Hot answers tagged antimalware
30
Antivirus detection is a feature extraction and a classification problem.
A great analogy is the 20 questions game where the goal is to identify an arbitrary object by asking 20 seemingly unrelated yes/no questions. The idea behind the game is that each answer would eliminate half of the objects so it is theoretically possible to describe 2^20 (1,048,576) ...
17
A signature-based detection system can't be the only solution, but it can be part of the solution. Indeed you'll find that a lot of the AV products that have behavioural detection and heuristic detection also still employ signature-based detection. It's simple, it's fast, the chances for false positives are very low. But the chances for false negatives are ...
13
Very easy.
Didier Stevens has provided two open-source, Python-based scripts to perform PDF malware analysis. There are a few others that I will also highlight.
The primary ones you want to run first are PDFiD (available another with Didier's other PDF Tools) and Pyew.
Here is an article on how to run pdfid.py and see the expected results; Here is another ...
13
It depends on how important the machine is. I know others say differently, but for my own machines, I always reinstall from scratch when I think something funny is going on. Given that AV scanners pick up only about 50% of malware on any given day (your stat may vary, but it's bad in any case), I'd be at least a little bit suspicious of removal tools too.
...
13
It actually depends a lot on the malware in question as to whether a removal tool is in fact a really feasible option. Whether said tool works or not depends on how much the author of the tool knew about the original malware and what it did.
To illustrate my point, take a look at something like Autoruns. There are a whole slew of ways to get your chosen ...
12
Malware signatures are unique values that indicate the presence of malicious code.
Simply speaking, When an anti-virus program scans your computer, it calculates the signature for a file (say like a hash), then compares that signature/hash to a list of known bad signatures.
Calculating a single hash of a file and then comparing it against a list of millions ...
10
False alarms of anti-malware are quite common because of the way these kind of software works and the theoretical limitations.
It is uncommon for anti-malware to have an exact copy of the malware included for a number of reasons:
There are many, many bad programs out there, so the anti-malware would be several hundreds of gigabytes in size.
Malware may ...
10
No, anti-malware packages will not detect every form of keylogger. They will detect known ones by hashing, and some may detect certain keylogger-like behaviour via heuristic analysis.
However, I strongly advise you against this. First off, it's insulting to your employees. If I found out my employer was doing such a thing, I'd resign on the spot. Secondly, ...
9
Hooks are implemented in a whole bunch of ways:
Modifying legitimate jump instructions to point at hooks instead of the normal code.
User call table (IAT) hooking - modifying the addresses of user-mode APIs in a process.
Kernel call table hooking (e.g. SSDT / GDT ) - replacing a call table pointer with the address of your hook.
WndProc hooks (e.g. ...
8
Please look at these videos at securitytube
http://securitytube.net/How-to-make-Files-Undetectable-by-Anti-Virus-video.aspx
http://www.securitytube.net/AV-Evasion-using-MSF3-Payloads-video.aspx
which both demonstrates how easy it is to avoid antivirus detection. Signature based antivirus needs to live on, but if they want to make a living it won't be ...
8
A quick analysis:
Threat: Somebody creates a clean file that matches a malicious file's MD5 hash.
Result: The clean file is identified as malicious, but is merely a collision. Another file that does match still exists and will always be identified as the same.
I suppose if this happens, there might be some talk about moving on. My guesses as to why we ...
8
tl;dr - compare the results of two functions that do the same thing, and look for differences.
Instead of focusing on that single rootkit scanner, I'm going to talk about generic techniques that rootkits use and how we can find them. This should give you a better overview of the challenges involved.
Rootkits work by intercepting certain system calls and ...
8
From the reviews I've seen of Windows 8 defender (which includes what was security essentials in Windows 7 and earlier), it's a pretty solid middle of the road A-V suite with some anti-spyware features.
I don't think that it's as fully featured as the paid for security suites, but then it is free.
From a personal perspective I use it as it seems fairly ...
7
First of all 'meterpreter' is not malware. I gather you mean how to detectet open meterpreter sessions between a compromised machine and the attacker.
Most antivirus can detect meterpreter payloads in memory - they are public, and thats why metasploit has special polymorphic engines to try to hide the payloads. A nice factoid: Commercial tools like canvas ...
7
Heuristic are:
learning techniques
common sense
discoveries
Their objective is to recognise a virus by analysing its code (not limited to). If a program is programmed to open a certain file, or to load/read certain memory address.
These methods are based on multiple criteria. They eventually can run program in virtual environment to monitor for known ...
7
Depending on what level you want to go to, the course Lenny Zeltser is doing at SANS is supposed to be very good.
Wes Brown gives a good talk here.
Paul Melson blogs about this kind of thing, and has a presentation up here.
But check the laws in your area - some types of reverse engineering are illegal in some jurisdictions, even if it is just for your ...
7
While in theory a malware infection could do this as part of it's payload, it's much more likely to be a buggy program that is writing too many log files. Malware tends to attack the disk by either deleting or encrypting existing files.
As a start, empty the temp folder and watch it to see exactly what files are being written. Note that lots of things are ...
6
It was lost when someone like your mom could lose her identity and payment cards to fraud.
I would say that, no, anti-virus and anti-malware have been very ineffective since the Windows buffer overflow in 1999. In 2010, they are adding fuel to the fire and make systems more insecure, and not just because they provide a false sense of security. They are ...
6
There are a gazillion independent organizations and people that publish information on computer security. The problem is not finding them; the problem is keeping track of all of these sources of information. Two example starting places include Bruce Schneier's blog and Krebs on Security.
If you think that all computer security research comes from ...
6
If you follow Full Disclosure (http://seclists.org/fulldisclosure/) and bugtraq (http://www.securityfocus.com/archive/1) mailing lists you can see that there are lots of security research by individuals or non-commercial entities.
You should join full disclosure and bugtraq mailing lists and also follow exploits and papers published by ...
6
Trusted Execution Technology is coupled with a collection of security features available on the modern Intel chipset. The Trusted Platform Module (TPM) and other DRM like features are also in this bundle. The reasoning behind this is because of abstraction, which is more commonly attributed to a software architecture. The commonality behind all of these ...
6
Introduction to Reverse Engineering Software - covers reverse engineering on both Linux and Windows. Haven't read it all the way through yet but seems to have some good coverage.
Malware Analysis and Antivirus Technologies is a course being at Aalto University in Helsinki. They have the Chief Research Officer from f-secure giving some lectures. The first ...
6
I am currently in your same situation as well. However, working in higher ed., our hands are tied behind our backs a bit. Removing admin rights for professors will never fly so we are going to limit user rights on administrative employees only. So far we've done the following;
Setup Wsus (great move)
Push(i know not the right term) updated group policy ...
6
Well, a bare executable is dangerous in that some users will try to execute it. They should not, they were told they must not, yet they do.
A Zip file, possibly renamed, containing possibly renamed executable files, is also dangerous because some users will rename files, do the unzip, and execute what they find within. They should not, they were told they ...
6
I think that your question (Will Antivirus detect keyloggers?) has been answered.
I'd like to take a step back and examine the broader issues - because sometimes the answer to a question isn't really the answer you're seeking.
First, I must respectfully disagree with @Polynomial's opinion. I think your core notion is fantastic. It doesn't matter what ...
5
From Joanna Rutkowska's blog: (and I admit I'm skating at the edge of my understanding here...)
When you load a hypervisor using TXT, the SENTER instruction would first apply the VT-d protections around the hypervsior image, then do the measurements, and only then load it, with VT-d protections still in-place.
And her more complete explanation:
...
5
Just came by this very recent blog post by Lenny Zeltser which is pretty much right on the money
6 Free Tools for analyzing Malicious PDF Files
http://blog.zeltser.com/post/5360563894/tools-for-malicious-pdf-analysis
The tools he mentions are:
PDF Tools suite by Didier Stevens
PDF Stream Dumper
Jsunpack-n
Peepdf
Origami
MalObjClass
There are details ...
5
You've got good thoughts, and much good advice has been posted in this thread, but let me touch on two things I don't see being addressed:
Have you been able to determine infection vectors for the machines that are being compromised and re-imaged? If you can determine how people keep getting hit - email versus web browsing, for instance - it can help you ...
5
For Duqu Symantic has a quite detailed explanation http://www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/w32_duqu_the_precursor_to_the_next_stuxnet.pdf
Most anti-virus companies have some reporting on threats of varing levels of details. As this is not my specialty it appears to be random as to who will have details of what, ...
Only top voted, non community-wiki answers of a minimum length are eligible
