New answers tagged

0

According to bitdefender blog a malware is included in modified installers for well-known programs, such as KMSPICO , winrar ... Once installed on a computer, Redirector.Paco modifies its Internet Settings to use a Web proxy server specified by the attackers in a PAC (Proxy auto-config) file. The malicious infection chain starts with a modified MSI file. ...


0

Whitelisting is just a methodology. The methodology can be applied in many ways. I will show two simple example, at the front end and backend. So let's talk about user front end : Here, Whitelisting is about trusting files or SSL certificates, to make sure they are from valid entities. However, certificate itself can be point of attack ,e.g. signature ...


2

Whitelisting is when the antivirus company explicitly marks a file signature as safe. Sometimes antivirus programs incorrectly identifies a file or program as being malicious, which can prevent the program from working. The computer user or developer can then contact the antivirus company and ask that the file signature be marked as safe. The the file will ...


0

Is this your own home machine? if its a work network i would just block google drive, Dropbox etc.. people tend to take things home and work on them but means you have no control over the company data. With that said i looked around a bit and it really depends on the provider some scan some don't and leave it to you to have a scanner installed. So i would ...


2

It's all a matter of API level: if you intercept an event using a (usually privileged) low-level API, you are then able to hide it to higher (unprivileged) level APIs. Thus, these two solutions most-likely rely on low-level APIs so intercept keystroke events so they remain undetected to key loggers (hopefully) relying on higher level API. In the case of ...


-1

Citrix and virtualization engineer for 23 years. YOU MUST INSTALL ANTIVIRUS AND MALWARE PROTECTION ON ALL END POINTS. Just because that little thin client doesn't save stuff after a restart, doesn't mean that malware and other viruses can infect and live during run time. Strongly recommend you consult a professional.


0

Many AV function the same way but may have different specific mechanisms of action. In general they work like this: When MBAM removes an item such as a file or a Registry entry and "quarantines" the item, it is removed from its original location and stored in a protected container. Both the removed item and it location are stored in the container ...


0

Sandboxes and AntiVirus are two separate things. AV scans a file and typically checks for "known knowns" (signatures) and heuristics of a file, whereas a sandbox executes a file in an isolated environment. As Schroeder stated sandboxes work differently depending on what Sandbox you're running. A typical sandbox will take a snapshot of processes, connections,...


12

There are a couple ways an antivirus program might go about preventing the execution of a quarantined file: Hold it open for exclusive access. It can simply use the normal CreateFile API and pass zero for dwShareMode, preventing all other kinds of access to the file. If an executable can't be read, it can't be executed. Since antivirus programs are usually ...


-1

It's unlikely that any file would execute without a user having granted that permission. That user could have been someone who prepared the factory image, or you when you ran another program. To prevent (malicious) content from being accessed, a sure way is to use a completely separate machine to encrypt it using a One Time Pad of the same length as the ...


6

The quarantine AV features mentioned in the reply before make sure that the file cannot be executed or accessed while under quarantine. So no, as long as the antivirus is working, there is no danger for the virus to escape quarantine. Practically, some store the file in a different non-runnable format and some just rename the file and deny read/write....


2

Suppose you have an important file(say, some presentation) that is flagged by your antivirus as "malicious". You do not wish to delete it(it's important after all, even if it is malicious!), but you don't want your machine to get infected as well. So, what option do you have? Your antivirus product can quarantine it. It keeps the files in an isolated ...


1

Trustwave SpiderLabs wrote up a blog on analyzing malware with hollow processes -- https://www.trustwave.com/Resources/SpiderLabs-Blog/Analyzing-Malware-Hollow-Processes/ Cuckoo Sandbox, a popular and free, open-source software (FOSS) automated malware analysis engine can also be leveraged for working with hollowed processes -- http://journeyintoir.blogspot....


1

If the cache length lets say is 10.1kb well then the memory block will look something like this (Lets say the whole block is 30kb [Notice the middle block is our PP cache]): |~~~~~9.95kb~~~~~|~~~~~~10.1kb~~~~~|~~~~~~9.95kb~~~~~~| Now lets use the exploit, our data will look like this (Notice we just ran over 9kb of the next segment!): |~~~~~9.95kb~~~~~|~~~...



Top 50 recent answers are included