Questions tagged [antimalware]

Software which includes anti-spyware, anti-rootkit, anti-phishing, and other technologies that attempt to identify and/or block malicious programs.

Filter by
Sorted by
Tagged with
1
vote
1answer
88 views

If a file has previously been scanned by VirusTotal, will the VirusTotal website always indicate this fact?

I recently downloaded a very popular open-source application. Usually, I compile open-source applications myself after reading the source code. But my compiler box was busy with many tasks, so I ...
2
votes
4answers
213 views

Can a antivirus software detect a malware that steals data?

For example, consider a software that wants to package all txt files in the /user/Desktop directory and upload them to its own server. I am not a programmer, but I know it can be done very easily with ...
1
vote
1answer
53 views

Cannot interpret maldet results

After executing sudo maldet -a / LMD provides the following report: HOST: foo.bar.baz SCAN ID: 210117-2223.1145531 STARTED: Jan 17 2021 22:23:26 +0000 COMPLETED: Jan 18 2021 22:01:12 +0000 ...
0
votes
1answer
64 views

What is the use case for antimalware manual scans?

I am not able to understand what use is the manual antimalware scan? All antivirus software has a manual anti-malware scan. I understand if it's the first time someone installs it on their infected/...
0
votes
2answers
95 views

Does malware that comes through outdated apps go away if I uninstall the apps?

I was reading this and this article. The first article itself is about why software updates are extremely important for security, and the second one also mentions the following: "Make sure your ...
1
vote
1answer
639 views

How to check for malware before downloading a torrent file?

I wanted to know if there is a way to check if a torrent file has malware or not, before actually downloading it via uTorrent f.e. I only know VirusTotal site. Is this one reliable? Because each time ...
0
votes
1answer
1k views

Remote Access Trojan (RAT) — How to detect, how to remove [duplicate]

Is there a guaranteed way to: Know there is a Remote Access Trojan in my PC? Remove it completely and successfully from my PC? Note: Assume that the hacker doesn't leave any hint of their activity (...
0
votes
1answer
92 views

How to check which process is modifying my clipboard?

I'm on Windows 10 last build and for a few days it looks like I have a malware that modifies ethereum addresses in my clipboard. I sadly tried a lot of antivirus, antispyware and nothing is found. I ...
1
vote
2answers
152 views

Why don't antivirus definition files get detected as malware

I was wondering... if antiviruses store virus definition files that contain virus signatures then why wouldn't they get detected as malware by themselves or Windows Defender or any other AV out there?
0
votes
2answers
145 views

What does the bizarre text mean at VirusTotal?

I downloaded Bitcoin Core from here: https://bitcoin.org/bin/bitcoin-core-0.20.0/bitcoin-0.20.0-win64-setup.exe I then uploaded it to VirusTotal: https://www.virustotal.com/gui/file/...
0
votes
0answers
41 views

Understanding Antivirus Sandbox limitations

The most advanced antiviruses fight against malware with different techniques, like signature-based detection and heuristic analysis. In case those two are bypassed by the malware, there is still the ...
0
votes
1answer
89 views

Anti virus vs Anti malware? [duplicate]

What is the difference in anti malware like malwarebytes premium and an anti virus? Do I need both or would malwarebytes be enough?
3
votes
5answers
338 views

What are the benefits of enabling antivirus full scanning?

If AV auto-scan will detect and prevent the malware from executing why there is a need to enable schedule/full scans? I'm asking because a full scan can create sometimes overhead on the machine and ...
4
votes
2answers
88 views

How could malware disable third party security software?

I'm asking this question with the assumption that anything the user can do, so can malware. I'm using a third party firewall on my system to control which programs are able to access the internet. ...
0
votes
1answer
33 views

where to get more information about Malware [closed]

Where I can find more information about Malware, like its name, malware family, its behavior, first seen, which type of file its use, its internal code, etc. If someone knows any source of Malware ...
0
votes
2answers
2k views

How to make sure my phone is secure after a phishing attempt?

Situation: My phone is an android (Samsung Galaxy s6) - In a moment of mindless distraction yesterday I opened a pdf in a phishing email - it did contain a link but I did not click it. Very shortly ...
0
votes
1answer
158 views

Is signature based malware detection a thing of the past?

I made an experimental AV application to detect some test files as malware. It uses a simple signature based detection to detect those files. When my test AV encounters a file, it computes the SHA256 ...
1
vote
0answers
13 views

How does Antivirus identify virus using signature-base? [duplicate]

I have read many articles about AV signature-based but I'm still not clear how AV using Hash to compared with the signature.
0
votes
1answer
65 views

Does a Windows 10 endpoint check software installations for malware if they are installed through GPO / SCCM / Software Center?

I'm trying to get a view on what extra security checks our packaging team could do when they download a potentially infected installer from the web before they package an MSI or EXE (assuming that the ...
0
votes
2answers
87 views

How can I determine if a malware sample is morphic? (polymorphic, metamorphic, etc)

I want to do a malware test that specifically uses recent morphic malware samples (polymorphic, metamorphic, etc). There are a couple of good sources I can pull samples from, but I need to know if ...
0
votes
0answers
47 views

How to remove the malware which hijacks the homepage of various browsers by hao.360.cn [duplicate]

This has been really getting my nerve. My friend installed some freeware which, in turn, hijacked the homepage of various browsers. The latter include chrome, edge, internet explorer, etc. Here is ...
1
vote
1answer
105 views

Can Malware Fight Against Malware?

Is there is a way to create a better anti-malware tool by utilizing malware to fight against malware itself? I've looked up how anti-malware works and searched a lot in famous sites like Avast Blogs (...
1
vote
0answers
55 views

Is it possible to get redirected to a malware download URI while using Tor as a proxy?

Now this is an interesting one. I just received a forwarded email notification from my data center provider that one of my servers accessed a sink hole that is associated with the nymaim malware. The ...
2
votes
2answers
93 views

Behavior Monitoring in Endpoint Protection Platform

There are some EPP solutions that are considered very innovative (Crowdstrike, SentinelOne...) for the use of Behavior Monitoring. What is the difference with more standard EPP solution (ex. Symantec ...
0
votes
0answers
1k views

How I can I make VBA macro force Run As Administrator

I'm trying to perform Reflective Dll Injection via VBA macro. The main idea behind using Reflective Dll Injection is to bypass Windows Defender as dropping an dll onto the disk seems very loud. The ...
0
votes
1answer
85 views

Are there virus scanners for Windows that can be run without installation? [closed]

I wonder if there are virus scanners that can be run without installation. It would be very practical. Simply insert the USB pen drive and scan... It would be good if the scanner also detects malware....
2
votes
1answer
53 views

Can any tools/tactics produce a higher confidence in a clean system than Microsoft Security Scanner?

In the process of trying to recover data in bulk from what I assumed was a failing hard drive, Windows Security kindly notified me it had found a handful of malicious items among the recovered files. ...
0
votes
1answer
83 views

Are automated steganalysis tools commonly used in malware analysis?

I want to know whether or not it is useful to a malware researcher or AV product to use steganalysis tools to detect or study malware. If so, is there a standard steganalysis tool that's generally ...
5
votes
4answers
391 views

How dangerous can a file be with no detected malware?

Let's say there is file which successfully passed all scans by all antivirus software there is on VirusTotal. Does it mean that it can't be dangerous. If no, what kind of dangers we can expect?
1
vote
2answers
765 views

Bypassing Windows Defender VBA custom code

I've recently written a simple keylogger using classic DLL-injection technique. I wanted to simulate a real phishing attack where the user opens an Office document with macros and by enabling them he ...
1
vote
1answer
244 views

Security of a laptop order

What's the likelihood of a laptop being compromised when it comes directly from a trusted computer store or a large, known computer technology company? Would there be any liability if malware or ...
0
votes
1answer
244 views

How to validate file content in php?

We have developed an application with contain file upload functionality. We use that application for internal purpose only. We use core php language. We already use the below validations: File ...
1
vote
2answers
167 views

What is the term for adding benign code/behavior to malware to evade antiviruses?

Some malware authors add benign code/behavior to their malware just to throw off antiviruses and IDSs which employ machine learning to detect malware. There is a name for this technique (and even a ...
1
vote
2answers
110 views

Should Anti Virus and Anti Malware layer be the first layer in web application stack or can it seat behind services?

Can you have Anti Virus and Anti Malware layer sitting deep with the microservice layer and have the malicious file flow through all the services ? Argument being the file is in memory and not getting ...
0
votes
0answers
326 views

Kaspersky TS blocking apt-get upgrade and marking files as HEUR:Trojan.Script.Generic

I have just recently downloaded kali linux onto my VM software and i was doing apt-get upgrade in terminal and some files got blocked by my kts and i was wondering whether it was a false positive as ...
0
votes
2answers
155 views

Python Antivirus comparing hashes [closed]

I'm writing an antivirus in python mostly to learn and for research purposes, I do understand it would be more efficient to do this in something like C and eventually I will port this over. So far I ...
3
votes
1answer
135 views

Is there an alternative to using hashing to identify malware?

I'm reading a sans paper on IOCs (indicators of compromise) in malware forensics and I came across this interesting obstacle: polymorphic and metamorphic codes (Paxson, 2011) result in multiple ...
-2
votes
1answer
184 views

How long is a typical malware signature?

I read in Peter Szor's Art of Computer Virus Research and Defense that, in the past, a 16-byte malware signature was sufficient to 16-bit detect malware, but that longer signatures are necessary for ...
0
votes
3answers
2k views

How do i scan my AWS S3 buckets for malicious content/objects?

I am setting up AWS SFTP which uses s3 to store files. I am setting up sftp to exchange files with third party organisations. When i receive files i want to ensure no malicious content is received. ...
0
votes
0answers
70 views

Unknown process attempted to execute code

This morning I booted up my computer and not long afterward, got a notification from ByteFence (unsubscribed) that an unknown process attempted to execute a command that was deemed unwanted. ByteFence ...
2
votes
1answer
331 views

How does the Emotet malware work?

I was searching this site for questions on Emotet and I was kind of baffled when nothing was on here. So the title is kind of self explanatory. See this question as an attempt to "complete" the ...
0
votes
1answer
289 views

Is there a way to download the Firefox Phishing and Malware Protection list?

I'm building an app that needs to check bad websites and was wondering if there is a way to download the Firefox bad site list directly outside of the browser? The list is described in the Mozilla.org ...
2
votes
0answers
179 views

Can developers stop their software from being flagged as malicious by AV products?

This may not be the correct community for this question, I apologize if that's the case. Scenario: A software development company has created a collection of small desktop applications. They have ...
-1
votes
1answer
73 views

Does the term “malware signature” always refer to a pattern of bytes? [duplicate]

I know that traditionally a malware signature is a pattern of bytes in a program. While reading Joxean Koret and Elias Bachaalany's "Antivirus Hacker's Handbook" I saw that the authors categorized the ...
0
votes
0answers
33 views

Is there any anti-virus that only uses behaviour-based malware detection? [duplicate]

I would like to know any antivirus software that uses strictly only a behaviour-based malware detection technique as the aim of my research is to compare behavioural-based and signature-based malware ...
4
votes
0answers
58 views

What is the most efficient approach to automate testing a malware sample on many different AVs without using online services? [closed]

So let's say you want to automate changing parts of malware and testing it on many different AVs, and you want all this process to be automated, i believe people who gave the AVLeak talk in black hat ...
0
votes
1answer
467 views

How do AVs scan the file in websites that claim they don't send the files to AVs like Nodistribute.com? [closed]

So for example one of the famous alternatives to Virustotal aka Nodistribute.com claims that it doesn't send the file to AVs, but if it doesn't, then how can they scan it? just by checking the hash? ...
0
votes
1answer
333 views

What is “rule-based” analysis in malware detection?

I've read a few articles that describe the heuristic detection used by AVs as being either "weight-based" or "rule-based". The weight-based aspect seems to make sense, but I don't understand what "...
1
vote
3answers
368 views

Can any Windows app install a kernel driver? if not, then how can Anti-Viruses install kernel drivers?

Can any application install a kernel driver? if not, then how Windows decides who can and who cannot? If AVs can install kernel drivers, considering they are an application with an installer just like ...
7
votes
2answers
2k views

How do AV scanners in VirusTotal check if a file is malicious or not and how trustworthy is its report?

So i have seen many times that people provide the virus total report for a file to prove its not a virus but i just checked and when i submit a file its not even uploading it (i checked my bandwidth),...

1
2 3 4 5 6