Questions tagged [malware-detection]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
0 votes
0 answers
153 views

What is the meaning of the MTB suffix according to Microsoft malware naming scheme?

Microsoft uses the CARO naming scheme for malware identification. The suffix part (name's right-most part after the ! separator) is supposed to be dedicated to "vendor-specific" comments [1]....
tumasgiu's user avatar
  • 101
0 votes
0 answers
129 views

If a .gz file was downloaded can it demage my computer or steal data?

I was unaware that I was on a data phishing landing page (it was very clever, I haven't seen anything like this before) and I downloaded a .gz file. After that it started to become suspicius so I ...
Bálint Forgács's user avatar
0 votes
3 answers
193 views

How can I test a old SSD disk in my home?

I need to access my old SSD to recover some archives and personal data. The drive didn't work well so I decided to replace it with a new one. I don't know what was wrong with it or if it was infected ...
Michel Le Trompetistte's user avatar
0 votes
1 answer
804 views

Suspicious script meddling with /usr/bin/open

I'm on macOS Ventura 13.2.1 (22D68). I run a script in my computer and the outcome was pretty much as described in this post. So some files were installed to the /tmp/ folder, and the Opera browser ...
aaragon's user avatar
  • 103
0 votes
0 answers
102 views

RunDLL and Regsvr32 Exploits - how to mitigate or stop? [duplicate]

I have installed Malwarebytes and Spyhunter 5 and run full scans and yet Malwarebytes still shows blocked calls to nefarious domains and IPs via regsvr32 and rundll32. Is there a way to find the ...
Jay Croghan's user avatar
0 votes
1 answer
108 views

Windows virus removed .exe while allowed

Windows 10 virus & threat removed a .exe file it thought was malware even though it was previously allowed. When windows security found the .exe file it said it was a threat. I hit "allow&...
Jeffro's user avatar
  • 11
1 vote
0 answers
43 views

Virus Total report lists 48 different types of malware in a file, are they all the same?

I bought a code scanner for my car on Amazon and it came with a USB key with the drivers, etc. Windows Defender identified malware on it and appears to have cleaned it up from my Windows 11 PC. I ...
Eric's user avatar
  • 1,243
4 votes
2 answers
6k views

What is this Firefox hidden add-on: "Add-ons Search Detection ([email protected])"?

In Firefox 95.0.1 task manager, I see the following item: "Add-ons Search Detection ([email protected])" with full permissions to all browsing and private tabs. What is ...
Ryan Griggs's user avatar
0 votes
2 answers
84 views

My PC has slowed down unexpectedly

I am worried that my PC might be infected with malware. I am getting a lot of notifications that taskhost and svchost tried accessing some specific folder but are blocked. I have also read that ...
Suryanshu Dinkar's user avatar
0 votes
1 answer
2k views

Why isn't VirusTotal detecting a zip file that contains malware? [closed]

Summary 1. On www.virustotal.com, I have just used its "Scan a URL" feature to see if it detects malware within zip files. I found a test zip file containing malware (I believe), at https://...
dave99's user avatar
  • 1
0 votes
1 answer
57 views

In context to executable compression, are compression softwares like 7ZIP/Winzip considered as executable packers?

A packer is a tool that compresses an executable file and combine the compressed data with decompression code into a single executable. They are also used to obfuscate malwares. As per my ...
Monk's user avatar
  • 123
2 votes
0 answers
51 views

How to find who — or what — exactly opened ad page?

Recently I noticed that sometimes in my Chrome somewhat opens new tabs with ads. It comes with a random interval (0-1-2-3 times in a day). It comes if I'm browsing or wathcing a video on youtube in ...
Alwx's user avatar
  • 21
3 votes
2 answers
3k views

How can I detect what causes Chrome to open a tab for "http://eaes.2track.info/" each time I search something in the address bar?

How can I detect what causes Chrome to open a tab for "http://eaes.2track.info/" each time I search something in the address bar? Interestingly this only happens for the first few searches I do after ...
Franck Dernoncourt's user avatar
0 votes
0 answers
10 views

Chrome opening links after prefixing with another domain [duplicate]

So, I was browsing through Chrome for something around three days ago in Google, and when I clicked a search result, noticed a weird think happening in the URL bar. Generally, clicking a link shown in ...
user avatar
0 votes
0 answers
157 views

Can Virus infected USB drive spread while booting Windows

I want to know that, if I connected computer malware infected USB drive to a Window laptop, while its booting, that malware can spread on that PC? (without opening USB drive via file manager). This ...
Chathu's user avatar
  • 1
0 votes
0 answers
83 views

Can't discover the source of virus. Faulty dll is causing many windows pop up

Attached here some samples of faulty bug report windows which pop up occasionally. Nvidia Container: Problem signature: Problem Event Name: BEX64 Application Name: nvcontainer.exe Application ...
Alex Zubkov's user avatar
-1 votes
1 answer
601 views

pestudio no longer uploading signatures to VirusTotal

For years, I've used pestudio to check executables for malware, and recent versions of pestudio have included the ability to upload a file signature to VirusTotal (VT). However, for the past few weeks,...
DrMoishe Pippik's user avatar
1 vote
2 answers
1k views

Strange requests from localhost in Apache access logs causing server to crash

I recently setup a Ubuntu 18 testing server on a cloud VPS host and installed the latest Wordpress. Today I went to log in and the site will not load - I get an error Error establishing a database ...
Jim's user avatar
  • 121
1 vote
0 answers
16 views

How to investigate why Windows game is cutting off Wifi to everything?

One member of the household downloaded a game through Windows Apps. Whenever they play the game, all other devices connected to the Wifi router cannot use the Wifi. They show an active connection, but ...
Village's user avatar
  • 149
1 vote
2 answers
116 views

How do I find which extension is modifying my website?

So, I noticed some other posts related to this (such as Full-page ads randomly pop up in Chrome ("Sponsored by")); however, since I have an extension that is only injecting an ad once in ...
Shnor W.'s user avatar
  • 101
1 vote
2 answers
526 views

Unknown Process sustse/kworkerds running on servers

We have noticed Unknown Process sustse/kworkerds running on CoreOS servers this was identified as Cripto malware, Followed below article but not helpfull, killed process and deleted the file in temp,...
ashok's user avatar
  • 11
1 vote
0 answers
5k views

How to investigate and remove Trojan:EC2/DGADomainRequest.B

My GuardDuty management console on Amazon shows that my server is infected with malware: "EC2 instance i-7e1d4356 is querying algorithmically generated domains. Such domains are commonly used by ...
Vijai Pandey's user avatar
1 vote
2 answers
6k views

Virus scanning a compressed file before vs after extracting

If I download a compressed file (i.e. a zip file, etc), does it make a difference if I: a) virus scan it as is vs. b) virus scan after extracting it? What are the differences/considerations if I ...
kite's user avatar
  • 187
2 votes
0 answers
894 views

Windows Defender reports Fuerboos.C!cl threat inconsistently

I'm not sure of the appropriate forum for this question since it kind of sits between programming and general computer use, but I'll try here because it has nothing to do with code yet. I've been ...
BlueMonkMN's user avatar
0 votes
0 answers
217 views

Extensions (Chrome etc.) sending browsing data, is it theoretically possible to prevent that?

Chrome's chrome://extensions/ say "Warning: Google Chrome cannot prevent extensions from recording your browsing history" when enabling the [x] Allow in incognito. It seems to imply that uploading the ...
Jim Hoyle's user avatar
  • 189
0 votes
1 answer
335 views

I updated Chrome through brew cask and getting suspicious behavior

I have updated my Google Chrome to version 59.0.3071.115 by using: brew cask reinstall google-chrome and now when I start chrome, it opens two tabs with these URLs: http://www.prosoftwarepc.com/...
RocketNuts's user avatar
  • 1,082
2 votes
1 answer
733 views

Hundreds of thousands of folders in Windows 10 user temp folder

I noticed last week it took a while to open a group of PDFs on my computer. I had a look in %userprofile%\appdata\local\temp and I found well over 800,000 folders. I had to delete them with a for loop ...
user38537's user avatar
  • 209
0 votes
1 answer
732 views

Spontaneously appearing and disappearing command line windows in Windows 10 [duplicate]

I run Windows 10 (Version 1607, Build 14393.969) with up-to-dated Bitdefender Total Security 2017 and MalwareBytes Anti-Malware Home (Premium). There is no pirated software installed on the computer. ...
yurnero's user avatar
  • 251
-1 votes
1 answer
567 views

Google searches in Internet Explorer redirects to cse.google.com

In Internet Explorer under Windows 10 Pro, Google searches suddenly redirects to cse.google.com. This wasn't happening previously, and this problem does not occur with Firefox. Google searches with ...
RHPT's user avatar
  • 1,292
-1 votes
1 answer
118 views

A malware in Mozilla, An URL opens automatically? [duplicate]

Some times when I open a site in Mozilla, a URL that starts with vadabzauefrpph4xraz8ewblhsbsbxkfq7sx8d9me4nuemgnx2yt5cnyfzzlxek.com will replace with the site's URL, What should I do to solve this ...
biprinea's user avatar
5 votes
0 answers
2k views

Is this a ransomware?

I just got this window on my main computer: Apparently, it's from Windows. I checked, and the process EXE file is the original one (efsui.exe or something like that). However, I don't use EFS (I ...
zdimension's user avatar
  • 13.1k
1 vote
0 answers
315 views

Preventing ransomware attacks by detecting suspicious levels of file system activity

Assume a Windows 8/10 home/small office system with 3-4 users and a few TB of file share (say 6TB in a suitable RAID). Most files are static, but sometimes files get moved round or modified. But if ...
Stilez's user avatar
  • 1,685
4 votes
0 answers
432 views

How to protect Linux from Ransomware by detecting mass changes?

I wonder if it would be possible to stop running ransomware on a Linux system by detecting mass changes on files. Can watchdog or entr or inotifywait be used to detect bulk file changes and stop what ...
Ralf Hersel's user avatar
1 vote
2 answers
216 views

Is my anti-malware setup consistent with "best practices"?

A few days ago, my PC was acting weird and froze sometimes. I did full scans using Avast! Free Antivirus and Malwarebytes Anti-Malware since I assumed it was a virus causing these, but both software ...
user avatar
13 votes
1 answer
5k views

uTorrent - adware / malware on download and install - Mac OSX Yosemite

I recently downloaded uTorrent (for the more ethically concerned: to get a wikipedia data dump as the official download server kept terminating my download, not to rip off copyright holders...), and ...
Jake_Howard's user avatar
0 votes
1 answer
183 views

How can I see what changes malware made to a virtual machine?

I want to know if I can open a virtual machine (VMware , Virtual Box ...) and (for example) install windows 7 + some programs (chrome,Word,antivirus....) and then save the current stat (i don't have ...
Khalil Bz's user avatar
  • 203
0 votes
0 answers
41 views

How to prevent sotware installation in Windows10 w/o asking machine password

Recently I upgraded to Windows10 and my brother did some downloading of books which brought some malwares too like mystarsearch engine, AnyProtect etc... Even after un-installing from Contol Panel it ...
Jaikrat's user avatar
  • 101
0 votes
1 answer
19k views

Why my website giving "The site ahead contains harmful programs" error? [closed]

My site is: hints.steptoinstall.com. It's build using Wordpress. My lastest Post is: PHP – Current Year for Copyright, after making this post for the last 5 days I'm getting The site ahead contains ...
KarSho's user avatar
  • 137
0 votes
0 answers
833 views

how to detect and eliminate suspicious activity on the computer

I have a particularly weird problem on my Windows 7 desktop pc running on an Intel CPU with a Gigabyte motherboard and CorsAir smps. Here are a few observations which might be connected to the bigger ...
user9623's user avatar
  • 153
0 votes
0 answers
807 views

How does one know a DLL is actually safe to use?

I've downloaded a certain DLL from the web and then uploaded it to Jotti's virus scan. All of those engines reported Found nothing. Nothing. Can there still be some sort of security issue with this ...
Robert Koritnik's user avatar
0 votes
1 answer
218 views

Random audio ads [duplicate]

Audio ads appear at random and last for around 5-10 seconds before turning off. I've run spy-bot on my entire system and still ads appear. No recent program installations are appearing either. Any ...
Alan's user avatar
  • 1
0 votes
1 answer
359 views

Why does this program give a Windows 8 SmartScreen warning?

Why does this program http://creativeadept.com/download-spintax-editor/ give me a SmartScreen warning in Windows 8 when a Malwarebytes scan and Windows Defender scan found nothing? What is wrong ...
Chloe's user avatar
  • 5,946
7 votes
2 answers
4k views

csrss.exe anomalies, is this a rootkit?

I'm seeing a strange anomaly in some systems I support. GMER flags the cdd.dll thread in csrss.exe, and when I run Process Explorer with Elevated Admin rights, I am: unable to view any loaded DLLs ...
Craig Cummings's user avatar
0 votes
1 answer
2k views

Catching malware and demonstrate it through windows logs

I need to catch a virus/malware on purpose on a VM and demonstrate the infection through windows logs analysis. I am using both syslog and eventlog analyzer, but no sign of events logged. I caught on ...
David Torreggiani's user avatar
-2 votes
1 answer
59 views

Post-Infection Analysis of Suspected Keylogger

I've recently downloaded and ran a file, which I now suspect might be a keylogger. I am wondering how can I tell if this file is a keylogger? I can provide a link to the file if anyone would be able ...
Newbie's user avatar
  • 1
0 votes
0 answers
94 views

4GB temporary system files showing up on desktop for no understandable reason

There are 4GB temporary system files called "BITEA#.tmp" e.g. BITEA5.tmp showing up on my Desktop folder just this last week. Does anyone know if this may be caused by malware recording screen or ...
chrips's user avatar
  • 264
0 votes
1 answer
1k views

How do I scan Firefox on Ubuntu Linux for malicious JavaScripts?

I run Ubuntu Linux in a VirtualBox VM. I was browsing using Firefox, and I always use Adblock Plus with default configuration (EasyList) and NoScript. Then my VM lagged(mouse badly out of sync with ...
user1258361's user avatar
0 votes
1 answer
48 views

How to determine if / ensure that a second-hand storage device is safe to use?

I am going to buy a SSD from someone who works in the same company, but even so is a complete stranger to me. Maybe I am a little paranoid, but is there a way to check if it is safe to use? Or is ...
print x div 0's user avatar
8 votes
4 answers
33k views

How can you find out if xlsx and docx files are safe to open?

I have received an email from a not entirely trustworthy source, it might be legit but I'm not really sure. It contains, among other things, information on a .docx Microsoft Word file and a .xlsx ...
fightermagethief's user avatar
0 votes
0 answers
2k views

Security Essentials (SE) hangs while scanning ProgramData folder

First I did a complete scan on C:\ and kept getting (after about 1.5M files scanned, which is at the end of the C:\ProgramData folder or the beginning of the C:\Recovery folder) Then, after scanning ...
Wuschelbeutel Kartoffelhuhn's user avatar