Questions tagged [malware]
Malware is any software application which subverts the will of the legitimate owner of a computer, by means of force or subterfuge, with or without personal or monetary gain on the part of the creator.
2,508
questions
56
votes
3
answers
12k
views
Does open source "protestware" represent a security risk?
Since the beginning of the Ukraine-Russian war, a new kind of software was created, which is called "protestware".
In the best case, the devs only add some (personal) statements about the ...
- 1,366
1
vote
2
answers
115
views
What are the issues with running a seemingly trustworthy python script from a stranger?
For context: in Sweden, the "end" of COVID has caused a huge buildup in passport applications, as everybody wants to resume travelling. However, due to the poor performance and general UX of ...
- 111
2
votes
1
answer
211
views
Does malware ever check CPUID?
CPUID is an instruction that identifies CPU type and features.
Has there ever been a case of either targeting or the opposite - ignoring of specific CPUIDs by malware in the wild?
- 1,552
3
votes
1
answer
603
views
Has there ever seen a recorded case of a M.2 infected SSD firmware?
Was there ever been out-in-the-wild or any kind of detected firmware rootkit in an M.2 SSD?
- 1,552
2
votes
2
answers
5k
views
Microsoft Defender flagged Surfshark.exe as "Misleading:Win32/Lodi"
Can this be safely ignored?
VirusTotal shows that Microsoft is the only security vendor that flagged this file as malicious. I did not modify my Surfshark installation in any way, except for an update ...
0
votes
1
answer
138
views
safely storing untrusted files on a trusted machine
given a collection of files (text and binary) that are likely to have been modified by a resourceful and motivated adversary in a targeted attack, is there a security risk to copying that collection ...
- 1
2
votes
1
answer
346
views
How to protect yourself from firmware viruses
What componets of a PC do firmware viruses and rootkits infect? Secure boot is supposed to protect you from these types of viruses. Although, it doesn't protect you against rootkits in UEFI firmware ...
- 589
0
votes
1
answer
116
views
Has there ever been a case of dangerous industrial malware, which would destroy motherboards and similar PC components and how to protect [duplicate]
I heard many years ago from word of mouth that this kind of malware exists, which could for example blow up capacitors in your PC.
Has such malware or something even remotely similar ever existed?
...
- 1,552
0
votes
1
answer
101
views
How does a malware usually figures if the machine is used for malware analysis?
Lately I've read a blog post for an advanced malware, that has a dropper that ensures that the victim machine is not used for malware analysis and if that's the case terminates.
So I'm thinking that ...
- 1
0
votes
2
answers
140
views
Is this weird folder "Up8d76c_31187" a windows thing?
I noticed it becaue one of these exe's started running after a BSOD.
Putting one of the exe's into VirusTotal gives it a 3/70. How can I examine this further?
Edit: Other exe's are worse: VirusTotal ...
- 103
0
votes
1
answer
421
views
How to store malware for analysis?
I am planning on analysing some malware samples dynamically using a sandbox tool and a target Windows VM. The host (physical machine) runs Ubuntu and in it are the sandbox and target VM.
So far I only ...
- 1,165
1
vote
0
answers
200
views
What is the difference between malware signatures and malware artifacts?
I am trying to analyse some malware samples but I am trying to understand the differen between malware signatures and malware artifacts. As far as I understand (and from what I've understood from this ...
- 31
0
votes
1
answer
188
views
The practicality that a home network / router gets compromised
I know that it's theoretically possible that a router can be hacked, and malware can be spread throughout a network merely by being connected to it.
However, I'm wondering what exactly the chances of ...
1
vote
0
answers
324
views
Can unzipping archive by itself cause malware execution? [duplicate]
It it possible to execute a malware just by unzipping a malicious zip archive? Like a malware would target some vulnerability in zip decompression routine. How common such an exploit would be in the ...
- 43
8
votes
2
answers
3k
views
Clamav identifies Certbot files as infected
I ran Clamav on an Ubuntu 20.04 machine and it identified ten Certbot files as infected.
/snap/certbot/1670/lib/python3.8/site-packages/pip/_vendor/distlib/t32.exe: Win.Malware.Generic-9937882-0 FOUND
...
- 183
0
votes
1
answer
11k
views
Can my android phone get hacked if I share my hotspot?
I lent my mobile data to someone's computer and was not in the room while they were using it.
Suppose they wanted to gain control/access to my android device. How easy would it be? As far as I know, ...
- 29
1
vote
2
answers
340
views
What's the likelihood of a compromised computer compromising others on the network?
Today my grandparents connected to my WiFi, the password was given to them by my partner. Well, after looking at their PC, we established that they hired someone who has installed loads of stuff on ...
- 11
1
vote
4
answers
294
views
Is doc file really modifying registry in Windows?
Been given a .docx file to check whether it has a virus or something, ran McAfee and SuperAntiSpyware on it and results came back negative so I though it was good and proceeded to open it, just a file ...
- 11
1
vote
1
answer
944
views
How to locate a malicious script in the Linux system
I would like to ask for some directions to trace back to the original (malicious) script on my system (Ubuntu Server). I would try to be more specific if needed. If the question does not fit this ...
- 131
0
votes
1
answer
191
views
Do viruses spread by infecting other files on an infected machine?
Suppose malware lands and executes on a computer. Could this malware attempt to spread further by writing itself to data files (images, pdfs, docs) and hoping that the owner would transfer or upload ...
- 43
0
votes
1
answer
272
views
Preventing Windows from seeing/tampering with linux drive
Is there a way to prevent a Windows 10/11 system to access/modify/delete data from a secondary linux drive?
I understand I can encrypt the linux drive, but wouldn't the windows system be still able to ...
- 1
2
votes
0
answers
516
views
Can a virus infect windows 10 bootable media?
I created a bootable windows 10 usb from my friend's computer. I used the official tool from microsoft. I was dumb enough to not check my friend's computer beforehand (turns out he had Utorrent Web ...
- 29
0
votes
1
answer
2k
views
Can two antivirus softwares work on one android phone?
Scenario: You have one antivirus installed on your phone. You suspect that your phone might have malware on it so you do a system scan and your AV doesn't find anything. So you decide to download ...
- 1
0
votes
0
answers
32
views
How to permanently remove DDE Exploit:O97M/DDEDownloader.C? Do I need to nuke my computer? Is it safe to not do so? [duplicate]
1Starting yesterday windows defender has found and quarantined 5 copies (pic 1) of the following threat (pic2) Exploit:O97M/DDEDownloader.C see here.
I tried contacting Microsoft tech support but they ...
- 1
0
votes
1
answer
145
views
Malware dropper uses "^" character in syntax of cmd.exe before calling mshta.exe to download file?
I found a malicious Excel file that was using an embedded HTA program as its dropper to download a powershell program from a malicious IP. The dropper was on a hidden sheet in the file. After ...
- 1
-1
votes
1
answer
338
views
Infecting files on GitHub
Suppose one uploads (carelessly or purposefully) a file with a malicious payload to their Github account (some pdf document, picture, etc.). Could this payload somehow be executed on the Github ...
- 43
0
votes
2
answers
84
views
Will setting up an installation on an SD card in this way prevent changes to the operating system?
I want to set up an SBC, e.g. Raspberry Pi, Banana Pi, to work as close as possible to a computer running a Live Distro. I'm intending to use this to inspect suspicious or infected storage drives and ...
- 983
1
vote
1
answer
2k
views
Mp4 virus scanners
I used to download a lot of mp4's from untrusted sources. But I discovered that they could contain malware. I would like to know if there are any methods to clean or to check video files for malware.
- 11
1
vote
2
answers
479
views
Is it safe to view infected word documents in office online?
Can viewing and editing a potentially infected microsoft word document (with images inside) on a web-based platform like office online (OneDrive) infect my pc? How does the browser running on my ...
- 43
1
vote
2
answers
666
views
How do I activate a malware inside a virtual machine?
I have been doing research on malware detection and my current setup is: one host OS (Ubuntu 18.04) and one guest OS (Ubuntu 18.04) inside VirtualBox. I have downloaded and executed some malware (...
2
votes
2
answers
390
views
How to create a safe environment in Windows 10 for high-performance programs?
My friend handed me a .exe file of an old game we want to play together. My laptop has important files, so I do not want to install it immediately. I am still sceptical that he might not know it ...
- 21
0
votes
0
answers
209
views
Sextorsion then Trojan
I received an email containing blackmail about videos that the hacker said he recorded. He said that he recorded the user of the laptop masturbating and he is asking for money to delete them otherwise ...
- 1
1
vote
3
answers
1k
views
Mistyped "google" and came to a suspicious page with a browser hijacker
I misspelt google as "googe" (very dumb, yes). It took me to a page that asked me to enter my birthdate. The URL was something along the lines of luj dott proasdf dott com
After going to ...
- 111
-1
votes
1
answer
61
views
Win10* OS-Shell Bluepill Attack likely [duplicate]
I'm running a seemingly normal Win10 system with updated drivers, both through standard Windows Updater and manual patching if a new driver is available.
The Dell logo flashes multiple times per boot.
...
0
votes
0
answers
249
views
How to isolate Windows10 Virtual machine from w10 host (virtualbox) for malware analysis [duplicate]
My goal is to find malware that performs network activities and captures the traffic with Wireshark. I have a Windows 10 laptop host machine and VirtualBox which has virtual Windows 10 machine.
I am ...
0
votes
2
answers
171
views
Someone accessed my phone application in Android 10 and dialled some codes to do some transactions while I was using the Tor browser [closed]
I was accessing some sites with the Tor browser. I got the URLs from some site and was hitting them one by one just to explore. Suddenly pages stopped responding but the internet was working fine. ...
- 103
0
votes
1
answer
411
views
Are there security risks to enabling 32-bit applications to run on Windows 10?
I'm installing an old game (32-bit) on my laptop (Windows 10 64-bit). This guide suggests enabling 32-bit applications to run with Internet Information Services (ISS), with the following steps:.
In ...
- 23
0
votes
1
answer
395
views
Do pdf files pose a higher security risk than regular image files (png, jpeg, etc.)?
Do pdf files pose a higher security risk than regular image files (png, jpeg, etc.)? In my understanding is that most image files don't carry any security risk because all exploits were fixed, but ...
- 111
1
vote
0
answers
433
views
A PDF ran GetAdaptersAddresses. Should I be concerned?
I received and opened a PDF that ran:
GetTickCount
IsDebuggerPresent
SetWindowsHookExW
Sleep
GetAdaptersAddresses
These are the 2 files it wrote:
C:\Windows\ServiceProfiles\LocalService\AppData\...
- 11
0
votes
2
answers
297
views
Bought a new Laptop. Can't reset. Is it Safe?
I recently bought a new laptop from a third-party seller on new egg. The seller states that it is "upgraded": "*We sell computers with upgraded configurations. If the computer has been ...
- 3
0
votes
0
answers
17
views
I ran an exe file on my computer [duplicate]
I downloaded a crack file today, Idk why I thought its safe to run, now my pc is infected.
I already used Tronscript, kaspersky and hitman
what else do you guys suggest me to do?
thanks in advance.
...
0
votes
1
answer
245
views
Can malicious binaries run from Program Files?
I've been seeing a few false positives from our AV Carbon Black pertaining to wordpad (wordpad.exe) use.
The alert I'd see is The application wordpad.exe injected code into another process. Upon doing ...
- 133
0
votes
1
answer
153
views
How can I prevent a C&C server from accessing my device?
Let's say I visited a malicious website and it downloaded malware that registered my phone to a C&C server
And after realizing what happened I uninstalled the malware from my device
Will my phone ...
1
vote
1
answer
810
views
Is it safe to view video files on Google Drive online?
I have a video file on my Drive which is very old but I am not sure whether it's infected or not. Is it safe to view this MP4 on Google Drive (no downloading only viewing it in the Drive app)?
- 11
2
votes
0
answers
118
views
Is "drag-drop files" computer backup sufficient to avoid most malware/ have all my files?
I'm debating dragging all my files onto an external hard drive manually - rather than a time machine backup - and then pulling over any specific files I need if I ever need them.
Afterwards, I'll ...
- 21
2
votes
1
answer
211
views
How to make sure my laptop (Ubuntu 20.04) is secure with a Windows 7 VM?
I have an old laptop which is running Ubuntu 20.04 and I am planning to use a virtual machine of Windows 7 Pro (using VirtualBox maybe). As its an old laptop and not my primary source of using the ...
- 23
0
votes
1
answer
621
views
What can happen when you click on a bad link? [duplicate]
I sleepily clicked on this bad link yesterday (DONT CLICK Unless you know what you're doing: https://6to.me/idsoni7kjv with a "?fbclid=" param - presumably identifying me)
I'm wondering how ...
- 1
0
votes
0
answers
271
views
False Positives for YARA rule
I've run a malware ruleset from the Yara rules repository run on my Sys32 directory
yara64.exe -f -r ./malware_index.yar C:\Windows\System32
and come across a lot of positives (+extra counts) for ...
- 41
1
vote
2
answers
306
views
What are the best steps to take to secure a LINUX PC from physical attack? Evil Maid, Boot Sector Malware?
What would be the best security practice to protect a device from physical attack? For instance an Evil Maid or boot sector malware?
For this question we are going to go with a UEFI boot debian linux ...
- 589
0
votes
0
answers
2k
views
crl.comodoca.com is a legit crl site, how can I determine it's legitimacy when bad actors are attempting to abuse uncertainty about the site
Yesterday I noted in my router logs that my wife's laptop accessed crl.comodoca.com. She was not using the machine at the time. A quick google search found three sites claiming this was an ...
