177
votes
Accepted
Help! My home PC has been infected by a virus! What do I do now?
What do I do now? How do I get rid of the virus?
The best option is what is referred to as "nuke it from orbit." The reference is from Aliens:
The idea behind this is that you wipe your ...
- 7,617
164
votes
Accepted
What is the safest way to deal with loads of incoming PDF files, some of which could potentially be malicious?
I think the safest option for you would be to use Qubes OS with its built in DisposableVMs functionality, and its “Convert to Trusted PDF” tool.
What is Qubes OS?
Qubes is an operating system where ...
143
votes
Accepted
Can Beehive detect a Snowden-like actor?
A backup operator will have the permission and behavioral markers of someone that moves lots of data around. Like any sysadmin where there's no dedicated backup operator in place.
Snowden was a ...
- 52.8k
32
votes
Help! My home PC has been infected by a virus! What do I do now?
I'm sorry to hear you've got a computer virus. Fortunately, thousands of people deal with virus infections daily, and in most cases, the computer and all data can be restored. By following good online ...
- 33.1k
25
votes
Help! My home PC has been infected by a virus! What do I do now?
Honestly, "non-technical users" are typically unaware of the basic conceptual difference between a data "file" and an "application", nevermind the minefield of subtleties in the advanced war game ...
- 696
23
votes
Can Beehive detect a Snowden-like actor?
Anomaly detection systems like Beehive make it easier than before to dig through lots of data and detect suspicious behavior. This means that it is possible for an analyst to focus on the more ...
- 196k
18
votes
What is the safest way to deal with loads of incoming PDF files, some of which could potentially be malicious?
Safest would probably be a burner device. Grab a cheap laptop, and a mobile internet dongle, use it to download the documents, and manually copy across any contents to your main computer (literally ...
- 27.3k
18
votes
Can Beehive detect a Snowden-like actor?
Snowden's intent was data exfiltration and he was also a system admin. So, he had access to large amounts of data normal users didn't and would have a different pattern of how he interacts with the ...
- 191
15
votes
Accepted
Could malware move during a scan to avoid detection?
The main reason malware can't evade AV this way is because the on-access scanner will catch that.
From the AV point of view, malware moving to different files is the same problem as new files being ...
- 9,837
15
votes
Help! My home PC has been infected by a virus! What do I do now?
I really don't have time to deal with this right now. Is it dangerous to keep using the computer while it is infected?
The very first thing you should do upon determining your machine is infected is ...
- 9,182
13
votes
What is the safest way to deal with loads of incoming PDF files, some of which could potentially be malicious?
So, I try to stick with these concerns in the "land of reasonable". With every security issue there is a balance of secure v.s. safe. For example, you could buy a laptop, read one PDF loaded from the ...
- 1,546
11
votes
Accepted
How can I kill minerd malware on an AWS EC2 instance?
I found the solution to removing minerd. I was lucky enough to find the actual script that was used to infect my server. All I had to do was remove the elements placed by this script -
On monkeyoto's ...
- 289
10
votes
Accepted
How does one properly check foreign USB Drives before getting them in your Network? Is the presented approach considered "safe"?
I would suggest going for the raspberry route. But instead of requiring administrators to perform the action, this could be constructed as a self-service station instead, of course locked with high ...
- 8,874
10
votes
Can Beehive detect a Snowden-like actor?
No it can't.
And the quote that you pulled clearly explained why not, and how people came to claim that it could.
What Beehive might be able to do is tell you that a Snowden-style attack has taken ...
- 225
9
votes
Why would I protect my computer?
Four threats to data:
distortion
destruction
disruption
disclosure
Sure, you can do a threat impact analysis and determine that the data on your computer is not worth the effort to protect it. That'...
- 127k
9
votes
Accepted
What is SpeedSurfing?
The Boomerang extension interacts with the Gmail website making lots of HTTP requests. That behaviour is usually associated with malicious extensions which attempt to exploit advertisement networks by ...
- 1,087
8
votes
Why Antiviruses does not check the library modules of exe to detect hook?
This is to avoid what is called a false positive, i.e. when the user receives an alert about a danger while there was actually no danger at all.
Do you remember this rich era when, while you were ...
- 19.2k
8
votes
Help! My home PC has been infected by a virus! What do I do now?
Do I really need to do a full reinstall? Can't I just run a couple of virus programs, delete some registry keys, and call it a day?
Unless you know a lot about malware and understand how the malware ...
- 7,122
8
votes
Accepted
How dangerous can a file be with no detected malware?
It is entirely possible for a file that is not detected by any scanner to still be malware. In fact, I would expect that most new malware starts out that way! Keep in mind that the bad guys have ...
- 10.4k
7
votes
How can I kill minerd malware on an AWS EC2 instance?
Your first goal is (if you don't want to reinstall) is to determine how it managed to get there in the first place. If the attacker was crafty, they'd of run "timestomp" to modify the dates of ...
- 8,682
7
votes
What is the safest way to deal with loads of incoming PDF files, some of which could potentially be malicious?
Using CubeOS and disposable VMs is a good approach.
Some other options (which can be combined with the CubeOS/DisVM one) :
Disarm the PDF
You can use ghostscript for that :
gs -dNOPAUSE -dBATCH -...
- 71
6
votes
Host based code injection defense vs anti virus?
This is based on information found here 1, 2
Bee Master is a research project that describes a mechanism for determining if a host-based code injection attack has occurred. It does this by running "...
- 14.8k
6
votes
Is virus removal a security risk comparing to reinstalling everything from a clean source?
Right, when you're dealing with devious malware, it's very hard to determine whether you've completely removed it.
Rootkits are pieces of malware that change core OS components (either on disk or in ...
- 2,501
6
votes
Accepted
Do Transient, Volatile Servers Require Antivirus Scanners?
You are asking yourselves the right questions but asking us the wrong one.
Security controls, like AV, are meant to address threats in order to reduce the impact to an acceptable level. You have ...
- 127k
6
votes
Do Transient, Volatile Servers Require Antivirus Scanners?
I would not run antivirus on my servers, for a couple reasons:
They are massive pieces of software
The whole idea of a server is to execute one task, and only one, in the fastest way possible. There ...
- 52.8k
6
votes
Can Beehive detect a Snowden-like actor?
First of all, there is a very important distinction between being able to detect a "Snowden-like" actor and being able to prevent one. As far as I have seen, Beehive makes no claims about preventing ...
- 241
6
votes
Accepted
How do AV scanners in VirusTotal check if a file is malicious or not and how trustworthy is its report?
ad 1: It does upload your file, but only if the hash is not known. As the very first thing, a piece of Javascript will calculate a cryptographic hash (SHA-256 if I recall correctly, but might be wrong)...
- 5,201
5
votes
Are there any known cases where antivirus software has deliberately ignored malware?
I think the best and most common example of this is software that has malware (specifically spyware/adware) like practices but operates as a "legitimate" business (particularly if they can get this ...
- 1,144
5
votes
Accepted
Is there a name for an anti-virus station / kiosk?
A "sheep dip" station is one term - from the practice of dipping sheep in cleansing fluids before letting them near the rest of the flock.
- 27.3k
Only top scored, non community-wiki answers of a minimum length are eligible