Questions tagged [antimalware]

Software which includes anti-spyware, anti-rootkit, anti-phishing, and other technologies that attempt to identify and/or block malicious programs.

Filter by
Sorted by
Tagged with
182 votes
11 answers

Help! My home PC has been infected by a virus! What do I do now?

This is an attempt to ask a canonical question as discussed in this old meta post. The goal is to create something helpful that can be used as a duplicate when non experts ask about virus infections. ...
Anders's user avatar
  • 65.2k
22 votes
8 answers

Are signature based antivirus or antimalware effective?

Are signature based antivirus or antimalware solutions effective? Has the battle been lost against the ever increasing amount of malware, particularly rootkits, that are in the wild?
Sim's user avatar
  • 1,267
161 votes
14 answers

What is the safest way to deal with loads of incoming PDF files, some of which could potentially be malicious?

As an investigative journalist I receive each day dozens of messages, many of which contain PDF documents. But I'm worried about some of the potentially malicious consequences of blindly opening them ...
Tom the journalist's user avatar
39 votes
1 answer

CSS based attacks

I'm currently working on a plugin for a CMS which should allow content editors to write inline style tags. I'm looking for advice / links on how inline styles could be abused. Part of the reason ...
symcbean's user avatar
  • 18.5k
46 votes
5 answers

How to scan a PDF for malware? [closed]

Can anyone suggest an automated tool to scan a PDF file to determine whether it might contain malware or other "bad stuff"? Or, alternatively, assigns a risk level to the PDF? I would prefer a free ...
D.W.'s user avatar
  • 99.1k
44 votes
8 answers

Are two anti-virus better than one in protecting your computer?

A century old adage: The more the merrier. In general, does this adage hold true in regards to the number of anti-virus software you should have on your PC? Are there any limits before it actually ...
Computernerd's user avatar
  • 2,411
10 votes
3 answers

Javascript Malware: How does it work, and how can it be mitigated?

I am wondering how malware gets served through Javascript. I've noticed a few illegitimate pop-ups while visiting some financial websites. I wonder how malware exploits work against the application ...
p_upadhyay's user avatar
  • 1,131
7 votes
4 answers

What is nuke it from orbit? [duplicate]

I was reading this Windows 2003 Enterprise infected by Conficker; post-infection problems continue And they talk about nuking it from orbit (which apparently means wiping out the system and starting ...
user13267's user avatar
  • 359
47 votes
2 answers

How do antiviruses scan for thousands of malware signatures in a short time?

Most antiviruses have hundreds of thousands or even millions of malware signatures and yet they scan many files in a reasonable short time with high detection rates. Even real-time scanners doesn't ...
Koorosh Pasokhi's user avatar
13 votes
1 answer

How does one properly check foreign USB Drives before getting them in your Network? Is the presented approach considered "safe"?

Current Situation: I´m currently employed at an Hospital and with rising danger of ransomware etc. spread by usb drives we decided to block all USB-Ports (roundabout 600 Clients/Windows only) via ...
architekt's user avatar
  • 996
3 votes
6 answers

Use PHP to check uploaded image file for malware?

I want my users to be able to upload a photo. Currently I am not checking the uploaded photo for problems of any kind, although I do limit the size to 32k. Is there any way for me to check uploaded ...
Frank E's user avatar
  • 113
-1 votes
1 answer

Online traffic monitoring by ISP for safety purposes [closed]

I have a question regarding approach to online security and protection against viruses, malware and phishing by one of the biggest European ISP. Below you will find my understanding of the topic. Is ...
grzebyk's user avatar
  • 107
42 votes
7 answers

How is it possible to embed executable code in an image

I was reading up on FireEye and came across this NYTimes article detailing a Skype chat where an image was sent laden with malware: Quote: To gain access to information on the devices..., hackers ...
Jeremy Thompson's user avatar
24 votes
2 answers

How would one know if they have a rootkit?

Are they impossible to detect? Seeing as the attacker has admin rights and could modify anti virus software that might otherwise be used to detect or circumvent a root kit. Are there certain red flags ...
DBroncos1558's user avatar
21 votes
4 answers

Reverse engineering malware/viruses

Assuming a machine has malware, regardless of how it got there, one thing I would like to learn to do is to take the binary file and reverse engineer it to see what the malware is doing/has already ...
Purge's user avatar
  • 1,996
16 votes
4 answers

Detecting reflective DLL injection

In the past few years, malware (and some pen-test tools like Metasploit's meterpreter payload) have begun to use reflective DLL injection (PDF) to load a DLL into the memory of a process. The benefit ...
Mick's user avatar
  • 283
14 votes
8 answers

Are antiviruses still useful? [duplicate]

Are anti-viruses useful nowadays ? Given the number of viruses that are developed and spread monthly, and given the fact anti-viruses are based on virus signatures, I wonder how much it is useful and ...
user avatar
4 votes
1 answer

Has an antivirus ever failed to detect malware for "non-technical" reasons? [closed]

I'm wondering if an antimalware vendor has ever whitelisted (or otherwise failed to detect) a piece of malware because the author/sponsor either paid them, threatened them, or legislated against them.
Hugh Allen's user avatar
3 votes
4 answers

Is it possible to crack ransomware encryption if I have the original file?

Is it possible to crack ransomware encryption if I have 2 versions of a file: before and after the encryption? Are there any tools for such a thing?
Ori Price's user avatar
  • 133
-5 votes
6 answers

Will antivirus detect all keyloggers?

Our company schedules Security Training courses for our personnel. In order for us to test them, we develop code such as keyloggers which we email to our personnel to detect stupid personnel, and of ...
saber tabatabaee yazdi's user avatar
64 votes
5 answers

Can Beehive detect a Snowden-like actor?

In a seminar, one of the Authors of Beehive: Large-Scale Log Analysis for Detecting Suspicious Activity in Enterprise Networks said that this system can prevent actions like Snowden did. From their ...
kelalaka's user avatar
  • 5,474
18 votes
4 answers

Malware - are removal tools acceptable or is bare metal re-install the only safe option?

I see a number of companies offering "malware removal" services. I see some software that claims to be able to remove malware from an infected machine. Is using a removal software tool to 'clean' an ...
DanBeale's user avatar
  • 2,074
15 votes
4 answers

How to detect Meterpreter and similar malware?

Is it possible to find Meterpreter or similar malware which doesn't modify the hard disk but is only stored in RAM? Most common anti-rootkit software like rkhunter and chkrootkit don't find it.
user avatar
12 votes
2 answers

Antivirus, antimalware and antispyware software. What is the difference?

What is the difference between antivirus, antimalware and antispyware software? If any clear distinction can be defined.
rem's user avatar
  • 2,117
8 votes
3 answers

Using MD5 for malware ids: collision attack risks?

It has been known since 2004 that the MD5 hash is vulnerable to collision attacks (update - not "preimage" attacks - my mistake....). Yet it still seems that people are using it to identify malware. ...
nealmcb's user avatar
  • 20.7k
7 votes
6 answers

How can I tell whether this computer is part of a botnet?

One of the computers that I manage (in the family, not business) has a weird set of files in its boot: bash.exe, curl.exe, uname.exe, sed.exe, rm.exe, tail.exe, cut.exe, awk.exe, cat.exe, chmod.exe, ...
Torben Gundtofte-Bruun's user avatar
5 votes
2 answers

Signature-based antiviruses

Do signature-based antiviruses search for the exact matches of the signatures they have in their database with those of viruses to analyse ? I ask this question because I wonder if it is the reason ...
user avatar
5 votes
1 answer

What are the methods to find hooked functions and APIs?

Many malware executables use hooking to be invisible. I am familiar with some hooking methods, I'm not sure what methods exist for detecting them. Is there a way to tell when a function call has been ...
Heeru West's user avatar
5 votes
2 answers

How can NSA implants and backdoors be detected? [closed]

It has been a while now since the Snowden revelations of various NSA malware and backdoors. For instance: March 12, 2014: NSA has developed implants to take over targeted computers’ microphones and ...
Dodgers's user avatar
  • 61
4 votes
2 answers

What are some possible uses of a zip bomb?

This article claims that zip bombs cannot be used today as modern systems are too smart for it and no victim is going to slowly unpack terrabytes of data so zip bombs are basically useless. Is this ...
Vegeta's user avatar
  • 41
3 votes
1 answer

Is Android anti-virus software necessary and helpful?

Is Android anti-virus software necessary and helpful? Can it actually prevent malware attacks on my system? Are there other good opportunities to block malicious software attacks? At home, I am ...
Kutsubato's user avatar
3 votes
1 answer

How can I assess the trust worthiness of a browser add-on?

Having learned a bit more about what add-ons/extensions can do in Firefox, I want to minimize my risk and use some safer mechanism to download videos (FLV in particular) for later viewing. ...
Marneau's user avatar
  • 31
2 votes
1 answer

How does the Emotet malware work?

I was searching this site for questions on Emotet and I was kind of baffled when nothing was on here. So the title is kind of self explanatory. See this question as an attempt to "complete" the ...
Tom K.'s user avatar
  • 7,945
2 votes
1 answer

Second hand pc safety tips?

Edit: Thanks for all the help, found a BIOS version and updated them all and gutman'd them all. everything is working well and nothing has died so all my paranoia paid off... or there was nothing ...
Jordan Ryan's user avatar
1 vote
2 answers

Has exploitation been demonstrated against the fundamental constructs of the debugging process?

I'm curious to know if an attacker can fundamentally exploit the debugging process. I'm not asking if specific debugging tools have been exploitable, surely some have, but rather whether the process ...
J.Todd's user avatar
  • 1,300
1 vote
2 answers

Virus checking and cleaning an external hdd

Is it safe to scan and clean an external hdd of malware/virus on an otherwise clean system ie my system!? Does the antivirus software on my machine do it's work externally? ie if a virus is detected ...
Kol12's user avatar
  • 53
0 votes
3 answers

Choice of Anti Virus Tool vs Anti Malware Tool?

We've had a breach in our network recently and we have been challenged over the the AV tool we are using. Because the malware/virus was cleaned (variant of Ransomware) by using an advanced anti ...
Sayan's user avatar
  • 2,033
0 votes
1 answer

What items should be on a malware remediation checklist? [closed]

Edit: Let's assume Windows 7 and potentially Windows Server 2003/2008. IMHO, any machine that has malware should be reimaged/reformatted/OS reinstalled before it is deployed back into the environment....
iAwardYouNoPoints's user avatar