Software which includes anti-spyware, anti-rootkit, anti-phishing, and other technologies that attempt to identify and/or block malicious programs.

learn more… | top users | synonyms

0
votes
0answers
48 views

Trying to build an offline virus total type product

I have been tasked with finding a way to scan a file using multiple AV products. The machines this is to be used on cannot be connected to the web, due to lab restrictions and the AV products cannot ...
2
votes
1answer
25 views

What are proper methods to automatically detect malware and are current methods reliable? [duplicate]

What I have seen so far is the ability to automate signing hashes and string offsets as a way for an AV-engine to detect possible malware. Does this prove to be a good strategy for malware detection? ...
0
votes
0answers
84 views

Possible to detect Metasploit trojan installation on Windows 10?

I'm concerned my Win 10 installation may be infected with one of Metasploit's trojan variants. How could I go about confirming or disproving this suspicion? Are there ways to detect Metasploit hacks?
2
votes
2answers
93 views

Hardening Javascript in respect to Javascript Malware/Ransomeware like Ransome32

Are there any methods or standards to harden Javascript implementations to help reduce/remediate the the risks associated with Javascript malware like the Ransom32 or other types of Javascript attacks?...
0
votes
1answer
56 views

Is virus removal a security risk comparing to reinstalling everything from a clean source? [duplicate]

Why would it be a good idea to run a tool to remove a virus? You know that your system was compromised, but you don't know whether the antivirus tool will work.
10
votes
1answer
547 views

Are keyboard hooks inherently malicious?

My software is using low-level keyboard and mouse Win32 hooks for legitimate reasons (if it's any relevant, it's for determining a change in the caret position of the active code pane in the VBA IDE). ...
-4
votes
1answer
25 views

What security measures to be considered [closed]

First, I know kali Linux is not suitable for day to day work. Since I am using Windows PC with low ram so I didn't prefer installing it on a virtual machine. I have totally uninstalled my windows (I ...
-2
votes
4answers
85 views

Zero-day malware protection [closed]

What is the best approach in defending your company against zero-day malware? Is there a firewall/system to do that? Is it good to run every file in a sandbox and to track activity of the sandbox?
0
votes
2answers
56 views

Protection against file distributed malware

Let's say I have one server called A which host an upload website which is connected at the network connection B. Let's say one of my clients uploads multiple .rar files of 1 MB (that contains malware ...
2
votes
0answers
68 views

Creating a dynamic malware analysis environment

I don't know much about malware analysis so why this question here. I have analysed Short cut virus statistically and its impact on USB drives and wrote a code to repair its damage. My static ...
2
votes
3answers
632 views

Unauthorized remote control performed today - teamviewer?

I came home a bit ago from an overnight trip and saw my PC screen moving around. I hoped it was just some ad animation but as I sat down I realized someone was opening 30+ tabs in my Chrome to an ...
4
votes
1answer
78 views

Is there a name for an anti-virus station / kiosk?

I am not able to define the exact term for a station that is meant to scan whatever media coming from outside a company and that have the following specifications: The station should never be on any ...
-3
votes
1answer
73 views

How many viruses has the average computer? [closed]

Malware hides, so you cannot expect your computer to be malware-free, even when you have antivirus. My computer works fine, but I am fairly sure that I might have something lurking in there. Rootkits ...
0
votes
1answer
91 views

Objectively, how effective are malware removal tools at detecting infections?

I'm fully aware that concrete scientific data may not exist on this topic but I feel that the question at hand won't all boil down to opinion. Either way, with the rampant increase in sophistication ...
1
vote
1answer
55 views

Ad-Banner Rendering Sites Serve with malicious content - how to respond?

We've received a random email, which was of-course by the way it looks might be a marketing attempt - however, one always needs for a verification to be done. The email read the following: We ...
3
votes
2answers
137 views

What to do after a BadUSB attack? [closed]

I'm asking myself what to do after a user gets attacked by BadUSB? (Full scan, boot-time scan, ...?) Is the "bad usb" stick even able to infect the user's system with malware or other spy tools?
1
vote
1answer
75 views

How to protect Windows Registery from being changed or from programs trying to add keys

This question is with regards to Windows Personal PC. How to protect Windows Registry from being changed or from programs trying to add keys? I understand that the following general good practices ...
3
votes
2answers
340 views

Google Chrome on Android constantly being redirected

I have an Android (5.0.1 with December 2015 patches). My problem is with Chrome (latest version as per Google Play Store). Which has malicious redirect going on to ...
1
vote
0answers
33 views

Access android internal storage for full passive deep malware scan?

Is it possible to passively (with a computer) view/scan all content on an android mobile device's internal storage without crackopen/damaging it? For a deep malware scan of the whole storage of the ...
0
votes
1answer
66 views

Is it a good idea to use two antivirus? [duplicate]

I read a "no two anti-virus" rule and I also read about how you can use two anti-virus programs, but you need to do some configuration. Is it worth it to run two anti-virus programs on one system and ...
-1
votes
1answer
51 views

User information changing for online school site only

My son goes to online school. Our user name, password, email and security question keeps changing. Tech support is saying I have a hacker in my network. I have checked and changed all passwords for ...
0
votes
3answers
96 views

How to successfully prevent advance persistent threats

With the topic of advance persistent threats (APT) getting common nowadays, how do you successfully prevent such an attack in the workplace? Do you have to purchase expensive tools, such as those from ...
0
votes
1answer
93 views

Dealing with a malware infected server

I have a web server which is heavily infected by malware. That is, around 12 websites (Outdated CMS) are infected by PHP shells and XSS. My websites are banned and are not accessible anymore. I have ...
2
votes
1answer
52 views

Running rkhunter on Linux

Currently each time before an application and after an application is either installed or updated including regular patches, the command rkhunter --propupd is run, followed by the command rkhunter --...
4
votes
3answers
169 views

Best way to check if your browser is secure

There is a lot of Malware checking software which seems is just a virus. How can you check for sure that your Windows 8 computer is uninfected with virus and malware? Is malwarebytes enough, or ...
1
vote
1answer
114 views

How to add a malicious file scanner to live server?

One of my WordPress websites recently got hacked, and I had to download the full website to my local PC and clean it. As soon as I downloaded the website, my antivirus software found the malicious ...
6
votes
1answer
90 views

Methods to Monitor Ads For Malware on Mobile Devices

I've noticed that malware being introduced to a mobile application or web application through advertisements, unknown to the developer of the application, is becoming increasingly popular. I've been ...
4
votes
1answer
116 views

How does Trusteer Rapport make accessing websites more secure?

Trusteer claims that: Trusteer Rapport verifies that you are really connected to the genuine website as opposed to a fake website created by criminals. Surprisingly, it is not trivial to reach a ...
6
votes
1answer
407 views

Why Antiviruses does not check the library modules of exe to detect hook?

I write a simple keylogger by C# in Windows (using Hook method SetWindowsHookEx). I checked my application with most antivirus and anti-spyware programs, but none detect it. Why don't these antivirus ...
3
votes
1answer
76 views

Host based code injection defense vs anti virus?

Recently I came across a paper titled Host-based code injection attacks: A popular technique used by malware. Another paper titled "Bee Master: Detecting Host-Based Code Injection Attacks", suggests ...
4
votes
2answers
140 views

Log of all processes running on a computer

I'm new to the security domain and I want to ask - Does every program leave an 'imprint' in a log of some kind, in a laptop or a PC - of whatever process it ran. If yes, can they be analysed?
4
votes
2answers
110 views

apple.com exploit attempt?

I recently browsed to apple.com; and the page crashed a few times, then after I reloaded I was given this alert after my browser attempted to redirect to res://ieframe.dll/acr_error.htm#apple.com,http:...
2
votes
1answer
126 views

How do I instantly disconnect from my ISP during an exploit or suspicious activity?

When I was using "Zone Alarm Security" under Windows 98 SE, there was a toggle link feature under Zone Alarm, whereby I could instantly sever connectivity to the web, while a suspicious exploit was ...
-1
votes
1answer
207 views

A sneaky way of disabling Microsoft Security Essentials?

For a long time I've been dismissing and ignoring this popup, which is easy since it only appears at boot (or logon) which is once every few months: But recently I became suspicious after a crash (...
23
votes
3answers
3k views

Could malware move during a scan to avoid detection?

I think every AV-Scanner is using some predictable recursive scan to search files for malware. Couldn't malware easily detect a scan and just move to an already checked location, determined by knowing ...
2
votes
0answers
40 views

How should end users respond to Earthlink's “Allowed Sender” feature when blocked by policy?

Some of our users are requested to click on an Earthlink antispam URL below https://webmail.pas.earthlink.net/wam/addme?a=USERNAME@earthlink.net&id=<SOME GUID> However our firewall ...
1
vote
3answers
623 views

Is it possible to crack ransomware encryption if I have the original file?

Is it possible to crack ransomware encryption if I have 2 versions of a file: before and after the encryption? Are there any tools for such a thing?
2
votes
0answers
187 views

Why use oddly compiled ELF files for Linux malware?

I ran file on some Linux malware ELF files that I've acquired over the last couple of years. I noticed some oddities: ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), statically linked, for ...
1
vote
3answers
313 views

How to get started as a Malware Analyst? [closed]

Sorry if this is posted in the wrong section. A little about me: I'm going to be a sophomore in the fall at university, my major is Computer Science (Information Assurance). I've been interested in ...
2
votes
1answer
120 views

How long does it typically take to distribute malware signatures?

Are there industry-wide measures that identify how long it typically takes to identify, develop and distribute new malware signatures? I want to understand how long organizations are typically ...
0
votes
1answer
205 views

What items should be on a malware remediation checklist? [closed]

Edit: Let's assume Windows 7 and potentially Windows Server 2003/2008. IMHO, any machine that has malware should be reimaged/reformatted/OS reinstalled before it is deployed back into the environment....
-1
votes
1answer
638 views

Offline malware / script scanner for webfiles (PHP and HTML) [closed]

I have downloaded an entire copy of a website that has been used as a spam relay. I think I have tracked down the problem to a loophole in a contact form (now closed, but was not used, but still ...
4
votes
1answer
336 views

Invoke an antimalware scanner from code on azure Roles

We have a requirement to scan uploaded images via azure services. I found that Azure has a free out of the box solution http://azure.microsoft.com/en-us/support/legal/endpoint-protection/ However ...
-1
votes
1answer
110 views

What are the heuristics for a malicious url? [closed]

I know that there is nothing like a safe website ,any website which is safe today could be hacked and its visitors could be served with latest malware. What I'm curious about is what checks can we ...
1
vote
1answer
135 views

Malware (internet connectivity) and defending against it

I was wondering whether anyone knew if malware could spread without internet connectivity? Also, can you defend against malware by releasing counter-malware that spreads exploiting the same ...
3
votes
1answer
150 views

Has an antivirus ever failed to detect malware for “non-technical” reasons? [closed]

I'm wondering if an antimalware vendor has ever whitelisted (or otherwise failed to detect) a piece of malware because the author/sponsor either paid them, threatened them, or legislated against them.
0
votes
1answer
167 views

What kinds of PE file infection can AV software detect?

I wonder what kind of infections AV software is capable of detecting: only if the file is signed? also if the entry point isn't changed? does it also have hashes for non system files? what if the ...
22
votes
2answers
3k views

Can a Trojan hide itself, so its activity doesn't appear in task manager process? [duplicate]

Can malicious software hide itself, so its activity doesn't appear in the list of processes from Task Manager? Can it hide itself so when someone is controlling your computer, even if you open Task ...
3
votes
1answer
76 views

Any reason for a user to use an email scanner if they don't use any offline mail clients?

I typically recommend that users enable a real-time email scanner (aka a mail shield) in order to detect a possible vector used by malware. Even if they don't use an email application, the rationale ...
2
votes
2answers
89 views

Virus - by-pass with binairies repackaging

Why don’t « hackers » (or more accurately, « virus maker ») just do repackaging over their malware to by-pass antivirus software? Because it resolves the issue of the virus signature (kind of hash), ...