Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [antimalware]

Software which includes anti-spyware, anti-rootkit, anti-phishing, and other technologies that attempt to identify and/or block malicious programs.

0
votes
0answers
50 views

Detecting cracked Themida packed malware

I'm working in a large SOC and my manager has tasked me with finding some way to provide coverage for Themida packed malware samples. As alluring as it is to suggest just blacklisting all Themida ...
0
votes
1answer
88 views

What are the heuristic detection techniques most often used in modern AVs? [closed]

Whenever I read books or academic papers and the subject of heuristic malware detection is brought up they always say the same thing: "it can be either static or dynamic", "it may use emulation", "may ...
0
votes
1answer
60 views

How do AV vendors select malware signatures?

AVs use signatures to identify malware which are often strings of bytes or regular expressions thought to be unique to that malware. Do reverse engineers select these signatures by hand or do they use ...
1
vote
1answer
103 views

How does android antivirus scan root files like “/data/data”

I want to know how does android antivirus scan packages private files in "/data/data" directory. I read somewhere that they check the file name with their database and declare it as malware but how ...
0
votes
1answer
262 views

Is there something fishy on Kaspersky Internet Security or I am missing something?

Whenever I turn on my computer, a notification pops up - You need to restart you PC (I have added screenshot). I did, but it keeps coming. So went to notification center and saw which application is ...
0
votes
0answers
35 views

Assess anti-malware detection techniques

Are there any known, conventional, ways of assessing the types of detection techniques an endpoint security product might employ? I know AV-Test and AV-Comparatives exist to test the effectiveness of ...
2
votes
1answer
101 views

Antivirus recall and precision not accuracy [closed]

I am studying antiviruses how antiviruses work at my university. This is just the very basics. He asked in our opinion which we think is better: recall or precision. Why does my professor say he ...
4
votes
2answers
190 views

Why malwares need to be light

I am learning about how malwares work and I read that a lot of them are written in assembly or C to keep the binary size as small as possible. In an example C++ source code, authors decided to remain ...
2
votes
1answer
49 views

Verifying Host Sterility After Running Malware Tests on Virtual Machine

I know that "VM escape" is becoming a common issue now with malware testing. I'm just wondering if there's any way of verifying if the host system is clean from any infection after running a malware ...
0
votes
2answers
85 views

Reasons why different antivirus engines detect same malware differently

I think I understand how does signature-based detection work (calculate hash -> compare it with the database of hashes), but I can't understand why some AV engines find the same virus as different. ...
-1
votes
1answer
50 views

How does an antivirus flag homemade malware? [duplicate]

Say I made some malware in python or c# or whatever language, How would an antivirus detect that the program has malicious intent because how does the antivirus know that the program is malicious ...
0
votes
0answers
30 views

What are the steps of making a fully undetectable piece of malware? [duplicate]

I've been recently taught how antiviruses work. I know that there is more to it but they basically have a list of known malware that they have encountered and every time they scan, they check if their ...
-1
votes
1answer
79 views

Online traffic monitoring by ISP for safety purposes [closed]

I have a question regarding approach to online security and protection against viruses, malware and phishing by one of the biggest European ISP. Below you will find my understanding of the topic. Is ...
62
votes
5answers
17k views

Can Beehive detect a Snowden-like actor?

In a seminar, one of the Authors of Beehive: Large-Scale Log Analysis for Detecting Suspicious Activity in Enterprise Networks said that this system can prevent actions like Snowden did. From their ...
0
votes
2answers
112 views

If a host is infected is the sandbox environment infected?

Say my host machine is infected and I have a sandbox program. Will that sandbox environment then be infected also? If the answer is yes, what if I have an AV running inside of the sandbox. Will it ...
3
votes
2answers
206 views

Malware Author's Mindset

I'm studying common malware characteristics, and I'm having a bit of difficulty understanding the design choices the malware authors make. Many of said choices seem to revolve around making life ...
0
votes
2answers
101 views

What is the thought process behind, Endpoint protection is better than firewalls?

I keep reading about, and seeing people post and recommend in the oddest places, that strong endpoint protection is better than having a in-service/supported/receiving security updates firewall. What ...
0
votes
3answers
198 views

Choice of Anti Virus Tool vs Anti Malware Tool?

We've had a breach in our network recently and we have been challenged over the the AV tool we are using. Because the malware/virus was cleaned (variant of Ransomware) by using an advanced anti ...
1
vote
2answers
69 views

Check uploaded python script for security issues before running it

I would be allowing a user to upload Python scripts and would execute them on my server. The base application is in Java and I am using ProcessBuilder to get Python to run from my Java application. ...
3
votes
1answer
127 views

Information on the specifics of how behavioral antiviruses work?

I'm looking into security software and it seems like the Next Big Thing is behavioral antivirus. I'd like to try possibly making my own rinky-dink "next-gen behavioral AV" so I can gain a better ...
-2
votes
1answer
75 views

Getting a M2IzYzlm.exe in task manager [duplicate]

Getting a M2IzYzlm.exe in task manager, It pops up after a certain interval of time and switches off my wifi, when I right clicked and tried to locate it, it shows a folder with a weird name inside ...
0
votes
3answers
115 views

Is it possible to intercept the payload of a secure request in plain text?

Consider we run the following request: import requests url="https://secretsub.example.com/secretpath/post.php" payload = {'secretmessage1' : 'foo','secretmessage2' : 'bar'} r = requests.post(url,...
0
votes
1answer
622 views

(WMI Infections) Suspect behavior from scrcons.exe detected?

In almost every five minutes, I come out of the AVG avg stop downloading files and do not know which program wants to download these files. I have read this before WMI Infections So, i opened this ...
7
votes
2answers
137 views

Do Transient, Volatile Servers Require Antivirus Scanners?

We are often asked whether we install antivirus software on our servers, specifically the kind of signature-based scanners that run on a schedule. Client security questionnaires and ISMSes often ...
-1
votes
1answer
217 views

What should I do if C:\Windows\System32\svchost.exe got infected? [duplicate]

The original svchost.exe file in my Windows XP was changed with a malicious copy, I think this is easy to do on Windows XP. How am I supposed to return it to the clean original without crashing the ...
6
votes
3answers
248 views

What are the privacy conerns with cloud based submission in antivirus?

It seems like many antivirus programs use the cloud to scan files for malware. Isn't this a privacy concern if local files are being uploaded to the cloud? For example with Automatic Sample Submission ...
-1
votes
1answer
68 views

Standards and Guidelines Pro/Con Anti Malware programs

For a whitepaper about anti-malware products used in combination with (server side) applications and infrastructure components (database server) I am looking for standards, guidelines and codified ...
1
vote
0answers
107 views

Which Anti-Virus companies share their signature databases?

I recently heard that AVG and AVAST shared their malware signature databases (avast forum) Which AV vendors share their signature databases or use the same engine for detecting malwares? Based on ...
3
votes
1answer
513 views

Examples of non signature based anti-malware/anti-virus programs, IDS, & system integrity scanners

All traditional anti-virus software uses signatures to detect known malware after it has been discovered by the software companies and added to the definitions. Heuristic definitions allow a piece ...
1
vote
1answer
111 views

Windows flags Microsoft Sysinternals .zip files as malicious

Downloaded sdelete v2.01 from official Microsoft website using Google Chrome on Windows 10 Pro: https://docs.microsoft.com/en-us/sysinternals/downloads/sdelete Basic info for SDelete.zip: SHA256: ...
0
votes
3answers
85 views

Adding false network tools / signatures for malware defense

I was looking into implementing a security measure by adding false analysis tools / signatures on client PC's. The idea is that certain malware would scan the environment for analysis tools, and if ...
0
votes
0answers
122 views

How can Malware Bytes scan “memory objects” in Windows?

I recently installed Malware Bytes onto a Windows PC. As part of its scan phase it reports that it is "scanning memory objects". I thought that Windows isolated memory address space making it ...
10
votes
1answer
430 views

What is SpeedSurfing?

My Sophos antivirus detected what it calls "SpeedSurfing", and my Google-fu is failing me. The Chrome extension it deleted was Boomerang for Gmail.
2
votes
1answer
96 views

Why did hosts get infected if the endpoint protection product has a signature for that malware?

Multiple hosts were attempting CNC communication that is specific to a threat from at least 2013, H-worm. However, endpoint protection is deployed on these hosts and functioning but no malicious ...
1
vote
0answers
269 views

tool with rest api to scan base64 encoded files [closed]

I'm searching for a tool (antimalware / antivirus) that exposes a REST API and accept me to pass a base64 encoded file in order to check if it's a malicious one or not. I've tried the ClaimAV but it ...
2
votes
0answers
327 views

A Facebook impersonator uploaded pictures of me I never posted online. Now what? [closed]

Exposition One late night I was multi-tasking when a (trusted) friend sent me a link with text in a Facebook message he had apparently written. The preview of the link had a picture of me, and ...
0
votes
1answer
741 views

How secure is a Kali Linux Live USB [duplicate]

How secure for the host computer is a Kali Linux Live USB installation? If I get a virus or any other kind of malware on Kali, can it also infect the computer to which it’s plugged into? Could it ...
3
votes
1answer
536 views

Is Android anti-virus software necessary and helpful?

Is Android anti-virus software necessary and helpful? Can it actually prevent malware attacks on my system? Are there other good opportunities to block malicious software attacks? At home, I am ...
2
votes
1answer
70 views

How Do antiviruses decide whether a file is to be quarantined or not?

Situation: Trying to understand how an antivirus works. So when an antivirus finds a file with a hash value matching their database, it reports it as an infected file and would quarantine it. Problem:...
0
votes
1answer
82 views

Programmatically Quarantining files

Situation: Using Python to make a simple quarantine software for malware. What I know: I do understand (from this forum no less) that one of the ways is to put the file in a quarantine directory and ...
-2
votes
2answers
108 views

Impossible VM-detection countermeasures

Are there any vm-detection techniques (of malware) which are impossible to mitigate in your vm? If yes, which?
0
votes
1answer
48 views

functioning ( behavioural based ) of an antivirus [closed]

I know how signatures are used to detect malware samples of already known malware and techniques to apply to use. 1.What are some of the different behavioral techniques used by antivirus/anti-malware ...
5
votes
3answers
2k views

What is the difference between an anti-virus and an IPS?

As I understand it, an intrusion protection system (IPS) detects anomalous behavior, does detection of protocol anomalies, and does signature filtering that blocks malware, DDoS, etc. An antivirus ...
0
votes
1answer
165 views

How do I know whether the RAT tool (cracked/) I am downloading isn't backdoored?

In a simple way? If I use VirusTotal (for example) how do I differentiate if it's just the RAT or if it's also backdoored? Or is there software to check?
0
votes
2answers
105 views

Given a malware's name or signature, how can I know of my current installation of Kaspersky antivirus knows about it?

Basically, I'm looking for an interface where the input would be the name of a malware, or its signature, and the output would be "malware found in the database" or "malware unknown" The tool must ...
-1
votes
1answer
138 views

Are there differences between McAfee quarantine and other AV quarantining mechanisms?

I'm working on a documentation of an IT system and I want to describe what is happening, when McAfee finds and quarantines a suspicious file. I have read the many questions on quarantining, but all ...
1
vote
5answers
364 views

Why would I protect my computer?

I see a lot of posts about how to protect your precious computer, but what is it that we are trying to protect? Note: Before you flame me, I'm not trying to ask a stupid question. I just see many not ...
-1
votes
1answer
404 views

Does C# code running with PowerShell Add-Type set off anti-virus?

C# code can be included and executed in a PowerShell script using Add-Type. According to Microsoft: "Add-Type compiles the specified source code and generates an in-memory assembly that contains ...
1
vote
1answer
91 views

Do virus author's purposely speak in broken English to avoid linguistic evidence? [closed]

Are there any examples of native English speakers creating a virus with broken English on purpose?
0
votes
2answers
184 views

How to really identify malware (virus)?

How could we really know if a software is a malware (virus), for platforms like Windows or Android? How to identify it automatically if we do not have predefined datasets? For example, when the ...