Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange
Make your voice heard. Take the 2019 Developer Survey now

Questions tagged [malware]

Malware is any software application which subverts the will of the legitimate owner of a computer, by means of force or subterfuge, with or without personal or monetary gain on the part of the creator.

4
votes
0answers
366 views

How to deal with Sage Ransomware 2.2 infection?

My PC got stuck like this: It's a Sage 2.2 Ransomware. How do I fix this? Does restoring the system help me?
4
votes
0answers
154 views

Lowercase 'w' seen in C:\windows application paths from wmic services list

In reviewing several Windows 7 computers built from the same image (using wmic services command), I'm seeing most all the Window services paths displayed as C:\windows not C:\Windows. The 'w' is ...
3
votes
0answers
76 views

Why is Spotify using my webcam (AppleCamera)

I'm running Mac OS Mojave. I've just run the following command into terminal to see which applications are using my web cam. lsof | grep "AppleCamera" Google and Spotify showed up: Spotify 668 ...
3
votes
0answers
68 views

How to find malware added in supply chain to Android phone?

As has become a mainstream news story many times over, some Android phones are being shipped with malware preinstalled, because they go from factory to a second party who adds the malware and then to ...
3
votes
0answers
216 views

Host process for windows services network activity between other computer on same network

Wondering if this is normal? I have two PCs hooked up to a router and when the other one powers up and I check my firewall I see that there's some sporadic network activity going on (mainly upload/...
2
votes
0answers
82 views

BlackEnergy2 vs. BlackEnergy3: Which one targeted HMIs?

Various reports have been published that analyze BlackEnergy2 and BlackEnergy3 in-depth. However, there seems to be discrepancies regarding the malware delivery phase, i.e., initial exploitation. The ...
2
votes
0answers
40 views

Search function in Outlook and attachements

I am wondering how the search function of Outlook is working, especially in regards to researching key words that are presents in emails attachements. Does the Outlook search function opens the files ...
2
votes
0answers
55 views

What caused these massive spikes in malware sites detected by Google in July 2012 and January-February 2014?

Google's Transparency Report shows pretty huge spikes in malware sites detected by crawlers in July 2012 and in January/February 2014. I can't find any record of what these spikes were caused by ...
2
votes
0answers
73 views

Need Security advice on virtualization and windows security

I have a little doubt about the security of my virtual machine and Windows. Can anyone please point me in right direction? Below is my what, how and why I made my virtual machine. Let me tell you ...
2
votes
0answers
99 views

How exactly do malicious ads run code?

Visiting quite a few malwaretisers (I think this is the term :) ), I get popups with address bar something like data:text/html;base64,PGh0bWw+PGJvZHk+...
2
votes
0answers
115 views

Wikileaks Vault 7 'WheepingAngel' SmartTV Malware

I investigated a little about the WheepingAngel Malware that was recently leaked due the 'Vault 7 CIA Leaks' by Wikileaks. What i couldn't find where the actual CVEs that enable WheepingAngel to ...
2
votes
0answers
419 views

Does storing user files in S3 ensure that my server is secure from user uploaded malware?

Consider a common scenario where I'm using an Amazon S3 bucket to store the files uploaded by my users and not in my actual server. So, all the files the user uploads, go to the s3 bucket, and doesn't ...
2
votes
0answers
269 views

Creating a dynamic malware analysis environment

I don't know much about malware analysis so why this question here. I have analysed Short cut virus statistically and its impact on USB drives and wrote a code to repair its damage. My static ...
2
votes
0answers
43 views

Can I trust LPS?

LPS protects against spyware/malware by booting an OS from trusted media without reading from hard drives. However, not all components are open source. How do I know the US DoD didn't include ...
2
votes
0answers
334 views

Novicorp WinToFlash Lite, spyware etc

I used Novicorp WinToFlash Lite on Windows 7 to create a Windows 10 bootable USB memory stick. While creating the USB drive, I noticed that WinToFlash wrote something like adding blahblah files to ...
2
votes
0answers
164 views

Is the process Wslxrqjet.exe, tagged 'Google Chrome', malicious?

Multiple instances (between 3 and 15) of this of this process Wslxrqjet.exe are running on my Windows 8 system at all times. Windows Task Manager 'Description' field for all instances is "Google ...
1
vote
0answers
41 views

How can user send malware code via input=file

After the file is uploaded via input=file it is converted to b64 standard. But what is the exact path the file is going through and where in javascript code we can catch that uploaded file. And if I ...
1
vote
0answers
19 views

Malware abusing SSH agent active keys

I am thinking about this lately a lot, so I wanted to get someone else's opinion. Let's say that I have an SSH key agent (e.g. Pageant or ssh-agent) running in background with loaded keys (keys were, ...
1
vote
0answers
169 views

Weird Python script found on a Mac Os X client machine

I was reviewing a Mac Os X machine (a late 2016 MacBook Pro) and I found some weird scripts in the LaunchAgent folder. 8 -rw-r--r-- 1 XX wheel 500 30 Lug 07:18 com.1e1zq.plist 8 -rw-r--r-- 1 XX ...
1
vote
0answers
105 views

Is This a Virus?

i want to ask about a program is it a malware or a program from mozilla? When i turn on my pc it start normally but i see an open program called update.exe and it have a firefox icon on it, when i ...
1
vote
0answers
53 views

Are there any malware for USB-connected printers

At work, we have a printer/scanner that connects only to USB. As far as I know, no one who uses it has a print server on their computers so I'm not sure it's accessible over the internet. Because most ...
1
vote
0answers
64 views

How to get malware campaign runners to use my mail honeypot?

I have a working mail honeypot but have yet to receive any malware. I've already tried submitting my domain to several unsubscribe forms, but it does not seem to have worked. Any suggestions would be ...
1
vote
0answers
88 views

Comodo Firewall HIPS (Paranoid Mode) Regedits

Old time lurker and odd poster here with a general question. I think this might fall more in the nature of understanding system processes. I've activated comodo HIPS on paranoid mode to firstly see ...
1
vote
0answers
299 views

Can VBR rootkit survive format?

I found this article which talks about a rootkit which infects the VBR and creates a virtual file system in unallocated space between partitions. I know that there are MBR rootkits which cannot be ...
1
vote
0answers
216 views

Malware Analysis for Internet of Things Malware

How do we do malware analysis for Non-Windows based datasets? In the Internet of Things, a good percentage of devices are neither windows based, nor Linux nor Mac nor Android. They are sensor and ...
1
vote
0answers
70 views

Wannacrypt - MS Outlook email

I use MS Outlook for email and have an exchange account such that the email is stored on my laptop as well as in the cloud. Is it safe to rely on the cloud version of the mail as a backup in the event ...
1
vote
0answers
61 views

Unwanted browswer redirection

I use IE 10 on Windows 10, and when I type www.outlook.com, my Facebook page opens! I can type www.msn.com and use it to get to the email, but what is causing this and how to fix it? I tried several ...
1
vote
0answers
115 views

What is the typical half-life of a virus/worm on the internet?

I am curious about the typical half-life (i.e., loosely relating to radioactive half-life here), if one has been measured/estimated, for the average virus/worm on the internet. Has anyone done a ...
1
vote
0answers
444 views

Actual example of strcpy exploit?

IIUC the C function strcpy copies the character string x to the character string y . void strcpy(char x[], char y[]) { int i = 0; while (x[i] != 0) { y[i] = x[i]; i = i + 1; ...
1
vote
0answers
126 views

Secured Web Browsing

What can be done to make a setup for super secured web browsing? I've been looking at something like this: Windows host > Sandboxie > Virtualbox > Linux Guest > Web Browser (Chrome with uBlock ...
1
vote
0answers
303 views

How a packed malware runs the unpacked code?

When we run a packed malware it will unpack the code in dynamically allocated heap memory and heap can be kept non executable and I find no purpose to make heap executable. So, how the malware ...
1
vote
0answers
116 views

Does KillDisk use existing commands on a server to encrypt the data?

I've been reading up on this KillDisk exploit for Linux. https://www.bleepingcomputer.com/news/security/killdisk-ransomware-now-targets-linux-prevents-boot-up-has-faulty-encryption/ Does anyone ...
1
vote
0answers
61 views

Will Gooligan or Gooligan-like near-future variants be capable of targeting Marshmallow users?

Android malware called Gooligan has already surpassed it's infection points up to 1M+ in Android market which targets Jellybean & Lollipop. Seems it doesn't work for Mashmallow due to security ...
1
vote
0answers
46 views

Forwarding requests to known suspicious site to an isolated server

I keep getting IPS alerts for suspicious DNS requests for a known host with malware. I can't find anything from the Windows DNS logs from the domain controllers because it just shows the source ...
1
vote
0answers
134 views

Is this link dangerous with source?

I received a suspicious email from a friend of mine with stange name of the form first.last@zs3.szczecin.pl, where first and last are his/her first and last names. But the domain is totally awkward. ...
1
vote
0answers
136 views

Is Norton Mobile Security for Kindle Fire a Fraud? (or Malware?)

I downloaded a security app to my Kindle Fire a few months ago, (in this case Norton Mobile Security), and I am doubting it's authenticity now. Why? Because of these reasons: Reason 1: The 5-star ...
1
vote
0answers
46 views

Are there any methodology for malware in case of threat assessment?

Malware is a threat in security assessment. Are there any criteria to assess malware in case of threat assessment?
1
vote
0answers
90 views

Volatility Plug-ins to investigate packed exe files

I am using volatility for malware analysis. I have got a process in my memory image that is packed by malware using UPX packer. Malfind plugin doesn't show injected code for it also. How can i use ...
1
vote
0answers
162 views

Bizarre HTTP requests to VPS, former malware command and control server?

I just bought a new VPS with Linode. I installed Apache and noticed some very strange behavior that I have been seeing consistently throughout the logs. So basically, I keep receiving stranger HTTP ...
1
vote
0answers
171 views

How to prevent cache-based side-channel attacks in IoT devices

The sharing of hardware resources from various vendors in the Internet of things is fundamental for efficient processing in the cloud. The presence of a myraid of clients accessing the same hardware ...
1
vote
0answers
115 views

Is it suspicious that mail server sends traffic to Tor Exit node?

I am monitoring the outbound traffic from mail server through IDS and recently I observed there were some traffic sending to Tor Exit nodes from mail server, for example, IP 46.183.85.124. After doing ...
1
vote
0answers
62 views

Polymorphic Analysis

I'm a beginner at malware analysis. For my research studies, I have to identify polymorphic malware based from experiments. I would like to know if there are any guides showing how to analyze the code ...
1
vote
0answers
277 views

How Skype Click to Call plugin is used to send spam?

My friend had Skype Click to Call plugin installed within browser on Mac OSX. And his Skype account started to send some automatic spam messages linking to lose weight websites (via goo.gl) without ...
1
vote
0answers
126 views

Access android internal storage for full passive deep malware scan?

Is it possible to passively (with a computer) view/scan all content on an android mobile device's internal storage without crackopen/damaging it? For a deep malware scan of the whole storage of the ...
1
vote
0answers
62 views

cuckoo sandbox - PID exit

I hope someone could help me I've played with cuckoo for a while however I've just done a new installation and it all works however it will not run the binary i would like to scan. the PID exits ...
1
vote
0answers
156 views

Does this pdf file embeds an exploit or malware?

So a friend of mine was sent a phishing attack(Which was tailored for him and he fell for it) which also downloaded this pdf file: hxxps://www.dropbox.com/s/qw9mcw9p3pmc5j5/resume.pdf?dl=0 and he ...
1
vote
0answers
292 views

Linux: Chinese Unionpay plugin, Ubuntu 64-bit - Spamware / Trojan?

China / Linux / Bank / Trojan / Backdoor / Executables Hey guys. I've got an account with a Chinese bank (I live here), and in the process of setting up an online account for the Chinese version of ...
1
vote
0answers
163 views

Detecting reflective DLL injection any other ways?

any way to detect it? maybe using mcafee hips rules? Are there any known Techniques to detect it ? like walking the VAD tree or something?
1
vote
0answers
70 views

Any Suggestion Exchanging shared key between process via port in untrusted machine (infected my malware)?

I am trying to get shared key between Firefox extension and a java program running in same machine. I am communicating both application via socket. My assumption is that malware is running in ...
0
votes
0answers
20 views

Preventing admin from changing proxy settings

I am using a proxy server for my environment deployed on premises for internal hosts and on the cloud from BYOD. When a user takes their device off the premises, the proxy changes to an external proxy ...