Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange
Make your voice heard. Take the 2019 Developer Survey now

Questions tagged [malware]

Malware is any software application which subverts the will of the legitimate owner of a computer, by means of force or subterfuge, with or without personal or monetary gain on the part of the creator.

-1
votes
1answer
173 views

How does malware come in to a PC from USB? [closed]

I know that there are many routes that malware comes in to a PC. One of them is USB or HDD, but I am not sure how it works on those devices. First af all, how is malware embedded into a device? What'...
6
votes
2answers
472 views

Why is my Windows desktop using a DNS Server on localhost?

I recently inherited a corporate network and one of the devices kept having errors connecting to mapped network drives with errors pertaining to the server time being different than the computer's ...
0
votes
1answer
59 views

If the browser enforces a Sandox, then why the infections by malware?

By design the browser enforces a Sandbox, but we know that Javascript which runs inside this sandbox can be used to do malware damage etc.Isn't the sandbox supposed to protect against it as well as ...
1
vote
1answer
220 views

Extract urls from obfuscated android malware

Working on android malwares, i have faced many android malwares that typically contain urls which are bank phishing page. This type of malwares are growing in number so an automated detection system ...
1
vote
2answers
157 views

Can a website detect malware or virus present on device / PC?

I just got off the phone with an investment firm where I have an account. About a month ago, they blocked online access to my account due to "malware or a virus" found on my PC or device. Since we ...
5
votes
1answer
756 views

Extract malicious code from PDF file

I've a PDF file that contains some malicious code; when opened the processor usage maxes out and the fans run at full rpm. The pdfid.py produces the following output: PDF Header: %PDF-1.7 obj ...
0
votes
0answers
109 views

About blocking of malicious .bit domains

Is it possible for any network security tool/best practice out there that can detect and block possible C2 communications with .bit domains? i.e. blacklisting URL calls to .bit? Through this article, ...
-3
votes
4answers
224 views

Is it possible to inject malware knowing only the victims IP? [closed]

Is it possible to inject and run malware on Windows 10 by knowing the victims IP address only?
0
votes
0answers
48 views

Info: Employee's route being echoed from foreign IP

I noticed in our server logs that after a specific employee would access an internal, sensitive route, there would sometimes be an "echo" originating from a foreign IP address (in this case, Russian) ...
7
votes
3answers
322 views

When did we start to call malicious software “malware”?

I'm looking into the history of malware. When was malicious software fist called malware? I think that malicious software is called "computer virus".
0
votes
0answers
31 views

Can a website run a malware on my computer? [duplicate]

Can a website install a malware on my computer and run it in the background without my knowing about it?
2
votes
1answer
169 views

Deobfuscating Javascript Code in a Malicious PDF

I'm currently working on a project to look at how PDFs are infected, and what the malicious code found in these documents do. The malicious code is obfuscated, and I've tried a variety of methods ...
0
votes
0answers
24 views

OS - Security Issues - Text Appearing - Performance Downgrade [duplicate]

First, I noticed PC performance downgrade, then random text started appearing in the different text fields (e.g. in Word when I was typing my text, half of page of some random text could appear or in ...
1
vote
3answers
162 views

Identifying malicious scripts on a website

We currently have a specific situation on our website. We are a portal which serves ads, mostly via google network. Some of our users have started to complain that they are experiencing popups and ...
5
votes
4answers
2k views

Cross-platform browser link highjacking/redirect issue in Chrome

I'm having strange issues using Chrome Version 65.0.3325.181 (Official Build) on PC (Win 7) and OSX (10.11.6) on different systems. Clicks are often being hijacked taking me to different sites (...
-1
votes
1answer
159 views

What should I do if C:\Windows\System32\svchost.exe got infected? [duplicate]

The original svchost.exe file in my Windows XP was changed with a malicious copy, I think this is easy to do on Windows XP. How am I supposed to return it to the clean original without crashing the ...
1
vote
1answer
714 views

URL changes to *.compute-1.amazonaws.com/ when entering website, do I have a problem?

I was browsing for help on how to connect a PS2 controller to my pc. I found what I was looking for here: https://gaming.stackexchange.com/questions/262873/do-playstation-2-controllers-support-usb-...
0
votes
2answers
64 views

Security for MCU

Oflate there has been a lot of interest in Microcontroller community about security with ARM TrustZone for MCUs. TrustZone is deemed to protect MCUs against software attacks. My question is what are ...
0
votes
0answers
64 views

How to check for malware in existing personal data

tl;dr: Before concentrating on the walls of my walled-garden security model how can I be sure that I don't already have infected plants. Put another way: How can I be sure that I'm not compromising ...
4
votes
1answer
286 views

Reality Check: Create chaos at an office

An opportunity has arisen for me to perform a "real hacking attack" on a TV show. The target is to attack the TV headquarters and cause as much chaos as possible. The idea is to show how a business ...
1
vote
1answer
253 views

Hijacked certificate and Remote Login. Office computer compromised with a virus?

This is a Windows 10 Desktop. This morning I checked our work computer and I noticed a lot of Security Alerts from a Spanish Godaddy Domain trying to use remote login. There were no browsers open ...
-1
votes
1answer
77 views

What is the role of procmon in responding to malware? [closed]

I am forced respond to malware with procmon. I do not understand how to use procmon (createFile, RegQueryKeyValue, ...) to help. Is it possible to explain to me these operation? Thank you.
-6
votes
1answer
767 views

How to load spyware through a text?

How is it possible to load spyware through a text or phone call? The target phone is always password protected.
0
votes
2answers
186 views

How do malware developers avoid wrecking their own computers?

Given that there's quite a lot of malware running around targeting home computers; that for there to be malware, someone has to have built it; and most malware developers probably don't have the ...
21
votes
5answers
3k views

How is Facebook not considered spyware? [closed]

Recently, it was unveiled that Facebook's application in mobile phones (and messenger) have access to data that you didn't consent in their collection. Data that is completely unrelated to the ...
2
votes
0answers
48 views

How can I find cryptomining malware on my vBulletin forum? [closed]

I‌ have a vBulletin 4.2.3 forum which is apparently infected by cryptomining malware because whenever I‌ open a tab, I get very high CPU‌ load, and the load drops as soon as I close the tab. I'm ...
0
votes
1answer
305 views

Is it safe to open a message in inbox? (but not the GIF itself?)

I received message in my inbox of facebook which says my friend sent me a gif. Now, is it safe if I only see the message? By seeing the message I mean "just" the message itself, and not click on the "...
2
votes
0answers
1k views

Why is Blizzard's battle.net.exe and agent.exe always sending data over the network in the background 24 hours a day? [closed]

Blizzard, the gaming company that makes WoW, SC and Hearthstone uses battle.net.exe and agent.exe. When I close the battle.net application and don't have any games open, agent.exe runs in the ...
1
vote
1answer
87 views

Windows flags Microsoft Sysinternals .zip files as malicious

Downloaded sdelete v2.01 from official Microsoft website using Google Chrome on Windows 10 Pro: https://docs.microsoft.com/en-us/sysinternals/downloads/sdelete Basic info for SDelete.zip: SHA256: ...
1
vote
2answers
215 views

Malware techiques via Linux Chrome and its effects, non-root

Is it possible to visit a website with Chrome on Ubuntu and have that site execute shell code on my machine without explicitly downloading anything nor click on some Chrome execute question/popup? If ...
-4
votes
1answer
416 views

I need to decode this suspicious code and explain what it is doing? [duplicate]

$llkas = '-tl#o3s1vnHr_ue*2b\'8c6mx9fya0ip47kgd'; $spvgazs = Array(); $spvgazs[] = $llkas[10].$llkas[15]; $spvgazs[] = $llkas[19].$llkas[19].$llkas[16].$llkas[16].$llkas[27].$llkas[27].$...
-1
votes
1answer
69 views

Maximum effective distance from the infected network

We are new to Information security and we have a question that we can not figure out how to solve. We can assume that: The malware is deployed on an infected laptop that is connected to a network, ...
13
votes
6answers
4k views

How can I safely back-up files from an infected computer?

Imagine a laptop that's been infected by malware, and that the owner hasn't backed-up their files.* They have pictures, videos, and documents they'd like to preserve, so they're hesitant to ...
108
votes
9answers
18k views

Alternatives to anti-virus for keeping oneself safe

I have read a lot of articles that talk about how using an AV is less safe than not having one for more intermediate PC users who are careful with what they click and download. For example, here are ...
2
votes
1answer
86 views

Hundreds of old MS Office files increased by about 10kb

We have most of our documents backed up and syncing in MS Sharepoint. That has worked very well for us. However, I just noticed an old folder I created on the C: drive at the time of setting all this ...
2
votes
1answer
154 views

Is it safe to download an HTML file on an unknown website using something like Python's urllib.urlretrieve?

I know that some sites can infect you with malware just from visiting them. Is this because they run JavaScript in your browser? So would merely downloading the HTML and not running its JavaScript be ...
5
votes
1answer
609 views

Unusual GET Request

I am getting unusual get requests to my server: /op69okl?name=http://www.ntdtv.com/ or /op69okl?name=http://www.epochtimes.com/ or something similar with other sites in the param. Doing some searching ...
3
votes
2answers
178 views

Do malicious files on old hard drives pose a risk?

Lets say that I buy a used hard drive on which an attacker has placed malicious files. Might these somehow pose a danger to my machine, e.g. via some other vulnerability such as buffer overflow ...
2
votes
0answers
55 views

What caused these massive spikes in malware sites detected by Google in July 2012 and January-February 2014?

Google's Transparency Report shows pretty huge spikes in malware sites detected by crawlers in July 2012 and in January/February 2014. I can't find any record of what these spikes were caused by ...
27
votes
8answers
7k views

What security risks are there in allowing someone to upload PHP scripts?

Let's say that a partner wants to upload a PHP script to my Apache server. What kind of mayhem could be caused by this? Which PHP parameters pose threats? If those PHP parameters are fully disabled, ...
2
votes
0answers
73 views

Need Security advice on virtualization and windows security

I have a little doubt about the security of my virtual machine and Windows. Can anyone please point me in right direction? Below is my what, how and why I made my virtual machine. Let me tell you ...
0
votes
0answers
82 views

Install dualboot Windows to avoid viruses

I need to work with some suspicious files or rather files without verified source. It is known that anti viruses(I use kaspersky and malwarebytes combined) fail to notice some hidden trojans. So I ...
1
vote
1answer
89 views

Why did hosts get infected if the endpoint protection product has a signature for that malware?

Multiple hosts were attempting CNC communication that is specific to a threat from at least 2013, H-worm. However, endpoint protection is deployed on these hosts and functioning but no malicious ...
1
vote
2answers
3k views

Can a computer get infected with malware by viewing a PDF online?

Is it possible for a computer to be infected by viewing the link to a PDF file without downloading it? For example, if I opened a link on a website such as www.wordpress.com/somepdfFile.pdf (not a ...
2
votes
1answer
69 views

Odd PHP error referring to Fallaga Priv8 404 Shell when visiting a web site

I visited a website (belonging to a large company in northern Europe) yesterday. One of their pages in the "about us" section gave me a long error with a message that started with <?PhP /* FALLAGA ...
0
votes
0answers
26 views

Malware added itself to Windows defender exclusion list [duplicate]

tldr; malware added itself to Windows defender exclusion list. Can I trust malware bytes to do the job or should I get my laptop looked at by a professional? I downloaded a bunch of adware and ...
0
votes
0answers
97 views

How to stop autogenerating PHP malware on GoDaddy shared hosting?(signature-index.html.bak.bak favicon_**.ico) [duplicate]

I have a GoDaddy shared hosting that has been infected by PHP malware. Every day it autogenerates and renames my index.html to index.html.bak.bak and creates a index.php with the following code: <?...
3
votes
1answer
135 views

How can I make sure if my computer is infected and know if I have to nuke it from orbit?

I am aware of this question: Help! My home PC has been infected by a virus! What do I do now? and would adhere to its answer if I had, as this question states, "determined beyond doubt that my home PC ...
1
vote
1answer
1k views

does karabiner elements on Mac OSX contain or potentially contain malware?

I'm using Karabiner elements, an open-source program to remap the keys on my macbook air (running the latest Mac OSX High Sierra) and my apple wireless keyboard. It works very nicely. However, I am ...
2
votes
0answers
312 views

A Facebook impersonator uploaded pictures of me I never posted online. Now what? [closed]

Exposition One late night I was multi-tasking when a (trusted) friend sent me a link with text in a Facebook message he had apparently written. The preview of the link had a picture of me, and ...