Software which includes anti-spyware, anti-rootkit, anti-phishing, and other technologies that attempt to identify and/or block malicious programs.

learn more… | top users | synonyms

42
votes
8answers
8k views

Can we trust antivirus software?

There are a lot of free antivirus software and free versions of commercial anti-malwares. Can we really trust these free antivirus programs? The same question about commercial antivirus software. ...
36
votes
2answers
6k views

How do antiviruses scan for thousands of malware signatures in a short time?

Most antiviruses have hundreds of thousands or even millions of malware signatures and yet they scan many files in a reasonable short time with high detection rates. Even real-time scanners doesn't ...
35
votes
8answers
16k views

Are two anti-virus better than one in protecting your computer?

A century old adage: The more the merrier. In general, does this adage hold true in regards to the number of anti-virus software you should have on your PC? Are there any limits before it actually ...
23
votes
6answers
25k views

How to scan a PDF for malware?

Can anyone suggest an automated tool to scan a PDF file to determine whether it might contain malware or other "bad stuff"? Or, alternatively, assigns a risk level to the PDF? I would prefer a free ...
22
votes
3answers
2k views

Could malware move during a scan to avoid detection?

I think every AV-Scanner is using some predictable recursive scan to search files for malware. Couldn't malware easily detect a scan and just move to an already checked location, determined by knowing ...
22
votes
1answer
970 views

CSS based attacks

I'm currently working on a plugin for a CMS which should allow content editors to write inline style tags. I'm looking for advice / links on how inline styles could be abused. Part of the reason ...
21
votes
2answers
3k views

Can a Trojan hide itself, so its activity doesn't appear in task manager process? [duplicate]

Can malicious software hide itself, so its activity doesn't appear in the list of processes from Task Manager? Can it hide itself so when someone is controlling your computer, even if you open Task ...
21
votes
2answers
3k views

How would one know if they have a rootkit?

Are they impossible to detect? Seeing as the attacker has admin rights and could modify anti virus software that might otherwise be used to detect or circumvent a root kit. Are there certain red flags ...
20
votes
4answers
3k views

Reverse engineering malware/viruses

Assuming a machine has malware, regardless of how it got there, one thing I would like to learn to do is to take the binary file and reverse engineer it to see what the malware is doing/has already ...
18
votes
4answers
674 views

Malware - are removal tools acceptable or is bare metal re-install the only safe option?

I see a number of companies offering "malware removal" services. I see some software that claims to be able to remove malware from an infected machine. Is using a removal software tool to 'clean' an ...
17
votes
8answers
2k views

Are signature based antivirus or antimalware effective?

Are signature based antivirus or antimalware solutions effective? Has the battle been lost against the ever increasing amount of malware, particularly rootkits, that are in the wild?
14
votes
7answers
2k views

How is it possible to embed executable code in an image

I was reading up on FireEye and came across this NYTimes article detailing a Skype chat where an image was sent that was laden with malware: Quote: To gain access to information on the ...
12
votes
8answers
2k views

Are antiviruses still useful? [duplicate]

Are anti-viruses useful nowadays ? Given the number of viruses that are developed and spread monthly, and given the fact anti-viruses are based on virus signatures, I wonder how much it is useful and ...
11
votes
4answers
2k views

How effective are anti-virus products against real-world threats?

In a recent interview† with Dave Kennedy, he in passing pegged the average effectiveness of anti-virus products as detecting approximately 3% to 5% of current active threats. While AV comparisons ...
11
votes
3answers
4k views

Detecting reflective DLL injection

In the past few years, malware (and some pen-test tools like Metasploit's meterpreter payload) have begun to use reflective DLL injection (PDF) to load a DLL into the memory of a process. The benefit ...
10
votes
2answers
467 views

Is email more secure when not letting any zipped content through?

Ah. This is a bit of a soft question, but I though there might be some here that can share some insight. I'm a developer. Sometimes I need to send a (bugfixed) DLL or EXE file to a customer. If this ...
9
votes
4answers
8k views

Why Adobe is recommending McAfee security scan during flash player installation?

Why is Adobe recommending a McAfee security scan during the installation of flash player?
9
votes
8answers
784 views

Battling Malware without spending money

Our environment consists of about 80 users running Windows 7. Previous to me showing up as a full time IT employee, the company had contracted an outsource IT solution. As part of their set up, they ...
9
votes
4answers
3k views

How to detect Meterpreter and similar malware?

Is it possible to find Meterpreter or similar malware which doesn't modify the hard disk but is only stored in RAM? Most common anti-rootkit software like rkhunter and chkrootkit don't find it.
8
votes
3answers
1k views

Using MD5 for malware ids: collision attack risks?

It has been known since 2004 that the MD5 hash is vulnerable to collision attacks (update - not "preimage" attacks - my mistake....). Yet it still seems that people are using it to identify malware. ...
8
votes
2answers
368 views

Are there any independent organizations doing (publicly available) IT security research?

When looking up security risks on the net I find that all research being cited (if any is cited) always seems to come from the Anti-Malware companies. (just e.g., this article cites F-secure, AVG and ...
7
votes
2answers
1k views

Antivirus, antimalware and antispyware software. What is the difference?

What is the difference between antivirus, antimalware and antispyware software? If any clear distinction can be defined.
7
votes
1answer
917 views

Have any viruses leveraging the GPU been discovered in the wild? What is the mitigation?

This news article from 2010 discusses how a GPU can be used by a virus to avoid detection by common anti-malware/anti-virus software. The idea is to obfuscate the virus payload and leverage the GPU's ...
6
votes
6answers
6k views

How can I tell whether this computer is part of a botnet?

One of the computers that I manage (in the family, not business) has a weird set of files in its boot: bash.exe, curl.exe, uname.exe, sed.exe, rm.exe, tail.exe, cut.exe, awk.exe, cat.exe, chmod.exe, ...
6
votes
3answers
2k views

Possible to detect packed executable?

A packer is a way of obfuscating an executable program, i.e., transforming so the result is still executable and has the same effect when run, but looks different (so it won't be detected by static ...
5
votes
3answers
2k views

vt-d Virtualisation and Trusted Execution Technology

Being a long time VirtualBox user and having recently purchased a new laptop equipped with an intel i7 720QM I discovered that it supported vt-d. In the meantime I've found out that vt-d comes with ...
5
votes
2answers
469 views

Signature-based antiviruses

Do signature-based antiviruses search for the exact matches of the signatures they have in their database with those of viruses to analyse ? I ask this question because I wonder if it is the reason ...
5
votes
3answers
6k views

Javascript Malware: How does it work, and how can it be mitigated?

I am wondering how malware gets served through Javascript. I've noticed a few illegitimate pop-ups while visiting some financial websites. I wonder how malware exploits work against the application ...
5
votes
7answers
439 views

Malicious Websites

Just wanted to get everyone's opinion on this. In Information Security, you get various alerts about particular machines on your network going to sites and/or IPs that have been flagged as ...
5
votes
3answers
642 views

How do anti-virus & anti-malware programs protect themselves?

I would assume that A/V products would need to employ the same kinds of techniques used by the software they are trying to cleanse to ensure that they can continue to run in such hostile environments. ...
4
votes
4answers
1k views

To what extent is FREE 3rd party antivirus software better than Windows 8 defender (if any)?

As someone who is not in a position to currently purchase an antivirus suite, I would like to know if having a free Avira or Avast or similar program is worth the overall system performance drop (I ...
4
votes
3answers
135 views

Duqu and other reference material for security people

I would like to read more on Duqu and similar exploits when they appear. The problem is that most references from google are for laymen. Isn't there a reference website or... that reports on these ...
4
votes
1answer
895 views

Icesword rootkit detector, How does it work?

I'm curious about how I can learn more about icesword rootkit detector. I've only used it and never studied it myself. Ive always been curious how it works. As far as I understand it works by ...
4
votes
3answers
489 views

How can I recognize and find file(s) dropped by malware?

Suppose I am doing malware analysis. How can I recognize if, during the analysis process, a piece of malware dropped a file in my system, and if so, the path of the file? What are the procedures, ...
4
votes
1answer
357 views

What is behaviourism and heuristic control in anti-virus software and how does it work?

In one local magazine I read interview with Adrian Porcescu, who is a technical consultant that works for Kaspersky Lab. Among other things, he says their anti-virus uses behaviourism and heuristic ...
4
votes
2answers
4k views

Cryptolocker: can servers be protected?

I'm IT in a small company. The network is about as ancient as most of the staff (at 30, I'm the company's youngest), and the staff also is notorious for spreading viruses around the network despite ...
4
votes
1answer
1k views

Where can a virus or other malware “hide” on common PC and Mac hardware?

I'm looking for a detailed list of locations that viruses can "hide" in modern hardware even after a reboot. Some things that come to mind include Boot BIOS/Firmware CPU Microcode Connected PCI ...
4
votes
1answer
211 views

firewall with cloud based malware analysis risks

Palo Alto, and probably others firewalls will offer it, has a feature to do malware analysis in a separate (cloud-based) process that does not impact stream processing. What I would like which risks ...
4
votes
2answers
929 views

How can NSA implants and backdoors be detected? [closed]

It has been a while now since the Snowden revelations of various NSA malware and backdoors. For instance: March 12, 2014: NSA has developed implants to take over targeted computers’ microphones ...
3
votes
1answer
1k views

Enterprise Anti-virus for Linux?

I know this question is probably at risk of offending the guidelines but our IaaS provider was unable to offer us an anti-virus solution for our Linux servers. We are deployed in an enterprise cloud ...
3
votes
1answer
2k views

What are the methods to find hooked functions and APIs?

Many malware executables use hooking to be invisible. I am familiar with some hooking methods, I'm not sure what methods exist for detecting them. Is there a way to tell when a function call has been ...
3
votes
2answers
8k views

Does Chrome OS Allow Executable Files?

My company has some real security issues and I am wondering if using Chrome OS can be some solution to my problem. Typical Windows computers seems all to vulnerable to attacks from malicious images ...
3
votes
6answers
151 views

When is an antivirus program needed/useful?

Let's say I buy a computer and use the internet for services but rarely download anything and when I do it is from legitimate sources with a minimal to non-existent chance of malware. What benefits ...
3
votes
1answer
245 views

How can I assess the trust worthiness of a browser add-on?

Having learned a bit more about what add-ons/extensions can do in Firefox, I want to minimize my risk and use some safer mechanism to download videos (FLV in particular) for later viewing. ...
3
votes
2answers
617 views

Why does Antivirus Softwares have an Issue with EXE Packers

Im trying to pack an Executable using an Exe Packer like UPX.I packed and checked the File with VirusTotal.com.Here some 9 Antivirus Products say its a Virus actually its a harmless exe.I think the AV ...
3
votes
2answers
58 views

apple.com exploit attempt?

I recently browsed to apple.com; and the page crashed a few times, then after I reloaded I was given this alert after my browser attempted to redirect to ...
3
votes
1answer
103 views

How do I instantly disconnect from my ISP during an exploit or suspicious activity?

When I was using "Zone Alarm Security" under Windows 98 SE, there was a toggle link feature under Zone Alarm, whereby I could instantly sever connectivity to the web, while a suspicious exploit was ...
3
votes
1answer
68 views

Any reason for a user to use an email scanner if they don't use any offline mail clients?

I typically recommend that users enable a real-time email scanner (aka a mail shield) in order to detect a possible vector used by malware. Even if they don't use an email application, the rationale ...
3
votes
3answers
114 views

Remove pdf malware by re-printing to new pdf or text extract?

Consider you have a suspicious pdf file that might contain malware. Would it be sufficient to either: (1) open the pdf file in a virtual environment and let the pdf viewer or pdf-creator program ...
3
votes
2answers
152 views

Can full disk encryption make malware recovery more difficult?

Let us say that we have a computer with a fully encrypted disk. If it gets infected with malware, does this make it more difficult to use a LiveCD or other rescue option to clean it or restore it? It ...