Antivirus or anti-virus software is used to prevent, detect, and remove malware, including but not limited to computer viruses, computer worm, trojan horses, spyware and adware.
56
votes
15answers
3k views
How to write an email regarding IT Security that will be read, and not ignored by the end user?
I've observed that several of our users are ignoring messages sent from IT Security managers, and also the system generated "You just sent a virus" notifications.
The problem seems to be among people ...
48
votes
10answers
4k views
How do you explain the necessity of “nuke it from orbit” to management and users?
When a machine has been infected with malware, most of us here immediately identify the appropriate action as "nuke it from orbit" - i.e. wipe the system and start over. Unfortunately, this is often ...
26
votes
2answers
985 views
How do antiviruses scan for thousands of malware signatures in a short time?
Most antiviruses have hundreds of thousands or even millions of malware signatures and yet they scan many files in a reasonable short time with high detection rates. Even real-time scanners doesn't ...
19
votes
2answers
471 views
Cohen's problem
Fred Cohen determined theoritically that viral detetction is an undecidable problem. Can anyone provide an intuitive reasoning for that?
Background
Fred Cohen experimented with computer viruses ...
18
votes
4answers
1k views
Are anti-virus companies companies regularly committing software piracy?
As Mikko Hypponen highlighted in a recent tweet, anti-Virus companies collect and store both samples of malicious software and samples of legitimate software:
This got me to thinking, what ...
17
votes
6answers
455 views
How to deal with a person who gets easily fooled by internet and mail scams?
alternative title: How to deal with a person who has gotten paranoid and doesn't want to go online anymore?
A person, who has over the years been scammed many times, by bad spam/fraud emails, and ...
16
votes
3answers
536 views
Are older viruses removed from virus definition files?
Antivirus software receives constant updates in the form of virus definition files, containing the patterns used to identify viruses. It is a feature present on most (if not all) major AV for at least ...
14
votes
5answers
823 views
Why would a virus writer bother to check to see if a machine is infected before infecting it?
I was looking at the tripartite structure of a virus, and it seems to check to see if a computer is infected before infecting it with the virus. Would this be an attempt to use files that are already ...
13
votes
6answers
6k views
How to scan a PDF for malware?
Can anyone suggest an automated tool to scan a PDF file to determine whether it might contain malware or other "bad stuff"? Or, alternatively, assigns a risk level to the PDF?
I would prefer a free ...
13
votes
2answers
2k views
How does a crypter for bypass antivirus detection work?
I am talking about crypters used to encrypt files like viruses and keyloggers for the sole purpose of bypassing antivirus detection. How do they work?
12
votes
8answers
885 views
Are signature based antivirus or antimalware effective?
Are signature based antivirus or antimalware solutions effective? Has the battle been lost against the ever increasing amount of malware, particularly rootkits, that are in the wild?
12
votes
4answers
606 views
How is a worm different from a virus?
In spite of various online articles, I'm a bit unclear on the distinction between a "worm" and a "virus".
Two related questions--
Is there a useful and clear distinction here or no? If so, what is ...
10
votes
5answers
201 views
What are the areas to focus on to protect users and devices?
What are the areas or technologies to focus on to protect users and devices?
Are patching, antivirus and firewalls still the main areas?
How do you defend against attacks against vulnerabilities ...
10
votes
4answers
3k views
Does a webserver need an antivirus software installed?
In what cases does a webserver need an antivirus software installed?
When it is not required?
If it is required sometimes, what should be considered when choosing the right one to install?
(In my ...
9
votes
2answers
17k views
How serious is InstallIQ?
Background:
Recently I've seen hits for InstallIQ a "potentially unwanted application" from ESET. From what I can find it seems like this is an installer wrapper that asks people to install other ...
8
votes
6answers
867 views
Whats the probability of a personal computer being hacked?
For a normal computer user following these practices:
Have an up to date anti-virus with a firewall installed (Norton).
Do not install cracked software.
Do not open suspicious links or download ...
8
votes
1answer
300 views
How do anti-virus apps for Android work?
There seems to be a lot of anti-virus apps for Android. On a desktop or server an anti-virus must run with super-user privileges, however I am pretty sure these mobile anti-viruses are running as an ...
7
votes
2answers
255 views
Are there any independent organizations doing (publicly available) IT security research?
When looking up security risks on the net I find that all research being cited (if any is cited) always seems to come from the Anti-Malware companies. (just e.g., this article cites F-secure, AVG and ...
7
votes
3answers
250 views
Do any antivirus products use “canary files” to detect rootkits?
Recently, I've learned how some rootkits are able to hide certain files, services, etc. from programs in the kernel or user modes.
This got me wondering: Are there any antivirus programs, or other ...
7
votes
1answer
405 views
Have any viruses leveraging the GPU been discovered in the wild? What is the mitigation?
This news article from 2010 discusses how a GPU can be used by a virus to avoid detection by common anti-malware/anti-virus software. The idea is to obfuscate the virus payload and leverage the GPU's ...
6
votes
8answers
556 views
Battling Malware without spending money
Our environment consists of about 80 users running Windows 7. Previous to me showing up as a full time IT employee, the company had contracted an outsource IT solution. As part of their set up, they ...
6
votes
4answers
332 views
How can Antivirus differentiate between a Trojan and a normal remote desktop application software?
RAT (Remote Access Tool, e.g. Sub7) are considered malicious by Antivirus software. How can it distinguish between such patches and a client application for commercial software like NetSupport ...
6
votes
2answers
186 views
How do AV vendors choose malware names?
If you take a look at McAfee's recent malware page, you'll see that the names in the "Malware name" column aren't very human-readable: Downloader.a!cnz, W32/Autorun.worm.bgh, ...
5
votes
4answers
393 views
How bad is a source code leak for an antivirus?
I was reading that Symantec suffered a source code leak and I was wondering how bad this is for a anti-virus product. Do these products rely heavily upon "(in)Security Through Obscurity" or does it ...
5
votes
2answers
485 views
Antivirus for scanning anonymous file uploads
Since I have no experience with AV solutions on Unix-like environments, I would need help with suggestions on something that can be suitable for scanning files that are uploaded by anonymous users ...
5
votes
6answers
405 views
How can I tell whether this computer is part of a botnet?
One of the computers that I manage (in the family, not business) has a weird set of files in its boot: bash.exe, curl.exe, uname.exe, sed.exe, rm.exe, tail.exe, cut.exe, awk.exe, cat.exe, chmod.exe, ...
5
votes
1answer
282 views
What steps do you take to keep both your computer and internet browsing secure?
I am thinking about your browser setup, antivirus protection, vpn, browsing best-practices and so on.
4
votes
5answers
137 views
Should there be an anti-virus used on client provided files?
This is based on Stack Exchange podcast # 25.
I really don't understand why there would need to be virus checking on uploaded files. It would generally be a bad idea to execute anything which was ...
4
votes
1answer
146 views
Behaviourism and heuristics in AV
In one local magazine I read interview with Adrian Porcescu who is technical consultant in Kaspersky Lab.
Anyway, among other, he says their anti-virus uses behaviourism and heuristic control to ...
4
votes
2answers
95 views
Can a firewall tamper with email attachments?
I am using Thunderbird as an email client for managing my different email accounts. Yesterday my friend sent me an email with a PDF attachment. Today when I tried to open the attachment I get the ...
4
votes
1answer
120 views
Does anti-virus/security software protect against NTFS ADS?
I know that NTFS has features called ADS which may be used to hide malware. So does antivirus/security software, such as Norton 360, protect against this type of attack?
4
votes
2answers
173 views
Remotely fingerprint AV software on LAN machines?
Does anyone know of a method to fingerprint machines in the LAN and find out what kind of AV software is installed?
4
votes
2answers
561 views
Antivirus, antimalware and antispyware software. What is the difference?
What is the difference between antivirus, antimalware and antispyware software? If any clear distinction can be defined.
4
votes
2answers
972 views
How to scan USB drive with clamav on Linux
Is there a way to scan the entire drive including auto-run and all partitions, including the master boot record (MBR)?
4
votes
3answers
248 views
How do anti-virus & anti-malware programs protect themselves?
I would assume that A/V products would need to employ the same kinds of techniques used by the software they are trying to cleanse to ensure that they can continue to run in such hostile environments. ...
4
votes
1answer
137 views
How does my antivirus determine which CTL is used?
I have imported a trusted root certificate into the Windows local machine list. This works fine with my signed certificates, unless my AV (Bitdefender Antivirus Plus 2012) is set to "scan SSL", in ...
3
votes
4answers
260 views
What is the purpose of EICAR?
For as long as can remember, EICAR has been used to test for the presence of Antivirus systems in email, the file system, or other places.
Sometimes the AV solution is so far out of date, that its ...
3
votes
3answers
340 views
How do polymorphic/metamorphic/self-encrypting/self-changing file infectors know if they have infected a file or not?
If a virus rewrites itself for each infection how would it know if it has infected a file or not? If it keeps infecting the same file soon the whole file structure will be corrupt. For example how ...
3
votes
4answers
216 views
Has any virus attempted to compromise the anti-virus database?
I was using an old version of Norton Anti Virus and the Live Update wouldn't run. The solution was to rename a file. This got me thinking if a virus could replace an anti-virus database with it's own ...
3
votes
1answer
264 views
How antivirus companies create virus defnitions for new outbreaks
This question quite amazes me. I dont understand how antivirus companies get info about the latest viruses. have they installed some kind of filters to monitor the internet traffic ?
Or they are ...
3
votes
4answers
1k views
Why Adobe is recommending McAfee security scan during flash player installation?
Why is Adobe recommending a McAfee security scan during the installation of flash player?
3
votes
2answers
466 views
Why do I get AV alerts when browsing a web page?
I'm using the latest version of Firefox and Windows is up to date. When I was browsing a webpage and clicked a link the browser displayed "connection has been reset" and AVAST poped-up saying "Alert!" ...
3
votes
5answers
1k views
What's a free recommended anti-spyware program for Windows? [closed]
Its been years since I installed an anti-spyware program. Keyloggers and other nasties might have gotten installed and so I'm looking for a program to flush them out. I used to use Spybot-S&D, but ...
3
votes
1answer
287 views
Is there a viable open source antivirus for OS/X?
I am interested in finding an antivirus program for the Mac, but not one from Symantec, because I don't trust them.
I wonder if perhaps there is an open source solution for antivirus for OS/X?
Or ...
3
votes
5answers
711 views
How can I know if my PC is getting infected?
I have installed an antivirus, but as no antivirus is perfect, what can I do to diagnose if my PC is getting infected?
For example, keeping a close eye on what programs and tasks run when I turn my ...
3
votes
2answers
108 views
When using a recovery disk, like AVGs boot-able CD, to scan for viruses, malware etc… what are the limitations?
What I like about about the boot-able CD concept, is it can connect to the Internet and get updates, however I'm not clear how effective they are at really finding things that are heuristic? How do ...
3
votes
2answers
142 views
Why some antiviruses detect viruses and some not?
I am curious why some anti-viruses detect viruses and some do not. From what I found online, antiviruses parse the binary files and check the sequence of code which is malicious(exists in virus ...
3
votes
2answers
283 views
What criteria do you use for evaluating Client-Side / Endpoint security products?
What features are important to you in client-side AV and Firewall products?
Who benefits from these features? Managment, the end user, helpdesk.
Are there features that are being 'sold' by the ...
3
votes
1answer
350 views
Should I install an antivirus on my mobile phone?
Is it advisable to install an antivirus for a mobile? I have recently purchased Note 2. Not too sure of how heavy application usage would I indulge into. But I would like to know if for safety ...
3
votes
1answer
235 views
Where can a virus or other malware “hide” on common PC and Mac hardware?
I'm looking for a detailed list of locations that viruses can "hide" in modern hardware even after a reboot.
Some things that come to mind include
Boot BIOS/Firmware
CPU Microcode
Connected PCI ...
