Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange
Make your voice heard. Take the 2019 Developer Survey now

Questions tagged [malware-detection]

The tag has no usage guidance.

0
votes
0answers
16 views

Suricata Oinkcode rule modification

I have an IDS network at work and I have setup in suricata variables file (vars.yaml): $HOME_NET network: internal server and workstation subnets $EXTERNAL_NET network: everything not defined as $...
1
vote
0answers
718 views

Windows Defender reports Fuerboos.C!cl threat inconsistently

I'm not sure of the appropriate forum for this question since it kind of sits between programming and general computer use, but I'll try here because it has nothing to do with code yet. I've been ...
0
votes
0answers
92 views

Extensions (Chrome etc.) sending browsing data, is it theoretically possible to prevent that?

Chrome's chrome://extensions/ say "Warning: Google Chrome cannot prevent extensions from recording your browsing history" when enabling the [x] Allow in incognito. It seems to imply that uploading the ...
0
votes
1answer
170 views

I updated Chrome through brew cask and getting suspicious behavior

I have updated my Google Chrome to version 59.0.3071.115 by using: brew cask reinstall google-chrome and now when I start chrome, it opens two tabs with these URLs: http://www.prosoftwarepc.com/...
-1
votes
1answer
104 views

Where to look for Addonjet infection on Chrome/Windows 10?

I have the following symptom of Addonjet infection showing up randomly on my Windows 10 system: However, I search for ways of eliminating it and the solutions proposed make no sense. I find nothing ...
3
votes
1answer
229 views

Hundreds of thousands of folders in Windows 10 user temp folder

I noticed last week it took a while to open a group of PDFs on my computer. I had a look in %userprofile%\appdata\local\temp and I found well over 800,000 folders. I had to delete them with a for loop ...
0
votes
1answer
398 views

Spontaneously appearing and disappearing command line windows in Windows 10 [duplicate]

I run Windows 10 (Version 1607, Build 14393.969) with up-to-dated Bitdefender Total Security 2017 and MalwareBytes Anti-Malware Home (Premium). There is no pirated software installed on the computer. ...
-1
votes
1answer
408 views

Google searches in Internet Explorer redirects to cse.google.com

In Internet Explorer under Windows 10 Pro, Google searches suddenly redirects to cse.google.com. This wasn't happening previously, and this problem does not occur with Firefox. Google searches with ...
0
votes
0answers
47 views

File analysis for potential malware in a fresh VM?

If I wanted to find out if a file is truly a virus, and not just a false positive, I'd imagine I would need to run the file in a fresh windows VM and track all changes made to the entire OS post-...
0
votes
1answer
87 views

A malware in Mozilla, An URL opens automatically? [duplicate]

Some times when I open a site in Mozilla, a URL that starts with vadabzauefrpph4xraz8ewblhsbsbxkfq7sx8d9me4nuemgnx2yt5cnyfzzlxek.com will replace with the site's URL, What should I do to solve this ...
4
votes
0answers
814 views

Is this a ransomware?

I just got this window on my main computer: Apparently, it's from Windows. I checked, and the process EXE file is the original one (efsui.exe or something like that). However, I don't use EFS (I ...
1
vote
0answers
268 views

Preventing ransomware attacks by detecting suspicious levels of file system activity

Assume a Windows 8/10 home/small office system with 3-4 users and a few TB of file share (say 6TB in a suitable RAID). Most files are static, but sometimes files get moved round or modified. But if ...
4
votes
0answers
311 views

How to protect Linux from Ransomware by detecting mass changes?

I wonder if it would be possible to stop running ransomware on a Linux system by detecting mass changes on files. Can watchdog or entr or inotifywait be used to detect bulk file changes and stop what ...
0
votes
0answers
67 views

Unable to send email error message in Yahoo webmail client: suspicious of fraud

When I was trying to send an email using Yahoo webmail client opened in Chrome, I kept getting a small rectangular box with a red border containing the error message "Unable to send email" beneath the ...
1
vote
2answers
122 views

Is my anti-malware setup consistent with “best practices”?

A few days ago, my PC was acting weird and froze sometimes. I did full scans using Avast! Free Antivirus and Malwarebytes Anti-Malware since I assumed it was a virus causing these, but both software ...
13
votes
1answer
5k views

uTorrent - adware / malware on download and install - Mac OSX Yosemite

I recently downloaded uTorrent (for the more ethically concerned: to get a wikipedia data dump as the official download server kept terminating my download, not to rip off copyright holders...), and ...
0
votes
1answer
84 views

How can I see what changes malware made to a virtual machine?

I want to know if I can open a virtual machine (VMware , Virtual Box ...) and (for example) install windows 7 + some programs (chrome,Word,antivirus....) and then save the current stat (i don't have ...
0
votes
0answers
37 views

How to prevent sotware installation in Windows10 w/o asking machine password

Recently I upgraded to Windows10 and my brother did some downloading of books which brought some malwares too like mystarsearch engine, AnyProtect etc... Even after un-installing from Contol Panel it ...
0
votes
1answer
17k views

Why my website giving “The site ahead contains harmful programs” error? [closed]

My site is: hints.steptoinstall.com. It's build using Wordpress. My lastest Post is: PHP – Current Year for Copyright, after making this post for the last 5 days I'm getting The site ahead contains ...
0
votes
0answers
480 views

how to detect and eliminate suspicious activity on the computer

I have a particularly weird problem on my Windows 7 desktop pc running on an Intel CPU with a Gigabyte motherboard and CorsAir smps. Here are a few observations which might be connected to the bigger ...
0
votes
0answers
201 views

How does one know a DLL is actually safe to use?

I've downloaded a certain DLL from the web and then uploaded it to Jotti's virus scan. All of those engines reported Found nothing. Nothing. Can there still be some sort of security issue with this ...
0
votes
1answer
210 views

Random audio ads [duplicate]

Audio ads appear at random and last for around 5-10 seconds before turning off. I've run spy-bot on my entire system and still ads appear. No recent program installations are appearing either. Any ...
0
votes
1answer
314 views

Why does this program give a Windows 8 SmartScreen warning?

Why does this program http://creativeadept.com/download-spintax-editor/ give me a SmartScreen warning in Windows 8 when a Malwarebytes scan and Windows Defender scan found nothing? What is wrong ...
7
votes
2answers
3k views

csrss.exe anomalies, is this a rootkit?

I'm seeing a strange anomaly in some systems I support. GMER flags the cdd.dll thread in csrss.exe, and when I run Process Explorer with Elevated Admin rights, I am: unable to view any loaded DLLs ...
0
votes
1answer
390 views

Catching malware and demonstrate it through windows logs

I need to catch a virus/malware on purpose on a VM and demonstrate the infection through windows logs analysis. I am using both syslog and eventlog analyzer, but no sign of events logged. I caught on ...
-2
votes
1answer
54 views

Post-Infection Analysis of Suspected Keylogger

I've recently downloaded and ran a file, which I now suspect might be a keylogger. I am wondering how can I tell if this file is a keylogger? I can provide a link to the file if anyone would be able ...
0
votes
0answers
80 views

4GB temporary system files showing up on desktop for no understandable reason

There are 4GB temporary system files called "BITEA#.tmp" e.g. BITEA5.tmp showing up on my Desktop folder just this last week. Does anyone know if this may be caused by malware recording screen or ...
0
votes
1answer
755 views

How do I scan Firefox on Ubuntu Linux for malicious JavaScripts?

I run Ubuntu Linux in a VirtualBox VM. I was browsing using Firefox, and I always use Adblock Plus with default configuration (EasyList) and NoScript. Then my VM lagged(mouse badly out of sync with ...
0
votes
1answer
43 views

How to determine if / ensure that a second-hand storage device is safe to use?

I am going to buy a SSD from someone who works in the same company, but even so is a complete stranger to me. Maybe I am a little paranoid, but is there a way to check if it is safe to use? Or is ...
6
votes
4answers
17k views

How can you find out if xlsx and docx files are safe to open?

I have received an email from a not entirely trustworthy source, it might be legit but I'm not really sure. It contains, among other things, information on a .docx Microsoft Word file and a .xlsx ...
0
votes
0answers
1k views

Security Essentials (SE) hangs while scanning ProgramData folder

First I did a complete scan on C:\ and kept getting (after about 1.5M files scanned, which is at the end of the C:\ProgramData folder or the beginning of the C:\Recovery folder) Then, after scanning ...
1
vote
0answers
1k views

Detect and remove malicious malware chrome extension that opens many tabs with ads

I observed throughout the day yesterday three episodes where my processor gets hijacked for a minute and the memory gets maxed out (12 gigs). The culprit was a seemingly infinite number of tabs being ...
0
votes
1answer
150 views

How to detect unwanted Firefox add-ons?

I have a Firefox add-on that seems to inject ads on the top of the pages when I'm using search engines. For example, for a search on hard drive on Google.com, I have this banner on top: You may ...
2
votes
4answers
10k views

How can I remove http://p.chango.com/static/c.js from my site?

I found some code injected somehow on my site. It links to <script src="http://p.chango.com/static/c.js. How can I get rid of it? Is this coming from my browser? Mind you, I see it in different ...
0
votes
4answers
6k views

High memory usage on Windows 7 unable to open browser

I switched on my laptop at 9 o’clock this morning and it is now 14:00 hours, where in after a series of reboots, hard or soft, I am able to open my browser. I opened a notepad and noted down ...
2
votes
1answer
2k views

Prevent Browser Search Hijack

What is the best way to prevent my browser's default search being hijacked? Also, what is the quickest/easiest way to clean up this sort of hijack? I just had to clean off all the browsers on my ...
1
vote
2answers
4k views

Monitor windows startup process

My win7 starts up pretty slow lately. I think it's some kind of malware, but my antivirus software doesn't pick up anything. How could i monitor the startup processes myself? It seems to me like ...
6
votes
2answers
3k views

What's the difference between traditional and heuristic virus scanning?

I just got off the phone with one of the major AV companies as to why a lesser known AV caught a virus that theirs didn't. The details of that delima are not important. What caught my attention ...
3
votes
2answers
34k views

what does it mean for MalwareBytes to find malicious registry keys but nothing else?

I have a machine that is obviously infected, and when I ran MalwareBytes it told me that it found some "malicious" registry keys (surprisingly enough these contained file path to currently non-...
2
votes
3answers
1k views

Should I disable my realtime virus protection while running a different malware scanner?

I use Microsoft Security Essentials for my virus protection but I also run scheduled scans with Malwarebytes and Spybot Search & Destroy. Should I disable the MSE realtime scanner when these other ...
3
votes
1answer
411 views

How to catch a malware process on my Mac?

Situation: 1st occurrence: without reason a new draft in mail opened up with non-sense text in the body, no TO,CC or subject 2nd and reoccurring every day around 2 PM: bing search with non-sense text ...
2
votes
1answer
95 views

Any information about the AsyncMapLite Trojan?

I recently noticed "something" hijacking Google search results (on Firefox!) and so I decided to run a scan by Malwarebytes. Sure enough, it found a Trojan.Agent with the following information: ...
0
votes
5answers
3k views

Impossible new virus [duplicate]

Possible Duplicate: What to do if my computer is infected by a virus or a malware? I have been hit by an absolutely impossible new virus. Only in the past 3 months or so the internet has become ...
0
votes
1answer
37 views

Strange localization problem

I spent several months in a foreign country (Ukraine). Now, many websites that I visit (at least the ones that support it) default to Russian. I'm worried that I might have some type of malware on ...
1
vote
2answers
1k views

Anti virus integration for Thunderbird?

Basic, newbie question: I am preparing to do a new system installation of Windows, and would like to setup Thunderbird for email. Since I am beginning with a clean slate, how should I setup my ...
1
vote
5answers
8k views

Safely view websites that may be harmful

I posted a car on Craigslist the other day and since then I've been getting nothing but scam emails that contain links the people want me to click. I know not to clink the links and that it's a scam, ...
4
votes
3answers
1k views

How do I properly check if a program is a virus/trojan in VMware?

How I should check if a program is a virus in VMware? Some programs I do need admin ability to install and it makes sense. But how do I know if it's doing more than I want? Some thoughts are: How ...
10
votes
5answers
197 views

How can I make my OS appear as if it is running virtualized?

A lot of malware these days is able to detect when it is running virtualized under VMWare, VirtualPC, WINE, or even in a sandbox such as Anubis or CWSandBox. This essentially means that malware will ...