Antivirus or anti-virus software is used to prevent, detect, and remove malware, including but not limited to computer viruses, computer worm, trojan horses, spyware and adware.

learn more… | top users | synonyms

2
votes
4answers
211 views

Could antivirus programs not just scan all files upon creation?

Could antivirus programs not just scan all files as they are created instead of using on access scanning. Would this kind of approach not be much more scure?
1
vote
2answers
54 views

Anti-virus anonymity question

Many people pay for VPNs and select the VPN based on whether or not that VPN keeps logs of the user's activities and if so for how long. The motivation is privacy- they don't want their surfing habits ...
0
votes
1answer
18 views

What kinds of PE file infection can AV software detect?

I wonder what kind of infections AV software is capable of detecting: only if the file is signed? also if the entry point isn't changed? does it also have hashes for non system files? what if the ...
0
votes
0answers
7 views

Could somebody that has worked with ePolicy Orchestrator in VMWare provide a high level overview of the roles in the stack? [migrated]

E policy Orchestrator (EPO) is a McAfee product that manages AV MOVE apis. The EPO server works in conjunction with ESX and vcenter. VISUALLY I don't see the workflow of this entire process very ...
-1
votes
0answers
6 views

Problem with rebooting after rescue mode [migrated]

I recently went into rescue mode using bitdefender then I selected to reboot my computer. I am using windows 8 and bit defender total security. There is a black screen with text "reboot: Machine ...
8
votes
2answers
925 views

Are there / have there ever been viruses that completely evade virus scanners for very long?

Are there, or have there ever been viruses that completely evade all virus scanners for a long time (e.g. longer than a year?)
3
votes
1answer
63 views

Any reason for a user to use an email scanner if they don't use any offline mail clients?

I typically recommend that users enable a real-time email scanner (aka a mail shield) in order to detect a possible vector used by malware. Even if they don't use an email application, the rationale ...
0
votes
3answers
99 views

How to make undetectable malware [closed]

Fred Cohen in 1986 has proved in his Ph.D. thesis the undecidability of viral detection (no perfect virus checker can ever exist). My question is : Is it possible for a malware to stay very long time ...
0
votes
0answers
35 views

What can Android Antivirus apps really do? [duplicate]

I am studiying about android development and given the permission restriction between apps and isolation that the operating system itself imposes, I was wondering what can an antivirus app distributed ...
0
votes
1answer
233 views

How exactly do viruses get on computer when watching online porn? [duplicate]

I've been hearing that your computer could get infected when you visit porn sites, especially when watching videos. But how exactly do viruses get on client side? Is it by cache? Or maybe by ...
2
votes
2answers
68 views

Virus - by-pass with binairies repackaging

Why don’t « hackers » (or more accurately, « virus maker ») just do repackaging over their malware to by-pass antivirus software? Because it resolves the issue of the virus signature (kind of hash), ...
0
votes
3answers
70 views

It is possible detecting threat by only with file information?

It is possible detecting threat by only with file information of a file like file's hash(md5,sha1,sha256, etc), file size, mime type, etc with ClamAV or Comodo AV for linux with shell command? It ...
1
vote
3answers
64 views

Gaming Mods Security Risks

I read the following post, and while the questions was specific to SkyRim, the more general answer was that it depends on the game. I wanted to pose a more generic question here to the security folks. ...
4
votes
3answers
74 views

Does it matter which platform a file is scanned on for malware?

Different operating systems use different file types and file systems. Does it make a difference to a virus scan which system it is being run on and what type of malware it's looking for? I ask ...
1
vote
2answers
132 views

Do thin-clients need antivirus?

I've just taken over as IT Manager in an environment where most of the end-users are using HP-based Win7 thin clients (approx 50 seats) to access a remote desktop server. All the servers & fat ...
2
votes
1answer
114 views

Should anti-virus detect metasploit payloads?

As part of a workstation pen test, I copy a simple metasploit payload onto the workstation, and try to run it. Usually this is blocked by anti-virus software. However, sometimes it isn't (I won't name ...
1
vote
0answers
58 views

HTTP GET Request to a webpage that does not exist [closed]

I am seeing a machine is making a HTTP GET request to webpage (ex: www.sample.com/1.png), proxy devices respond with status code 407 (proxy auth required). But when I checked for the site via ...
1
vote
1answer
92 views

Has this method ever been used by viruses to check if system has already been infected?

I know the era of the self spreading worm is over, but has this mechanism for determining if a machine has already been infected or not ever been used? When a virus runs it checks to see if the ...
6
votes
3answers
2k views

Detected virus in pdf - should I be worried (CVE-2014-8449)?

I downloaded a pdf earlier, and I was trying to send it to my friend, but gmail said that it detected a virus. So I ran it through virustotal.com and only 1 out of 56 scanners came up with a virus - ...
2
votes
0answers
62 views

Should veil framework produce packed and obfuscated binaries which bypass virustotal?

I have been working with the veil framework to test an internal IDS system I have in place. I have used a public malware sample which produces an 8/53 hit score on Virustotal and run it through the ...
2
votes
1answer
160 views

How is the file overlay read by an exe/virus?

According to what I know ,Overlay is the part of PE file that is not covered by the PE header and therefore isn't part of the virtual image in the Loaded PE. My question is if the overlay is not ...
2
votes
1answer
84 views

Will 3rd party antivirus/antimalware programs compromise OSX's built-in security?

There is a very interesting post written by @TechZen. Here's the excerpt from the original post (bold emphasis mine) Should I get an antivirus for my Mac? There's never been a an actual Mac OS X ...
3
votes
6answers
117 views

When is an antivirus program needed/useful?

Let's say I buy a computer and use the internet for services but rarely download anything and when I do it is from legitimate sources with a minimal to non-existent chance of malware. What benefits ...
9
votes
1answer
93 views

Security measures and anti-virus on server to mitigate acting as a propagation vector

We have a web application for which I've been asked to add the ability to let users upload documents that will then be visible and downloadable by other users. Those documents will typically be images ...
8
votes
2answers
113 views

AV detection of signed malware

With the massive Sony leaks (including their private keys/certificate), i was wondering: How do major AVs deal with signed binaries? ie: Does it influence their detecting ability of the signed ...
1
vote
2answers
93 views

Any “cleaned” virus that's been successfully re-released?

Anti-malware software has to keep track of all bad software there is. To ease this load, it seems like a good idea to stop looking for threats that's been dead for years. Is there any example of some ...
0
votes
1answer
59 views

Is there vulnerabilities that are inherent to the concept of an open source antivirus? [closed]

I read that antivirus opensource software would be a good idea since the database could be informed and mainained by lots of capable people. However I have also read arguments to the contrary but none ...
0
votes
1answer
160 views

What is the difference between YARA and CLAMAV?

Can any one explain the difference between YARA and ClamAV ? Are they just two different ways of writing AV or Malware signatures ?
1
vote
1answer
38 views

What does “hosts-modifier” tag in VirusTotal Intelligence means?

I went through the help pages of VT and VT Intelligence, saw documentation about most tags, but couldn't find anything about the "hosts-modifier" tag, can anyone explain to me what does it mean?
14
votes
3answers
8k views

Why is 'avast! Web/Mail Shield Root' listed as CA for google.com?

I just noticed something weird in my browser: the certificate for www.google.com has been issued by avast! Web/Mail Shield Root. Should I be worried? I am using avast! Antivirus so it's probably a ...
23
votes
9answers
5k views

What makes it difficult to have a hardware antivirus

MS Windows is always vulnerable to virus and worms and having an antivirus is almost necessary. How is it possible that hardware antiviruses don't exist? The idea sounds pretty good, if the antivirus ...
0
votes
4answers
239 views

How can I scan hosted POP3 or IMAP e-mail for viruses?

In our company we use a hosting provider for e-mails and it seems they don't scan incoming email against viruses. And our employees does not very careful about attachments... So we deal with virus ...
0
votes
1answer
70 views

PCI Compliance - Antivirus in host and virtual environment?

We have a couple servers with a host system, and virtual DB and Web instances. Is it possible to be compliant with PCI if you install the Antivirus only on the host system, or does it need to be ...
-2
votes
1answer
60 views

Old e-mail text types itself back into PC later by itself? [closed]

Occasionally, I'll notice my Win7 PC is typing in text by itself. When I open Notepad leave it, the text being typed in is a snippet of text from an e-mail that I wrote and sent months ago to a friend ...
1
vote
2answers
270 views

“Threat: WMA:Wimad [Susp]” on .avi file, possible to remove threat and keep file?

I ran a full system scan this morning with all of my virus/malware programs and Avast detected 1 virus in an .avi file (which thankfully I have not yet watched): Severity: Medium Threat: WMA: Wimad ...
3
votes
2answers
3k views

Avast https scanning

How does Avast's https scanning feature work? Is it basically a MITM attack? This feature was enabled in the 2015 version released a few days back
0
votes
0answers
101 views

How can the .rsrc section of a PE used for evil?

I was doing some work with a bootable iso and ClamXav notified me that if found a potential security threat in one of the drivers, nvstor32.sys, located in the iso. I was really curious, so I googled ...
2
votes
4answers
84 views

Do I need antivirus for this unusual installation - or just firewall?

I'm donating an old Windows XP laptop to a school. The machine will spend its golden years doing only one thing - a process that consists of just three steps: Recording lectures and discussions ...
1
vote
2answers
116 views

Help understanding malware infection

I'm kind of a newbie to security and need help fully understanding how I would infect myself inadvertently. Let's say I was to download a .zip file attached to an email and I unzipped the contents. ...
28
votes
10answers
6k views

How to explain to a customer that spamfilters don't catch everything

I used to work in a small office which provided basic desktop support for users. One day I had to answer a call from a very angry customer and he asked for my boss. He wanted to know how could one ...
0
votes
2answers
60 views

How do I prove my proxy is scanning for viruses?

I have a proxy server in my DMZ that among other tasks has the role of scanning incoming messages - email, SOAP - for viruses. How do I prove to my team leader that it is performing this role on all ...
0
votes
0answers
181 views

Application Privilege Control in Kaspersky blocks program with no digital signature

I made a small application that displays hello world to the console output and attempted to open it in another computer that had Kaspersky fully updated. When I ran the application, Kaspersky gave a ...
5
votes
2answers
110 views

Are malware detection rulesets publicly discoverable?

I am uncertain about how public malware detection rulesets are? By a "ruleset" I mean the rules, usually written in Yara, that malware detection engines use to determine whether a file or memory ...
18
votes
1answer
640 views

EICAR Virus Test maliciously used to delete logs?

Today at work I was asked to test our anti-virus software on our Linux servers. I attempted to create a text file containing the EICAR Virus Test signature. The file was deleted instantly, ...
3
votes
1answer
114 views

How exactly are new viruses discovered?

When Evil McJones develops Virus X and initiates its propagation, what events must transpire for AV companies (and AV testing/validation companies) to recognize Virus X? This answer to this question ...
1
vote
2answers
337 views

Does the EICAR test work on Linux based antivirus scanners?

Does the EICAR antivirus test work on antivirus scanners for Linux? The EICAR test is described in more detail here: http://en.wikipedia.org/wiki/EICAR_test_file The reason I ask is that it requests ...
1
vote
1answer
797 views

Bitdefender Antivirus SSL Cert substitution

I am using Bitdefender AV 2013 ed and I have noticed that when the Scan SSL is enabled in the configuration BD will use a local certificate, as mentioned here. This modifies the cert chain with BD as ...
2
votes
2answers
636 views

Antivirus settings: delete or quarantine the file?

I understand that most antiviruses by default quarantine infected files. I have changed it to remove all infected files immediately. Would this cause more harm than good?
30
votes
6answers
4k views

Can malware be dangerous even when quarantined?

I am reading a book on network security and when talking about user confusion it writes: "It is not uncommon for a user to be asked security questions such as Is it safe to quarantine this ...
11
votes
8answers
2k views

Are antiviruses still useful? [duplicate]

Are anti-viruses useful nowadays ? Given the number of viruses that are developed and spread monthly, and given the fact anti-viruses are based on virus signatures, I wonder how much it is useful and ...