Questions tagged [antimalware]
Software which includes anti-spyware, anti-rootkit, anti-phishing, and other technologies that attempt to identify and/or block malicious programs.
31
questions with no upvoted or accepted answers
5
votes
0
answers
430
views
How to deal with Sage Ransomware 2.2 infection?
My PC got stuck like this:
It's a Sage 2.2 Ransomware. How do I fix this? Does restoring the system help me?
- 51
4
votes
0
answers
309
views
What does Memory Scanning refer to in the Context of Malware Detection Wanna Cry
When reading https://www.zionsecurity.com/sites/default/files/what_to_expect_from_your_antivirus.pdf
It mentions:
It is almost impossible to protect against new malware that will use
the ...
- 53
2
votes
0
answers
319
views
Can a virus infect windows 10 bootable media?
I created a bootable windows 10 usb from my friend's computer. I used the official tool from microsoft. I was dumb enough to not check my friend's computer beforehand (turns out he had Utorrent Web ...
- 29
2
votes
2
answers
2k
views
Bypassing Windows Defender VBA custom code
I've recently written a simple keylogger using classic DLL-injection technique. I wanted to simulate a real phishing attack where the user opens an Office document with macros and by enabling them he ...
- 51
2
votes
0
answers
459
views
Can developers stop their software from being flagged as malicious by AV products?
This may not be the correct community for this question, I apologize if that's the case.
Scenario:
A software development company has created a collection of small desktop applications. They have ...
- 121
2
votes
0
answers
569
views
How should end users respond to Earthlink's "Allowed Sender" feature when blocked by policy?
Some of our users are requested to click on an Earthlink antispam URL below
https://webmail.pas.earthlink.net/wam/addme?a=USERNAME@earthlink.net&id=<SOME GUID>
However our firewall policy ...
- 50.6k
2
votes
0
answers
587
views
Why use oddly compiled ELF files for Linux malware?
I ran file on some Linux malware ELF files that I've acquired over the last
couple of years. I noticed some oddities:
ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), statically linked, for ...
- 4,542
1
vote
0
answers
29
views
Best practice: checking backups of CMS-websites for viruses (code, database, and files)?
I've got backup files of several CMS-based websites on my local computer (Microsoft Windows) that need to get checked for viruses. Are there anti-virus scanners that catch viruses in the code, in ...
- 111
1
vote
0
answers
41
views
Can you exclude scanning of a particular app or file on Avast Antivirus for Samsung?
I have Avast pro for my Samsung. I searched the whole app but I cant find the option to exclude/whitelist an app or file from scanning. Is there such an option for android? I looked through their ...
- 11
1
vote
0
answers
142
views
What is the difference between malware signatures and malware artifacts?
I am trying to analyse some malware samples but I am trying to understand the differen between malware signatures and malware artifacts. As far as I understand (and from what I've understood from this ...
- 31
1
vote
0
answers
145
views
How to stop 3rd party libraries from being reported as malicious, if they were part of malicious programs in the past?
Some are standard user space dll’s and another one is actually a windows driver. The libraries alone are not dangerous and are pure utilities but they can be used by bad guys, like most software tools....
- 161
1
vote
1
answer
145
views
Does a Windows 10 endpoint check software installations for malware if they are installed through GPO / SCCM / Software Center?
I'm trying to get a view on what extra security checks our packaging team could do when they download a potentially infected installer from the web before they package an MSI or EXE (assuming that the ...
- 21
1
vote
0
answers
95
views
Is it possible to get redirected to a malware download URI while using Tor as a proxy?
Now this is an interesting one. I just received a forwarded email notification from my data center provider that one of my servers accessed a sink hole that is associated with the nymaim malware. The ...
- 111
1
vote
0
answers
2k
views
How I can I make VBA macro force Run As Administrator
I'm trying to perform Reflective Dll Injection via VBA macro. The main idea behind using Reflective Dll Injection is to bypass Windows Defender as dropping an dll onto the disk seems very loud.
The ...
- 51
1
vote
0
answers
389
views
Which Anti-Virus companies share their signature databases?
I recently heard that AVG and AVAST shared their malware signature databases (avast forum)
Which AV vendors share their signature databases or use the same engine for detecting malwares? Based on ...
- 1,142
1
vote
0
answers
403
views
Heuristic Malware Detection Methods
I would like to know some basic heuristic detection methods in detail because when I do research there is only a general overview of heuristics and not what methods are used to achieve it. I would ...
- 121
1
vote
0
answers
605
views
Is "Virus Scanner Plus" a legitimate product?
I have "Virus Scanner Plus" (ostensibly) by Bitdefender installed on my Mac from the App Store (and have had for a few years). But, although the app was recently updated in the App Store, it is not ...
- 333
1
vote
0
answers
183
views
Access android internal storage for full passive deep malware scan?
Is it possible to passively (with a computer) view/scan all content on an android mobile device's internal storage without crackopen/damaging it? For a deep malware scan of the whole storage of the ...
- 861
1
vote
0
answers
213
views
Detecting reflective DLL injection any other ways?
any way to detect it? maybe using mcafee hips rules?
Are there any known Techniques to detect it ? like walking the VAD tree or something?
- 111
1
vote
0
answers
232
views
How dangerous is Exploit.LNK.BadLnk.a (v)?
I have encountered a supposed low level eploit on my network at work, by the name of: Exploit.LNK.BadLnk.a (v). I have torn through pages of entries on google trying to find information on this bit of ...
- 21
0
votes
0
answers
37
views
Monitor Live Volatile Memory (RAM)
I am developing a project that involves extracting the contents of the RAM (volatile memory) of a computer to mitigate malware while is being executed. Currently, I do this by capturing the memory ...
- 1
0
votes
0
answers
100
views
Same miner detection by Kaspersky Anti-Virus after every boot up
I recently bought and downloaded Kaspersky. Since I downloaded it, after every reboot, it keeps detecting what seems to be a crypto miner. Every time it claims to delete it.
Should I be worried ?
Name:...
- 101
0
votes
0
answers
137
views
Reliable information on AV engine false positive rate
I just came across this blog post (archived here). I am curious to know where I can find more data on false positive rates of anti-virus software. Of course, any such data would be subjective, since ...
- 623
0
votes
0
answers
57
views
Malware sinkhole evasion techniques
I have read into malware sink holing, as a way to disrupt botnets.
There are also approaches to make this more difficult, for example using a Domain Name Generator algorithm which is what the ...
- 181
0
votes
0
answers
823
views
Kaspersky TS blocking apt-get upgrade and marking files as HEUR:Trojan.Script.Generic
I have just recently downloaded kali linux onto my VM software and i was doing apt-get upgrade in terminal and some files got blocked by my kts and i was wondering whether it was a false positive as ...
- 1
0
votes
0
answers
110
views
Unknown process attempted to execute code
This morning I booted up my computer and not long afterward, got a notification from ByteFence (unsubscribed) that an unknown process attempted to execute a command that was deemed unwanted. ByteFence ...
- 191
0
votes
0
answers
273
views
How can Malware Bytes scan "memory objects" in Windows?
I recently installed Malware Bytes onto a Windows PC.
As part of its scan phase it reports that it is "scanning memory objects".
I thought that Windows isolated memory address space making it ...
- 171
0
votes
0
answers
704
views
Does the old technique of kernel32.dll search (find .dll base address) not work anymore?
Does the old technique of kernel32.dll search (find .dll base address) not work anymore?
In the code below, I first take the kernel32.dll (return) address when the application starts, and then ...
- 1,177
0
votes
1
answer
146
views
Windows Security deletes my USB virus as soon as I plug it in
I am studying ethical hacking and I work in the cybersecurity department of a company.
I have been testing a hacking program but some PCs delete this executable as soon as I plug in the USB and some ...
- 1
-1
votes
1
answer
123
views
Standards and Guidelines Pro/Con Anti Malware programs
For a whitepaper about anti-malware products used in combination with (server side) applications and infrastructure components (database server) I am looking for standards, guidelines and codified ...
- 962
-1
votes
3
answers
109
views
Do some malware/viruses stay on the internet basically indefinitely?
Biological viruses stay in the population essentially indefinitely. We have immune systems, but this somehow doesn't cause virus strains to completely disappear after some time, as everyone's immune ...
- 99