Software which includes anti-spyware, anti-rootkit, anti-phishing, and other technologies that attempt to identify and/or block malicious programs.

learn more… | top users | synonyms

1
vote
3answers
230 views

What is the safest way to copy a file from an untrusted system?

Scenario: There are two computers running GNU/Linux, U and T. U is untrusted and T is trusted. A non-executable file F (which may however have been infected with malware) resides on U. (For ...
-1
votes
1answer
300 views

Whats the difference between Anti-malware and antispyware?

Whats the difference between Anti-malware and antispyware ?
0
votes
2answers
168 views

What security products are necessary or advised for a home computer running Windows?

There is a lot of security related products for home users and it is becoming unclear what the difference is between them. What is the difference between antimalware, antispyware, antiadware and ...
0
votes
2answers
76 views

Is there a down side to how so many security products bundle multiple components into one these days?

For example it seems like anti-virus, anti-spam and firewalls have sort of merged into one product. Is there a downside to this? I don't know of any software firewalls that can be purchased without an ...
3
votes
3answers
3k views

Cryptolocker: can servers be protected?

I'm IT in a small company. The network is about as ancient as most of the staff (at 30, I'm the company's youngest), and the staff also is notorious for spreading viruses around the network despite ...
0
votes
1answer
162 views

someone claims to have created such a malware, can he be true?

These are not my lines they are by someone else on the internet. I also want to know is that malware that unique? How will it work in GPU and is there a way to sandbox such application? "HERE GOES ...
20
votes
2answers
3k views

How would one know if they have a rootkit?

Are they impossible to detect? Seeing as the attacker has admin rights and could modify anti virus software that might otherwise be used to detect or circumvent a root kit. Are there certain red flags ...
6
votes
3answers
1k views

Possible to detect packed executable?

A packer is a way of obfuscating an executable program, i.e., transforming so the result is still executable and has the same effect when run, but looks different (so it won't be detected by static ...
1
vote
0answers
125 views

How dangerous is Exploit.LNK.BadLnk.a (v)?

I have encountered a supposed low level eploit on my network at work, by the name of: Exploit.LNK.BadLnk.a (v). I have torn through pages of entries on google trying to find information on this bit of ...
0
votes
2answers
554 views

How to defeat software keyloggers [duplicate]

Is it possible to defeat software keyloggers? I remember reading long ago about programs run from a USB which will defeat keyloggers. The software works (if I remember correctly) by intercepting ...
0
votes
1answer
89 views

How does Look Out Secuirty and Anti-Virus determine if an app is harmeful?

For Android Lookout can scan an app before it is installed, and I think it scans a new app the first time it runs too. It displays the message "this app is safe" and I'm wondering, how does it ...
1
vote
1answer
346 views

EMET and AntiVirus

I've just heard about and started playing with EMET and I am curious, do any AV or security suite applications do what EMET does or is EMET something entirely different?
1
vote
1answer
2k views

How to check if your computer has a backdoor installed on it? [closed]

Just some time ago I had this unusual popup from Malwarebytes Anti-Malware (MBAM): I did a quick Google of the IP address and found this thread where the OP is complaining of MBAM blocking ...
11
votes
4answers
2k views

How effective are anti-virus products against real-world threats?

In a recent interview† with Dave Kennedy, he in passing pegged the average effectiveness of anti-virus products as detecting approximately 3% to 5% of current active threats. While AV comparisons ...
22
votes
1answer
750 views

CSS based attacks

I'm currently working on a plugin for a CMS which should allow content editors to write inline style tags. I'm looking for advice / links on how inline styles could be abused. Part of the reason ...
2
votes
2answers
112 views

Virus Removal Boot Disks — a few questions

I'm new to working with and using a backdoor/virus with a boot disk. Can they be mounted to a USB drive? What options are out there and what should I look for in one? Are they practical? Do they ...
1
vote
2answers
7k views

Does Chrome OS Allow Executable Files?

My company has some real security issues and I am wondering if using Chrome OS can be some solution to my problem. Typical Windows computers seems all to vulnerable to attacks from malicious images ...
2
votes
1answer
1k views

how is BAT_VOBFUS (or similar) dangerous?

I was reading http://about-threats.trendmicro.com/malware.aspx?language=au&name=BAT_VOBFUS.SM earlier today after it turned up in a scan of a friends PC. I suppose I may be missing something vital ...
2
votes
4answers
641 views

What is nuke it from orbit? [duplicate]

I was reading this Windows 2003 Enterprise infected by Conficker; post-infection problems continue And they talk about nuking it from orbit (which apparently means wiping out the system and starting ...
33
votes
2answers
4k views

How do antiviruses scan for thousands of malware signatures in a short time?

Most antiviruses have hundreds of thousands or even millions of malware signatures and yet they scan many files in a reasonable short time with high detection rates. Even real-time scanners doesn't ...
0
votes
3answers
242 views

Using a VM to access internet when malware blocks internet access?

My computer was recently infected by some malware which had blocked internet access. I had a virtualization software with an OS in it. Surprisingly, I could access the internet from the VM. I know ...
6
votes
6answers
5k views

How can I tell whether this computer is part of a botnet?

One of the computers that I manage (in the family, not business) has a weird set of files in its boot: bash.exe, curl.exe, uname.exe, sed.exe, rm.exe, tail.exe, cut.exe, awk.exe, cat.exe, chmod.exe, ...
1
vote
6answers
7k views

Use PHP to check uploaded image file for malware?

I want my users to be able to upload a photo. Currently I am not checking the uploaded photo for problems of any kind, although I do limit the size to 32k. Is there any way for me to check uploaded ...
2
votes
1answer
509 views

How does one test AV against zero-day malware?

Lately, I've read several articles about anti-malware software and one thing caught my eye - ability to detect zero-day attacks. In short - how does anti-malware / anti-virus industry test their own ...
8
votes
4answers
7k views

Why Adobe is recommending McAfee security scan during flash player installation?

Why is Adobe recommending a McAfee security scan during the installation of flash player?
4
votes
1answer
993 views

Where can a virus or other malware “hide” on common PC and Mac hardware?

I'm looking for a detailed list of locations that viruses can "hide" in modern hardware even after a reboot. Some things that come to mind include Boot BIOS/Firmware CPU Microcode Connected PCI ...
7
votes
1answer
854 views

Have any viruses leveraging the GPU been discovered in the wild? What is the mitigation?

This news article from 2010 discusses how a GPU can be used by a virus to avoid detection by common anti-malware/anti-virus software. The idea is to obfuscate the virus payload and leverage the GPU's ...
2
votes
1answer
150 views

How should I select an antimalware solution?

As I prepare to reinstall the software on my machine, I am currently reevaluating my choice of anti-malware software for home use. What factors should I be considering? How reputable are AV-test and ...
0
votes
3answers
130 views

Does AV software protect web applications (Twitter, Facebook, etc) from attacks? (CSRF, etc)

Is it correct to say that AV software focuses on downloaded executables and locally malicious activity, and it doesn't actively scan HTTP/S content for web based attacks such as CSRF, XSS, phishing ...
-1
votes
2answers
321 views

sanesecurity - clamav - getting a false positive - should I bother?

A client of mine reported that he isn't getting emails sent from our domain. This is offcourse a false positive, as we are a legitimate comapny. I am also not hearing this issue from other clients (we ...
4
votes
4answers
957 views

To what extent is FREE 3rd party antivirus software better than Windows 8 defender (if any)?

As someone who is not in a position to currently purchase an antivirus suite, I would like to know if having a free Avira or Avast or similar program is worth the overall system performance drop (I ...
2
votes
1answer
126 views

Is there a website or free downloadable program to identify and remove malware from an ISO file?

Is there a website or free downloadable program that allows a user to identify and remove multiple types of malware from an ISO file?
-4
votes
6answers
9k views

Will antivirus detect all keyloggers?

Our company schedules Security Training courses for our personnel. In order for us to test them, we develop code such as keyloggers which we email to our personnel to detect stupid personnel, and of ...
2
votes
1answer
120 views

What metrics are available on malware?

All the main AV have a risk rating or severity level, how do they determine what is "low","high",etc.?
10
votes
2answers
4k views

Detecting reflective DLL injection

In the past few years, malware (and some pen-test tools like Metasploit's meterpreter payload) have begun to use reflective DLL injection (PDF) to load a DLL into the memory of a process. The benefit ...
4
votes
2answers
400 views

How can I recognize and find file(s) dropped by malware?

Suppose I am doing malware analysis. How can I recognize if, during the analysis process, a piece of malware dropped a file in my system, and if so, the path of the file? What are the procedures, ...
-1
votes
2answers
8k views

Malware or buggy software gives Low Disk Space warning

Since a few days, I am getting an alert that in my c drive disk space is low. When I verified, free space in my c drive was decreasing hour by hour and there was a stage when it simply said that 0 mb ...
5
votes
3answers
5k views

Javascript Malware: How does it work, and how can it be mitigated?

I am wondering how malware gets served through Javascript. I've noticed a few illegitimate pop-ups while visiting some financial websites. I wonder how malware exploits work against the application ...
4
votes
1answer
858 views

Icesword rootkit detector, How does it work?

I'm curious about how I can learn more about icesword rootkit detector. I've only used it and never studied it myself. Ive always been curious how it works. As far as I understand it works by ...
1
vote
1answer
175 views

Appilicability of Theoritical Computer Science/Formal methods in Malware research

I would like to know the importance of Theoritical CS/Formal methods in Malware research. Due to the large volume of new malware variants received per day (~50,000 samples/day according to McAfee), ...
3
votes
1answer
2k views

What are the methods to find hooked functions and APIs?

Many malware executables use hooking to be invisible. I am familiar with some hooking methods, I'm not sure what methods exist for detecting them. Is there a way to tell when a function call has been ...
2
votes
2answers
522 views

Can a polymorphic/metamorphic worm use a mutex?

Can a polymorphic/metamorphic worm use (the same) mutex? This would solve the problem of grinding the network into the ground and consuming all resources with multiple instances of the worm. Is the ...
3
votes
2answers
569 views

Why does Antivirus Softwares have an Issue with EXE Packers

Im trying to pack an Executable using an Exe Packer like UPX.I packed and checked the File with VirusTotal.com.Here some 9 Antivirus Products say its a Virus actually its a harmless exe.I think the AV ...
8
votes
3answers
1k views

Using MD5 for malware ids: collision attack risks?

It has been known since 2004 that the MD5 hash is vulnerable to collision attacks (update - not "preimage" attacks - my mistake....). Yet it still seems that people are using it to identify malware. ...
3
votes
3answers
180 views

A way to secure hyperlinks on websites

How do you think could we secure hyperlinks pasted by users on website's forums, comments, blogs against bad links/leading to malware etc.? I thought about google safe browsing, projecthoneypot. Did ...
4
votes
1answer
210 views

firewall with cloud based malware analysis risks

Palo Alto, and probably others firewalls will offer it, has a feature to do malware analysis in a separate (cloud-based) process that does not impact stream processing. What I would like which risks ...
5
votes
3answers
577 views

How do anti-virus & anti-malware programs protect themselves?

I would assume that A/V products would need to employ the same kinds of techniques used by the software they are trying to cleanse to ensure that they can continue to run in such hostile environments. ...
4
votes
3answers
132 views

Duqu and other reference material for security people

I would like to read more on Duqu and similar exploits when they appear. The problem is that most references from google are for laymen. Isn't there a reference website or... that reports on these ...
1
vote
1answer
281 views

Why does Microsoft Security Essentials remove Chrome in some situations?

According to Google, Microsoft Security Essentials is currently detecting some versions of the Chrome browser as malware. Could someone have hacked Google and put a virus into some Chrome updates? ...
10
votes
2answers
438 views

Is email more secure when not letting any zipped content through?

Ah. This is a bit of a soft question, but I though there might be some here that can share some insight. I'm a developer. Sometimes I need to send a (bugfixed) DLL or EXE file to a customer. If this ...