18
You need to check the exact description of the malware that was detected, because antivirus software nowadays doesn't just detect "viruses", but may also warn you about other kinds of software, like adware and riskware. If you look closely at the descriptions in your scan, you will notice, for example:
Clyance: Unsafe. They don't tell you it's a virus, ...
16
Yes, under certain conditions.
If you have previously connected to a "hidden" wireless network, your NIC may continuously broadcast their BSSID's in hopes of connecting to them. It's the only way to "automatically" connect to a hidden network, because there is otherwise no way for the card to know when it is in range to a known hidden network.
This looks ...
5
Interpreting output like this when you are not a technical expert can be difficult, especially when you get 13/70 engines reporting malicious behavior.
With uncertainty like this you can look at a few factors:
the quality of the companies running the engine
the type of behavior
the community votes
the risk you feel comfortable with
In this case, you have ...
5
Sometimes engines will flag programs as viruses if the program or some part of the program is used in the payload of an actual virus. For example, programs made by PyInstaller are plagued by false positives due to viruses using it, even though the programs themselves are clean.
In your case, we can even see what might have caused this. If you go to the ...
3
The answer to your question is listed in the Wikipedia article and dictionary definition. Yes, most people associate a Nation State with an ethnicity, but if it is used in a general sense it is just a large group of like minded individuals:
Wikipedia:
In a more general sense, a nation state is simply a large, politically sovereign country or ...
3
To answer the sidenote, a hacker could make a rogue access point or "evil twin" access point. This would not replace the known network, but it will pretend to be the known network by using the same SSID and BSSID as it.
If the network is unsecured (i.e its a free public WiFi hotspot), any device that comes along with the connection details will connect to ...
3
Lots of right answers but none of them seems both clear and complete to me.
You need scheduled full anti-malware scans for the following reasons:
Seemingly innocuous executable files may hide payloads in seemingly innocuous file types
At the time of the infections the anti-virus definitions might not have included the necessary signatures. Real-time ...
2
Your definitions explain why:
...Whenever you access, copy, save, move, open or close a file...
And what of processes that create files on their own? I could write a Powershell script that will not get picked up by AV, because it is not malicious, but it can write a malicious file. If I can get a non-user process to trigger this, then you have malware ...
2
It would be a security vulnerability, yes.
Executing javascript code in the context of a web page allows that code more or less full access to the content of the page, in this case Google Drive. Such code could leak content, and ask for information such as passwords.
This is generally referred to as Cross site scripting or XSS in shorthand.
The specific ...
2
As Anthony Russell wrote in the answer to that other question you referenced:
Always use TLS and if you can, connect to a VPN whenever you're on a public wifi. Make sure that you don't have any unnecessary services running on your machine that are open to the network. Honestly, you probably shouldn't have any ports open. Any openings are potential access ...
1
From the + and / you can tell this is Base64 per RFC 4648, 4:
Characters ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/
Padding =, == or nothing in the end.
Then there is:
Binary 01
Decimal 0123456789
Base16 a.k.a. hexadecimal: 0123456789ABCDEF (case insensitive) RFC 4648, 8
Base32:
RFC 4648, 6: A-Z, 2-7: ...
1
So, this looks bad, obviously. What I want to know is how can I stop these attacks? Blocking javascript sounds like a good start, the original post also suggested to check my device for open ports (they did not demonstrate how to shut them though). What else? Is there a fool-proof way to prevent these sort of (virus injection? remote control?) attacks?
A ...
1
It makes no sense to distinguish WiFi networks. If you are connected to any network that you don't fully control, you should not trust it.
If the site uses HTTPS, then of course no injection of JavaScript, ActiveX etc. is possible. But on the other hand, it is not necessary that an attacker in particular WiFi is trying to inject anything. Even if you use ...
1
It depends on what stage of the boot loading or fresh new installation point you are on in the BIOS. From what I am reading, it seems you are only at the "reboot and select proper boot devices" screen. This is typically a BIOS screen that is part of the BIOS which is typically located in the small boot partition or a BIOS flash chip. The BIOS on many ...
1
Usually there is not much information send/requested only by clicking onto the network, even in case you sucessfully connect to that network it will need time to scan your system and use any know vulnerabilities to infect your system. If your system is out of date or has any services that are out of date then you can be worried, but in your case there is ...
1
You do not have to worry, because you didn't send anything to the router that was part of the WiFi network you accidentally clicked on.
When any computer, regardless if it is a Mac, Windows, Linux, System V, ect., scans for available WiFi networks, it in fact is not scanning or communicating. In fact it is just waiting for what is called "Beacon Signal", ...
1
From your description of a full scan a reason why it is better, is if a file or executable on your computer that is malicious was downloaded from the internet, but bypassed the Auto-protect at the time. This is possible if the type of virus was was not known at the time the file was downloaded, (this type of scenario is called a "Zero Day" scenario).
...
1
Sandboxing doesn’t require much in the way of additional RAM or disk space, and is fairly easy to set up and use. But sandboxes are less secure then VMs.
In Virtualbox, virtual machines can be resource hungry. But they are “just as if it were a separate physical machine”, but for some malware you need to have anti-VM capabilities.
But I prefer not to have ...
1
Typically (and perhaps just personally) I don't perform full scans on schedule or any other method unless I notice actual symptoms or suspicious system activity/behavior. On the other hand, some may disagree with this - I would have been among them 10-15 years ago - therefore, if its believed to be a necessity, I suggest a monthly full/schedule scan.
...
1
It is extremely common for Anti Virus software to continuously update their scanning rules/parameters to allow the software to cast a wider net and detect the latest varieties of malware.
Usually, this update works hand-in-hand with the scheduled-full scan. Before a full scan happens, the software will check for updates then proceed to do the scan.
'Auto-...
1
This question is too broad and too naive for this forum.
If anyone that knows a phone number can hack into that phone, then we would have giant botnets. Think about it:
for phone = 0 to 99999999
send malicious sms to 06-phone
(06 is the Dutch prefix for mobile phones, if you're wondering.)
So, most malicious SMS messages will involve some form of ...
1
... have a remote network based firewall capable of application level filtering (e.g. block all outgoing traffic from test.exe).
The phrase "application level filtering" is usually used with a different meaning than yours, i.e. filtering on the application protocol level (web, mail, ...) and not on the level of a specific application program.
The exact ...
1
Depending on the circumstances, nature & capabilities of the virus/malware.
The very fact that a USB drive is writable and does contain memory space makes it susceptible to being infected.
However, infecting a new host with a different OS (in your case, MACOS) is also another set of risks. Certain viruses/malware are created to cater to certain ...
1
As already mentioned in the comments, there several missing details about this scenario:
Is it usual/unusual that endpoints in your network communicate with IP addresses located in Russia?
Which OS are the endpoints based-on?
Which proccess is running as PID 4?
...
However, based on the information already provided, there are three facts I would focus on:
...
1
No, Defender is digitally signed. You can check the image by opening its properties in Explorer and check it manually. I found that it is a bug, but Microsoft hasn't fixed it yet.
1
What are the techniques to detect malware call home/beaconing
activities?
As we discussed in the comments sir, following are the broad known ways to hide malware network communications followed by ways to detect them. I have generalized some info because I am no expert in malware analysis. Hopefully below information serves help.
0> Direct IP ...
Only top voted, non community-wiki answers of a minimum length are eligible
