Software which includes anti-spyware, anti-rootkit, anti-phishing, and other technologies that attempt to identify and/or block malicious programs.

learn more… | top users | synonyms

1
vote
0answers
49 views

Why use oddly compiled ELF files for Linux malware?

I ran file on some Linux malware ELF files that I've acquired over the last couple of years. I noticed some oddities: ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), statically linked, for ...
1
vote
3answers
95 views

How to get started as a Malware Analyst? [closed]

Sorry if this is posted in the wrong section. A little about me: I'm going to be a sophomore in the fall at university, my major is Computer Science (Information Assurance). I've been interested in ...
0
votes
3answers
521 views

Virus/Malware: Force Java Download

I have two separate pieces of security software that run regularly - Webroot and Microsoft Security Essentials, and even though neither of these have detected anything is wrong with my computer, every ...
1
vote
1answer
62 views

Invoke an antimalware scanner from code on azure Roles

We have a requirement to scan uploaded images via azure services. I found that Azure has a free out of the box solution http://azure.microsoft.com/en-us/support/legal/endpoint-protection/ However ...
1
vote
0answers
31 views

How long does it typically take to distribute malware signatures?

Are there industry-wide measures that identify how long it typically takes to identify, develop and distribute new malware signatures? I want to understand how long organizations are typically ...
0
votes
1answer
61 views

What items should be on a malware remediation checklist? [closed]

Edit: Let's assume Windows 7 and potentially Windows Server 2003/2008. IMHO, any machine that has malware should be reimaged/reformatted/OS reinstalled before it is deployed back into the ...
4
votes
3answers
456 views

How can I recognize and find file(s) dropped by malware?

Suppose I am doing malware analysis. How can I recognize if, during the analysis process, a piece of malware dropped a file in my system, and if so, the path of the file? What are the procedures, ...
11
votes
2answers
4k views

Detecting reflective DLL injection

In the past few years, malware (and some pen-test tools like Metasploit's meterpreter payload) have begun to use reflective DLL injection (PDF) to load a DLL into the memory of a process. The benefit ...
-1
votes
1answer
104 views

Offline malware / script scanner for webfiles (PHP and HTML) [closed]

I have downloaded an entire copy of a website that has been used as a spam relay. I think I have tracked down the problem to a loophole in a contact form (now closed, but was not used, but still ...
6
votes
3answers
2k views

Possible to detect packed executable?

A packer is a way of obfuscating an executable program, i.e., transforming so the result is still executable and has the same effect when run, but looks different (so it won't be detected by static ...
-1
votes
1answer
71 views

What are the heuristics for a malicious url? [closed]

I know that there is nothing like a safe website ,any website which is safe today could be hacked and its visitors could be served with latest malware. What I'm curious about is what checks can we ...
23
votes
6answers
23k views

How to scan a PDF for malware?

Can anyone suggest an automated tool to scan a PDF file to determine whether it might contain malware or other "bad stuff"? Or, alternatively, assigns a risk level to the PDF? I would prefer a free ...
2
votes
1answer
105 views

Malware (internet connectivity) and defending against it

I was wondering whether anyone knew if malware could spread without internet connectivity? Also, can you defend against malware by releasing counter-malware that spreads exploiting the same ...
9
votes
4answers
3k views

How to detect Meterpreter and similar malware?

Is it possible to find Meterpreter or similar malware which doesn't modify the hard disk but is only stored in RAM? Most common anti-rootkit software like rkhunter and chkrootkit don't find it.
0
votes
1answer
42 views

What kinds of PE file infection can AV software detect?

I wonder what kind of infections AV software is capable of detecting: only if the file is signed? also if the entry point isn't changed? does it also have hashes for non system files? what if the ...
2
votes
1answer
72 views

Has an antivirus ever failed to detect malware for “non-technical” reasons? [closed]

I'm wondering if an antimalware vendor has ever whitelisted (or otherwise failed to detect) a piece of malware because the author/sponsor either paid them, threatened them, or legislated against them. ...
21
votes
2answers
3k views

Can a Trojan hide itself, so its activity doesn't appear in task manager process? [duplicate]

Can malicious software hide itself, so its activity doesn't appear in the list of processes from Task Manager? Can it hide itself so when someone is controlling your computer, even if you open Task ...
0
votes
3answers
2k views

How to detect the so-called “undetectable” Gameover Zeus?

The media are currently (and have been) creating a huge ruckus surrounding the supposedly "undetectable" Gameover Zeus malware. The Daily Mail The Mirror The Independant PC World The Telegraph ...
3
votes
1answer
67 views

Any reason for a user to use an email scanner if they don't use any offline mail clients?

I typically recommend that users enable a real-time email scanner (aka a mail shield) in order to detect a possible vector used by malware. Even if they don't use an email application, the rationale ...
14
votes
7answers
1k views

How is it possible to embed executable code in an image

I was reading up on FireEye and came across this NYTimes article detailing a Skype chat where an image was sent that was laden with malware: Quote: To gain access to information on the ...
2
votes
2answers
76 views

Virus - by-pass with binairies repackaging

Why don’t « hackers » (or more accurately, « virus maker ») just do repackaging over their malware to by-pass antivirus software? Because it resolves the issue of the virus signature (kind of hash), ...
0
votes
3answers
100 views

It is possible detecting threat by only with file information?

It is possible detecting threat by only with file information of a file like file's hash(md5,sha1,sha256, etc), file size, mime type, etc with ClamAV or Comodo AV for linux with shell command? It ...
1
vote
3answers
82 views

Gaming Mods Security Risks

I read the following post, and while the questions was specific to SkyRim, the more general answer was that it depends on the game. I wanted to pose a more generic question here to the security folks. ...
1
vote
2answers
457 views

Do thin-clients need antivirus?

I've just taken over as IT Manager in an environment where most of the end-users are using HP-based Win7 thin clients (approx 50 seats) to access a remote desktop server. All the servers & fat ...
1
vote
0answers
77 views

Detecting reflective DLL injection any other ways?

any way to detect it? maybe using mcafee hips rules? Are there any known Techniques to detect it ? like walking the VAD tree or something?
2
votes
1answer
273 views

How is the file overlay read by an exe/virus?

According to what I know ,Overlay is the part of PE file that is not covered by the PE header and therefore isn't part of the virtual image in the Loaded PE. My question is if the overlay is not ...
3
votes
3answers
85 views

Remove pdf malware by re-printing to new pdf or text extract?

Consider you have a suspicious pdf file that might contain malware. Would it be sufficient to either: (1) open the pdf file in a virtual environment and let the pdf viewer or pdf-creator program ...
2
votes
1answer
112 views

Will 3rd party antivirus/antimalware programs compromise OSX's built-in security?

There is a very interesting post written by @TechZen. Here's the excerpt from the original post (bold emphasis mine) Should I get an antivirus for my Mac? There's never been a an actual Mac OS X ...
3
votes
6answers
140 views

When is an antivirus program needed/useful?

Let's say I buy a computer and use the internet for services but rarely download anything and when I do it is from legitimate sources with a minimal to non-existent chance of malware. What benefits ...
1
vote
1answer
97 views

Why is there a path to a .pdb file in an exe I am trying to reverse?

My query is ,if I'm seeing a .pdb path in a exe(VC++) what conclusion can I draw from it.Why does the exe have these paths and does it have significance in malware analysis? eg ...
8
votes
4answers
8k views

Why Adobe is recommending McAfee security scan during flash player installation?

Why is Adobe recommending a McAfee security scan during the installation of flash player?
1
vote
2answers
100 views

Any “cleaned” virus that's been successfully re-released?

Anti-malware software has to keep track of all bad software there is. To ease this load, it seems like a good idea to stop looking for threats that's been dead for years. Is there any example of some ...
0
votes
1answer
247 views

What is the difference between YARA and CLAMAV?

Can any one explain the difference between YARA and ClamAV ? Are they just two different ways of writing AV or Malware signatures ?
-1
votes
2answers
189 views

Open Source Malware Scanner/Cleaner [closed]

What is the best Open Source Malware Scanner/Cleaner? Malware-bites is good but it requires licensing for companies.
0
votes
1answer
337 views

Find and kill process that create malicious connections

State Recv-Q Send-Q Local Address:Port Peer Address:Port FIN-WAIT-1 0 3640 my.public.ip.xx:https xxx.xx.xxx.xx:56206 SYN-SENT 0 1 ...
1
vote
1answer
148 views

Efficacy of self-made ransomware protection

I was recently wondering about how to circumvent malware such as the infamous Cryptolocker a while back and was wondering about the efficacy of having a set of files with known content in a known ...
2
votes
1answer
63 views

When does it make sense to whitelist some subdomains but not others for a given domain?

Little Snitch has been useful to get a better handle on all the connections my computer tries to make. It's main dialog to allow or deny connections allows customizing (e.g. require specific port, or ...
42
votes
8answers
7k views

Can we trust antivirus software?

There are a lot of free antivirus software and free versions of commercial anti-malwares. Can we really trust these free antivirus programs? The same question about commercial antivirus software. ...
3
votes
1answer
1k views

Enterprise Anti-virus for Linux?

I know this question is probably at risk of offending the guidelines but our IaaS provider was unable to offer us an anti-virus solution for our Linux servers. We are deployed in an enterprise cloud ...
5
votes
3answers
5k views

Javascript Malware: How does it work, and how can it be mitigated?

I am wondering how malware gets served through Javascript. I've noticed a few illegitimate pop-ups while visiting some financial websites. I wonder how malware exploits work against the application ...
16
votes
8answers
2k views

Are signature based antivirus or antimalware effective?

Are signature based antivirus or antimalware solutions effective? Has the battle been lost against the ever increasing amount of malware, particularly rootkits, that are in the wild?
0
votes
1answer
86 views

Google safe browsing vs traditional anti-malware scanners

What is the difference between using Google Safe Browsing and using other traditional anti-webmalware tools ? Which one is more efficient to protect against malicious web content ?
12
votes
8answers
2k views

Are antiviruses still useful? [duplicate]

Are anti-viruses useful nowadays ? Given the number of viruses that are developed and spread monthly, and given the fact anti-viruses are based on virus signatures, I wonder how much it is useful and ...
0
votes
1answer
59 views

Questions about common exploits

I'm investigating the state of my MacBook Pro which I know was compromised, and do not know if I removed the exploits completely (and I realize, technically will never know this). I'm trying to hone ...
0
votes
1answer
91 views

malicious website blocked - on a legit program?

I'm fairly okay with PCs but when it comes to networking i'm quite lost with the details. My brother started up Mount and blade war band napleonic wars - an official game and played multi player and ...
2
votes
0answers
108 views

Are there any known cases were antivirus software have deliberately ignored malware?

Are there any known cases were antivirus companies for some reason have choosen to make their product allow/ignore malicious software? The reason could be government coercion or former trustworthy ...
0
votes
1answer
276 views

How safe is virtual box without internet [duplicate]

I am running a windows 7 virtual box without internet connected. Internet is, however, connected to the host, and I allow any internet access to and from the host. On the guest platform I am working ...
1
vote
1answer
85 views

Detecting code source variants of the same function [closed]

Suppose I have this JavaScript malicious function f1() : <SCRIPT type="text/javascript"> function f1(){ a=1; b=2; c=a+b; } </SCRIPT> This function is embedded within a larger ...
5
votes
2answers
462 views

Signature-based antiviruses

Do signature-based antiviruses search for the exact matches of the signatures they have in their database with those of viruses to analyse ? I ask this question because I wonder if it is the reason ...
1
vote
1answer
156 views

Malware infected ATMs in China via specialized device

Hackers inserted a specialized device which was connected to the notebook into the card reader slot on the ATM and installed malicious software. 100 thousand US dollars were stolen from at least seven ...