177
votes
Accepted
Help! My home PC has been infected by a virus! What do I do now?
What do I do now? How do I get rid of the virus?
The best option is what is referred to as "nuke it from orbit." The reference is from Aliens:
The idea behind this is that you wipe your ...
- 7,497
164
votes
Accepted
What is the safest way to deal with loads of incoming PDF files, some of which could potentially be malicious?
I think the safest option for you would be to use Qubes OS with its built in DisposableVMs functionality, and its “Convert to Trusted PDF” tool.
What is Qubes OS?
Qubes is an operating system where ...
143
votes
Accepted
Can Beehive detect a Snowden-like actor?
A backup operator will have the permission and behavioral markers of someone that moves lots of data around. Like any sysadmin where there's no dedicated backup operator in place.
Snowden was a ...
- 50.5k
69
votes
Accepted
How is it possible to embed executable code in an image
The answer is simple. That was not a photo. And .pif is not an image format. Count on NYTimes to provide correct technical info.
As the log on NYTimes's article says, and as FireEye's actual report ...
- 1,241
49
votes
Accepted
Can we trust antivirus software?
Maybe commercial or free anti-malware installs backdoors
Very true. Maybe they do.
However – there are a lot of technically experienced individuals who are in a position to check, either ...
- 61.4k
47
votes
Can a Trojan hide itself, so its activity doesn't appear in task manager process?
Yes. There are a number of ways:
Directly patch Task Manager's process at runtime so that its enumeration code skips over your process.
Run "processless", by loading a DLL into a process (e.g. via ...
- 132k
32
votes
Help! My home PC has been infected by a virus! What do I do now?
I'm sorry to hear you've got a computer virus. Fortunately, thousands of people deal with virus infections daily, and in most cases, the computer and all data can be restored. By following good online ...
- 32.7k
25
votes
Help! My home PC has been infected by a virus! What do I do now?
Honestly, "non-technical users" are typically unaware of the basic conceptual difference between a data "file" and an "application", nevermind the minefield of subtleties in the advanced war game ...
- 696
23
votes
Can Beehive detect a Snowden-like actor?
Anomaly detection systems like Beehive make it easier than before to dig through lots of data and detect suspicious behavior. This means that it is possible for an analyst to focus on the more ...
- 183k
21
votes
Can we trust antivirus software?
There is no more reason to expect that these software could put in a back door than any other software. Your Internet browser could put in a back door, your word processor could, your computer ...
- 41.8k
18
votes
What is the safest way to deal with loads of incoming PDF files, some of which could potentially be malicious?
Safest would probably be a burner device. Grab a cheap laptop, and a mobile internet dongle, use it to download the documents, and manually copy across any contents to your main computer (literally ...
- 27.2k
18
votes
Can Beehive detect a Snowden-like actor?
Snowden's intent was data exfiltration and he was also a system admin. So, he had access to large amounts of data normal users didn't and would have a different pattern of how he interacts with the ...
- 191
15
votes
Accepted
Could malware move during a scan to avoid detection?
The main reason malware can't evade AV this way is because the on-access scanner will catch that.
From the AV point of view, malware moving to different files is the same problem as new files being ...
- 9,797
15
votes
Help! My home PC has been infected by a virus! What do I do now?
I really don't have time to deal with this right now. Is it dangerous to keep using the computer while it is infected?
The very first thing you should do upon determining your machine is infected is ...
- 9,122
13
votes
Can we trust antivirus software?
You cannot trust anybody; but you have to... for instance, when you buy some food, you trust whoever produced it for not having put poison in it. It would be certainly feasible; yet it happens rarely ...
- 169k
12
votes
How is it possible to embed executable code in an image
Nothing is perfect, and a common kind of bug is a buffer overflow, where in short data gets copied where it shouldn't be, and in some cases this can lead to arbitrary code being executed.
For example ...
- 2,323
12
votes
What is the safest way to deal with loads of incoming PDF files, some of which could potentially be malicious?
So, I try to stick with these concerns in the "land of reasonable". With every security issue there is a balance of secure v.s. safe. For example, you could buy a laptop, read one PDF loaded from the ...
- 1,506
11
votes
Are antiviruses still useful?
Yes, there are also near infinitely many possible vulnerabilities and exploits on your system, but applying system updates is still advisable. Good security includes a concept called defense in depth....
- 41.8k
11
votes
Accepted
How can I kill minerd malware on an AWS EC2 instance?
I found the solution to removing minerd. I was lucky enough to find the actual script that was used to infect my server. All I had to do was remove the elements placed by this script -
On monkeyoto's ...
- 289
10
votes
Accepted
How does one properly check foreign USB Drives before getting them in your Network? Is the presented approach considered "safe"?
I would suggest going for the raspberry route. But instead of requiring administrators to perform the action, this could be constructed as a self-service station instead, of course locked with high ...
- 8,739
10
votes
Can Beehive detect a Snowden-like actor?
No it can't.
And the quote that you pulled clearly explained why not, and how people came to claim that it could.
What Beehive might be able to do is tell you that a Snowden-style attack has taken ...
- 227
9
votes
Accepted
Gaming Mods Security Risks
Mods certainly can be used as infection vectors. A lot of it comes down to a question of trust. A mod with tens of thousands of downloads and nobody suggesting they've had any problems is likely to be ...
- 1,168
9
votes
Why would I protect my computer?
Four threats to data:
distortion
destruction
disruption
disclosure
Sure, you can do a threat impact analysis and determine that the data on your computer is not worth the effort to protect it. That'...
- 123k
9
votes
Accepted
What is SpeedSurfing?
The Boomerang extension interacts with the Gmail website making lots of HTTP requests. That behaviour is usually associated with malicious extensions which attempt to exploit advertisement networks by ...
- 1,047
8
votes
Why Antiviruses does not check the library modules of exe to detect hook?
This is to avoid what is called a false positive, i.e. when the user receives an alert about a danger while there was actually no danger at all.
Do you remember this rich era when, while you were ...
- 19.1k
8
votes
Help! My home PC has been infected by a virus! What do I do now?
Do I really need to do a full reinstall? Can't I just run a couple of virus programs, delete some registry keys, and call it a day?
Unless you know a lot about malware and understand how the malware ...
- 7,072
8
votes
Accepted
How dangerous can a file be with no detected malware?
It is entirely possible for a file that is not detected by any scanner to still be malware. In fact, I would expect that most new malware starts out that way! Keep in mind that the bad guys have ...
- 10.2k
7
votes
Can we trust antivirus software?
I have seen one instance where the virus actually installed itself in the AV's virus-signature folder. Since the AV did not scan it's own virus signatures (this would only raise false-positives), the ...
- 523
7
votes
How is it possible to embed executable code in an image
Mints97's answer is great, but I think there may be more to it than that. An especially wonderful (read: terrible) problem with Windows is that it supports complete Unicode character set in filenames, ...
- 171
Only top scored, non community-wiki answers of a minimum length are eligible