple and straightforward, which is why I like it. However I have barely seen anyone suggesting it, I ...
0
votes
1answer
223 views

How can I safely use potentially infected USB sticks from a previous OS installation?

So I recently upgraded an old MB Pro to Mojave because I was concerned I could've infected it. Now I'm probably overreacting to all of this but since I was using all of my USB sticks in the previous ...
1
vote
1answer
136 views

What is “Waiting for eb2.3lift.com…”?

I am using purevpn on Firefox, I have noticed that when I open the browser sometimes it hangs and on the bottom left hand corner it says "Waiting for eb2.3lift.com..." I tried to google this eb2....
0
votes
2answers
103 views

Is Kaspersky Total Security a good choice against malware? [closed]

I've been using Kaspersky Total Security for quite some time even though I'm not an Information Security professional, I heard it was considerably efficient. Yesterday, though, I was navigating ...
0
votes
2answers
140 views

Could my computer have downloaded some sort of virus or malware after clicking this button?

I went to the website: katsokos.com, and was shown this page: I stupidly clicked on the verification button and was redirected to the chrome store page for some chrome plugin, as well as the website ...
1
vote
1answer
115 views

Send GET request from a PDF file

I'm currently working on a security Proof Of Concept where I need to show the danger of opening an unknown PDF file. Internet says that many malwares use Javascript in PDF document (AcroJS) to ...
1
vote
2answers
95 views

How can I securely edit an Office file that I downloaded from the Internet?

When I open an Office file such as a Word file that was downloaded from the internet, it warns me that it might not be safe to edit unless I trust the file source, but what if I actually need the file ...
1
vote
0answers
170 views

Weird Python script found on a Mac Os X client machine

I was reviewing a Mac Os X machine (a late 2016 MacBook Pro) and I found some weird scripts in the LaunchAgent folder. 8 -rw-r--r-- 1 XX wheel 500 30 Lug 07:18 com.1e1zq.plist 8 -rw-r--r-- 1 XX ...
1
vote
1answer
389 views

Potential router malware? Receiving “Access Denied” and other weird blocks from various websites

So I've been having some weird browsing behavior over the last few weeks and it's gotten a lot worse the last few days. I've been getting blocked/banned by various websites off and on. Here are a few ...
2
votes
1answer
93 views

I found a browser extension I don't trust installed, should I worry?

Someone told me that their Firefox had a strange new menu bar. I found that it was “FindYourMaps”. FindYourMaps is a deceptive browser toolbar that supposedly allows users to find driving ...
2
votes
3answers
311 views

New user with Chinese name appeared on MacOS. Hacker?

I'm the only user on my personal laptop (MacBook Pro) running macOS Sierra. I discovered today that a suspicious user with a Chinese name appeared next to mine in the finder. Please see the attached ...
61
votes
5answers
16k views

Can Beehive detect a Snowden-like actor?

In a seminar, one of the Authors of Beehive: Large-Scale Log Analysis for Detecting Suspicious Activity in Enterprise Networks said that this system can prevent actions like Snowden did. From their ...
0
votes
2answers
63 views

If a host is infected is the sandbox environment infected?

Say my host machine is infected and I have a sandbox program. Will that sandbox environment then be infected also? If the answer is yes, what if I have an AV running inside of the sandbox. Will it ...
3
votes
1answer
53 views

Running a brief asm script inline for dynamic analysis

Is there any good reason not to run a brief unknown (30 line) assembly script inline in a usermode c program for dynamic analysis directly on my laptop? There's only one system call to time, and at ...
0
votes
1answer
94 views

How can you reset a UEFI completely in case of a firmware infection?

I haven't really understood whether firmware level infection (on either motherboard or drives) can actually be a thing without physical access, however how can one factory reset the firmware in that ...
2
votes
0answers
40 views

Search function in Outlook and attachements

I am wondering how the search function of Outlook is working, especially in regards to researching key words that are presents in emails attachements. Does the Outlook search function opens the files ...
1
vote
2answers
114 views

If C uses shared libraries, is it possible to write a program that will modify the code that opens a file

If C uses shared libraries, is it possible to write a program that will modify the fopen function to execute a malicious code? How can the OS protect the user from this?
1
vote
2answers
88 views

What files can I keep to reinstall an infected system without getting infected again?

I'm quite sure my Windows PC is infected beyond salvation and I want to format it and reinstall everything. However, I have a 128 GB SSD where I keep only the OS and a 1 TB hard disk where I have ...
3
votes
1answer
85 views

Remove malicious rootkits and spyware from HDDs and SSDs

I have read at least twenty articles dating from the time Edward Snowden's startling revelations about rogue nations and bad actors embedding malicious rootkits and spyware in the firmware of hard ...
1
vote
0answers
37 views

Found possible malware code on site - contacted owner - what does it do? [duplicate]

Small question. I'm trying to figure out what a piece of code does that I came across on a website I visited. The website has obviously been hacked into, as there's a bunch of minified PHP code up ...
2
votes
1answer
63 views

Scanning a binary against YARA rules dictionary

I have found a malware binary, Which i am curious to see what patterns has been found from this file. Also i have a collection of ~1000 ioc's and yara-rule's related to Malwares and RAT's. I used Loki,...
1
vote
3answers
111 views

is spoofing CA to sign application possible?

Is it possible to spoof the CA of any server to sign some application? As like as what CarbonCopy claims?
40
votes
5answers
5k views

How should source code security be checked?

How to check whether the source code of an open-source project contains no malicious content? For example, in a set of source code files with altogether 30,000 lines, there might be 1-2 lines ...
0
votes
2answers
53 views

What type of malware can see my browsing activity?

I downloaded and installed Malwarebytes. After running a scan, Malwarebytes quarantined a bunch of different malware programs. What type of malware can see my browsing history, my Google searches ...
3
votes
2answers
190 views

Malware Author's Mindset

I'm studying common malware characteristics, and I'm having a bit of difficulty understanding the design choices the malware authors make. Many of said choices seem to revolve around making life ...
2
votes
2answers
141 views

How to harvest plaintext passwords from emails

Do you have any links to stories from a reputable source about any malware that harvests plaintext passwords from emails? I do tech support and every once in a while one of my clients will send me ...
-1
votes
1answer
144 views

Explain how a BIOS/UEFI infection may compromise the security of the Operating System [closed]

Explain how a BIOS/UEFI infection may compromise the security of the Operating System.
1
vote
0answers
106 views

Is This a Virus?

i want to ask about a program is it a malware or a program from mozilla? When i turn on my pc it start normally but i see an open program called update.exe and it have a firefox icon on it, when i ...
0
votes
1answer
68 views

Is it possible to become infected with virus, trojan or malware by browsing the infected sites or running installation .exe?

I am quite paranoid and I am always afraid that when i accidentally open some infected sites it would run scripts that automatically download malwares, viruses and trojans into my pc and run by ...
10
votes
1answer
148 views

How can faulty version of an iOS app (such as WhatsApp) expose the whole device to crashes or take-over

There was a lot of recent, prominent news about a security vulnerability in WhatsApp that affects also iOS versions of the app. The volnerability has been described as carrying the risk of an attacker ...
1
vote
1answer
75 views

Malware Execution Delay

I am new to malware analysis and am currently using Cuckoo to understand some of the basics. I am trying to figure the time that the malware delays its initial executions. I found a functional call ...
2
votes
2answers
236 views

How would one scan a large, untrusted file?

I've recently started to convince relatives to upload anything they download to Virus Total, to help them be more safe when downloading stuff. However, I have recently come across an installer for a ...
2
votes
1answer
111 views

Is it possible for a virus to be embedded in a image and can this image execute on Android Oreo by just opening the image?

I am aware that on Windows this is very much possible. But is it possible on Android (latest OS with all the security updates)? Can you install a virus/malware/spyware by just clicking on an image? ...
-1
votes
0answers
27 views

How to remove malware from entire shared hosting account

My shared hosting account was infiltrated and all files infected. Is there any way to disinfect the entire account?
3
votes
0answers
69 views

How to find malware added in supply chain to Android phone?

As has become a mainstream news story many times over, some Android phones are being shipped with malware preinstalled, because they go from factory to a second party who adds the malware and then to ...
3
votes
1answer
149 views

How does malware stay undetected for months?

For my college course, I am currently researching how malware works and stays undetected from antivirus and users. I built a proof of concept that stays hidden at scan time and run time. If a hacker ...
2
votes
2answers
240 views

Malwarebytes found bitcoin miners after I installed a new drive. Is my system screwed?

Recently I bought this external hard drive from Amazon ("Sold by: Amazon.com Services, Inc"). The first time I plug it into my computer, Malwarebytes shows this report (it found bitcoin miners in my ...
-2
votes
1answer
56 views

Penetration testing or Malware analysis? [closed]

My M.Sc research is about developing IDS for IOT. I'm confused about which field should learn more about; penetration testing or malware analysis. I have some knowledge about each one but for IDS, ...
0
votes
2answers
190 views

Ways to hide injected dll?

So if I inject my dll to a pprocess (or all running processes, including AVs) and it hooks some functions, why can't I just simply hook the functions (WinAPI functions) that could detect my injection ...
-1
votes
1answer
225 views

What makes a VPN safe for an organization when connecting BYOD infected machine?

Several malware types have the capability to move laterally within the company infrastructure, infecting connected machines within the company. I was wondering how it's possible for an infected ...
0
votes
2answers
122 views

On urlscan.io Indicators of Compromise, what do the hashes represent?

When I look up a domain of interest on urlscan.io, I see a lot of interesting information. When I click on "Indicators of compromise" (IOC), I see a list of hashes that are actually links to pages ...
1
vote
1answer
296 views

Antivirus warns about processes trying to access my webcam

For the last two weeks I am constantly getting notifications from my antivirus about attempts of using my webcam. I have always chosen "Block access", often after checking "remember for this ...
-1
votes
1answer
67 views

decompile a DLL which is not .NET

I ran over a suspicious DLL file which originally was created by Adobe Photoshop (The license looks legit). I want to check if DLL contains malicious code which would be executed at runtime. What I ...
4
votes
3answers
435 views

Is hijacking a webcam after visiting a website a plausible threat?

(I made a throwaway to ask this question, since this situation is pretty embarrassing) Earlier today I started receiving emails threatening to send embarrassing video of me to all my contacts unless ...
6
votes
3answers
344 views

Is com.com a Google web site?

With the new Chrome update, I started getting a message at the top of Chrome: When I clicked on Learn More, it took me to Com.com web site. A warning appeared before that "your connection is not ...
0
votes
2answers
345 views

Is this a safe way to open a PDF file? [duplicate]

I have recieved an email with a pdf file whose content I want, but I'm not exactly sure what the source of it is. In gmail, I have two options: "Download" and "Save to Drive". I'm assuming it means ...
0
votes
1answer
109 views

Fake bank text message

I recently tried to use my card to buy something on my phone for £29.99. My card was declined so I used a different card and the payment went through. A couple minutes later I get a message from a ...
8
votes
6answers
471 views

What are the techniques to detect malware call home/beaconing activities?

It is very common for active malware to "call home" (or beaconing), either to fetch updates and instructions or to send back stolen information.. In an internal network where web access to the ...
2
votes
1answer
181 views

Type of malware on adult sites

What kind of malware is there on random adults site? When I open a video in such a sites there is weird effect of opening another window of browser which is immiedetely closed or opening another tab ...