177 votes
Accepted

Help! My home PC has been infected by a virus! What do I do now?

What do I do now? How do I get rid of the virus? The best option is what is referred to as "nuke it from orbit." The reference is from Aliens: The idea behind this is that you wipe your ...
user avatar
164 votes
Accepted

What is the safest way to deal with loads of incoming PDF files, some of which could potentially be malicious?

I think the safest option for you would be to use Qubes OS with its built in DisposableVMs functionality, and its “Convert to Trusted PDF” tool. What is Qubes OS? Qubes is an operating system where ...
143 votes
Accepted

Can Beehive detect a Snowden-like actor?

A backup operator will have the permission and behavioral markers of someone that moves lots of data around. Like any sysadmin where there's no dedicated backup operator in place. Snowden was a ...
user avatar
  • 50.5k
69 votes
Accepted

How is it possible to embed executable code in an image

The answer is simple. That was not a photo. And .pif is not an image format. Count on NYTimes to provide correct technical info. As the log on NYTimes's article says, and as FireEye's actual report ...
user avatar
  • 1,241
49 votes
Accepted

Can we trust antivirus software?

Maybe commercial or free anti-malware installs backdoors Very true. Maybe they do. However – there are a lot of technically experienced individuals who are in a position to check, either ...
user avatar
  • 61.4k
47 votes

Can a Trojan hide itself, so its activity doesn't appear in task manager process?

Yes. There are a number of ways: Directly patch Task Manager's process at runtime so that its enumeration code skips over your process. Run "processless", by loading a DLL into a process (e.g. via ...
user avatar
  • 132k
32 votes

Help! My home PC has been infected by a virus! What do I do now?

I'm sorry to hear you've got a computer virus. Fortunately, thousands of people deal with virus infections daily, and in most cases, the computer and all data can be restored. By following good online ...
user avatar
  • 32.7k
25 votes

Help! My home PC has been infected by a virus! What do I do now?

Honestly, "non-technical users" are typically unaware of the basic conceptual difference between a data "file" and an "application", nevermind the minefield of subtleties in the advanced war game ...
user avatar
23 votes

Can Beehive detect a Snowden-like actor?

Anomaly detection systems like Beehive make it easier than before to dig through lots of data and detect suspicious behavior. This means that it is possible for an analyst to focus on the more ...
user avatar
21 votes

Can we trust antivirus software?

There is no more reason to expect that these software could put in a back door than any other software. Your Internet browser could put in a back door, your word processor could, your computer ...
user avatar
  • 41.8k
18 votes

What is the safest way to deal with loads of incoming PDF files, some of which could potentially be malicious?

Safest would probably be a burner device. Grab a cheap laptop, and a mobile internet dongle, use it to download the documents, and manually copy across any contents to your main computer (literally ...
user avatar
  • 27.2k
18 votes

Can Beehive detect a Snowden-like actor?

Snowden's intent was data exfiltration and he was also a system admin. So, he had access to large amounts of data normal users didn't and would have a different pattern of how he interacts with the ...
user avatar
  • 191
15 votes
Accepted

Could malware move during a scan to avoid detection?

The main reason malware can't evade AV this way is because the on-access scanner will catch that. From the AV point of view, malware moving to different files is the same problem as new files being ...
user avatar
15 votes

Help! My home PC has been infected by a virus! What do I do now?

I really don't have time to deal with this right now. Is it dangerous to keep using the computer while it is infected? The very first thing you should do upon determining your machine is infected is ...
user avatar
  • 9,122
13 votes

Can we trust antivirus software?

You cannot trust anybody; but you have to... for instance, when you buy some food, you trust whoever produced it for not having put poison in it. It would be certainly feasible; yet it happens rarely ...
user avatar
  • 169k
12 votes

How is it possible to embed executable code in an image

Nothing is perfect, and a common kind of bug is a buffer overflow, where in short data gets copied where it shouldn't be, and in some cases this can lead to arbitrary code being executed. For example ...
user avatar
  • 2,323
12 votes

What is the safest way to deal with loads of incoming PDF files, some of which could potentially be malicious?

So, I try to stick with these concerns in the "land of reasonable". With every security issue there is a balance of secure v.s. safe. For example, you could buy a laptop, read one PDF loaded from the ...
user avatar
  • 1,506
11 votes

Are antiviruses still useful?

Yes, there are also near infinitely many possible vulnerabilities and exploits on your system, but applying system updates is still advisable. Good security includes a concept called defense in depth....
user avatar
  • 41.8k
11 votes
Accepted

How can I kill minerd malware on an AWS EC2 instance?

I found the solution to removing minerd. I was lucky enough to find the actual script that was used to infect my server. All I had to do was remove the elements placed by this script - On monkeyoto's ...
user avatar
10 votes
Accepted

How does one properly check foreign USB Drives before getting them in your Network? Is the presented approach considered "safe"?

I would suggest going for the raspberry route. But instead of requiring administrators to perform the action, this could be constructed as a self-service station instead, of course locked with high ...
user avatar
10 votes

Can Beehive detect a Snowden-like actor?

No it can't. And the quote that you pulled clearly explained why not, and how people came to claim that it could. What Beehive might be able to do is tell you that a Snowden-style attack has taken ...
user avatar
  • 227
9 votes
Accepted

Gaming Mods Security Risks

Mods certainly can be used as infection vectors. A lot of it comes down to a question of trust. A mod with tens of thousands of downloads and nobody suggesting they've had any problems is likely to be ...
user avatar
  • 1,168
9 votes

Why would I protect my computer?

Four threats to data: distortion destruction disruption disclosure Sure, you can do a threat impact analysis and determine that the data on your computer is not worth the effort to protect it. That'...
user avatar
  • 123k
9 votes
Accepted

What is SpeedSurfing?

The Boomerang extension interacts with the Gmail website making lots of HTTP requests. That behaviour is usually associated with malicious extensions which attempt to exploit advertisement networks by ...
user avatar
8 votes

Why Antiviruses does not check the library modules of exe to detect hook?

This is to avoid what is called a false positive, i.e. when the user receives an alert about a danger while there was actually no danger at all. Do you remember this rich era when, while you were ...
user avatar
8 votes

Help! My home PC has been infected by a virus! What do I do now?

Do I really need to do a full reinstall? Can't I just run a couple of virus programs, delete some registry keys, and call it a day? Unless you know a lot about malware and understand how the malware ...
user avatar
8 votes
Accepted

How dangerous can a file be with no detected malware?

It is entirely possible for a file that is not detected by any scanner to still be malware. In fact, I would expect that most new malware starts out that way! Keep in mind that the bad guys have ...
user avatar
  • 10.2k
7 votes

Can we trust antivirus software?

I have seen one instance where the virus actually installed itself in the AV's virus-signature folder. Since the AV did not scan it's own virus signatures (this would only raise false-positives), the ...
user avatar
7 votes

How is it possible to embed executable code in an image

Mints97's answer is great, but I think there may be more to it than that. An especially wonderful (read: terrible) problem with Windows is that it supports complete Unicode character set in filenames, ...
user avatar

Only top scored, non community-wiki answers of a minimum length are eligible