Software which includes anti-spyware, anti-rootkit, anti-phishing, and other technologies that attempt to identify and/or block malicious programs.

learn more… | top users | synonyms

32
votes
8answers
4k views

Are two anti-virus better than one in protecting your computer?

A century old adage: The more the merrier. In general, does this adage hold true in regards to the number of anti-virus software you should have on your PC? Are there any limits before it actually ...
29
votes
2answers
2k views

How do antiviruses scan for thousands of malware signatures in a short time?

Most antiviruses have hundreds of thousands or even millions of malware signatures and yet they scan many files in a reasonable short time with high detection rates. Even real-time scanners doesn't ...
20
votes
2answers
1k views

How would one know if they have a rootkit?

Are they impossible to detect? Seeing as the attacker has admin rights and could modify anti virus software that might otherwise be used to detect or circumvent a root kit. Are there certain red flags ...
19
votes
6answers
14k views

How to scan a PDF for malware?

Can anyone suggest an automated tool to scan a PDF file to determine whether it might contain malware or other "bad stuff"? Or, alternatively, assigns a risk level to the PDF? I would prefer a free ...
18
votes
4answers
2k views

Reverse engineering malware/viruses

Assuming a machine has malware, regardless of how it got there, one thing I would like to learn to do is to take the binary file and reverse engineer it to see what the malware is doing/has already ...
18
votes
1answer
449 views

CSS based attacks

I'm currently working on a plugin for a CMS which should allow content editors to write inline style tags. I'm looking for advice / links on how inline styles could be abused. Part of the reason ...
17
votes
4answers
533 views

Malware - are removal tools acceptable or is bare metal re-install the only safe option?

I see a number of companies offering "malware removal" services. I see some software that claims to be able to remove malware from an infected machine. Is using a removal software tool to 'clean' an ...
15
votes
8answers
1k views

Are signature based antivirus or antimalware effective?

Are signature based antivirus or antimalware solutions effective? Has the battle been lost against the ever increasing amount of malware, particularly rootkits, that are in the wild?
10
votes
4answers
906 views

How effective are anti-virus products against real-world threats?

In a recent interview† with Dave Kennedy, he in passing pegged the average effectiveness of anti-virus products as detecting approximately 3% to 5% of current active threats. While AV comparisons ...
10
votes
2answers
432 views

Is email more secure when not letting any zipped content through?

Ah. This is a bit of a soft question, but I though there might be some here that can share some insight. I'm a developer. Sometimes I need to send a (bugfixed) DLL or EXE file to a customer. If this ...
8
votes
3answers
990 views

Using MD5 for malware ids: collision attack risks?

It has been known since 2004 that the MD5 hash is vulnerable to collision attacks (update - not "preimage" attacks - my mistake....). Yet it still seems that people are using it to identify malware. ...
8
votes
1answer
2k views

Detecting reflective DLL injection

In the past few years, malware (and some pen-test tools like Metasploit's meterpreter payload) have begun to use reflective DLL injection (PDF) to load a DLL into the memory of a process. The benefit ...
7
votes
8answers
629 views

Battling Malware without spending money

Our environment consists of about 80 users running Windows 7. Previous to me showing up as a full time IT employee, the company had contracted an outsource IT solution. As part of their set up, they ...
7
votes
2answers
301 views

Are there any independent organizations doing (publicly available) IT security research?

When looking up security risks on the net I find that all research being cited (if any is cited) always seems to come from the Anti-Malware companies. (just e.g., this article cites F-secure, AVG and ...
7
votes
1answer
715 views

Have any viruses leveraging the GPU been discovered in the wild? What is the mitigation?

This news article from 2010 discusses how a GPU can be used by a virus to avoid detection by common anti-malware/anti-virus software. The idea is to obfuscate the virus payload and leverage the GPU's ...
6
votes
2answers
789 views

Antivirus, antimalware and antispyware software. What is the difference?

What is the difference between antivirus, antimalware and antispyware software? If any clear distinction can be defined.
6
votes
2answers
308 views

Possible to detect packed executable?

A packer is a way of obfuscating an executable program, i.e., transforming so the result is still executable and has the same effect when run, but looks different (so it won't be detected by static ...
5
votes
3answers
922 views

vt-d Virtualisation and Trusted Execution Technology

Being a long time VirtualBox user and having recently purchased a new laptop equipped with an intel i7 720QM I discovered that it supported vt-d. In the meantime I've found out that vt-d comes with ...
5
votes
5answers
4k views

Why Adobe is recommending McAfee security scan during flash player installation?

Why is Adobe recommending a McAfee security scan during the installation of flash player?
5
votes
6answers
2k views

How can I tell whether this computer is part of a botnet?

One of the computers that I manage (in the family, not business) has a weird set of files in its boot: bash.exe, curl.exe, uname.exe, sed.exe, rm.exe, tail.exe, cut.exe, awk.exe, cat.exe, chmod.exe, ...
5
votes
3answers
2k views

How to detect Meterpreter and similar malware?

Is it possible to find Meterpreter or similar malware which doesn't modify the hard disk but is only stored in RAM? Most common anti-rootkit software like rkhunter and chkrootkit don't find it.
5
votes
7answers
341 views

Malicious Websites

Just wanted to get everyone's opinion on this. In Information Security, you get various alerts about particular machines on your network going to sites and/or IPs that have been flagged as ...
5
votes
3answers
383 views

How do anti-virus & anti-malware programs protect themselves?

I would assume that A/V products would need to employ the same kinds of techniques used by the software they are trying to cleanse to ensure that they can continue to run in such hostile environments. ...
4
votes
3answers
129 views

Duqu and other reference material for security people

I would like to read more on Duqu and similar exploits when they appear. The problem is that most references from google are for laymen. Isn't there a reference website or... that reports on these ...
4
votes
1answer
645 views

Icesword rootkit detector, How does it work?

I'm curious about how I can learn more about icesword rootkit detector. I've only used it and never studied it myself. Ive always been curious how it works. As far as I understand it works by ...
4
votes
1answer
229 views

What is behaviourism and heuristic control in anti-virus software and how does it work?

In one local magazine I read interview with Adrian Porcescu, who is a technical consultant that works for Kaspersky Lab. Among other things, he says their anti-virus uses behaviourism and heuristic ...
4
votes
2answers
296 views

How can I recognize and find file(s) dropped by malware?

Suppose I am doing malware analysis. How can I recognize if, during the analysis process, a piece of malware dropped a file in my system, and if so, the path of the file? What are the procedures, ...
4
votes
1answer
548 views

Where can a virus or other malware “hide” on common PC and Mac hardware?

I'm looking for a detailed list of locations that viruses can "hide" in modern hardware even after a reboot. Some things that come to mind include Boot BIOS/Firmware CPU Microcode Connected PCI ...
4
votes
1answer
196 views

firewall with cloud based malware analysis risks

Palo Alto, and probably others firewalls will offer it, has a feature to do malware analysis in a separate (cloud-based) process that does not impact stream processing. What I would like which risks ...
3
votes
4answers
797 views

To what extent is FREE 3rd party antivirus software better than Windows 8 defender (if any)?

As someone who is not in a position to currently purchase an antivirus suite, I would like to know if having a free Avira or Avast or similar program is worth the overall system performance drop (I ...
3
votes
1answer
177 views

How can I assess the trust worthiness of a browser add-on?

Having learned a bit more about what add-ons/extensions can do in Firefox, I want to minimize my risk and use some safer mechanism to download videos (FLV in particular) for later viewing. ...
3
votes
2answers
377 views

Why does Antivirus Softwares have an Issue with EXE Packers

Im trying to pack an Executable using an Exe Packer like UPX.I packed and checked the File with VirusTotal.com.Here some 9 Antivirus Products say its a Virus actually its a harmless exe.I think the AV ...
3
votes
3answers
155 views

A way to secure hyperlinks on websites

How do you think could we secure hyperlinks pasted by users on website's forums, comments, blogs against bad links/leading to malware etc.? I thought about google safe browsing, projecthoneypot. Did ...
2
votes
2answers
100 views

Virus Removal Boot Disks — a few questions

I'm new to working with and using a backdoor/virus with a boot disk. Can they be mounted to a USB drive? What options are out there and what should I look for in one? Are they practical? Do they ...
2
votes
1answer
896 views

What are the methods to find hooked functions and APIs?

Many malware executables use hooking to be invisible. I am familiar with some hooking methods, I'm not sure what methods exist for detecting them. Is there a way to tell when a function call has been ...
2
votes
4answers
386 views

What is nuke it from orbit? [duplicate]

I was reading this Windows 2003 Enterprise infected by Conficker; post-infection problems continue And they talk about nuking it from orbit (which apparently means wiping out the system and starting ...
2
votes
3answers
3k views

Javascript Malware: How does it work, and how can it be mitigated?

I am wondering how malware gets served through Javascript. I've noticed a few illegitimate pop-ups while visiting some financial websites. I wonder how malware exploits work against the application ...
2
votes
2answers
109 views

What is the current best practice to secure an executive's laptop?

What is the current best practice to secure an executive's laptop? The exec will be processing highly sensitive documents (high-value bids, merger & acquisition info, technical specs). As such ...
2
votes
3answers
643 views

Cryptolocker: can servers be protected?

I'm IT in a small company. The network is about as ancient as most of the staff (at 30, I'm the company's youngest), and the staff also is notorious for spreading viruses around the network despite ...
2
votes
1answer
383 views

How does one test AV against zero-day malware?

Lately, I've read several articles about anti-malware software and one thing caught my eye - ability to detect zero-day attacks. In short - how does anti-malware / anti-virus industry test their own ...
2
votes
1answer
93 views

What metrics are available on malware?

All the main AV have a risk rating or severity level, how do they determine what is "low","high",etc.?
2
votes
2answers
404 views

Can a polymorphic/metamorphic worm use a mutex?

Can a polymorphic/metamorphic worm use (the same) mutex? This would solve the problem of grinding the network into the ground and consuming all resources with multiple instances of the worm. Is the ...
2
votes
2answers
494 views

Force AV Scan of USB drive vs. File-Access Scan

I have been evaluating MS Forefront Endpoint Protection 2010 vs. Kasperskey 2010. One of the major differences in features seems to be that Kasperskey gives the option to force the full scan of a USB ...
2
votes
1answer
930 views

how is BAT_VOBFUS (or similar) dangerous?

I was reading http://about-threats.trendmicro.com/malware.aspx?language=au&name=BAT_VOBFUS.SM earlier today after it turned up in a scan of a friends PC. I suppose I may be missing something vital ...
2
votes
1answer
131 views

How should I select an antimalware solution?

As I prepare to reinstall the software on my machine, I am currently reevaluating my choice of anti-malware software for home use. What factors should I be considering? How reputable are AV-test and ...
2
votes
1answer
100 views

Is there a website or free downloadable program to identify and remove malware from an ISO file?

Is there a website or free downloadable program that allows a user to identify and remove multiple types of malware from an ISO file?
2
votes
2answers
61 views

Can full disk encryption make malware recovery more difficult?

Let us say that we have a computer with a fully encrypted disk. If it gets infected with malware, does this make it more difficult to use a LiveCD or other rescue option to clean it or restore it? It ...
1
vote
1answer
259 views

Why does Microsoft Security Essentials remove Chrome in some situations?

According to Google, Microsoft Security Essentials is currently detecting some versions of the Chrome browser as malware. Could someone have hacked Google and put a virus into some Chrome updates? ...
1
vote
3answers
166 views

What is the safest way to copy a file from an untrusted system?

Scenario: There are two computers running GNU/Linux, U and T. U is untrusted and T is trusted. A non-executable file F (which may however have been infected with malware) resides on U. (For ...
1
vote
2answers
2k views

Does Chrome OS Allow Executable Files?

My company has some real security issues and I am wondering if using Chrome OS can be some solution to my problem. Typical Windows computers seems all to vulnerable to attacks from malicious images ...