Questions tagged [antivirus]

Antivirus or anti-virus software is used to prevent, detect, and remove malware, including but not limited to computer viruses, computer worm, trojan horses, spyware and adware.

Filter by
Sorted by
Tagged with
0
votes
0answers
22 views

How do i scan my AWS S3 buckets for malicious content/objects?

I am setting up AWS SFTP which uses s3 to store files. I am setting up sftp to exchange files with third party organisations. When i receive files i want to ensure no malicious content is received. ...
1
vote
0answers
40 views

How unwise is it to exclude WSL from Windows Defender?

Windows Defender often takes up a significant amount of CPU time due to I/O operations in WSL. For example, if I'm working on web development and using tools like npm or yarn, downloading packages ...
4
votes
1answer
322 views

What are some of the benign use cases of injecting bytes into another process and creating remote thread?

Lets say, you are developing an AV, and marked any type of injecting into another process (for example openning it and writing to it) and creating remote thread malicious. If so, what will be some of ...
0
votes
0answers
50 views

How can Runtime-Crypters stay FUD

A Runtime Crypter always works with the same principle: It decrypts its payload, starts up a process in suspended state, inserts the payload and resumes the suspended process under false flag. All ...
3
votes
1answer
109 views

Antivirus settings for developers and build machines?

I work in a company that has strict antivirus policy. Each computer must have an up-to date antivirus with all the bells and whistles turned on. But as a developers, this is giving us problems. ...
0
votes
0answers
68 views

Unknown process attempted to execute code

This morning I booted up my computer and not long afterward, got a notification from ByteFence (unsubscribed) that an unknown process attempted to execute a command that was deemed unwanted. ByteFence ...
0
votes
0answers
35 views

Test antivirus with virus/malware (No EICAR) [duplicate]

I am currently testing a new AI/Machine Learning antivirus solution. I installed it on a laptop and i manage through the dashboard on a different laptop. I am now testing how quickly it picks up stuff ...
1
vote
1answer
296 views

Difference between system uptime and last boot time in windows

As it shows in attached pictures, there is a "Difference between system uptime and last boot time" in my windows, it becomes an issue because AV, SIEM or every monitoring system shows a different time ...
2
votes
0answers
114 views

Can developers stop their software from being flagged as malicious by AV products?

This may not be the correct community for this question, I apologize if that's the case. Scenario: A software development company has created a collection of small desktop applications. They have ...
2
votes
1answer
104 views

Platform as a Service and Anti Virus

We currently use a PaaS solution for our web application and db for a Ruby on Rails environment and PostgreSQL. In an on-premise solution, we had servers that we managed ourselves and had antivirus ...
1
vote
1answer
73 views

Virus from a printer kiosk?

I encountered a puzzling situation the other day when I plugged in a USB flash drive. Windows defender displayed an alert saying that a threat had been quarantined, specifically the Jenxcus VBS virus. ...
-1
votes
1answer
44 views

Does the term “malware signature” always refer to a pattern of bytes? [duplicate]

I know that traditionally a malware signature is a pattern of bytes in a program. While reading Joxean Koret and Elias Bachaalany's "Antivirus Hacker's Handbook" I saw that the authors categorized the ...
0
votes
1answer
92 views

Norton Symantec Flagging my python script as Trojan.Bayrob9

I have symantec endpoint protection on my computer. I have the python script: import subprocess import os from ftplib import FTP os.chdir("public_html2") data=subprocess.check_output(["git", "diff","-...
0
votes
0answers
29 views

How to remove a very stealthy virus? [duplicate]

I have a virus on my laptop preventing me from installing antivirus, or updating windows or even opening task manager. i tried running a virus scanner from a portable scanners, the virus disappears ...
0
votes
0answers
22 views

Is there any anti-virus that only uses behaviour-based malware detection? [duplicate]

I would like to know any antivirus software that uses strictly only a behaviour-based malware detection technique as the aim of my research is to compare behavioural-based and signature-based malware ...
0
votes
2answers
105 views

how common is it for an antivirus program to give false positive?

Often antivirus programs trigger a false alarm that a certain file is corrupted or infected. My question is that how common is that and if it is too common, can we really rely on them. Along with ...
4
votes
0answers
39 views

What is the most efficient approach to automate testing a malware sample on many different AVs without using online services? [closed]

So let's say you want to automate changing parts of malware and testing it on many different AVs, and you want all this process to be automated, i believe people who gave the AVLeak talk in black hat ...
0
votes
1answer
105 views

How do AVs scan the file in websites that claim they don't send the files to AVs like Nodistribute.com? [closed]

So for example one of the famous alternatives to Virustotal aka Nodistribute.com claims that it doesn't send the file to AVs, but if it doesn't, then how can they scan it? just by checking the hash? ...
0
votes
1answer
79 views

What is “rule-based” analysis in malware detection?

I've read a few articles that describe the heuristic detection used by AVs as being either "weight-based" or "rule-based". The weight-based aspect seems to make sense, but I don't understand what "...
1
vote
3answers
118 views

Can any Windows app install a kernel driver? if not, then how can Anti-Viruses install kernel drivers?

Can any application install a kernel driver? if not, then how Windows decides who can and who cannot? If AVs can install kernel drivers, considering they are an application with an installer just like ...
0
votes
0answers
44 views

Are all “behavioral detection” of malware a form of heuristic detection? [duplicate]

A lot of articles I read seem to lump behavioral detection together with heuristic detection. From what I know, one of the defining features of heuristic detection is that it can be used to detect new ...
0
votes
1answer
59 views

USB read only permission and antivirus

We would like to block write permissions to USB drives. We will allow user read-only permissions to the USB drive. By doing that, do we still allow the Antivirus to scan the USB drive and delete, if ...
0
votes
2answers
120 views

Can I rely on Operating System (OS) Anti Virus (AV) scanning to scan files shares?

I have an EC2 instance with an Windows OS with anti virus installed. I have a requirement to attach a file share to the OS where the application is hosted. The file share is Amazon Fsx ( Amazon's ...
7
votes
2answers
571 views

How do AV scanners in VirusTotal check if a file is malicious or not and how trustworthy is its report?

So i have seen many times that people provide the virus total report for a file to prove its not a virus but i just checked and when i submit a file its not even uploading it (i checked my bandwidth),...
0
votes
0answers
58 views

Will my Windows driver stop being reported as malware if signed? [duplicate]

I have developed an IRP hooking based driver for one of my clients. Avast oes not complain about it but his AV suite reports it as malware. The lient will eventually sign this driver, but will it ...
1
vote
1answer
64 views

Is it correct to say that AVs use the same signature-based detection methods in emulation as they do on static binaries?

Many malwares can be packed or encrypted and AVs will emulate their execution to allow them to unpack or decrypt themselves. Once they do, are AVs simply using the same hashing or pattern-matching ...
0
votes
3answers
83 views

Can antiviruses scan /var

I was wondering if antiviruses could scan /var or if it was off limits i am trying to understand how antiviruses work and there impact on the file system and any limitations imposed on scanning ...
1
vote
1answer
54 views

Are the malware signatures used by AVs primarily created by human analysts or by automated means?

I've only ever read about human analysts creating signatures, but it seems like automated signature derivation would be less time-consuming and I'm surprised that I'm not seeing more about automated ...
0
votes
4answers
110 views

Scanning USB stick with multiple Antivirus tools [closed]

I realise that having multiple AVs is not recommended, but I have a specific question. My boss supplied me with a laptop which has like 5 different AVs (some of them are more like portable "launch ...
2
votes
1answer
65 views

When writing software do all programs have a signature? [closed]

I have always been curious if all software have a signature for whatever reason or is only related to AV.
0
votes
0answers
46 views

Antivirus and it's role in detecting payload execution?

My first question is this: 1) Antivirus software works using signature based detection. Signature based detection evaluates items (maybe not the right word?) based upon a big database of known threats....
0
votes
3answers
149 views

Are there types of malware that are so time-intensive to detect that AV vendors simply choose to not detect them? [closed]

I've been reading a lot about how AVs use different heuristic methods to detect obfuscated malware and it seems like some of these methods are very time/processor intensive. For example, to detect ...
1
vote
0answers
36 views

Best Antivirus for Android [closed]

Please suggest best Antivirus, thanks
0
votes
1answer
153 views

What is “JTI/Suspect.131328” from McAfee? [closed]

Using McAfee Endpoint Security 10.6 on Windows 10 it is the second time I got the: Warning. I cannot find anything related to it while Googling around: "JTI/Suspect.131328" The question: is this ...
2
votes
1answer
4k views

CVE-2019-0903 detected by just one anti-virus service

On my Windows 8.1 computer I created an MS Word document containing a couple images I downloaded from the internet, and exported it as PDF. The MS Word version is 14.0.7232.5000, 64 bit. I sent that ...
0
votes
1answer
173 views

How to inject a malware in a video

Is it possible to trigger an antivirus program to alarm by playing a video? I don't want to run malware, I only want the AV to do something. Can I put EICAR in the metadata? The video file shoudn't ...
6
votes
2answers
226 views

Suppose antivirus provider turned malicious: What do we do?

It was recently reported that the hacking group Fxmsp "...claimed to have secured access to three leading antivirus companies," and that they "...extracted sensitive source code from antivirus ...
-2
votes
2answers
156 views

Antivirus and malware fingerprints

I´m a student in IT security and I would like to know how the malware fingerprints work in common AntiVirus. I understand that when a malware is detected it's because the binary fingerprint is known ...
0
votes
2answers
70 views

Can 3rd party AVs have accessed to my Windows PC and Android phone even after uninstalling and removing them?

Before we start this, I have paranoia issues (doctor diagnosed, not self-diagnosed) so things might at some points seem like an extremely far reach, but please bear with me. I bought an AV yesterday ...
0
votes
1answer
113 views

What are the heuristic detection techniques most often used in modern AVs? [closed]

Whenever I read books or academic papers and the subject of heuristic malware detection is brought up they always say the same thing: "it can be either static or dynamic", "it may use emulation", "may ...
0
votes
1answer
85 views

How do AV vendors select malware signatures?

AVs use signatures to identify malware which are often strings of bytes or regular expressions thought to be unique to that malware. Do reverse engineers select these signatures by hand or do they use ...
2
votes
3answers
195 views

Is fileless malware is a new type of attack or the media just bringing them now more to our attention to promote sales of related “new” solutions?

I feel there are so many articles talking about fileless malware, so I was trying to understand is it a new type of attack or those articles are just kind of promoting new cyber solutions?
1
vote
1answer
169 views

How does android antivirus scan root files like “/data/data”

I want to know how does android antivirus scan packages private files in "/data/data" directory. I read somewhere that they check the file name with their database and declare it as malware but how ...
0
votes
1answer
323 views

Is there something fishy on Kaspersky Internet Security or I am missing something?

Whenever I turn on my computer, a notification pops up - You need to restart you PC (I have added screenshot). I did, but it keeps coming. So went to notification center and saw which application is ...
0
votes
1answer
193 views

ClamAV detects virus in Modsec Audit logs

I have a Xen VM running Debian Stretch with Apache2 to play around with. I have installed ClamAV and Modsecurity (not doing anything just logging at the moment). I keep getting emails from ClamAV ...
0
votes
0answers
61 views

How to test behavioral detection of antivirus

I want to test to see if my antiviruses are working correctly and if possible to see which one is better. As each antivirus has two parts I want to test both. For signature-based detection, I use ...
2
votes
1answer
110 views

Antivirus recall and precision not accuracy [closed]

I am studying antiviruses how antiviruses work at my university. This is just the very basics. He asked in our opinion which we think is better: recall or precision. Why does my professor say he ...
0
votes
1answer
112 views

How can I explain our system admins that AV can't protect our enterprise machines from attacks leverage on USBninja? [closed]

Was hoping to get your support to help to explain to our system admins how come the AV can't protect our enterprise from attacks that can be generated from USBninja. How can I explain our system ...
-1
votes
1answer
124 views

Is there any example of a network-based anti-virus system? [closed]

Is there any example of network-based anti-virus system? There are two types of anti-virus systems; one is host-based, and the other is network-based. We often see host-based anti-virus systems(...
3
votes
1answer
110 views

Is there any risk in adding exceptions in the antivirus software for paths that are only writable by Administrator?

Sometimes antivirus administrators don't want to add any exceptions for the antivirus software. My question is what is the risk of adding paths that whose permissions are correctly configured to allow ...