Hot answers tagged antivirus
79
A small trick I learned years ago - lay your email out like this:
Short Version
Small number of very short succinct points
If X, then you need to do this
Else, then you need to do that (or don't need to do anything)
Long Version or Full Details
...and here you lay out whatever full version you want.
97% of your users will never ...
55
In my experience management doesn't like to listen to clever analogies. Depending on the person they care about the bottom line in dollars or hours of productivity. I would explain "The actual bottom line is that a compromise of our data will cost the company approximately X dollars + X hours to recover. This is X% likely to happen given the malware that is ...
30
Antivirus detection is a feature extraction and a classification problem.
A great analogy is the 20 questions game where the goal is to identify an arbitrary object by asking 20 seemingly unrelated yes/no questions. The idea behind the game is that each answer would eliminate half of the objects so it is theoretically possible to describe 2^20 (1,048,576) ...
24
I would avoid the biological or non-business analogies (unless this is a hospital). Your job is to assess risk, cost, and provide options. Your management's job is to make the decision based on your analysis and advice.
Generally, an approach in a tabular format is best. "approach", "likelihood of correcting the problem", "cost" are the minimum needed. ...
23
Sure. In Cohen's famous result, he says that a perfect virus detector should emit an alarm if and only if the input program can ever act like a virus (i.e., infect your machine and do damage).
Consider the following program:
f();
infect_and_do_damage();
where f() is some harmless function, and infect_and_do_damage() is a viral payload that infects your ...
22
"You can drink all the red wine anti-virus you want to try and prevent getting cancer, but once you get that first tumor, more drinking isn't going to help. You need to cut it out and make sure that you get all of it, because if you don't it will come back again."
"Once you get infected with a virus, the obvious symptoms are an annoyance, but it is what you ...
20
TL;DR: There are many more threat vectors from which a virus may be caught than you might think. Viruses commonly exploit holes in software for which there is not yet an available patch. Only third-party software, such as an Antivirus program which can detect and prevent execution of exploit code, can protect you from this.
I've been reading on ...
18
As @gowenfawr says many users will not read messages no matter what you do.
So, in cases when you need to guarantee that the message was delivered to the brain and not only inbox, or acted upon, what you need is a feedback mechanism.
This can be simple, using social approach - for example asking users an essentially fake question while providing ...
17
A signature-based detection system can't be the only solution, but it can be part of the solution. Indeed you'll find that a lot of the AV products that have behavioural detection and heuristic detection also still employ signature-based detection. It's simple, it's fast, the chances for false positives are very low. But the chances for false negatives are ...
16
You need anti-viruses for the following reasons:
0-days
Unpatched vulnerabilities
Deceptions
you uses USB sticks on machine that are not yours
Malicious users that could use your PC (in a way)
Avoid virus propagations over all your data.
Nobody knows all the infections vectors of virus. You could at any time encounter a way to be infected you don't know ...
16
The goal of most malware is to remain active as long as possible. The longer it can collect keystrokes, participate in DDoS attacks, redirect search results, send spam emails, shows popup ads, etc., the more profitable it is for the creator. To reach this goal, it has to be undetected.
If a piece of malware infects a machine twice, it may leave the machine ...
15
It all depends on the person; but a good first step would be to change their default browser to Chrome or Firefox - install AdBlock Plus (http://adblockplus.org/, or similar) and Ghostery (http://www.ghostery.com/) in their browser, and a decent anti-virus (Microsoft Security Essentials (http://www.microsoft.com/mse) should be fine, and since it's free - you ...
14
The difference is mostly a matter of historical tradition.
Biologically, a virus is a piece of RNA. RNA is an intermediary vessel for genetic code, which temporarily duplicates a piece of the DNA (the permanent storage of genetic information in a cell). RNA then goes through some "engines" which can duplicate it and/or convert it into proteins (genetic code ...
13
Very easy.
Didier Stevens has provided two open-source, Python-based scripts to perform PDF malware analysis. There are a few others that I will also highlight.
The primary ones you want to run first are PDFiD (available another with Didier's other PDF Tools) and Pyew.
Here is an article on how to run pdfid.py and see the expected results; Here is another ...
13
But what if I have a virus right now? My PC is faster like this than with an AV
Viruses are not (generally) about speed. A virus/trojan/malicious piece of software usually exists to make it's author money. Malware authors have gotten quite good at coming up with roundabout ways of doing this (in order of problems for you):
Modify all your web search ...
12
I consider myself to have high technical skills, and usually find myself skimming or simply ignoring these kind of messages myself. However, I was installing a Google product recently that had the following header:
Please read this carefully - It's not just the usual yada yada.
Because of the light hearted nature of this, I found myself to read the docs ...
12
Copying software for malware analysis seems like a textbook case of fair use (under U.S. law, anyway). To take the fair use criteria one by one:
Purpose and character of use: The use of the copy is legally transformative, which means that it creates something new, instead of merely attempting to recreate the original. Here, the analysts are producing a ...
12
Detection for a piece of malware is never removed from a mainstream AV.
Detection for old or rare malware is not removed mainly because AV benchmarks and clients seeing one AV missing detection while the others have it.
Let's say a signature is added for "Malw" malware but then the persistent malware writer makes subtle changes to avoid that specific ...
12
Malware signatures are unique values that indicate the presence of malicious code.
Simply speaking, When an anti-virus program scans your computer, it calculates the signature for a file (say like a hash), then compares that signature/hash to a list of known bad signatures.
Calculating a single hash of a file and then comparing it against a list of millions ...
11
Is there anything malicious InstallIQ does that I have missed?
From what I can gather, InstallIQ in and of itself does not actually install anything malicious - however, it does provide mechanisms for third parties to bundle additional "offers" with products at install-time, which is a very attractive proposition for malware/spyware authors.
Will ...
10
Some points that come to my mind:
Be concise and precise. Too long messages are usually dropped.
Categorise message using the topic : maintenance, notice, important. And make the topic clear (but short).
If possible, configure the email client to colourise email headers by default. With a consistent set of rules you can get more attention. Make important ...
10
False alarms of anti-malware are quite common because of the way these kind of software works and the theoretical limitations.
It is uncommon for anti-malware to have an exact copy of the malware included for a number of reasons:
There are many, many bad programs out there, so the anti-malware would be several hundreds of gigabytes in size.
Malware may ...
10
The purpose of EICAR is to provide a cross vendor file that will be detected as a virus. Why? Well, imagine you are building a web application that allows user uploaded content, for example. Into this solution, because you are security-conscious, you might want to scan the uploaded files and remove those files that are malicious before you spread them to ...
10
No, anti-malware packages will not detect every form of keylogger. They will detect known ones by hashing, and some may detect certain keylogger-like behaviour via heuristic analysis.
However, I strongly advise you against this. First off, it's insulting to your employees. If I found out my employer was doing such a thing, I'd resign on the spot. Secondly, ...
10
Despite outrageous marketing claims to the contrary, antivirus software is not smart. Antivirus does not recognize "types" of software, as in "mmh... this looks like a tool for RAT". There are strong theoretical reasons why this sort of detection is, in all generality, impossible to achieve, and correspondingly very hard to do in practice.
What antivirus ...
9
One point is to only send out emails when it is important and critical that they be read - don't use them for normal newsletters or boring info - users will learn to ignore them very quickly.
For general security awareness, use different mechanisms every time, and make it interesting, worth their while or if those fail: mandatory, along with annual signoff ...
9
Try spies. The last James Bond opus appears to make millions of entries, so the crowd at large is, for now, receptive to spy stories. Explain that once unreliable/hostile people are in charge (that's the "compromised" setup), there is no way to recover proper security by asking them to do it; and yet, that's what running an AV on an infected machine is ...
9
The more I think about it, the more I start to think that a chromebook might be the way to go for casual use cases. It's Linux with nothing but a browser installed. Everything updates automatically, and users can't install anything, malware or otherwise. Plus the computers are dirt-cheap.
You still have to educate people to not give out their bank account ...
8
Please look at these videos at securitytube
http://securitytube.net/How-to-make-Files-Undetectable-by-Anti-Virus-video.aspx
http://www.securitytube.net/AV-Evasion-using-MSF3-Payloads-video.aspx
which both demonstrates how easy it is to avoid antivirus detection. Signature based antivirus needs to live on, but if they want to make a living it won't be ...
8
User education & training is huge. Get the users to help you play good defense.
I always like to see the security programs that award spot bonuses to employees for challenging a person in a secured area without a badge. You can be creative and extend this idea to phishing attacks, pretexting, etc; for example, send out a mock phishing attack and ...
Only top voted, non community-wiki answers of a minimum length are eligible
