Questions tagged [malware]
Malware is any software application which subverts the will of the legitimate owner of a computer, by means of force or subterfuge, with or without personal or monetary gain on the part of the creator.
2,508
questions
1
vote
1
answer
18
views
Anything I can do to combat malicious domains?
On Facebook, malware is currently trying to spread itself using the domain googlediver (dot) com, one sample of a malicious url is https://googlediver (dot) com/list-of-traveling-staff , and I believe ...
- 573
-1
votes
0
answers
32
views
Looking for tips on hiring malware consultant - suspected repeated android compromise [closed]
I very strongly suspect that my devices (phones, but possibly also home pcs and work network) have been hacked repeatedly by the same person. I am trying to hire a consultant that can help me look for ...
- 1
1
vote
1
answer
37
views
How serious are npm module vulnerabilities?
Obviously any known vulnerabilities are not great, but I'm curious how much I should be concerned about them.
I've seen plenty of articles that talk about the rise in malware/spam in npm packages:
...
- 11
0
votes
0
answers
69
views
Use a virtual machine to do risky stuff. How to stay as safe as possible? [duplicate]
I have a PC with Ubuntu and Windows in dual boot. I use this PC for basic stuff: Windows for gaming, shopping and common browsing, Ubuntu to do something such as home banking.
I was thinking to create ...
0
votes
0
answers
49
views
How to Safely Research a Suspected Malicious Website by Using A VM [duplicate]
I am aware of a website that I suspect is, at the very least, pulling user data from visitors and possibly performing other malicious activity on visitors. Of course, the safest course of action is to ...
2
votes
1
answer
314
views
In the modern context, what max harm can a webpage do, if the creator is malignant? [duplicate]
Note: this does not answer my question as it mentions Java/Flash(not in the modern context. The question is from like 10 years ago so probably outdated), and mentions weakness introduced by the user(...
- 131
1
vote
0
answers
58
views
Detecting hard to detect stalkerware - a theoretical question
Suppose you have a stalker and this person has access to professional advice.
Suppose your Android phone was hacked by means of physical access, i.e. known unlock pattern or stolen password note, with ...
- 11
4
votes
1
answer
171
views
Suspicious indexing of non-existent pages
Just recently, the Google search engine started indexing my site with a crazy number of requests. When I logged into the console, 600,000 pages were indexed, and 919,000 more were not indexed. For ...
- 43
0
votes
1
answer
69
views
Cleansing a personal laptop to use for business
I am going to be setting up an online business that will expose high-value data, i.e. trade secrets, IP, merchant/e-commerce accounts, etc.
The computer has been used before for looking at porn, etc. ...
0
votes
0
answers
62
views
How can I know whether I'm infected by StripedFly malware?
I was reading this article, and decided to search for sd-pam in the processes of one of my laptops.
I did ps -x | grep -i "sd-pam", and got
2864 ? S 0:00 (sd-pam)
29172 pts/0 ...
0
votes
0
answers
14
views
macOS processes [migrated]
Anyone have any idea what the PerfPowerService and PerfPowerTelemetry...Service is on macOS (Sonoma?) I can't seem to find a lot of information on these processes. The second one isn't even mentioned ...
0
votes
0
answers
46
views
help in understanding hybrid analysis results? Mac
So I have a few PDFs on my computer I got online a few years ago on my Mac computer.
When I ran a virus total scan on some of them I got a couple that were concerning. Here is the one that most ...
1
vote
0
answers
66
views
Is having no driver installed better than having old driver?
How safe are installed & genuine-vendor signed old drivers, specifically when attackers are spoofing Microsoft and other vendor certificates?
On older PCs and laptops where some components are no ...
0
votes
0
answers
68
views
I am trying to identify suspicious content within a PDF file
I have a PDF file that has been sent to me as part of a suspicious email. I viewed the email as message source from within outlook. This gave me all raw text within the email. I copied this to ...
- 1
0
votes
1
answer
80
views
Malware in neural networks
Lately, there has been discussion about malware hidden inside deep neural networks, such as, EvilModel: Hiding Malware Inside of Neural
Network Models (pdf).
I understand the hiding part, but I would ...
0
votes
0
answers
87
views
USB Drive Malware (.lnk extension) Suspicions: Seeking Advice on Next Steps
I recently encountered a concerning situation involving a USB drive, and I'm seeking guidance on how to proceed.
The scenario:
I used an older computer to extract photos from a DVD and transferred ...
- 1
0
votes
1
answer
64
views
In case of multiple websites using a single IP, and we have been asked to perform vulnerability assessment to ensure its security, how many to target
When doing black-box vulnerability assessment (with permission of course) of a subdomain of a website, the first step is enumeration; and the first step of that is finding IP of the subdomain.
If you ...
- 121
-1
votes
1
answer
157
views
Will Remote Access Trojans work on an offline PC?
Using a USB memory stick that was frequently used on a Trojan-infected PC on an uninfected offline Windows 10 PC. Physically, the PC has no wireless adapter, so it cannot be connected to wifi. ...
1
vote
1
answer
114
views
Malware infection to wifi router from android phone
Suppose a wifi router has strong admin password, updated firmware and no vulnurability then -
Is the router safe from malware infection from android phones connected to it?
Can malware from an ...
- 41
0
votes
0
answers
114
views
Is UAC an overestimated protection measure in Windows? Does Linux do it better?
Windows is an API-based operating system, whereas Linux is file-based. Hence in my opinion, any operating system API security measures alone aren't effective in Windows. One of such examples would be ...
- 1,552
0
votes
0
answers
25
views
i found an inserted script in all my pages and posts [duplicate]
I found this script in all my pages & posts and custom CSS. I want to delete it and prevent regenerating it again. This script stopped me from updating custom css in customize.
please help if you ...
0
votes
0
answers
64
views
Can malware module be signed as Microsoft Corporation module?
In this security tutorial:
https://youtu.be/dykc9YC9Z6U?t=257
the author claims that "sihost is a network component of the malware..." (at 4:23). Yet, prior to his claim, at 3:09 he shows ...
- 101
1
vote
1
answer
85
views
Github repos with CVEs mentioned and no real content
When I look for proof-of-concepts of a security vulnerability, I often see this kind of Github repositories:
https://github.com/Satheesh575555/linux-4.19.72_CVE-2023-0386
https://github.com/nidhi7598/...
- 232
0
votes
1
answer
150
views
How does Windows Defender for Mac block applications and how can people evade the block?
I am using MS Defender for Mac to specify a list of unwanted applications on the managed devices in my company. I am concerned that some users try to evade the detection by altering the binaries of ...
- 51
0
votes
0
answers
58
views
How to isolate a bash script process?
I have a bash script that opens various random files that could be anything (PDF, xlsx, MKV, MP4, WebM, html). Since I don't fully trust the source of these files, there is a chance that some of them ...
0
votes
1
answer
62
views
Static malware analysis using machine learning
As you know, using machine learning we can detect malware.
We can use dynamic analysis based on WinAPI function calls and their arguments.
But what about static analysis using machine learning? In ...
0
votes
0
answers
9
views
Seeking advice for possible virus [duplicate]
I have grown suspicious because I just witnessed powershell opening and immediately closing very fast and multiple times, probably 15 times. After that, the same happened with schtasks.exe. The ...
0
votes
0
answers
44
views
Can malicious files be traced and removed from my phone
I had a files analysis done on my phone using Falcon Sandbox. An alarming amount of malicious files,marked as clean, were found,identified,and shown each capable abilities. Literally THE ONLY thing of ...
2
votes
1
answer
339
views
Downloaded a .scr file (didn't click), will it harm my computer?
I've downloaded a .rar file and extracted it. I have seen that there is a file with extension .scr and in a few seconds, my Windows Defender warned me that a threat had been found. So I just deleted ...
1
vote
0
answers
112
views
Practical examples of a trusting trust attack
Ken Thompson's famous trusting trust paper describes an attack wherein a compiler is subverted, and subsequently subverts all software it compiles, including itself. I have always thought the idea of ...
- 11
1
vote
1
answer
440
views
Is it possible to attack using a CDN as a cover?
I had a security engineer analyze a packet capture from my machine.
About five IPs were used in an attack. It was the only IP (6) that was detected multiple times by VirusTotal.
The IP is 209.197.3.8. ...
0
votes
1
answer
129
views
How to know if you have downloaded a malware on a virtual machine [duplicate]
First, I'm a complete beginner, my only experience in malware is running windows defender lol. But I will try my best to learn anything that you guys recommend.
My younger brother keeps downloading ...
2
votes
1
answer
193
views
Is running rsync as root problematic?
Is there a security risk with running rsync as root to copy potentially malicious files? Or for that matter with any read command like cp, cat, du?
Background:
I'm moving data from various systems ...
- 21
0
votes
0
answers
38
views
How to "clean" PDF to remove non-text and non-images in Product User Manual? [duplicate]
I need guidance on, with the least security risk, how to edit Product User Manuals and Engineering Drawings PDFs from the internet.
Antivirus is insufficient, according to advice from a website which ...
34
votes
4
answers
9k
views
Domain about to expire. Afraid that new owners will spread malware
I have a domain that is about to expire. It was used for hosting my freeware which I do not maintain anymore but can still be found on shareware directories. The application points to my domain (...
- 2,493
0
votes
0
answers
73
views
Is it possible to have infected Computer A infect Computer B whilst being only connected by an Ethernet cable? [duplicate]
Is it possible to have infected Computer A infect Computer B whilst being only connected by an Ethernet cable?
My current research into worms is that they always seem to require an additional vector ...
0
votes
1
answer
117
views
Why some ransomware adds padding to headers
Does anyone know why some ransomware families (e.g. Cuba but also Phobos if I am not mistaken) pad the file header to get to 1024 bytes?
I mean what would be a reason for the ransomware developer to ...
0
votes
1
answer
141
views
Can virus survive macOS Recovery?
In what scenarios would a MacOS virus/malware/rootkit/etc (I use those terms to englobe all types of undesirable or malicious software or code) resist a format of the hard drive in MacOS recovery?
I ...
- 21
0
votes
0
answers
121
views
What information does the Microsoft Intelligent Security Graph use for querying files?
I'm looking into WDAC and the option to use Microsoft's ISG for files that are not explicitly allowed or denied caught my interest. Unfortunately I haven't been able to find any information on what is ...
- 11
-1
votes
2
answers
113
views
Help: Does this website contain malware? [closed]
My grandmother told me she visited a site to buy something but it did not open properly. It does look like it redirects to something else. It could be malware.
Website: sanjaytools.com. Browser: ...
- 3
1
vote
1
answer
957
views
How to decrypt LockBit encrypted files
I've got an emergency on my PC. I remotely connected to it using Remote Desktop Connection a couple of days ago and I worked on my PC for a while and logged off. Later, when I went to log back on, I ...
0
votes
1
answer
138
views
Do viruses survive in other drive and than re infect after resetting the PC?
Backstory:
I got infected while installing some shady software and at that time I kept Windows Defender off, (I have very much faith on my shady website) by turning its features off. But when I ...
0
votes
0
answers
29
views
How to proceed once your machine has been infected? [duplicate]
I have a Windows 10 machine. Around a week ago, someone was able to purchase stuff using my credit card, before I was able to lock my card. For a few weeks before then, I'd noticed that my computer ...
- 1
1
vote
2
answers
221
views
What are some symptoms of malware exfiltrating data in packet captures?
I am concerned that my Linux laptop has been compromised with malware that is remotely and regularly monitoring my activity. I ran Wireshark for a day to see if I could find any symptoms of data being ...
- 11
0
votes
1
answer
98
views
Successful UEFI secure boot exploitation
Are there any real examples (malware, rootkits, etc.) of exploiting the UEFI secure boot mechanism vulnerabilities such as CVE-2022-21894?
- 2,552
0
votes
0
answers
29
views
Need assistance with hacked website [duplicate]
I need help about this: Is this script malicious? What does it do?
I have the same problem in my site, how could I fix that? I tried to place clean wordpress files but the problem persists.
0
votes
1
answer
86
views
How to make VBA code stay hidden even after vba stomping?
I am experimenting with VBA stomping in microsoft word documents.
I have done it manually but also with the evilClippy tool aswell.
What i have noticed is that, although the original vba code stays ...
- 23
2
votes
1
answer
113
views
PC to iOS, USB storage Malware?
I have a laptop, with Windows 7, no internet (with the wifi adapter physically removed). I want to use that machine for stuff like old abandonware, and don’t want to risk any type of malware or virus ...
- 21
0
votes
2
answers
280
views
Chance of virus/malware and non-executable files
I’ve seen this question being asked so many times, but I still have questions.
I know that to execute malicious code from non-executable files such as videos (mp4), audios (mp3) and documents (pdf), ...
1
vote
0
answers
109
views
Has my browser been infected after visiting malicious link?
Today I typed in a URL of a site I know. Unfortunately I missed one letter of the TLD. I typed .co instead of .com.
No problem, I'll quickly retype the URL. Unfortunately, this was not possible. The ...
- 111