Software which includes anti-spyware, anti-rootkit, anti-phishing, and other technologies that attempt to identify and/or block malicious programs.

learn more… | top users | synonyms

2
votes
2answers
334 views

What is the current best practice to secure an executive's laptop?

What is the current best practice to secure an executive's laptop? The exec will be processing highly sensitive documents (high-value bids, merger & acquisition info, technical specs). As such ...
2
votes
1answer
1k views

how is BAT_VOBFUS (or similar) dangerous?

I was reading http://about-threats.trendmicro.com/malware.aspx?language=au&name=BAT_VOBFUS.SM earlier today after it turned up in a scan of a friends PC. I suppose I may be missing something vital ...
2
votes
1answer
551 views

How does one test AV against zero-day malware?

Lately, I've read several articles about anti-malware software and one thing caught my eye - ability to detect zero-day attacks. In short - how does anti-malware / anti-virus industry test their own ...
2
votes
1answer
129 views

What metrics are available on malware?

All the main AV have a risk rating or severity level, how do they determine what is "low","high",etc.?
2
votes
2answers
535 views

Can a polymorphic/metamorphic worm use a mutex?

Can a polymorphic/metamorphic worm use (the same) mutex? This would solve the problem of grinding the network into the ground and consuming all resources with multiple instances of the worm. Is the ...
2
votes
2answers
76 views

Virus - by-pass with binairies repackaging

Why don’t « hackers » (or more accurately, « virus maker ») just do repackaging over their malware to by-pass antivirus software? Because it resolves the issue of the virus signature (kind of hash), ...
2
votes
2answers
630 views

Force AV Scan of USB drive vs. File-Access Scan

I have been evaluating MS Forefront Endpoint Protection 2010 vs. Kasperskey 2010. One of the major differences in features seems to be that Kasperskey gives the option to force the full scan of a USB ...
2
votes
1answer
104 views

Malware (internet connectivity) and defending against it

I was wondering whether anyone knew if malware could spread without internet connectivity? Also, can you defend against malware by releasing counter-malware that spreads exploiting the same ...
2
votes
1answer
112 views

Will 3rd party antivirus/antimalware programs compromise OSX's built-in security?

There is a very interesting post written by @TechZen. Here's the excerpt from the original post (bold emphasis mine) Should I get an antivirus for my Mac? There's never been a an actual Mac OS X ...
2
votes
1answer
63 views

When does it make sense to whitelist some subdomains but not others for a given domain?

Little Snitch has been useful to get a better handle on all the connections my computer tries to make. It's main dialog to allow or deny connections allows customizing (e.g. require specific port, or ...
2
votes
1answer
372 views

My home PC was hacked and accessed my bank! Advice on next steps? [duplicate]

I recently setup a new Win8.1 PC while still working on my main development PC so it did not have all of the security tools that I usually install, e.g. malwarebytes, adaware, etc. Since it takes me a ...
2
votes
1answer
151 views

How should I select an antimalware solution?

As I prepare to reinstall the software on my machine, I am currently reevaluating my choice of anti-malware software for home use. What factors should I be considering? How reputable are AV-test and ...
2
votes
1answer
127 views

Is there a website or free downloadable program to identify and remove malware from an ISO file?

Is there a website or free downloadable program that allows a user to identify and remove multiple types of malware from an ISO file?
2
votes
1answer
271 views

How is the file overlay read by an exe/virus?

According to what I know ,Overlay is the part of PE file that is not covered by the PE header and therefore isn't part of the virtual image in the Loaded PE. My question is if the overlay is not ...
2
votes
0answers
108 views

Are there any known cases were antivirus software have deliberately ignored malware?

Are there any known cases were antivirus companies for some reason have choosen to make their product allow/ignore malicious software? The reason could be government coercion or former trustworthy ...
1
vote
6answers
8k views

Use PHP to check uploaded image file for malware?

I want my users to be able to upload a photo. Currently I am not checking the uploaded photo for problems of any kind, although I do limit the size to 32k. Is there any way for me to check uploaded ...
1
vote
3answers
239 views

What is the safest way to copy a file from an untrusted system?

Scenario: There are two computers running GNU/Linux, U and T. U is untrusted and T is trusted. A non-executable file F (which may however have been infected with malware) resides on U. (For ...
1
vote
1answer
288 views

Why does Microsoft Security Essentials remove Chrome in some situations?

According to Google, Microsoft Security Essentials is currently detecting some versions of the Chrome browser as malware. Could someone have hacked Google and put a virus into some Chrome updates? ...
1
vote
2answers
7k views

Does Chrome OS Allow Executable Files?

My company has some real security issues and I am wondering if using Chrome OS can be some solution to my problem. Typical Windows computers seems all to vulnerable to attacks from malicious images ...
1
vote
3answers
82 views

Gaming Mods Security Risks

I read the following post, and while the questions was specific to SkyRim, the more general answer was that it depends on the game. I wanted to pose a more generic question here to the security folks. ...
1
vote
1answer
148 views

Efficacy of self-made ransomware protection

I was recently wondering about how to circumvent malware such as the infamous Cryptolocker a while back and was wondering about the efficacy of having a set of files with known content in a known ...
1
vote
2answers
670 views

Can I get a malware on Windows without administrative rights?

I'm a Linux user and I installed Windows recently, I need it for some software. I don't want to use any anti-malware programs, I don't plan on giving administrative rights to applications I don't ...
1
vote
1answer
85 views

Detecting code source variants of the same function [closed]

Suppose I have this JavaScript malicious function f1() : <SCRIPT type="text/javascript"> function f1(){ a=1; b=2; c=a+b; } </SCRIPT> This function is embedded within a larger ...
1
vote
1answer
3k views

How to check if your computer has a backdoor installed on it? [closed]

Just some time ago I had this unusual popup from Malwarebytes Anti-Malware (MBAM): I did a quick Google of the IP address and found this thread where the OP is complaining of MBAM blocking ...
1
vote
1answer
178 views

Appilicability of Theoritical Computer Science/Formal methods in Malware research

I would like to know the importance of Theoritical CS/Formal methods in Malware research. Due to the large volume of new malware variants received per day (~50,000 samples/day according to McAfee), ...
1
vote
2answers
455 views

Do thin-clients need antivirus?

I've just taken over as IT Manager in an environment where most of the end-users are using HP-based Win7 thin clients (approx 50 seats) to access a remote desktop server. All the servers & fat ...
1
vote
2answers
100 views

Any “cleaned” virus that's been successfully re-released?

Anti-malware software has to keep track of all bad software there is. To ease this load, it seems like a good idea to stop looking for threats that's been dead for years. Is there any example of some ...
1
vote
1answer
371 views

EMET and AntiVirus

I've just heard about and started playing with EMET and I am curious, do any AV or security suite applications do what EMET does or is EMET something entirely different?
1
vote
3answers
92 views

How to get started as a Malware Analyst? [closed]

Sorry if this is posted in the wrong section. A little about me: I'm going to be a sophomore in the fall at university, my major is Computer Science (Information Assurance). I've been interested in ...
1
vote
1answer
97 views

Why is there a path to a .pdb file in an exe I am trying to reverse?

My query is ,if I'm seeing a .pdb path in a exe(VC++) what conclusion can I draw from it.Why does the exe have these paths and does it have significance in malware analysis? eg ...
1
vote
1answer
156 views

Malware infected ATMs in China via specialized device

Hackers inserted a specialized device which was connected to the notebook into the card reader slot on the ATM and installed malicious software. 100 thousand US dollars were stolen from at least seven ...
1
vote
1answer
590 views

Can signature-based Antivirus detect encrypted malware? [duplicate]

How effective signature-based Antivirus is, in detecting encrypted malware?
1
vote
0answers
48 views

Why use oddly compiled ELF files for Linux malware?

I ran file on some Linux malware ELF files that I've acquired over the last couple of years. I noticed some oddities: ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), statically linked, for ...
1
vote
0answers
31 views

How long does it typically take to distribute malware signatures?

Are there industry-wide measures that identify how long it typically takes to identify, develop and distribute new malware signatures? I want to understand how long organizations are typically ...
1
vote
1answer
62 views

Invoke an antimalware scanner from code on azure Roles

We have a requirement to scan uploaded images via azure services. I found that Azure has a free out of the box solution http://azure.microsoft.com/en-us/support/legal/endpoint-protection/ However ...
1
vote
0answers
77 views

Detecting reflective DLL injection any other ways?

any way to detect it? maybe using mcafee hips rules? Are there any known Techniques to detect it ? like walking the VAD tree or something?
1
vote
0answers
130 views

How dangerous is Exploit.LNK.BadLnk.a (v)?

I have encountered a supposed low level eploit on my network at work, by the name of: Exploit.LNK.BadLnk.a (v). I have torn through pages of entries on google trying to find information on this bit of ...
0
votes
3answers
248 views

Using a VM to access internet when malware blocks internet access?

My computer was recently infected by some malware which had blocked internet access. I had a virtualization software with an OS in it. Surprisingly, I could access the internet from the VM. I know ...
0
votes
3answers
100 views

It is possible detecting threat by only with file information?

It is possible detecting threat by only with file information of a file like file's hash(md5,sha1,sha256, etc), file size, mime type, etc with ClamAV or Comodo AV for linux with shell command? It ...
0
votes
3answers
137 views

Does AV software protect web applications (Twitter, Facebook, etc) from attacks? (CSRF, etc)

Is it correct to say that AV software focuses on downloaded executables and locally malicious activity, and it doesn't actively scan HTTP/S content for web based attacks such as CSRF, XSS, phishing ...
0
votes
1answer
276 views

How safe is virtual box without internet [duplicate]

I am running a windows 7 virtual box without internet connected. Internet is, however, connected to the host, and I allow any internet access to and from the host. On the guest platform I am working ...
0
votes
2answers
172 views

What security products are necessary or advised for a home computer running Windows?

There is a lot of security related products for home users and it is becoming unclear what the difference is between them. What is the difference between antimalware, antispyware, antiadware and ...
0
votes
1answer
336 views

Find and kill process that create malicious connections

State Recv-Q Send-Q Local Address:Port Peer Address:Port FIN-WAIT-1 0 3640 my.public.ip.xx:https xxx.xx.xxx.xx:56206 SYN-SENT 0 1 ...
0
votes
3answers
2k views

How to detect the so-called “undetectable” Gameover Zeus?

The media are currently (and have been) creating a huge ruckus surrounding the supposedly "undetectable" Gameover Zeus malware. The Daily Mail The Mirror The Independant PC World The Telegraph ...
0
votes
1answer
40 views

What kinds of PE file infection can AV software detect?

I wonder what kind of infections AV software is capable of detecting: only if the file is signed? also if the entry point isn't changed? does it also have hashes for non system files? what if the ...
0
votes
1answer
245 views

What is the difference between YARA and CLAMAV?

Can any one explain the difference between YARA and ClamAV ? Are they just two different ways of writing AV or Malware signatures ?
0
votes
2answers
165 views

Why does host's antivirus detect guest's malware?

I'm analyzing some malicious files on a VM and I'm noticing that every time I open a file, the host's antivirus detects it. Why does this happen? Is the malicious content escaping to the host?
0
votes
1answer
61 views

What items should be on a malware remediation checklist? [closed]

Edit: Let's assume Windows 7 and potentially Windows Server 2003/2008. IMHO, any machine that has malware should be reimaged/reformatted/OS reinstalled before it is deployed back into the ...
0
votes
1answer
85 views

Google safe browsing vs traditional anti-malware scanners

What is the difference between using Google Safe Browsing and using other traditional anti-webmalware tools ? Which one is more efficient to protect against malicious web content ?
0
votes
1answer
59 views

Questions about common exploits

I'm investigating the state of my MacBook Pro which I know was compromised, and do not know if I removed the exploits completely (and I realize, technically will never know this). I'm trying to hone ...