Last call to make your voice heard! Our 2022 Developer Survey closes in less than a week. Take survey.

Questions tagged [antimalware]

Software which includes anti-spyware, anti-rootkit, anti-phishing, and other technologies that attempt to identify and/or block malicious programs.

Filter by
Sorted by
Tagged with
0 votes
0 answers
34 views

PDF security analysis tool for non-experts

I occasionally come across PDFs from shady sources. Is there a tool that a non-expert can use, which can check them for common vulnerabilities? I have seen this question: Malicious PDF Analysis but I'...
user avatar
1 vote
0 answers
45 views

What is the difference between malware signatures and malware artifacts?

I am trying to analyse some malware samples but I am trying to understand the differen between malware signatures and malware artifacts. As far as I understand (and from what I've understood from this ...
user avatar
2 votes
0 answers
111 views

Can a virus infect windows 10 bootable media?

I created a bootable windows 10 usb from my friend's computer. I used the official tool from microsoft. I was dumb enough to not check my friend's computer beforehand (turns out he had Utorrent Web ...
user avatar
0 votes
0 answers
39 views

Floss and many tools not detecting cyrillic strings in binary

I am practicing some malware detection basics and it has caught my attention that the Cyrillic alphabet is not detected by practically any traditional string detection tool. Source Code while (...
user avatar
0 votes
1 answer
74 views

Malware dropper uses "^" character in syntax of cmd.exe before calling mshta.exe to download file?

I found a malicious Excel file that was using an embedded HTA program as its dropper to download a powershell program from a malicious IP. The dropper was on a hidden sheet in the file. After ...
user avatar
  • 1
1 vote
1 answer
164 views

Mp4 virus scanners

I used to download a lot of mp4's from untrusted sources. But I discovered that they could contain malware. I would like to know if there are any methods to clean or to check video files for malware.
user avatar
  • 11
0 votes
3 answers
155 views

How can I have my process detect if antivirus injected a module or DLL to it?

I am writing an installer process (.exe). My installer deploys different components. It will add registry entries, copy files, copy files over the network, remote execute, remote PowerShell, local ...
user avatar
  • 103
6 votes
2 answers
358 views

Do antivirus programs increase your attack surface and potentially give more power to malware?

When I was a student one of my professors used to say that an antivirus actually increases your attack surface by injecting itself into system processes and let's say opening more doors for ...
user avatar
0 votes
1 answer
217 views

How to find discrepancy between exploitable and unexploitable VM

For several years, I have been setting up VMs with 2-3 year old versions of Windows as well as some additional applications to demonstrate two-stage exploits using Metasploit for educational purposes (...
user avatar
1 vote
0 answers
141 views

How to stop 3rd party libraries from being reported as malicious, if they were part of malicious programs in the past?

Some are standard user space dll’s and another one is actually a windows driver. The libraries alone are not dangerous and are pure utilities but they can be used by bad guys, like most software tools....
user avatar
  • 131
0 votes
0 answers
118 views

Is W^X enforced against UEFI DXE drivers (firmware)? Could it be if we tried?

W^X is a critical security feature, allowing us a chance to perform security analysis on data that some entity on a computer wants to execute. Windows implements this by requiring a process to call ...
user avatar
  • 1,290
1 vote
1 answer
145 views

Are there any existing JTAG (hardware debugging) based malware detection systems, and if not, why?

JTAG System software debug support is for many software developers the main reason to be interested in JTAG. Many silicon architectures such as PowerPC, MIPS, ARM, x86 built an entire software debug, ...
user avatar
  • 1,290
1 vote
2 answers
152 views

Has exploitation been demonstrated against the fundamental constructs of the debugging process?

I'm curious to know if an attacker can fundamentally exploit the debugging process. I'm not asking if specific debugging tools have been exploitable, surely some have, but rather whether the process ...
user avatar
  • 1,290
2 votes
1 answer
188 views

Is there a way to record CPU operations for a given process as they occur in a standard, production OS environment?

Doing malware analysis I'm interested in being able to log every instruction the CPU executes for a given process. I was hoping this was perhaps possible in a standard VM environment, even if not ...
user avatar
  • 1,290
1 vote
1 answer
122 views

Why don't computers enforce immutable address spaces for execution?

A piece of malware detects signatures of the sandbox an AV solution tries to use to fingerprint malicious behavior and pretends to be innocent. Once in the real OS environment, it then downloads ...
user avatar
  • 765
1 vote
0 answers
115 views

Detecting and understanding malware/spyware [closed]

Recently, stumbled upon the new FB 500m+ leak and decided to satisfy my curiosity and poke around. Basically just wanted to see how 500m+ user records were kept and what info was released( it was ...
user avatar
  • 11
1 vote
1 answer
571 views

If a file has previously been scanned by VirusTotal, will the VirusTotal website always indicate this fact?

I recently downloaded a very popular open-source application. Usually, I compile open-source applications myself after reading the source code. But my compiler box was busy with many tasks, so I ...
user avatar
2 votes
4 answers
297 views

Can a antivirus software detect a malware that steals data?

For example, consider a software that wants to package all txt files in the /user/Desktop directory and upload them to its own server. I am not a programmer, but I know it can be done very easily with ...
user avatar
  • 23
1 vote
1 answer
108 views

Cannot interpret maldet results

After executing sudo maldet -a / LMD provides the following report: HOST: foo.bar.baz SCAN ID: 210117-2223.1145531 STARTED: Jan 17 2021 22:23:26 +0000 COMPLETED: Jan 18 2021 22:01:12 +0000 ...
user avatar
0 votes
1 answer
158 views

What is the use case for antimalware manual scans?

I am not able to understand what use is the manual antimalware scan? All antivirus software has a manual anti-malware scan. I understand if it's the first time someone installs it on their infected/...
user avatar
  • 339
0 votes
2 answers
174 views

Does malware that comes through outdated apps go away if I uninstall the apps?

I was reading this and this article. The first article itself is about why software updates are extremely important for security, and the second one also mentions the following: "Make sure your ...
user avatar
  • 339
1 vote
1 answer
5k views

How to check for malware before downloading a torrent file?

I wanted to know if there is a way to check if a torrent file has malware or not, before actually downloading it via uTorrent f.e. I only know VirusTotal site. Is this one reliable? Because each time ...
user avatar
0 votes
1 answer
3k views

Remote Access Trojan (RAT) -- How to detect, how to remove [duplicate]

Is there a guaranteed way to: Know there is a Remote Access Trojan in my PC? Remove it completely and successfully from my PC? Note: Assume that the hacker doesn't leave any hint of their activity (...
user avatar
  • 339
0 votes
1 answer
251 views

How to check which process is modifying my clipboard?

I'm on Windows 10 last build and for a few days it looks like I have a malware that modifies ethereum addresses in my clipboard. I sadly tried a lot of antivirus, antispyware and nothing is found. I ...
user avatar
1 vote
2 answers
210 views

Why don't antivirus definition files get detected as malware

I was wondering... if antiviruses store virus definition files that contain virus signatures then why wouldn't they get detected as malware by themselves or Windows Defender or any other AV out there?
user avatar
0 votes
2 answers
230 views

What does the bizarre text mean at VirusTotal?

I downloaded Bitcoin Core from here: https://bitcoin.org/bin/bitcoin-core-0.20.0/bitcoin-0.20.0-win64-setup.exe I then uploaded it to VirusTotal: https://www.virustotal.com/gui/file/...
user avatar
0 votes
1 answer
157 views

Anti virus vs Anti malware? [duplicate]

What is the difference in anti malware like malwarebytes premium and an anti virus? Do I need both or would malwarebytes be enough?
user avatar
3 votes
5 answers
635 views

What are the benefits of enabling antivirus full scanning?

If AV auto-scan will detect and prevent the malware from executing why there is a need to enable schedule/full scans? I'm asking because a full scan can create sometimes overhead on the machine and ...
user avatar
  • 1,182
4 votes
2 answers
137 views

How could malware disable third party security software?

I'm asking this question with the assumption that anything the user can do, so can malware. I'm using a third party firewall on my system to control which programs are able to access the internet. ...
user avatar
0 votes
1 answer
73 views

where to get more information about Malware [closed]

Where I can find more information about Malware, like its name, malware family, its behavior, first seen, which type of file its use, its internal code, etc. If someone knows any source of Malware ...
user avatar
0 votes
2 answers
3k views

How to make sure my phone is secure after a phishing attempt?

Situation: My phone is an android (Samsung Galaxy s6) - In a moment of mindless distraction yesterday I opened a pdf in a phishing email - it did contain a link but I did not click it. Very shortly ...
user avatar
0 votes
1 answer
462 views

Is signature based malware detection a thing of the past?

I made an experimental AV application to detect some test files as malware. It uses a simple signature based detection to detect those files. When my test AV encounters a file, it computes the SHA256 ...
user avatar
1 vote
0 answers
14 views

How does Antivirus identify virus using signature-base? [duplicate]

I have read many articles about AV signature-based but I'm still not clear how AV using Hash to compared with the signature.
user avatar
0 votes
1 answer
128 views

Does a Windows 10 endpoint check software installations for malware if they are installed through GPO / SCCM / Software Center?

I'm trying to get a view on what extra security checks our packaging team could do when they download a potentially infected installer from the web before they package an MSI or EXE (assuming that the ...
user avatar
0 votes
2 answers
130 views

How can I determine if a malware sample is morphic? (polymorphic, metamorphic, etc)

I want to do a malware test that specifically uses recent morphic malware samples (polymorphic, metamorphic, etc). There are a couple of good sources I can pull samples from, but I need to know if ...
user avatar
0 votes
0 answers
47 views

How to remove the malware which hijacks the homepage of various browsers by hao.360.cn [duplicate]

This has been really getting my nerve. My friend installed some freeware which, in turn, hijacked the homepage of various browsers. The latter include chrome, edge, internet explorer, etc. Here is ...
user avatar
  • 101
1 vote
1 answer
152 views

Can Malware Fight Against Malware?

Is there is a way to create a better anti-malware tool by utilizing malware to fight against malware itself? I've looked up how anti-malware works and searched a lot in famous sites like Avast Blogs (...
user avatar
  • 113
1 vote
0 answers
94 views

Is it possible to get redirected to a malware download URI while using Tor as a proxy?

Now this is an interesting one. I just received a forwarded email notification from my data center provider that one of my servers accessed a sink hole that is associated with the nymaim malware. The ...
user avatar
  • 111
2 votes
2 answers
174 views

Behavior Monitoring in Endpoint Protection Platform

There are some EPP solutions that are considered very innovative (Crowdstrike, SentinelOne...) for the use of Behavior Monitoring. What is the difference with more standard EPP solution (ex. Symantec ...
user avatar
  • 23
0 votes
0 answers
2k views

How I can I make VBA macro force Run As Administrator

I'm trying to perform Reflective Dll Injection via VBA macro. The main idea behind using Reflective Dll Injection is to bypass Windows Defender as dropping an dll onto the disk seems very loud. The ...
user avatar
  • 41
0 votes
1 answer
122 views

Are there virus scanners for Windows that can be run without installation? [closed]

I wonder if there are virus scanners that can be run without installation. It would be very practical. Simply insert the USB pen drive and scan... It would be good if the scanner also detects malware....
user avatar
  • 101
2 votes
1 answer
88 views

Can any tools/tactics produce a higher confidence in a clean system than Microsoft Security Scanner?

In the process of trying to recover data in bulk from what I assumed was a failing hard drive, Windows Security kindly notified me it had found a handful of malicious items among the recovered files. ...
user avatar
0 votes
1 answer
143 views

Are automated steganalysis tools commonly used in malware analysis?

I want to know whether or not it is useful to a malware researcher or AV product to use steganalysis tools to detect or study malware. If so, is there a standard steganalysis tool that's generally ...
user avatar
5 votes
4 answers
488 views

How dangerous can a file be with no detected malware?

Let's say there is file which successfully passed all scans by all antivirus software there is on VirusTotal. Does it mean that it can't be dangerous. If no, what kind of dangers we can expect?
user avatar
  • 245
1 vote
2 answers
2k views

Bypassing Windows Defender VBA custom code

I've recently written a simple keylogger using classic DLL-injection technique. I wanted to simulate a real phishing attack where the user opens an Office document with macros and by enabling them he ...
user avatar
  • 41
1 vote
1 answer
281 views

Security of a laptop order

What's the likelihood of a laptop being compromised when it comes directly from a trusted computer store or a large, known computer technology company? Would there be any liability if malware or ...
user avatar
1 vote
1 answer
541 views

How to validate file content in php?

We have developed an application with contain file upload functionality. We use that application for internal purpose only. We use core php language. We already use the below validations: File ...
user avatar
1 vote
2 answers
206 views

What is the term for adding benign code/behavior to malware to evade antiviruses?

Some malware authors add benign code/behavior to their malware just to throw off antiviruses and IDSs which employ machine learning to detect malware. There is a name for this technique (and even a ...
user avatar
1 vote
2 answers
180 views

Should Anti Virus and Anti Malware layer be the first layer in web application stack or can it seat behind services?

Can you have Anti Virus and Anti Malware layer sitting deep with the microservice layer and have the malicious file flow through all the services ? Argument being the file is in memory and not getting ...
user avatar
0 votes
0 answers
594 views

Kaspersky TS blocking apt-get upgrade and marking files as HEUR:Trojan.Script.Generic

I have just recently downloaded kali linux onto my VM software and i was doing apt-get upgrade in terminal and some files got blocked by my kts and i was wondering whether it was a false positive as ...
user avatar
  • 1

1
2 3 4 5
7