Questions tagged [antimalware]
Software which includes anti-spyware, anti-rootkit, anti-phishing, and other technologies that attempt to identify and/or block malicious programs.
38
questions
182
votes
11
answers
35k
views
Help! My home PC has been infected by a virus! What do I do now?
This is an attempt to ask a canonical question as discussed in this old meta post. The goal is to create something helpful that can be used as a duplicate when non experts ask about virus infections.
...
- 65.2k
22
votes
8
answers
4k
views
Are signature based antivirus or antimalware effective?
Are signature based antivirus or antimalware solutions effective? Has the battle been lost against the ever increasing amount of malware, particularly rootkits, that are in the wild?
- 1,267
161
votes
14
answers
18k
views
What is the safest way to deal with loads of incoming PDF files, some of which could potentially be malicious?
As an investigative journalist I receive each day dozens of messages, many of which contain PDF documents. But I'm worried about some of the potentially malicious consequences of blindly opening them ...
- 1,389
39
votes
1
answer
6k
views
CSS based attacks
I'm currently working on a plugin for a CMS which should allow content editors to write inline style tags.
I'm looking for advice / links on how inline styles could be abused.
Part of the reason ...
- 18.5k
46
votes
5
answers
83k
views
How to scan a PDF for malware? [closed]
Can anyone suggest an automated tool to scan a PDF file to determine whether it might contain malware or other "bad stuff"? Or, alternatively, assigns a risk level to the PDF?
I would prefer a free ...
- 99.1k
44
votes
8
answers
25k
views
Are two anti-virus better than one in protecting your computer?
A century old adage: The more the merrier.
In general, does this adage hold true in regards to the number of anti-virus software you should have on your PC?
Are there any limits before it actually ...
- 2,411
10
votes
3
answers
18k
views
Javascript Malware: How does it work, and how can it be mitigated?
I am wondering how malware gets served through Javascript. I've noticed a few illegitimate pop-ups while visiting some financial websites. I wonder how malware exploits work against the application ...
- 1,131
7
votes
4
answers
6k
views
What is nuke it from orbit? [duplicate]
I was reading this
Windows 2003 Enterprise infected by Conficker; post-infection problems continue
And they talk about nuking it from orbit (which apparently means wiping out the system and starting ...
- 359
47
votes
2
answers
22k
views
How do antiviruses scan for thousands of malware signatures in a short time?
Most antiviruses have hundreds of thousands or even millions of malware signatures and yet they scan many files in a reasonable short time with high detection rates. Even real-time scanners doesn't ...
- 1,107
13
votes
1
answer
2k
views
How does one properly check foreign USB Drives before getting them in your Network? Is the presented approach considered "safe"?
Current Situation:
I´m currently employed at an Hospital and with rising danger of ransomware etc. spread by usb drives we decided to block all USB-Ports (roundabout 600 Clients/Windows only) via ...
- 996
3
votes
6
answers
27k
views
Use PHP to check uploaded image file for malware?
I want my users to be able to upload a photo. Currently I am not checking the uploaded photo for problems of any kind, although I do limit the size to 32k.
Is there any way for me to check uploaded ...
- 113
-1
votes
1
answer
227
views
Online traffic monitoring by ISP for safety purposes [closed]
I have a question regarding approach to online security and protection against viruses, malware and phishing by one of the biggest European ISP. Below you will find my understanding of the topic. Is ...
- 107
42
votes
7
answers
82k
views
How is it possible to embed executable code in an image
I was reading up on FireEye and came across this NYTimes article detailing a Skype chat where an image was sent laden with malware:
Quote:
To gain access to information on the devices..., hackers ...
- 473
24
votes
2
answers
14k
views
How would one know if they have a rootkit?
Are they impossible to detect? Seeing as the attacker has admin rights and could modify anti virus software that might otherwise be used to detect or circumvent a root kit. Are there certain red flags ...
- 341
21
votes
4
answers
6k
views
Reverse engineering malware/viruses
Assuming a machine has malware, regardless of how it got there, one thing I would like to learn to do is to take the binary file and reverse engineer it to see what the malware is doing/has already ...
- 1,996
16
votes
4
answers
12k
views
Detecting reflective DLL injection
In the past few years, malware (and some pen-test tools like Metasploit's meterpreter payload) have begun to use reflective DLL injection (PDF) to load a DLL into the memory of a process. The benefit ...
- 283
14
votes
8
answers
3k
views
Are antiviruses still useful? [duplicate]
Are anti-viruses useful nowadays ?
Given the number of viruses that are developed and spread monthly, and given the fact anti-viruses are based on virus signatures, I wonder how much it is useful and ...
user52657
4
votes
1
answer
310
views
Has an antivirus ever failed to detect malware for "non-technical" reasons? [closed]
I'm wondering if an antimalware vendor has ever whitelisted (or otherwise failed to detect) a piece of malware because the author/sponsor either paid them, threatened them, or legislated against them.
- 354
3
votes
4
answers
4k
views
Is it possible to crack ransomware encryption if I have the original file?
Is it possible to crack ransomware encryption if I have 2 versions of a file: before and after the encryption? Are there any tools for such a thing?
- 133
-5
votes
6
answers
24k
views
Will antivirus detect all keyloggers?
Our company schedules Security Training courses for our personnel.
In order for us to test them, we develop code such as keyloggers which we email to our personnel to detect stupid personnel, and of ...
- 1,048
64
votes
5
answers
17k
views
Can Beehive detect a Snowden-like actor?
In a seminar, one of the Authors of Beehive: Large-Scale Log Analysis for Detecting Suspicious Activity in Enterprise Networks said that this system can prevent actions like Snowden did.
From their ...
- 5,474
18
votes
4
answers
914
views
Malware - are removal tools acceptable or is bare metal re-install the only safe option?
I see a number of companies offering "malware removal" services. I see some software that claims to be able to remove malware from an infected machine.
Is using a removal software tool to 'clean' an ...
- 2,074
15
votes
4
answers
13k
views
How to detect Meterpreter and similar malware?
Is it possible to find Meterpreter or similar malware which doesn't modify the hard disk but is only stored in RAM?
Most common anti-rootkit software like rkhunter and chkrootkit don't find it.
chris12345
12
votes
2
answers
2k
views
Antivirus, antimalware and antispyware software. What is the difference?
What is the difference between antivirus, antimalware and antispyware software? If any clear distinction can be defined.
- 2,117
8
votes
3
answers
4k
views
Using MD5 for malware ids: collision attack risks?
It has been known since 2004 that the MD5 hash is vulnerable to collision attacks (update - not "preimage" attacks - my mistake....). Yet it still seems that people are using it to identify malware. ...
- 20.7k
7
votes
6
answers
9k
views
How can I tell whether this computer is part of a botnet?
One of the computers that I manage (in the family, not business) has a weird set of files in its boot: bash.exe, curl.exe, uname.exe, sed.exe, rm.exe, tail.exe, cut.exe, awk.exe, cat.exe, chmod.exe, ...
5
votes
2
answers
666
views
Signature-based antiviruses
Do signature-based antiviruses search for the exact matches of the signatures they have in their database with those of viruses to analyse ?
I ask this question because I wonder if it is the reason ...
user45139
5
votes
1
answer
9k
views
What are the methods to find hooked functions and APIs?
Many malware executables use hooking to be invisible. I am familiar with some hooking methods, I'm not sure what methods exist for detecting them. Is there a way to tell when a function call has been ...
- 51
5
votes
2
answers
2k
views
How can NSA implants and backdoors be detected? [closed]
It has been a while now since the Snowden revelations of various NSA malware and backdoors. For instance:
March 12, 2014: NSA has developed implants to take over targeted computers’ microphones and ...
- 61
4
votes
2
answers
5k
views
What are some possible uses of a zip bomb?
This article claims that zip bombs cannot be used today as modern systems are too smart for it and no victim is going to slowly unpack terrabytes of data so zip bombs are basically useless.
Is this ...
- 41
3
votes
1
answer
759
views
Is Android anti-virus software necessary and helpful?
Is Android anti-virus software necessary and helpful? Can it actually prevent malware attacks on my system? Are there other good opportunities to block malicious software attacks?
At home, I am ...
- 45
3
votes
1
answer
336
views
How can I assess the trust worthiness of a browser add-on?
Having learned a bit more about what add-ons/extensions can do in Firefox, I want to minimize my risk and use some safer mechanism to download videos (FLV in particular) for later viewing.
...
- 31
2
votes
1
answer
408
views
How does the Emotet malware work?
I was searching this site for questions on Emotet and I was kind of baffled when nothing was on here. So the title is kind of self explanatory. See this question as an attempt to "complete" the ...
- 7,945
2
votes
1
answer
219
views
Second hand pc safety tips?
Edit:
Thanks for all the help, found a BIOS version and updated them all and gutman'd them all. everything is working well and nothing has died so all my paranoia paid off... or there was nothing ...
- 23
1
vote
2
answers
162
views
Has exploitation been demonstrated against the fundamental constructs of the debugging process?
I'm curious to know if an attacker can fundamentally exploit the debugging process.
I'm not asking if specific debugging tools have been exploitable, surely some have, but rather whether the process ...
- 1,300
1
vote
2
answers
944
views
Virus checking and cleaning an external hdd
Is it safe to scan and clean an external hdd of malware/virus on an otherwise clean system ie my system!?
Does the antivirus software on my machine do it's work externally? ie if a virus is detected ...
- 53
0
votes
3
answers
336
views
Choice of Anti Virus Tool vs Anti Malware Tool?
We've had a breach in our network recently and we have been challenged over the the AV tool we are using. Because the malware/virus was cleaned (variant of Ransomware) by using an advanced anti ...
- 2,033
0
votes
1
answer
575
views
What items should be on a malware remediation checklist? [closed]
Edit: Let's assume Windows 7 and potentially Windows Server 2003/2008.
IMHO, any machine that has malware should be reimaged/reformatted/OS reinstalled before it is deployed back into the environment....
