Skip to main content
OverflowAI is here! AI power for your Stack Overflow for Teams knowledge community. Learn more
177 votes
Accepted

Help! My home PC has been infected by a virus! What do I do now?

What do I do now? How do I get rid of the virus? The best option is what is referred to as "nuke it from orbit." The reference is from Aliens: The idea behind this is that you wipe your ...
CaffeineAddiction's user avatar
162 votes
Accepted

What is the safest way to deal with loads of incoming PDF files, some of which could potentially be malicious?

I think the safest option for you would be to use Qubes OS with its built in DisposableVMs functionality, and its “Convert to Trusted PDF” tool. What is Qubes OS? Qubes is an operating system where ...
142 votes
Accepted

Can Beehive detect a Snowden-like actor?

A backup operator will have the permission and behavioral markers of someone that moves lots of data around. Like any sysadmin where there's no dedicated backup operator in place. Snowden was a ...
ThoriumBR's user avatar
  • 54.4k
32 votes

Help! My home PC has been infected by a virus! What do I do now?

I'm sorry to hear you've got a computer virus. Fortunately, thousands of people deal with virus infections daily, and in most cases, the computer and all data can be restored. By following good online ...
paj28's user avatar
  • 33.4k
29 votes

Zero-day prevention. Is there a Windows program that encrypts files on-the-fly, keeping only the currently open file decrypted?

First things first: Asking for software recommendations is off topic for this site and you should instead use the Software Recommendations site. I'm going to mostly talk about why what you're asking ...
CBHacking's user avatar
  • 48.9k
25 votes

Help! My home PC has been infected by a virus! What do I do now?

Honestly, "non-technical users" are typically unaware of the basic conceptual difference between a data "file" and an "application", nevermind the minefield of subtleties in the advanced war game ...
John McNamara's user avatar
23 votes

Can Beehive detect a Snowden-like actor?

Anomaly detection systems like Beehive make it easier than before to dig through lots of data and detect suspicious behavior. This means that it is possible for an analyst to focus on the more ...
Steffen Ullrich's user avatar
18 votes

What is the safest way to deal with loads of incoming PDF files, some of which could potentially be malicious?

Safest would probably be a burner device. Grab a cheap laptop, and a mobile internet dongle, use it to download the documents, and manually copy across any contents to your main computer (literally ...
Matthew's user avatar
  • 27.3k
18 votes

Can Beehive detect a Snowden-like actor?

Snowden's intent was data exfiltration and he was also a system admin. So, he had access to large amounts of data normal users didn't and would have a different pattern of how he interacts with the ...
RG1's user avatar
  • 191
15 votes

Help! My home PC has been infected by a virus! What do I do now?

I really don't have time to deal with this right now. Is it dangerous to keep using the computer while it is infected? The very first thing you should do upon determining your machine is infected is ...
TTT's user avatar
  • 9,222
15 votes

Zero-day prevention. Is there a Windows program that encrypts files on-the-fly, keeping only the currently open file decrypted?

The most reasonable thing to do here would be to leverage filesystem access controls by running Visual Studio under a separate user account. I'd: Create a new Windows user account, eg code. Lock down ...
josh3736's user avatar
  • 2,565
13 votes

What is the safest way to deal with loads of incoming PDF files, some of which could potentially be malicious?

So, I try to stick with these concerns in the "land of reasonable". With every security issue there is a balance of secure v.s. safe. For example, you could buy a laptop, read one PDF loaded from the ...
coteyr's user avatar
  • 1,556
11 votes
Accepted

How can I kill minerd malware on an AWS EC2 instance?

I found the solution to removing minerd. I was lucky enough to find the actual script that was used to infect my server. All I had to do was remove the elements placed by this script - On monkeyoto's ...
Anish Sana's user avatar
10 votes
Accepted

How does one properly check foreign USB Drives before getting them in your Network? Is the presented approach considered "safe"?

I would suggest going for the raspberry route. But instead of requiring administrators to perform the action, this could be constructed as a self-service station instead, of course locked with high ...
sebastian nielsen's user avatar
9 votes

Why would I protect my computer?

Four threats to data: distortion destruction disruption disclosure Sure, you can do a threat impact analysis and determine that the data on your computer is not worth the effort to protect it. That'...
schroeder's user avatar
  • 130k
9 votes
Accepted

What is SpeedSurfing?

The Boomerang extension interacts with the Gmail website making lots of HTTP requests. That behaviour is usually associated with malicious extensions which attempt to exploit advertisement networks by ...
Enos D'Andrea's user avatar
9 votes

Can Beehive detect a Snowden-like actor?

No it can't. And the quote that you pulled clearly explained why not, and how people came to claim that it could. What Beehive might be able to do is tell you that a Snowden-style attack has taken ...
Hobbamok's user avatar
  • 215
8 votes

Help! My home PC has been infected by a virus! What do I do now?

Do I really need to do a full reinstall? Can't I just run a couple of virus programs, delete some registry keys, and call it a day? Unless you know a lot about malware and understand how the malware ...
Julian Knight's user avatar
8 votes
Accepted

How dangerous can a file be with no detected malware?

It is entirely possible for a file that is not detected by any scanner to still be malware. In fact, I would expect that most new malware starts out that way! Keep in mind that the bad guys have ...
tlng05's user avatar
  • 10.4k
7 votes

How can I kill minerd malware on an AWS EC2 instance?

Your first goal is (if you don't want to reinstall) is to determine how it managed to get there in the first place. If the attacker was crafty, they'd of run "timestomp" to modify the dates of ...
munkeyoto's user avatar
  • 8,692
7 votes

What is the safest way to deal with loads of incoming PDF files, some of which could potentially be malicious?

Using CubeOS and disposable VMs is a good approach. Some other options (which can be combined with the CubeOS/DisVM one) : Disarm the PDF You can use ghostscript for that : gs -dNOPAUSE -dBATCH -...
jfs's user avatar
  • 71
6 votes

Is virus removal a security risk comparing to reinstalling everything from a clean source?

Right, when you're dealing with devious malware, it's very hard to determine whether you've completely removed it. Rootkits are pieces of malware that change core OS components (either on disk or in ...
Ben N's user avatar
  • 2,501
6 votes
Accepted

Do Transient, Volatile Servers Require Antivirus Scanners?

You are asking yourselves the right questions but asking us the wrong one. Security controls, like AV, are meant to address threats in order to reduce the impact to an acceptable level. You have ...
schroeder's user avatar
  • 130k
6 votes

Do Transient, Volatile Servers Require Antivirus Scanners?

I would not run antivirus on my servers, for a couple reasons: They are massive pieces of software The whole idea of a server is to execute one task, and only one, in the fastest way possible. There ...
ThoriumBR's user avatar
  • 54.4k
6 votes

Can Beehive detect a Snowden-like actor?

First of all, there is a very important distinction between being able to detect a "Snowden-like" actor and being able to prevent one. As far as I have seen, Beehive makes no claims about preventing ...
Cliff AB's user avatar
  • 241
6 votes
Accepted

How do AV scanners in VirusTotal check if a file is malicious or not and how trustworthy is its report?

ad 1: It does upload your file, but only if the hash is not known. As the very first thing, a piece of Javascript will calculate a cryptographic hash (SHA-256 if I recall correctly, but might be wrong)...
Damon's user avatar
  • 5,221
5 votes

How can I kill minerd malware on an AWS EC2 instance?

The problem is that the minerd is probably the payload of some (other) malware, so you can't really tell what else has been compromised on the system. Possibly there isn't anything else resident on ...
Douglas Leeder's user avatar
5 votes
Accepted

Affected by Marlboro Ransomware (".oops" extension) - Which decryptor to use to decrypt the files?

You can use the decrypter available here: https://decrypter.emsisoft.com/marlboro I am the author of said tool. Yes, I did see the answer above. However, I can't comment because of lack of ...
Fabian Wosar's user avatar
5 votes
Accepted

Examples of non signature based anti-malware/anti-virus programs, IDS, & system integrity scanners

While I will answer your questions to the best of my abilities, please realize that any of the tools listed here require moderate to heavy configuration and a good understanding of systems security. ...
forest's user avatar
  • 66.8k
5 votes

Is there a way to download the Firefox Phishing and Malware Protection list?

The phishing and malware protection in Firefox is provided with Google Safe Browsing service. This is not a list you can download. It is instead a database with an SDK on top of it which provides an ...
Steffen Ullrich's user avatar

Only top scored, non community-wiki answers of a minimum length are eligible