Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [antimalware]

Software which includes anti-spyware, anti-rootkit, anti-phishing, and other technologies that attempt to identify and/or block malicious programs.

0
votes
2answers
70 views

Reasons why different antivirus engines detect same malware differently

I think I understand how does signature-based detection work (calculate hash -> compare it with the database of hashes), but I can't understand why some AV engines find the same virus as different. ...
-1
votes
1answer
39 views

How does an antivirus flag homemade malware? [duplicate]

Say I made some malware in python or c# or whatever language, How would an antivirus detect that the program has malicious intent because how does the antivirus know that the program is malicious ...
0
votes
0answers
28 views

What are the steps of making a fully undetectable piece of malware? [duplicate]

I've been recently taught how antiviruses work. I know that there is more to it but they basically have a list of known malware that they have encountered and every time they scan, they check if their ...
-1
votes
1answer
58 views

Online traffic monitoring by ISP for safety purposes [closed]

I have a question regarding approach to online security and protection against viruses, malware and phishing by one of the biggest European ISP. Below you will find my understanding of the topic. Is ...
61
votes
5answers
16k views

Can Beehive detect a Snowden-like actor?

In a seminar, one of the Authors of Beehive: Large-Scale Log Analysis for Detecting Suspicious Activity in Enterprise Networks said that this system can prevent actions like Snowden did. From their ...
0
votes
2answers
66 views

If a host is infected is the sandbox environment infected?

Say my host machine is infected and I have a sandbox program. Will that sandbox environment then be infected also? If the answer is yes, what if I have an AV running inside of the sandbox. Will it ...
3
votes
2answers
196 views

Malware Author's Mindset

I'm studying common malware characteristics, and I'm having a bit of difficulty understanding the design choices the malware authors make. Many of said choices seem to revolve around making life ...
0
votes
2answers
95 views

What is the thought process behind, Endpoint protection is better than firewalls?

I keep reading about, and seeing people post and recommend in the oddest places, that strong endpoint protection is better than having a in-service/supported/receiving security updates firewall. What ...
0
votes
3answers
146 views

Choice of Anti Virus Tool vs Anti Malware Tool?

We've had a breach in our network recently and we have been challenged over the the AV tool we are using. Because the malware/virus was cleaned (variant of Ransomware) by using an advanced anti ...
1
vote
2answers
59 views

Check uploaded python script for security issues before running it

I would be allowing a user to upload Python scripts and would execute them on my server. The base application is in Java and I am using ProcessBuilder to get Python to run from my Java application. ...
3
votes
1answer
122 views

Information on the specifics of how behavioral antiviruses work?

I'm looking into security software and it seems like the Next Big Thing is behavioral antivirus. I'd like to try possibly making my own rinky-dink "next-gen behavioral AV" so I can gain a better ...
-2
votes
1answer
68 views

Getting a M2IzYzlm.exe in task manager [duplicate]

Getting a M2IzYzlm.exe in task manager, It pops up after a certain interval of time and switches off my wifi, when I right clicked and tried to locate it, it shows a folder with a weird name inside ...
0
votes
3answers
89 views

Is it possible to intercept the payload of a secure request in plain text?

Consider we run the following request: import requests url="https://secretsub.example.com/secretpath/post.php" payload = {'secretmessage1' : 'foo','secretmessage2' : 'bar'} r = requests.post(url,...
0
votes
1answer
370 views

(WMI Infections) Suspect behavior from scrcons.exe detected?

In almost every five minutes, I come out of the AVG avg stop downloading files and do not know which program wants to download these files. I have read this before WMI Infections So, i opened this ...
7
votes
2answers
131 views

Do Transient, Volatile Servers Require Antivirus Scanners?

We are often asked whether we install antivirus software on our servers, specifically the kind of signature-based scanners that run on a schedule. Client security questionnaires and ISMSes often ...
-1
votes
1answer
170 views

What should I do if C:\Windows\System32\svchost.exe got infected? [duplicate]

The original svchost.exe file in my Windows XP was changed with a malicious copy, I think this is easy to do on Windows XP. How am I supposed to return it to the clean original without crashing the ...
5
votes
3answers
213 views

What are the privacy conerns with cloud based submission in antivirus?

It seems like many antivirus programs use the cloud to scan files for malware. Isn't this a privacy concern if local files are being uploaded to the cloud? For example with Automatic Sample Submission ...
-1
votes
1answer
57 views

Standards and Guidelines Pro/Con Anti Malware programs

For a whitepaper about anti-malware products used in combination with (server side) applications and infrastructure components (database server) I am looking for standards, guidelines and codified ...
1
vote
0answers
94 views

Which Anti-Virus companies share their signature databases?

I recently heard that AVG and AVAST shared their malware signature databases (avast forum) Which AV vendors share their signature databases or use the same engine for detecting malwares? Based on ...
3
votes
1answer
371 views

Examples of non signature based anti-malware/anti-virus programs, IDS, & system integrity scanners

All traditional anti-virus software uses signatures to detect known malware after it has been discovered by the software companies and added to the definitions. Heuristic definitions allow a piece ...
1
vote
1answer
93 views

Windows flags Microsoft Sysinternals .zip files as malicious

Downloaded sdelete v2.01 from official Microsoft website using Google Chrome on Windows 10 Pro: https://docs.microsoft.com/en-us/sysinternals/downloads/sdelete Basic info for SDelete.zip: SHA256: ...
0
votes
3answers
81 views

Adding false network tools / signatures for malware defense

I was looking into implementing a security measure by adding false analysis tools / signatures on client PC's. The idea is that certain malware would scan the environment for analysis tools, and if ...
0
votes
0answers
86 views

How can Malware Bytes scan “memory objects” in Windows?

I recently installed Malware Bytes onto a Windows PC. As part of its scan phase it reports that it is "scanning memory objects". I thought that Windows isolated memory address space making it ...
10
votes
1answer
407 views

What is SpeedSurfing?

My Sophos antivirus detected what it calls "SpeedSurfing", and my Google-fu is failing me. The Chrome extension it deleted was Boomerang for Gmail.
1
vote
1answer
90 views

Why did hosts get infected if the endpoint protection product has a signature for that malware?

Multiple hosts were attempting CNC communication that is specific to a threat from at least 2013, H-worm. However, endpoint protection is deployed on these hosts and functioning but no malicious ...
1
vote
0answers
196 views

tool with rest api to scan base64 encoded files [closed]

I'm searching for a tool (antimalware / antivirus) that exposes a REST API and accept me to pass a base64 encoded file in order to check if it's a malicious one or not. I've tried the ClaimAV but it ...
2
votes
0answers
317 views

A Facebook impersonator uploaded pictures of me I never posted online. Now what? [closed]

Exposition One late night I was multi-tasking when a (trusted) friend sent me a link with text in a Facebook message he had apparently written. The preview of the link had a picture of me, and ...
0
votes
1answer
585 views

How secure is a Kali Linux Live USB [duplicate]

How secure for the host computer is a Kali Linux Live USB installation? If I get a virus or any other kind of malware on Kali, can it also infect the computer to which it’s plugged into? Could it ...
3
votes
1answer
405 views

Is Android anti-virus software necessary and helpful?

Is Android anti-virus software necessary and helpful? Can it actually prevent malware attacks on my system? Are there other good opportunities to block malicious software attacks? At home, I am ...
2
votes
1answer
67 views

How Do antiviruses decide whether a file is to be quarantined or not?

Situation: Trying to understand how an antivirus works. So when an antivirus finds a file with a hash value matching their database, it reports it as an infected file and would quarantine it. Problem:...
0
votes
1answer
76 views

Programmatically Quarantining files

Situation: Using Python to make a simple quarantine software for malware. What I know: I do understand (from this forum no less) that one of the ways is to put the file in a quarantine directory and ...
-3
votes
2answers
106 views

Impossible VM-detection countermeasures

Are there any vm-detection techniques (of malware) which are impossible to mitigate in your vm? If yes, which?
0
votes
1answer
46 views

functioning ( behavioural based ) of an antivirus [closed]

I know how signatures are used to detect malware samples of already known malware and techniques to apply to use. 1.What are some of the different behavioral techniques used by antivirus/anti-malware ...
4
votes
2answers
1k views

What is the difference between an anti-virus and an IPS?

As I understand it, an intrusion protection system (IPS) detects anomalous behavior, does detection of protocol anomalies, and does signature filtering that blocks malware, DDoS, etc. An antivirus ...
0
votes
1answer
164 views

How do I know whether the RAT tool (cracked/) I am downloading isn't backdoored?

In a simple way? If I use VirusTotal (for example) how do I differentiate if it's just the RAT or if it's also backdoored? Or is there software to check?
0
votes
2answers
100 views

Given a malware's name or signature, how can I know of my current installation of Kaspersky antivirus knows about it?

Basically, I'm looking for an interface where the input would be the name of a malware, or its signature, and the output would be "malware found in the database" or "malware unknown" The tool must ...
-1
votes
1answer
129 views

Are there differences between McAfee quarantine and other AV quarantining mechanisms?

I'm working on a documentation of an IT system and I want to describe what is happening, when McAfee finds and quarantines a suspicious file. I have read the many questions on quarantining, but all ...
0
votes
5answers
361 views

Why would I protect my computer?

I see a lot of posts about how to protect your precious computer, but what is it that we are trying to protect? Note: Before you flame me, I'm not trying to ask a stupid question. I just see many not ...
-1
votes
1answer
363 views

Does C# code running with PowerShell Add-Type set off anti-virus?

C# code can be included and executed in a PowerShell script using Add-Type. According to Microsoft: "Add-Type compiles the specified source code and generates an in-memory assembly that contains ...
1
vote
1answer
90 views

Do virus author's purposely speak in broken English to avoid linguistic evidence? [closed]

Are there any examples of native English speakers creating a virus with broken English on purpose?
0
votes
1answer
125 views

How to really identify malware (virus)?

How could we really know if a software is a malware (virus), for platforms like Windows or Android? How to identify it automatically if we do not have predefined datasets? For example, when the ...
1
vote
0answers
687 views

Is it safe to use “Iguana Tex”? Why does it trigger a virus report? [closed]

I have used Iguana Tex in the past to insert Latex equations into my power point presentations. Lately, it triggers a response from the virus check programs. According to the developer, it is a 'false ...
0
votes
1answer
200 views

How to efficiently locate malware on an endpoint? [closed]

I have a question from one of the interviews I had, I have no knowledge in system security and so I didn't know how to approach each. The question was: A customer suspects that one of his endpoints ...
3
votes
1answer
1k views

Do thin-clients need antivirus/antimalware?

All the servers & fat clients on site are protected with ESET Endpoint Antivirus, however I notice none of the thin clients have any type of AV enabled. A brief Google search doesn't show much ...
0
votes
1answer
85 views

How does Thunderbird quarantine downloaded emails? Is it dangerous to download emails and store them offline?

There shouldn't be a high security risk as long as the email attachments aren't opened / executed by the user but it could still be a risk and maybe I'm wrong. So how does Thunderbird quarantine ...
3
votes
0answers
184 views

What does Memory Scanning refer to in the Context of Malware Detection Wanna Cry

When reading https://www.zionsecurity.com/sites/default/files/what_to_expect_from_your_antivirus.pdf It mentions: It is almost impossible to protect against new malware that will use the ...
5
votes
2answers
1k views

Is malware in $RECYCLE.BIN (deleted files) dangerous?

I'm running Debian 9.1 with KDE and scanned some other hard drive with the open source AV ClamAv. I got plenty of findings, most of which are PUAs (and I suspect many or even all being false positives ...
0
votes
1answer
564 views

What tools one can use to detect a malicious activity on a computer, aside from antivirus programs?

Some time ago I got a virus on my computer, which is not detected by antivirus programs. Yet I can see the malicious activity in the Windows Event Log and in the TcpLogView: Considering that updates ...
2
votes
1answer
912 views

ClamAV findings under Debian 9: LibreOfficeMacros and PUA.Win.Exploit.CVE_2012_0110-1 - false positives?

I'm running a recently installed Debian 9.1 with KDE and a ClamAV scan gives me these findings: /usr/lib/libreoffice/share/extensions/wiki-publisher/WikiEditor/Module1.xba PUA.Doc.Tool....
0
votes
1answer
313 views

How to Determine if Keylogger is Running on My Windows System [duplicate]

How would a program (such as AV) pick up key loggers running on a Windows based system ? Are there internal system processes that are normally invoked to pickup keystrokes ? I ask because I know ...