Questions tagged [antivirus]

Antivirus or anti-virus software is used to prevent, detect, and remove malware, including but not limited to computer viruses, computer worm, trojan horses, spyware and adware.

Filter by
Sorted by
Tagged with
0
votes
0answers
9 views

Threat detected notifications everytime I open chrome and visit websites via Bitdefender

I accidentally clicked a random website before and Adware.Agent.WOM. malware injected into my computer. Now everytime I open google chrome and visit some websites the caches generate under \AppData\...
4
votes
0answers
36 views

What is the most efficient approach to automate testing a malware sample on many different AVs without using online services? [closed]

So let's say you want to automate changing parts of malware and testing it on many different AVs, and you want all this process to be automated, i believe people who gave the AVLeak talk in black hat ...
0
votes
1answer
92 views

How do AVs scan the file in websites that claim they don't send the files to AVs like Nodistribute.com? [closed]

So for example one of the famous alternatives to Virustotal aka Nodistribute.com claims that it doesn't send the file to AVs, but if it doesn't, then how can they scan it? just by checking the hash? ...
0
votes
1answer
61 views

What is “rule-based” analysis in malware detection?

I've read a few articles that describe the heuristic detection used by AVs as being either "weight-based" or "rule-based". The weight-based aspect seems to make sense, but I don't understand what "...
1
vote
3answers
108 views

Can any Windows app install a kernel driver? if not, then how can Anti-Viruses install kernel drivers?

Can any application install a kernel driver? if not, then how Windows decides who can and who cannot? If AVs can install kernel drivers, considering they are an application with an installer just like ...
0
votes
0answers
43 views

Are all “behavioral detection” of malware a form of heuristic detection? [duplicate]

A lot of articles I read seem to lump behavioral detection together with heuristic detection. From what I know, one of the defining features of heuristic detection is that it can be used to detect new ...
0
votes
1answer
53 views

USB read only permission and antivirus

We would like to block write permissions to USB drives. We will allow user read-only permissions to the USB drive. By doing that, do we still allow the Antivirus to scan the USB drive and delete, if ...
0
votes
2answers
111 views

Can I rely on Operating System (OS) Anti Virus (AV) scanning to scan files shares?

I have an EC2 instance with an Windows OS with anti virus installed. I have a requirement to attach a file share to the OS where the application is hosted. The file share is Amazon Fsx ( Amazon's ...
7
votes
2answers
484 views

How do AV scanners in VirusTotal check if a file is malicious or not and how trustworthy is its report?

So i have seen many times that people provide the virus total report for a file to prove its not a virus but i just checked and when i submit a file its not even uploading it (i checked my bandwidth),...
0
votes
0answers
56 views

Will my Windows driver stop being reported as malware if signed? [duplicate]

I have developed an IRP hooking based driver for one of my clients. Avast oes not complain about it but his AV suite reports it as malware. The lient will eventually sign this driver, but will it ...
1
vote
1answer
59 views

Is it correct to say that AVs use the same signature-based detection methods in emulation as they do on static binaries?

Many malwares can be packed or encrypted and AVs will emulate their execution to allow them to unpack or decrypt themselves. Once they do, are AVs simply using the same hashing or pattern-matching ...
0
votes
3answers
81 views

Can antiviruses scan /var

I was wondering if antiviruses could scan /var or if it was off limits i am trying to understand how antiviruses work and there impact on the file system and any limitations imposed on scanning ...
1
vote
1answer
53 views

Are the malware signatures used by AVs primarily created by human analysts or by automated means?

I've only ever read about human analysts creating signatures, but it seems like automated signature derivation would be less time-consuming and I'm surprised that I'm not seeing more about automated ...
0
votes
4answers
103 views

Scanning USB stick with multiple Antivirus tools [closed]

I realise that having multiple AVs is not recommended, but I have a specific question. My boss supplied me with a laptop which has like 5 different AVs (some of them are more like portable "launch ...
2
votes
1answer
63 views

When writing software do all programs have a signature? [closed]

I have always been curious if all software have a signature for whatever reason or is only related to AV.
0
votes
0answers
45 views

Antivirus and it's role in detecting payload execution?

My first question is this: 1) Antivirus software works using signature based detection. Signature based detection evaluates items (maybe not the right word?) based upon a big database of known threats....
0
votes
3answers
147 views

Are there types of malware that are so time-intensive to detect that AV vendors simply choose to not detect them? [closed]

I've been reading a lot about how AVs use different heuristic methods to detect obfuscated malware and it seems like some of these methods are very time/processor intensive. For example, to detect ...
1
vote
0answers
33 views

Best Antivirus for Android [closed]

Please suggest best Antivirus, thanks
0
votes
1answer
113 views

What is “JTI/Suspect.131328” from McAfee? [closed]

Using McAfee Endpoint Security 10.6 on Windows 10 it is the second time I got the: Warning. I cannot find anything related to it while Googling around: "JTI/Suspect.131328" The question: is this ...
2
votes
1answer
4k views

CVE-2019-0903 detected by just one anti-virus service

On my Windows 8.1 computer I created an MS Word document containing a couple images I downloaded from the internet, and exported it as PDF. The MS Word version is 14.0.7232.5000, 64 bit. I sent that ...
0
votes
1answer
161 views

How to inject a malware in a video

Is it possible to trigger an antivirus program to alarm by playing a video? I don't want to run malware, I only want the AV to do something. Can I put EICAR in the metadata? The video file shoudn't ...
6
votes
2answers
221 views

Suppose antivirus provider turned malicious: What do we do?

It was recently reported that the hacking group Fxmsp "...claimed to have secured access to three leading antivirus companies," and that they "...extracted sensitive source code from antivirus ...
-2
votes
2answers
122 views

Antivirus and malware fingerprints

I´m a student in IT security and I would like to know how the malware fingerprints work in common AntiVirus. I understand that when a malware is detected it's because the binary fingerprint is known ...
0
votes
2answers
65 views

Can 3rd party AVs have accessed to my Windows PC and Android phone even after uninstalling and removing them?

Before we start this, I have paranoia issues (doctor diagnosed, not self-diagnosed) so things might at some points seem like an extremely far reach, but please bear with me. I bought an AV yesterday ...
0
votes
1answer
104 views

What are the heuristic detection techniques most often used in modern AVs? [closed]

Whenever I read books or academic papers and the subject of heuristic malware detection is brought up they always say the same thing: "it can be either static or dynamic", "it may use emulation", "may ...
0
votes
1answer
73 views

How do AV vendors select malware signatures?

AVs use signatures to identify malware which are often strings of bytes or regular expressions thought to be unique to that malware. Do reverse engineers select these signatures by hand or do they use ...
2
votes
3answers
175 views

Is fileless malware is a new type of attack or the media just bringing them now more to our attention to promote sales of related “new” solutions?

I feel there are so many articles talking about fileless malware, so I was trying to understand is it a new type of attack or those articles are just kind of promoting new cyber solutions?
1
vote
1answer
139 views

How does android antivirus scan root files like “/data/data”

I want to know how does android antivirus scan packages private files in "/data/data" directory. I read somewhere that they check the file name with their database and declare it as malware but how ...
0
votes
1answer
279 views

Is there something fishy on Kaspersky Internet Security or I am missing something?

Whenever I turn on my computer, a notification pops up - You need to restart you PC (I have added screenshot). I did, but it keeps coming. So went to notification center and saw which application is ...
0
votes
1answer
144 views

ClamAV detects virus in Modsec Audit logs

I have a Xen VM running Debian Stretch with Apache2 to play around with. I have installed ClamAV and Modsecurity (not doing anything just logging at the moment). I keep getting emails from ClamAV ...
1
vote
0answers
58 views

How to test behavioral detection of antivirus

I want to test to see if my antiviruses are working correctly and if possible to see which one is better. As each antivirus has two parts I want to test both. For signature-based detection, I use ...
2
votes
1answer
104 views

Antivirus recall and precision not accuracy [closed]

I am studying antiviruses how antiviruses work at my university. This is just the very basics. He asked in our opinion which we think is better: recall or precision. Why does my professor say he ...
0
votes
1answer
109 views

How can I explain our system admins that AV can't protect our enterprise machines from attacks leverage on USBninja? [closed]

Was hoping to get your support to help to explain to our system admins how come the AV can't protect our enterprise from attacks that can be generated from USBninja. How can I explain our system ...
-1
votes
1answer
88 views

Is there any example of a network-based anti-virus system? [closed]

Is there any example of network-based anti-virus system? There are two types of anti-virus systems; one is host-based, and the other is network-based. We often see host-based anti-virus systems(...
3
votes
1answer
110 views

Is there any risk in adding exceptions in the antivirus software for paths that are only writable by Administrator?

Sometimes antivirus administrators don't want to add any exceptions for the antivirus software. My question is what is the risk of adding paths that whose permissions are correctly configured to allow ...
0
votes
0answers
48 views

Why should we use antivirus scanning on our NAS?

When using non-persistent VDI windows instances that running AV but the storage is on NAS, should we also install AV on the NAS to do real-time scanning or it's good enough that we have AV running on ...
1
vote
3answers
94 views

How to detect a virus /malware missed by antivirus program

I was On FB page,accidentally clicked an ad. Another window opened up and locked the browser with background audio message, purportedly from MS, warning about security compromise on my PC. Unplugged ...
0
votes
0answers
72 views

What's the deal with .LNK (Windows shortcuts) files?

Today Ms Security Essentials thought that a .lnk in my computer was infected and quarantined it. It seemed legit to me, just a shortcut to my H2 (database) console script, which I had installed (in ...
2
votes
1answer
64 views

Verifying Host Sterility After Running Malware Tests on Virtual Machine

I know that "VM escape" is becoming a common issue now with malware testing. I'm just wondering if there's any way of verifying if the host system is clean from any infection after running a malware ...
1
vote
1answer
78 views

How did antivirus vendors find malware to include in traditional AV signatures?

Forgive me if it's a silly question, but I'm genuinely curious. How do traditional AV (signature-based only) vendors get the malware to analyse and include in definition files? Also, what's the ...
0
votes
1answer
131 views

Can ClamAV detect CSV Injection?

I'm allowing users to upload CSV files. Other users can download these files. I'm aware that CSV could be an attack vector. Would a ClamAV (or other AV) scan offer protection against such a file? ...
46
votes
9answers
11k views

Replacing Windows 7 security updates with anti-virus?

Microsoft has announced Windows 7 will no longer be receiving updates after January 14, 2020: Here. I hate windows 10's forced updates and telemetry so I have always stuck with Windows 7, but it may ...
1
vote
2answers
247 views

Do Anti-Virus programs scan running processes?

If I have malicious software running, and I can see it in the Task Manager, is an AV program expected to scan the processes running and test if they are a virus/malware? Or, does AV have to: Detect ...
2
votes
1answer
131 views

Real time Anti-virus communication with API hooks

I'm writing a simple user-space, real-time, anti-virus project, with normal permissions. Reading about many techniques an AV vendor works, I eventually chose to implement inline APIs hooks. I have ...
0
votes
1answer
420 views

Strange and unknown user name on Windows 10

Today I was through folder information and, when I switched to the security tab, I observed that there were 5 users listed there. In this list, there was also a user called "yupgyzmhuma". I tried ...
1
vote
0answers
47 views

Does Local API Hooks trigger Anti-Virus Flags? [closed]

If I do API hooking on my local Address Space (without doing dll injection on other process), will the AVs be triggered?
1
vote
1answer
47 views

Multiple outbound TCP/8333 connections containing the EICAR test string

An IPS / IDS / UTM detects 50 connections from a single client containing Virus/Worm Eicar test string within half an hour. The destinations are IP addresses all around the world on port TCP/8333. A ...
0
votes
2answers
415 views

Cmd shuts down computer immediately after windows boots up and logs into the default account/user [closed]

as the title suggests, after I login to default/main account which has administration privileges, after desktop loads almost instantly CMD opens and shuts down the computer, only way I found to stop ...
0
votes
1answer
99 views

How to analyze and track what data a software sends?

How can i track which program sends data over my network and can i see the contents of it? If we have a AV software installed in a VM , can we see what it's sending from your pc when doing a scan?
2
votes
1answer
60 views

What information can antivirus software collect?

If you take Dr web for example, it lists personal data and statistics, what do those mean? https://free.drweb.com/cureit/send_statistics/