172
What do I do now? How do I get rid of the virus?
The best option is what is referred to as "nuke it from orbit." The reference is from Aliens:
The idea behind this is that you wipe your hard drive and reinstall your OS. Before you do this, you should make sure you have the following:
A way to boot your computer off installation media. This can be in the ...
165
I think the safest option for you would be to use Qubes OS with its built in DisposableVMs functionality, and its “Convert to Trusted PDF” tool.
What is Qubes OS?
Qubes is an operating system where it's all based on virtual machines. You can think of it as if you had different isolated ‘computers’ inside yours. So that way you can compartmentalize your ...
143
A backup operator will have the permission and behavioral markers of someone that moves lots of data around. Like any sysadmin where there's no dedicated backup operator in place.
Snowden was a sysadmin. He would knew all the protection protocols in place. He could just impersonate anyone, from any area, download things, impersonate the next one, and keep ...
66
The answer is simple. That was not a photo. And .pif is not an image format. Count on NYTimes to provide correct technical info.
As the log on NYTimes's article says, and as FireEye's actual report confirms, the file used was a .pif file. It's one of the less known of Windows's executable file extensions.
.pif is legacy from MS-DOS, like .com. It's ...
54
Most anti-virus vendors advise not to use their products together with those from others. That's not (just) because they fear competition. Live virus-scanners scan files on access. When they notice that a process accesses a file, they try to access it before the process to scan it. They even try to do that when that process is another virus-scanner.
When ...
49
Maybe commercial or free anti-malware installs backdoors
Very true. Maybe they do.
However – there are a lot of technically experienced individuals who are in a position to check, either through monitoring unexpected connections outbound, or through reviewing the code, so we can have reasonable assurance that they don't.
But think about the ...
47
Antivirus detection is a feature extraction and a classification problem.
A great analogy is the 20 questions game where the goal is to identify an arbitrary object by asking 20 seemingly unrelated yes/no questions. The idea behind the game is that each answer would eliminate half of the objects so it is theoretically possible to describe 2^20 (1,048,576) ...
47
Yes. There are a number of ways:
Directly patch Task Manager's process at runtime so that its enumeration code skips over your process.
Run "processless", by loading a DLL into a process (e.g. via AppInit_DLLs) or injecting code into process memory and starting a thread (via VirtualAllocEx / WriteProcessMemory / CreateRemoteThread).
Hook the Process32First /...
36
I would advise against it.
In order to perform its job, an antivirus software has to root itself very deeply inside the system, hooking everything, installing drivers and you-name-it. In order to do so, it ends up using techniques similar to malware authors, which will be flagged as highly suspicious by other products. Even if it's not the case, it is ...
30
I'm sorry to hear you've got a computer virus. Fortunately, thousands of people deal with virus infections daily, and in most cases, the computer and all data can be restored. By following good online practice you can avoid future infections.
There are two main approaches for removing a virus:
Use anti-virus software to perform a "deep scan and clean".
...
27
Regarding JavaScript:
In Internet Explorer and some very old browsers, it's possible to inject JavaScript into stylesheets. Several ways to do this are described in the XSS Filter Evasion Cheat Sheet. The three major issues are:
background-image and similiar: background-image: url('javascript:alert(/XSS/);')
JavaScript expression: width: expression(alert(/...
24
A "rootkit" normally tries real hard not to be detected. However, it cannot, in theory, be completely undetectable, since the point of the rootkit is to maintain an entry path for the attacker, so at least the attacker can know whether the root kit is in place or not.
A lot of methods have been used in the past. For instance, some rootkits install ...
23
Honestly, "non-technical users" are typically unaware of the basic conceptual difference between a data "file" and an "application", nevermind the minefield of subtleties in the advanced war game between malware and anti-malware experts. The only sane answer is...
Don't panic.
Switch off the PC immediately and disconnect ALL cables and removable batteries. ...
22
Anomaly detection systems like Beehive make it easier than before to dig through lots of data and detect suspicious behavior. This means that it is possible for an analyst to focus on the more relevant data, process more data in shorter time and also use more detailed input data for the analysis. This way the chance is higher than before that somebody can ...
21
There is no more reason to expect that these software could put in a back door than any other software. Your Internet browser could put in a back door, your word processor could, your computer hardware itself could. Fundamentally, you have to source your software and hardware from vendors you trust and you trust them based on either their reputation or the ...
20
No, anti-malware packages will not detect every form of keylogger. They will detect known ones by hashing, and some may detect certain keylogger-like behaviour via heuristic analysis.
However, I strongly advise you against this. First off, it's insulting to your employees. If I found out my employer was doing such a thing, I'd resign on the spot. Secondly, ...
18
It's an affiliate thing. Adobe get paid to promote McAfee's anti-malware software. You have nothing to worry about in terms of security, it's just a marketing trick to get you to buy an AV.
18
Malware signatures are unique values that indicate the presence of malicious code.
Simply speaking, When an anti-virus program scans your computer, it calculates the signature for a file (say like a hash), then compares that signature/hash to a list of known bad signatures.
Calculating a single hash of a file and then comparing it against a list of millions ...
18
Safest would probably be a burner device. Grab a cheap laptop, and a mobile internet dongle, use it to download the documents, and manually copy across any contents to your main computer (literally retyping would be safest, if you're particularly worried). Since it's not on your network, it shouldn't be able to cause problems even if it got infected, and you'...
17
I've already answered this question a few times here. Have a look at this answer in particular:
Virus scanner on server
And in particular this part:
The concept of a virus implies a user at an interactive session. Someone opening email in Outlook or documents in Word, or running programs they received in an email. A virus implies a human element. Servers ...
17
Snowden's intent was data exfiltration and he was also a system admin. So, he had access to large amounts of data normal users didn't and would have a different pattern of how he interacts with the network. If Beehive was in place, it may have logged that he was doing something but anyone who has an intent of data exfiltration would've known how to bypass ...
15
The main reason malware can't evade AV this way is because the on-access scanner will catch that.
From the AV point of view, malware moving to different files is the same problem as new files being created during the scan. A very simple solution is for the AV to keep track of new files being created (which includes current files being renamed). This is done ...
15
I really don't have time to deal with this right now. Is it dangerous to keep using the computer while it is infected?
The very first thing you should do upon determining your machine is infected is isolate it. This means you must completely disconnect it from the internet and your local network, and disconnect any peripheral devices with the exception of ...
13
Hooks are implemented in a whole bunch of ways:
Modifying legitimate jump instructions to point at hooks instead of the normal code.
User call table (IAT) hooking - modifying the addresses of user-mode APIs in a process.
Kernel call table hooking (e.g. SSDT / GDT ) - replacing a call table pointer with the address of your hook.
WndProc hooks (e.g. ...
13
Yes. It can infect you nonetheless.
Using a non-administrative account only keeps malware from spreading to other users in the system, and it's a good practice regardless of everything else.
But aside from that, The malware can do everything your user is allowed to do, because it is a program like every other: it could create and modify files, open sockets,...
13
You cannot trust anybody; but you have to... for instance, when you buy some food, you trust whoever produced it for not having put poison in it. It would be certainly feasible; yet it happens rarely enough that you accept that risk, especially since the alternatives have their own costs and risks (hunting wild animals, foraging for berries, growing potatoes ...
12
Nothing is perfect, and a common kind of bug is a buffer overflow, where in short data gets copied where it shouldn't be, and in some cases this can lead to arbitrary code being executed.
For example here is a bug in old Microsoft versions in which if you viewed a certain image with IE than arbitrary code could be executed.
Note that this is very ...
12
So, I try to stick with these concerns in the "land of reasonable". With every security issue there is a balance of secure v.s. safe. For example, you could buy a laptop, read one PDF loaded from the web mail side of your email provider, re type any content you need on a "main computer" then destroy the laptop starting all over again with a new laptop. That ...
Only top voted, non community-wiki answers of a minimum length are eligible
