178
votes
Accepted
Help! My home PC has been infected by a virus! What do I do now?
What do I do now? How do I get rid of the virus?
The best option is what is referred to as "nuke it from orbit." The reference is from Aliens:
The idea behind this is that you wipe your ...
- 7,912
162
votes
Accepted
What is the safest way to deal with loads of incoming PDF files, some of which could potentially be malicious?
I think the safest option for you would be to use Qubes OS with its built in DisposableVMs functionality, and its “Convert to Trusted PDF” tool.
What is Qubes OS?
Qubes is an operating system where ...
142
votes
Accepted
Can Beehive detect a Snowden-like actor?
A backup operator will have the permission and behavioral markers of someone that moves lots of data around. Like any sysadmin where there's no dedicated backup operator in place.
Snowden was a ...
- 55.1k
32
votes
Help! My home PC has been infected by a virus! What do I do now?
I'm sorry to hear you've got a computer virus. Fortunately, thousands of people deal with virus infections daily, and in most cases, the computer and all data can be restored. By following good online ...
- 34.6k
29
votes
Zero-day prevention. Is there a Windows program that encrypts files on-the-fly, keeping only the currently open file decrypted?
First things first: Asking for software recommendations is off topic for this site and you should instead use the Software Recommendations site. I'm going to mostly talk about why what you're asking ...
- 50.3k
25
votes
Help! My home PC has been infected by a virus! What do I do now?
Honestly, "non-technical users" are typically unaware of the basic conceptual difference between a data "file" and an "application", nevermind the minefield of subtleties in the advanced war game ...
- 696
23
votes
Can Beehive detect a Snowden-like actor?
Anomaly detection systems like Beehive make it easier than before to dig through lots of data and detect suspicious behavior. This means that it is possible for an analyst to focus on the more ...
- 205k
18
votes
What is the safest way to deal with loads of incoming PDF files, some of which could potentially be malicious?
Safest would probably be a burner device. Grab a cheap laptop, and a mobile internet dongle, use it to download the documents, and manually copy across any contents to your main computer (literally ...
- 27.4k
18
votes
Can Beehive detect a Snowden-like actor?
Snowden's intent was data exfiltration and he was also a system admin. So, he had access to large amounts of data normal users didn't and would have a different pattern of how he interacts with the ...
- 191
15
votes
Help! My home PC has been infected by a virus! What do I do now?
I really don't have time to deal with this right now. Is it dangerous to keep using the computer while it is infected?
The very first thing you should do upon determining your machine is infected is ...
- 9,232
15
votes
Zero-day prevention. Is there a Windows program that encrypts files on-the-fly, keeping only the currently open file decrypted?
The most reasonable thing to do here would be to leverage filesystem access controls by running Visual Studio under a separate user account.
I'd:
Create a new Windows user account, eg code.
Lock down ...
- 2,575
13
votes
What is the safest way to deal with loads of incoming PDF files, some of which could potentially be malicious?
So, I try to stick with these concerns in the "land of reasonable". With every security issue there is a balance of secure v.s. safe. For example, you could buy a laptop, read one PDF loaded from the ...
- 1,556
11
votes
Accepted
How can I kill minerd malware on an AWS EC2 instance?
I found the solution to removing minerd. I was lucky enough to find the actual script that was used to infect my server. All I had to do was remove the elements placed by this script -
On monkeyoto's ...
- 289
10
votes
Accepted
How does one properly check foreign USB Drives before getting them in your Network? Is the presented approach considered "safe"?
I would suggest going for the raspberry route. But instead of requiring administrators to perform the action, this could be constructed as a self-service station instead, of course locked with high ...
- 8,994
9
votes
Why would I protect my computer?
Four threats to data:
distortion
destruction
disruption
disclosure
Sure, you can do a threat impact analysis and determine that the data on your computer is not worth the effort to protect it. That'...
- 132k
9
votes
Accepted
What is SpeedSurfing?
The Boomerang extension interacts with the Gmail website making lots of HTTP requests. That behaviour is usually associated with malicious extensions which attempt to exploit advertisement networks by ...
- 1,107
9
votes
Can Beehive detect a Snowden-like actor?
No it can't.
And the quote that you pulled clearly explained why not, and how people came to claim that it could.
What Beehive might be able to do is tell you that a Snowden-style attack has taken ...
- 215
8
votes
Help! My home PC has been infected by a virus! What do I do now?
Do I really need to do a full reinstall? Can't I just run a couple of virus programs, delete some registry keys, and call it a day?
Unless you know a lot about malware and understand how the malware ...
- 7,142
8
votes
Accepted
How dangerous can a file be with no detected malware?
It is entirely possible for a file that is not detected by any scanner to still be malware. In fact, I would expect that most new malware starts out that way! Keep in mind that the bad guys have ...
- 10.4k
7
votes
How can I kill minerd malware on an AWS EC2 instance?
Your first goal is (if you don't want to reinstall) is to determine how it managed to get there in the first place. If the attacker was crafty, they'd of run "timestomp" to modify the dates of ...
- 8,692
7
votes
What is the safest way to deal with loads of incoming PDF files, some of which could potentially be malicious?
Using CubeOS and disposable VMs is a good approach.
Some other options (which can be combined with the CubeOS/DisVM one) :
Disarm the PDF
You can use ghostscript for that :
gs -dNOPAUSE -dBATCH -...
- 71
6
votes
Accepted
Do Transient, Volatile Servers Require Antivirus Scanners?
You are asking yourselves the right questions but asking us the wrong one.
Security controls, like AV, are meant to address threats in order to reduce the impact to an acceptable level. You have ...
- 132k
6
votes
Do Transient, Volatile Servers Require Antivirus Scanners?
I would not run antivirus on my servers, for a couple reasons:
They are massive pieces of software
The whole idea of a server is to execute one task, and only one, in the fastest way possible. There ...
- 55.1k
6
votes
Can Beehive detect a Snowden-like actor?
First of all, there is a very important distinction between being able to detect a "Snowden-like" actor and being able to prevent one. As far as I have seen, Beehive makes no claims about preventing ...
- 241
6
votes
Accepted
How do AV scanners in VirusTotal check if a file is malicious or not and how trustworthy is its report?
ad 1: It does upload your file, but only if the hash is not known. As the very first thing, a piece of Javascript will calculate a cryptographic hash (SHA-256 if I recall correctly, but might be wrong)...
- 5,221
5
votes
How can I kill minerd malware on an AWS EC2 instance?
The problem is that the minerd is probably the payload of some (other) malware, so you can't really tell what else has been compromised on the system. Possibly there isn't anything else resident on ...
- 1,994
5
votes
Accepted
Affected by Marlboro Ransomware (".oops" extension) - Which decryptor to use to decrypt the files?
You can use the decrypter available here:
https://decrypter.emsisoft.com/marlboro
I am the author of said tool. Yes, I did see the answer above. However, I can't comment because of lack of ...
- 66
5
votes
Accepted
Examples of non signature based anti-malware/anti-virus programs, IDS, & system integrity scanners
While I will answer your questions to the best of my abilities, please realize that any of the tools listed here require moderate to heavy configuration and a good understanding of systems security. ...
- 67.1k
5
votes
Is there a way to download the Firefox Phishing and Malware Protection list?
The phishing and malware protection in Firefox is provided with Google Safe Browsing service. This is not a list you can download.
It is instead a database with an SDK on top of it which provides an ...
- 205k
5
votes
How does the Emotet malware work?
This one is pretty advanced.
Infection method: malicious script, macro-enabled document files, or malicious link.
Cloaking: familiar branding designed to look like a legitimate e-mail.
Persuade ...
- 8,909
Only top scored, non community-wiki answers of a minimum length are eligible