1

My question is being asked in the case that I am currently infected. Many viruses are zero-day viruses, and in addition, I only occasionally install MalwareBytes, which seems to be the agreed-upon all purpose virus swiss army knife which gets prescribed by online forums when you request assistance with malware.

My question is.. are nearly all viruses detected after a while? Since if I get infected by a zero-day virus, I guess my scanner would eventually be updated to detect that virus. So... over a long period of time am I alright? In short, even Stuxnet is detected and rendered useless after a while.

5
  • You ask for "most" yet then take specific examples - which kind of implies "all". As for "most" - yes. As for "all" - no. Anything which has a relevant exposure (many infected, high value targets infected ...) will probably be detected after a while. Only it can be too late then since the system or even network is compromised already. Malware is only the early phase and not the end of the compromise, like detected malware will not give your encrypted data back or remove stolen data from the attacker. Apr 12, 2022 at 3:59
  • Thanks. For my situation, just someone at home, can I essentially be comforted by installing and scanning with MBAM every few months? Apr 12, 2022 at 4:24
  • As I said, malware infection is only an early phase of compromise. You don't get back control over encrypted or stolen data by installing some antivirus. Apr 12, 2022 at 4:33
  • 1
    Most malware targeted at regular users is eventually detected. Regular users are generally fine if they have an anti-virus with real time protection and use common sense (e.g. not downloading and running random files from the internet). As for advanced malware targeted at high value users... well we can't really know for sure, but my guess is a significant portion manages to fly under the radar, or only gets detected after the damage is done.
    – nobody
    Apr 12, 2022 at 10:51
  • can I essentially be comforted by installing and scanning with MBAM every few months No, you should leave it running so that it catches file writes and file execs as they happen. Jan 8, 2023 at 2:11

1 Answer 1

1

First of all, most malware encountered by regular users is not "zero-day". The reason for that is simply because bypassing AVs is very easy. That means the typical attacker doesn't need to be some 1337 hacker, they just need to allocate 100 MB before running their malware and the scanner is fooled.

Further, the term "zero-day" usually means a vulnerability in a specific software, which has been discovered by someone, but the vendor is not aware of it yet and no fix or workaround is available. "Zero-Day Exploits" are immensely valuable and are not burned on low-value targets like you or me - they're used to target companies, governments, infrastructure, etc.

So the takeaway is: Don't worry about Zero-Days. You're not the intended target.

Are most viruses eventually detected?

Yes and no. A lot of malware is eventually detected by one scanner or another, but as the paper suggested, modifying the payload to thwart detection is a trivial task. So if your malware scanner detects some kind of malware, chances are that a lot of other malware has already been successful.

Several Anti-Malware vendors seem to cite a successful detection rate of ~25%, which is a figure I find believable, based on nothing but my gut feeling.

Is running AV every few months enough?

You asked this soft follow-up question in a comment. The answer is that it's fundamentally the wrong approach. That's like repeatedly drinking any liquid you happen to find and then visiting the doctor every 3 months just to check if everything is fine.

What you should be doing is to be cautious where you download stuff from, what it is you're actually downloading (e.g. Linkin Park - In The End.mp3.exe), not download fron shady sources, etc.

Unfortunately, how to spot such risks is a skill honed over many years (and malware infections), and one you will have to develop yourself. Good luck.


I should note that "virus" is technically a specific kind of malware, which is basically not used anymore. The term "virus" has become synonymous with "malware" among common users, so I use the terms interchangably here as well.

4
  • Appreciated! I do understand what you're saying, but at this point, my hope is that I can put these worries on the backburner like everyone else who isn't an IT professional and know that in the long term, I'll eventually be safe. But it does sound like "malware" is... frighteningly advanced right now and AV's are simply insufficient. Apr 13, 2022 at 1:40
  • @SgtStacker "Malware" isn't "Malware". There is malware out there, sold in kits to criminals, who just want to make a quick buck (see various ransomware infections today). These are not very sophisticated, because as long as the revenue gained exceeds the purchase price, it doesn't have to be. Targeted malware on the other hand, yeah good luck with that. Luckily for you, this is not the kind you will be facing.
    – user163495
    Apr 13, 2022 at 12:38
  • @SgtStacker So again, my advice here is not to be too worried and just be mindful of what you download, what links you click, etc... The overwhelming majority of infections stem either from people downloading malware from piracy sites or from downloading and executing stuff from email attachments.
    – user163495
    Apr 13, 2022 at 12:39
  • Thank you. Very curious response. Apr 15, 2022 at 4:11

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .