Software which includes anti-spyware, anti-rootkit, anti-phishing, and other technologies that attempt to identify and/or block malicious programs.

learn more… | top users | synonyms

3
votes
2answers
9k views

Does Chrome OS Allow Executable Files?

My company has some real security issues and I am wondering if using Chrome OS can be some solution to my problem. Typical Windows computers seems all to vulnerable to attacks from malicious images ...
3
votes
1answer
130 views

Has an antivirus ever failed to detect malware for “non-technical” reasons? [closed]

I'm wondering if an antimalware vendor has ever whitelisted (or otherwise failed to detect) a piece of malware because the author/sponsor either paid them, threatened them, or legislated against them. ...
3
votes
5answers
172 views

When is an antivirus program needed/useful?

Let's say I buy a computer and use the internet for services but rarely download anything and when I do it is from legitimate sources with a minimal to non-existent chance of malware. What benefits ...
3
votes
1answer
68 views

Host based code injection defense vs anti virus?

Recently I came across a paper titled Host-based code injection attacks: A popular technique used by malware. Another paper titled "Bee Master: Detecting Host-Based Code Injection Attacks", suggests ...
3
votes
1answer
246 views

How can I assess the trust worthiness of a browser add-on?

Having learned a bit more about what add-ons/extensions can do in Firefox, I want to minimize my risk and use some safer mechanism to download videos (FLV in particular) for later viewing. ...
3
votes
1answer
657 views

How does one test AV against zero-day malware?

Lately, I've read several articles about anti-malware software and one thing caught my eye - ability to detect zero-day attacks. In short - how does anti-malware / anti-virus industry test their own ...
3
votes
2answers
99 views

What to do after a BadUSB attack? [closed]

I'm asking myself what to do after a user gets attacked by BadUSB? (Full scan, boot-time scan, ...?) Is the "bad usb" stick even able to infect the user's system with malware or other spy tools?
3
votes
1answer
74 views

Any reason for a user to use an email scanner if they don't use any offline mail clients?

I typically recommend that users enable a real-time email scanner (aka a mail shield) in order to detect a possible vector used by malware. Even if they don't use an email application, the rationale ...
3
votes
3answers
211 views

Remove pdf malware by re-printing to new pdf or text extract?

Consider you have a suspicious pdf file that might contain malware. Would it be sufficient to either: (1) open the pdf file in a virtual environment and let the pdf viewer or pdf-creator program ...
3
votes
2answers
163 views

Can full disk encryption make malware recovery more difficult?

Let us say that we have a computer with a fully encrypted disk. If it gets infected with malware, does this make it more difficult to use a LiveCD or other rescue option to clean it or restore it? It ...
3
votes
3answers
198 views

A way to secure hyperlinks on websites

How do you think could we secure hyperlinks pasted by users on website's forums, comments, blogs against bad links/leading to malware etc.? I thought about google safe browsing, projecthoneypot. Did ...
3
votes
2answers
153 views

Google Chrome on Android constantly being redirected

I have an Android (5.0.1 with December 2015 patches). My problem is with Chrome (latest version as per Google Play Store). Which has malicious redirect going on to ...
2
votes
2answers
122 views

Virus Removal Boot Disks — a few questions

I'm new to working with and using a backdoor/virus with a boot disk. Can they be mounted to a USB drive? What options are out there and what should I look for in one? Are they practical? Do they ...
2
votes
4answers
843 views

What is nuke it from orbit? [duplicate]

I was reading this Windows 2003 Enterprise infected by Conficker; post-infection problems continue And they talk about nuking it from orbit (which apparently means wiping out the system and starting ...
2
votes
1answer
472 views

What is the difference between YARA and CLAMAV?

Can any one explain the difference between YARA and ClamAV ? Are they just two different ways of writing AV or Malware signatures ?
2
votes
2answers
426 views

What is the current best practice to secure an executive's laptop?

What is the current best practice to secure an executive's laptop? The exec will be processing highly sensitive documents (high-value bids, merger & acquisition info, technical specs). As such ...
2
votes
1answer
474 views

EMET and AntiVirus

I've just heard about and started playing with EMET and I am curious, do any AV or security suite applications do what EMET does or is EMET something entirely different?
2
votes
1answer
4k views

How to check if your computer has a backdoor installed on it? [closed]

Just some time ago I had this unusual popup from Malwarebytes Anti-Malware (MBAM): I did a quick Google of the IP address and found this thread where the OP is complaining of MBAM blocking ...
2
votes
1answer
1k views

how is BAT_VOBFUS (or similar) dangerous?

I was reading http://about-threats.trendmicro.com/malware.aspx?language=au&name=BAT_VOBFUS.SM earlier today after it turned up in a scan of a friends PC. I suppose I may be missing something vital ...
2
votes
1answer
148 views

What metrics are available on malware?

All the main AV have a risk rating or severity level, how do they determine what is "low","high",etc.?
2
votes
2answers
592 views

Can a polymorphic/metamorphic worm use a mutex?

Can a polymorphic/metamorphic worm use (the same) mutex? This would solve the problem of grinding the network into the ground and consuming all resources with multiple instances of the worm. Is the ...
2
votes
2answers
85 views

Virus - by-pass with binairies repackaging

Why don’t « hackers » (or more accurately, « virus maker ») just do repackaging over their malware to by-pass antivirus software? Because it resolves the issue of the virus signature (kind of hash), ...
2
votes
2answers
718 views

Force AV Scan of USB drive vs. File-Access Scan

I have been evaluating MS Forefront Endpoint Protection 2010 vs. Kasperskey 2010. One of the major differences in features seems to be that Kasperskey gives the option to force the full scan of a USB ...
2
votes
1answer
38 views

Running rkhunter on Linux

Currently each time before an application and after an application is either installed or updated including regular patches, the command rkhunter --propupd is run, followed by the command rkhunter ...
2
votes
1answer
120 views

How do I instantly disconnect from my ISP during an exploit or suspicious activity?

When I was using "Zone Alarm Security" under Windows 98 SE, there was a toggle link feature under Zone Alarm, whereby I could instantly sever connectivity to the web, while a suspicious exploit was ...
2
votes
1answer
80 views

How long does it typically take to distribute malware signatures?

Are there industry-wide measures that identify how long it typically takes to identify, develop and distribute new malware signatures? I want to understand how long organizations are typically ...
2
votes
1answer
119 views

Malware (internet connectivity) and defending against it

I was wondering whether anyone knew if malware could spread without internet connectivity? Also, can you defend against malware by releasing counter-malware that spreads exploiting the same ...
2
votes
1answer
159 views

Will 3rd party antivirus/antimalware programs compromise OSX's built-in security?

There is a very interesting post written by @TechZen. Here's the excerpt from the original post (bold emphasis mine) Should I get an antivirus for my Mac? There's never been a an actual Mac OS X ...
2
votes
1answer
103 views

When does it make sense to whitelist some subdomains but not others for a given domain?

Little Snitch has been useful to get a better handle on all the connections my computer tries to make. It's main dialog to allow or deny connections allows customizing (e.g. require specific port, or ...
2
votes
1answer
445 views

My home PC was hacked and accessed my bank! Advice on next steps? [duplicate]

I recently setup a new Win8.1 PC while still working on my main development PC so it did not have all of the security tools that I usually install, e.g. malwarebytes, adaware, etc. Since it takes me a ...
2
votes
1answer
155 views

How should I select an antimalware solution?

As I prepare to reinstall the software on my machine, I am currently reevaluating my choice of anti-malware software for home use. What factors should I be considering? How reputable are AV-test and ...
2
votes
1answer
141 views

Is there a website or free downloadable program to identify and remove malware from an ISO file?

Is there a website or free downloadable program that allows a user to identify and remove multiple types of malware from an ISO file?
2
votes
0answers
36 views

How should end users respond to Earthlink's “Allowed Sender” feature when blocked by policy?

Some of our users are requested to click on an Earthlink antispam URL below https://webmail.pas.earthlink.net/wam/addme?a=USERNAME@earthlink.net&id=<SOME GUID> However our firewall ...
2
votes
0answers
144 views

Why use oddly compiled ELF files for Linux malware?

I ran file on some Linux malware ELF files that I've acquired over the last couple of years. I noticed some oddities: ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), statically linked, for ...
2
votes
1answer
585 views

How is the file overlay read by an exe/virus?

According to what I know ,Overlay is the part of PE file that is not covered by the PE header and therefore isn't part of the virtual image in the Loaded PE. My question is if the overlay is not ...
1
vote
6answers
11k views

Use PHP to check uploaded image file for malware?

I want my users to be able to upload a photo. Currently I am not checking the uploaded photo for problems of any kind, although I do limit the size to 32k. Is there any way for me to check uploaded ...
1
vote
3answers
312 views

What is the safest way to copy a file from an untrusted system?

Scenario: There are two computers running GNU/Linux, U and T. U is untrusted and T is trusted. A non-executable file F (which may however have been infected with malware) resides on U. (For ...
1
vote
1answer
325 views

Why does Microsoft Security Essentials remove Chrome in some situations?

According to Google, Microsoft Security Essentials is currently detecting some versions of the Chrome browser as malware. Could someone have hacked Google and put a virus into some Chrome updates? ...
1
vote
3answers
136 views

Gaming Mods Security Risks

I read the following post, and while the questions was specific to SkyRim, the more general answer was that it depends on the game. I wanted to pose a more generic question here to the security folks. ...
1
vote
1answer
172 views

Efficacy of self-made ransomware protection

I was recently wondering about how to circumvent malware such as the infamous Cryptolocker a while back and was wondering about the efficacy of having a set of files with known content in a known ...
1
vote
2answers
886 views

Can I get a malware on Windows without administrative rights?

I'm a Linux user and I installed Windows recently, I need it for some software. I don't want to use any anti-malware programs, I don't plan on giving administrative rights to applications I don't ...
1
vote
1answer
91 views

Detecting code source variants of the same function [closed]

Suppose I have this JavaScript malicious function f1() : <SCRIPT type="text/javascript"> function f1(){ a=1; b=2; c=a+b; } </SCRIPT> This function is embedded within a larger ...
1
vote
1answer
197 views

Appilicability of Theoritical Computer Science/Formal methods in Malware research

I would like to know the importance of Theoritical CS/Formal methods in Malware research. Due to the large volume of new malware variants received per day (~50,000 samples/day according to McAfee), ...
1
vote
2answers
1k views

Do thin-clients need antivirus?

I've just taken over as IT Manager in an environment where most of the end-users are using HP-based Win7 thin clients (approx 50 seats) to access a remote desktop server. All the servers & fat ...
1
vote
2answers
121 views

Any “cleaned” virus that's been successfully re-released?

Anti-malware software has to keep track of all bad software there is. To ease this load, it seems like a good idea to stop looking for threats that's been dead for years. Is there any example of some ...
1
vote
1answer
96 views

Using multiple AV's

As my computer is currently set up, I have 3 AV's: AVG (paid), Malwarebytes, and Spybot S&D. I think that each one of these serves a purpose: AVG gets your real malware - Trojans, Worms, etc. and ...
1
vote
1answer
51 views

Ad-Banner Rendering Sites Serve with malicious content - how to respond?

We've received a random email, which was of-course by the way it looks might be a marketing attempt - however, one always needs for a verification to be done. The email read the following: We ...
1
vote
1answer
57 views

How to protect Windows Registery from being changed or from programs trying to add keys

This question is with regards to Windows Personal PC. How to protect Windows Registry from being changed or from programs trying to add keys? I understand that the following general good practices ...
1
vote
1answer
56 views

How to add a malicious file scanner to live server?

One of my WordPress websites recently got hacked, and I had to download the full website to my local PC and clean it. As soon as I downloaded the website, my antivirus software found the malicious ...
1
vote
3answers
258 views

How to get started as a Malware Analyst? [closed]

Sorry if this is posted in the wrong section. A little about me: I'm going to be a sophomore in the fall at university, my major is Computer Science (Information Assurance). I've been interested in ...