14

I've seen several questions from people whom I'd generally not describe as "Information Security Professionals" which asked if their personal device is infected by malware.

Are these questions categorically off-topic? I my gut-feeling is Yes, because:

  • It's in most cases impossible to definitely say "Yes, you are infected" or "No, you are not infected" unless it's extremely obvious.
  • It's extremely unlikely that the question would benefit anyone but the person who originally asked the question.
  • If these questions would be on-topic, Security.SE would become a tech support website and not "a question and answer site for information security professionals" as defined by the scope of the website.

Please note that I am not talking about general questions in regards to malware infections, such as "Is an Anti-Virus sufficient protection against malware?", but about questions regarding to a specific system.

  • Note that "No, you are not infected" is never extremely obvious. The particular symptom they point to may be normal, but they could still be infected and be missing the red flag. Since all we can see is what they tell us, we can never say for absolute sure that they are not infected. – NH. Apr 21 '19 at 2:29
  • 1
    @NH. True, but I was more refering to something like "My mouse isn't working. Am I infected? Edit:// Turns out my battery just died." – MechMK1 Apr 21 '19 at 17:58
14

The problem with these questions is the narrow scope. The answer really only benefits the asker.

We have 2 canonical questions for home PCs and Servers that we usually use to close new questions as a duplicate of:

Help! My home PC has been infected by a virus! What do I do now?

How do I deal with a compromised server?

But we are also seeing a lot of just purely worded questions or questions that appear to be fueled more by paranoia ("my ex is stalking me!1!!") than by a genuine troubleshooting perspective. We tend to just close those questions.

  • 3
    None of those two questions are duplicates of questions asking if a home PC is infected. First one assumes it is already established it is, second one is about servers. I might agree that a lot of "Is my PC infected?" should be closed, but not as duplicates of those. – Anders Apr 17 '19 at 4:52
  • @Anders semantically, you are correct. But almost all of the questions I've seen are not that pure. They almost all end with or include, "and what do I do?" – schroeder♦ Apr 17 '19 at 7:10
  • 2
    Most questions I have come across are like "My PC is acting weird. Is it infected?". – MechMK1 Apr 17 '19 at 7:23
  • @MechMK1 ok, then we might need to differentiate in your question. There is 1. "I am infected, what do I do?", 2. "does X mean I'm infected?", and 3. "I do not understand what is happening, am I infected?". It is possible that we need 3 different routes to close each. – schroeder♦ Apr 17 '19 at 17:14
  • I think there are some "Am I infected?" questions that should not be closed, usually because they can be answered with a "no". E.g. "An ad on a webpage said I had a virus and I should install their antirvirus. Am I infected?" – Anders Apr 17 '19 at 18:58
  • 6
    Mandatory XKCD: xkcd.com/1180 – Anders Apr 17 '19 at 18:58
  • @Anders honestly, I don't think we should be a place for those types of questions either. – schroeder♦ Apr 17 '19 at 20:19
  • @Anders I tend to agree with schroeder. Sec.SE should not become a tech-support Q&A site. I personally believe we should be closer to Server Fault, where any non-professional questions are categorically closed or migrated to other sites. – MechMK1 Apr 19 '19 at 9:42
  • 1
    @MechMK1 I diverge with you on the last point. The industry is so new, and we need more professionals, that we do need some level of non-professional questions. End-user, personal end-device questions should be closed, in my opinion. – schroeder♦ Apr 19 '19 at 9:48
  • @schroeder This is the case now, but in 10 years, the situation will be different. I should have perhaps phrased it in a different way, such as to say that this should be the situation as the site matures. And I agree with your last statement; these questions are out-of-scope. – MechMK1 Apr 19 '19 at 9:50
  • One significant case that these canonicals don't address adequately, however, is cases of outright paranoid ideation (my computer has been hacked by the KGB, my hard disk gave my kitchen sink a virus, I think it is BadBIOS/USB/whatever, how do I fix it). Care to add any details on closing these? – duskwuff -inactive- Apr 23 '19 at 7:01
  • @duskwuff that's my entire last paragraph – schroeder♦ Apr 23 '19 at 7:29

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .