Questions tagged [antivirus]

Antivirus or anti-virus software is used to prevent, detect, and remove malware, including but not limited to computer viruses, computer worm, trojan horses, spyware and adware.

Filter by
Sorted by
Tagged with
-1 votes
0 answers
30 views

To what company does Norton Antivirus actually belong? [closed]

Norton Antivirus used to be from Symantec. Symantec got acquired by Digicert. But Norton is now part of Broadcom. I'm confused. Can someone enlighten me?
  • 117
1 vote
1 answer
59 views

Can I trust companies that test antimalware software? [closed]

Do they lie? I mean companies something like AV-TEST, AV-Comparatives, Virus Bulleting, ERG Effitas, etc.
  • 11
1 vote
0 answers
166 views

What is the most efficient way to get new executables whitelisted by Norton? [closed]

We developed an application (see https://embeetle.com). To avoid false positives, all our executables and DLLs are code-signed with an Extended Verification Code Signing Certificate from Sectigo. ...
  • 117
0 votes
1 answer
136 views

Windows Security deletes my USB virus as soon as I plug it in

I am studying ethical hacking and I work in the cybersecurity department of a company. I have been testing a hacking program but some PCs delete this executable as soon as I plug in the USB and some ...
  • 1
0 votes
0 answers
59 views

Same miner detection by Kaspersky Anti-Virus after every boot up

I recently bought and downloaded Kaspersky. Since I downloaded it, after every reboot, it keeps detecting what seems to be a crypto miner. Every time it claims to delete it. Should I be worried ? Name:...
0 votes
3 answers
195 views

Is it safe to use pirated software if AVs don't detect anything malicious about it?

I want to know whether it's safe to use a pirated software if during all of the processes including (downloading, running installer, installing, using and scanning installed files) the system's ...
's user avatar
2 votes
1 answer
45 views

Signature-based antivirus for mobile devices is impossible?

In the OWASP MASVS it says: Smartphones are like small computers, and mobile apps are just like classic software, so surely the security requirements are similar? But it doesn’t work like that. ...
0 votes
1 answer
83 views

What are the best security practices when when using VirtualBox on Windows 11 with an old OS?

Got a cheap new laptop to play old games with a VM of Windows XP/7, with the host being Windows 11. Using a WiFi that isn't my own (as I don't plan on connecting to the internet with this laptop) I ...
  • 1
0 votes
0 answers
29 views

Reliable information on AV engine false positive rate

I just came across this blog post (archived here). I am curious to know where I can find more data on false positive rates of anti-virus software. Of course, any such data would be subjective, since ...
  • 623
0 votes
1 answer
93 views

No antiviruses scan graphics cards VRAM for malware?

As I know, for antiviruses the VRAM is a blindspot, so casual Windows users like me can't do much about it. They have an antivirus, which doesn't even search for malware in VRAM. What's the answer for ...
  • 19
0 votes
2 answers
77 views

What exactly is Application.Hacktool.AMZ?

I have been using Windows Product Key Viewer for ages to read current Windows' serial number. I had never any hack- or virus-related issue about this application. A few days ago I have installed ...
  • 3,329
-1 votes
3 answers
103 views

Do some malware/viruses stay on the internet basically indefinitely?

Biological viruses stay in the population essentially indefinitely. We have immune systems, but this somehow doesn't cause virus strains to completely disappear after some time, as everyone's immune ...
14 votes
6 answers
3k views

Is it acceptable to exclude folders in antivirus?

A technical problem has arisen, and the vendor's first suggested solution is to exclude the program's folders from our antivirus. There are multiple reasons I am hesitant to do so: Primarily: If a ...
0 votes
0 answers
31 views

Why this Hello World exe flagged as malicious on Virustotal? [duplicate]

I am compiling the following source code: #include <stdio.h> int main() { printf("Hello World!"); } As you can see, it's just a normal program that print out Hello World! to ...
0 votes
1 answer
105 views

Non executable virus?

Bitdefender detected .class -- File path: ...\tetra-1.12.2.jar => .../GuiStats.class -- Threat name: Java.Trojan.GenericGBA.31135 .tif -- File path: ...\crash-81154...60f8.tif -- Threat name: ...
0 votes
1 answer
121 views

Are most viruses detected eventually?

My question is being asked in the case that I am currently infected. Many viruses are zero-day viruses, and in addition, I only occasionally install MalwareBytes, which seems to be the agreed-upon all ...
0 votes
1 answer
36 views

Is EDR the same as NGAV (next gen antivirus)?

I have searched online and still do not fully understand. Some sites treat them as different and others treat them as if they are the same. Can anyone please tell me if they are the same? Thank you
2 votes
0 answers
41 views

Kaspersky Total Security Data Vault encryption AES256 BUT with "effective key-length 56bit"

While comparing Kaspersky Total Security (KST) with Kaspersky Internet Security (KIS). One of the "extras" of KTS is the added "feature" of "Data Vaults", which "...
0 votes
0 answers
454 views

C# Hello World program detected as virus

I just wrote and compiled a Hello World program in C# (I'm using Visual Studio 2022) and when I sent the file to VirusTotal, 1 antivirus program detected the exe as unsafe (VirusTotal results of C# ...
2 votes
2 answers
5k views

Microsoft Defender flagged Surfshark.exe as "Misleading:Win32/Lodi"

Can this be safely ignored? VirusTotal shows that Microsoft is the only security vendor that flagged this file as malicious. I did not modify my Surfshark installation in any way, except for an update ...
0 votes
1 answer
70 views

What's the point in blocking content upload by extension?

In a web application I manage, we have installed an option to let the users to upload files. The files are stored directly in the database. The security department of the company have requested us to ...
  • 121
0 votes
0 answers
48 views

Spam popup using Google news

The other day I was using Google News, clicked a Politico link, and got a popup saying Google had selected me to get a free iPad if I answered some survey questions. I didn't fall for it but I had ...
  • 101
0 votes
2 answers
47 views

How do AV interact with malicious executables in remote shares?

I mainly use Linux and am not very familiar with Windows shares so my apologies if this question sounds noobish. Say I'm attacking a Windows machine and host an SMB share from my Linux machine with ...
1 vote
0 answers
80 views

What is the difference between malware signatures and malware artifacts?

I am trying to analyse some malware samples but I am trying to understand the differen between malware signatures and malware artifacts. As far as I understand (and from what I've understood from this ...
0 votes
0 answers
49 views

How to find data associated with windows defender processStart reference in windows10

Recently my windows defender warned me about a possibly malicious program it found on my pc. I have trouble interpreting the data windows defender serves me and I haven't found any microsoft ...
2 votes
0 answers
180 views

Can a virus infect windows 10 bootable media?

I created a bootable windows 10 usb from my friend's computer. I used the official tool from microsoft. I was dumb enough to not check my friend's computer beforehand (turns out he had Utorrent Web ...
0 votes
0 answers
60 views

Docker for canary file and virus detection

I am looking to create a pipeline for cleaning a large amount of files which may include files infected with viruses or canary tokens (to communicate with the attacker). My strategy at the moment is ...
0 votes
1 answer
510 views

Can two antivirus softwares work on one android phone?

Scenario: You have one antivirus installed on your phone. You suspect that your phone might have malware on it so you do a system scan and your AV doesn't find anything. So you decide to download ...
  • 1
0 votes
1 answer
91 views

Malware dropper uses "^" character in syntax of cmd.exe before calling mshta.exe to download file?

I found a malicious Excel file that was using an embedded HTA program as its dropper to download a powershell program from a malicious IP. The dropper was on a hidden sheet in the file. After ...
  • 1
0 votes
1 answer
212 views

Microsoft site iso download flagged by Defender as hacktool while creating bootable USB through rufus [closed]

Iso of 32 bit Windows 10 professional english version downloaded from Microsoft's website by using chrome's developer tools to spoof a chromeOS signature, so as to avoid using Microsoft's download ...
1 vote
0 answers
107 views

Why doesn't Defender get suspicious if a program adds exceptions to the Defender?

One can simply add exceptions to the Windows Defender by running this command in Powershell: Add-MpPreference -ExclusionPath <your_path> Why does Windows Defender not immediately flag programs ...
  • 51
-2 votes
2 answers
129 views

I accidentally clicked on ransomware link. Antivirus cleaned the files successfully

I am researching information regarding locker ransomware. I did a search for "Locker ransomware github". I clicked on the link in GitHub and found the link to view code and clicked that link ...
0 votes
1 answer
103 views

Windows Defender Exclusions

If a virus added itself to windows defender exclusions, it will never be scanned. However would windows defender still remove its startup registry keys and scheduled tasks? Windows defender is the ...
1 vote
3 answers
264 views

How can I have my process detect if antivirus injected a module or DLL to it?

I am writing an installer process (.exe). My installer deploys different components. It will add registry entries, copy files, copy files over the network, remote execute, remote PowerShell, local ...
  • 113
0 votes
0 answers
77 views

Antivirus denies Chrome

Our AV (Carbon Black) has denied chrmstp.exe (Chrome installer). I did some digging as to why and I found that it thought that it was attempting to install a backdoor. Digging further, I found the ...
  • 133
6 votes
2 answers
383 views

Do antivirus programs increase your attack surface and potentially give more power to malware?

When I was a student one of my professors used to say that an antivirus actually increases your attack surface by injecting itself into system processes and let's say opening more doors for ...
0 votes
2 answers
418 views

Can spyware be downloaded and installed on Android phone in a minute or less?

Following Scenario: You unlock your phone and you give it to someone so they can promply check it out (since it's a new phone). Now let's presume that the very exact person has intentions to install ...
1 vote
1 answer
235 views

Utilising 3rd-party AV definitions with ClamAV engine

I have ClamAV/engine pretty widely deployed on most of my Linux/UNIX/POSIX & other boxes - including gateways & at-rest storage, but I've found the ClamAV definitions... lacking... sometimes. ...
  • 75
1 vote
0 answers
142 views

How to stop 3rd party libraries from being reported as malicious, if they were part of malicious programs in the past?

Some are standard user space dll’s and another one is actually a windows driver. The libraries alone are not dangerous and are pure utilities but they can be used by bad guys, like most software tools....
  • 141
0 votes
1 answer
138 views

Security Tools - File Encryption vs Corruption

When security tools quarantine files, why do they tend to use encryption, rather than simple file corruption? The main goal of quarantining a file is to make it impossible to run on a system. This ...
5 votes
0 answers
398 views

Windows Defender catches Trojan right after clean install

I recently upgraded some desktop PC components (GPU, SSD). I decided to perform a clean install of Windows 10 onto the SSD. I used a USB created using the Installation Media tool provided by Microsoft,...
  • 51
0 votes
1 answer
336 views

Detect what antivirus installed on Windows Operating system

If we want to detect all Antivirus/Endpoint protection currently installed on a Windows machine? What is the best approach? Is there a list of registry locations we can read/iterate? Industry ...
  • 113
8 votes
4 answers
6k views

Can a virus infection spread from a PC to a PCB and back to a PC?

We have some equipment that is linked to PC's. These PC's acquire data from the equipment that they send to a server through an internal network. Furthermore these PC's are used to mediate ...
  • 105
1 vote
0 answers
95 views

What is known about the sandbox used for file parsers in MalwareBytes on Android?

Malwarebytes on Android includes a file scanner. Is it known or claimed to be sandboxed, by anything more than the Android sandbox for the Malwarebytes app? Or does it avoid using any parser code in ...
3 votes
1 answer
193 views

Is there a way to record CPU operations for a given process as they occur in a standard, production OS environment?

Doing malware analysis I'm interested in being able to log every instruction the CPU executes for a given process. I was hoping this was perhaps possible in a standard VM environment, even if not ...
  • 1,300
1 vote
2 answers
500 views

How to securely create a bootable USB drive from a possibly infected system?

I'm not sure about my system so I want to completely wipe my HDD and reinstall Windows 10. But I realized that an infected system can also infect a USB bootable drive. Unfortunately, I don't have ...
's user avatar
0 votes
0 answers
92 views

Whitelisting our app to prevent connection blocking?

We publish a Windows desktop app, and while I've run VirusTotal on all of our files with no hits, some security software blocks incoming connections on ports we use, leading to frequent user support ...
1 vote
1 answer
219 views

What's the point of Empire if all payloads get flagged?

I've been reading about how powerful frameworks such as Empire and Metasploit are but I'm confused about something. Say I gain access through a custom reverse-shell which I self-coded (so it bypasses ...
  • 13
1 vote
1 answer
654 views

How to run PrintSpoofer in memory from powershell?

PrintSpoofer uses named pipe impersonation to elevate on Windows 10 to SYSTEM from a user with SeImpersonatePrivilege (Local Service, Network Service, Administrator etc.). The compiled version is ...
  • 123
1 vote
0 answers
248 views

How to know if I had scanned a file on VirusTotal? [closed]

A few weeks ago, I was using VirusTotal to check a few files on my computer to see if they were viruses. But I do not remember if I had scanned a particular file. Is there is a way to check that? And ...
  • 71

1
2 3 4 5
14