2022 Developer Survey is open! Take survey.

Questions tagged [antivirus]

Antivirus or anti-virus software is used to prevent, detect, and remove malware, including but not limited to computer viruses, computer worm, trojan horses, spyware and adware.

Filter by
Sorted by
Tagged with
0 votes
0 answers
11 views

Which browser add-ons prevent downloading of malware when clicking a malicious link? [closed]

Which browser add-ons prevent you from downloading malware when clicking a malicious/infected link? Both Firefox and Chrome.
user avatar
  • 101
0 votes
0 answers
18 views

Small file to trigger false positive when scanning with clamav 0.103 [closed]

I want to set up some scripts for running clamav scans but I want to test that they behave the way I expect them in case of a detection. I tried searching on the Internet but failed. What small non-...
user avatar
0 votes
1 answer
76 views

Non executable virus?

Bitdefender detected .class -- File path: ...\tetra-1.12.2.jar => .../GuiStats.class -- Threat name: Java.Trojan.GenericGBA.31135 .tif -- File path: ...\crash-81154...60f8.tif -- Threat name: ...
user avatar
0 votes
0 answers
7 views

Understand Hooked syscalls - Do win32 api always call system ones in ntdll.dll? [migrated]

I wrote a keylogger that hooks keystrokes. I learned about the AV's detection with hooked syscall and wanted to know if my keyboard hook is side by side with the av's...so can AV monitor that function?...
user avatar
0 votes
1 answer
106 views

Are most viruses detected eventually?

My question is being asked in the case that I am currently infected. Many viruses are zero-day viruses, and in addition, I only occasionally install MalwareBytes, which seems to be the agreed-upon all ...
user avatar
0 votes
1 answer
30 views

Is EDR the same as NGAV (next gen antivirus)?

I have searched online and still do not fully understand. Some sites treat them as different and others treat them as if they are the same. Can anyone please tell me if they are the same? Thank you
user avatar
2 votes
0 answers
31 views

Kaspersky Total Security Data Vault encryption AES256 BUT with "effective key-length 56bit"

While comparing Kaspersky Total Security (KST) with Kaspersky Internet Security (KIS). One of the "extras" of KTS is the added "feature" of "Data Vaults", which "...
user avatar
  • 111
0 votes
0 answers
122 views

C# Hello World program detected as virus

I just wrote and compiled a Hello World program in C# (I'm using Visual Studio 2022) and when I sent the file to VirusTotal, 1 antivirus program detected the exe as unsafe (VirusTotal results of C# ...
user avatar
2 votes
2 answers
5k views

Microsoft Defender flagged Surfshark.exe as "Misleading:Win32/Lodi"

Can this be safely ignored? VirusTotal shows that Microsoft is the only security vendor that flagged this file as malicious. I did not modify my Surfshark installation in any way, except for an update ...
user avatar
0 votes
1 answer
63 views

What's the point in blocking content upload by extension?

In a web application I manage, we have installed an option to let the users to upload files. The files are stored directly in the database. The security department of the company have requested us to ...
user avatar
  • 121
0 votes
0 answers
29 views

Spam popup using Google news

The other day I was using Google News, clicked a Politico link, and got a popup saying Google had selected me to get a free iPad if I answered some survey questions. I didn't fall for it but I had ...
user avatar
  • 101
0 votes
2 answers
45 views

How do AV interact with malicious executables in remote shares?

I mainly use Linux and am not very familiar with Windows shares so my apologies if this question sounds noobish. Say I'm attacking a Windows machine and host an SMB share from my Linux machine with ...
user avatar
1 vote
0 answers
43 views

What is the difference between malware signatures and malware artifacts?

I am trying to analyse some malware samples but I am trying to understand the differen between malware signatures and malware artifacts. As far as I understand (and from what I've understood from this ...
user avatar
0 votes
0 answers
41 views

How to find data associated with windows defender processStart reference in windows10

Recently my windows defender warned me about a possibly malicious program it found on my pc. I have trouble interpreting the data windows defender serves me and I haven't found any microsoft ...
user avatar
2 votes
0 answers
110 views

Can a virus infect windows 10 bootable media?

I created a bootable windows 10 usb from my friend's computer. I used the official tool from microsoft. I was dumb enough to not check my friend's computer beforehand (turns out he had Utorrent Web ...
user avatar
0 votes
0 answers
52 views

Docker for canary file and virus detection

I am looking to create a pipeline for cleaning a large amount of files which may include files infected with viruses or canary tokens (to communicate with the attacker). My strategy at the moment is ...
user avatar
0 votes
1 answer
200 views

Can two antivirus softwares work on one android phone?

Scenario: You have one antivirus installed on your phone. You suspect that your phone might have malware on it so you do a system scan and your AV doesn't find anything. So you decide to download ...
user avatar
  • 1
0 votes
1 answer
74 views

Malware dropper uses "^" character in syntax of cmd.exe before calling mshta.exe to download file?

I found a malicious Excel file that was using an embedded HTA program as its dropper to download a powershell program from a malicious IP. The dropper was on a hidden sheet in the file. After ...
user avatar
  • 1
0 votes
1 answer
197 views

Microsoft site iso download flagged by Defender as hacktool while creating bootable USB through rufus [closed]

Iso of 32 bit Windows 10 professional english version downloaded from Microsoft's website by using chrome's developer tools to spoof a chromeOS signature, so as to avoid using Microsoft's download ...
user avatar
2 votes
0 answers
101 views

Why doesn't Defender get suspicious if a program adds exceptions to the Defender?

One can simply add exceptions to the Windows Defender by running this command in Powershell: Add-MpPreference -ExclusionPath <your_path> Why does Windows Defender not immediately flag programs ...
user avatar
  • 53
-2 votes
2 answers
118 views

I accidentally clicked on ransomware link. Antivirus cleaned the files successfully

I am researching information regarding locker ransomware. I did a search for "Locker ransomware github". I clicked on the link in GitHub and found the link to view code and clicked that link ...
user avatar
0 votes
1 answer
89 views

Windows Defender Exclusions

If a virus added itself to windows defender exclusions, it will never be scanned. However would windows defender still remove its startup registry keys and scheduled tasks? Windows defender is the ...
user avatar
0 votes
3 answers
154 views

How can I have my process detect if antivirus injected a module or DLL to it?

I am writing an installer process (.exe). My installer deploys different components. It will add registry entries, copy files, copy files over the network, remote execute, remote PowerShell, local ...
user avatar
  • 103
0 votes
0 answers
69 views

Antivirus denies Chrome

Our AV (Carbon Black) has denied chrmstp.exe (Chrome installer). I did some digging as to why and I found that it thought that it was attempting to install a backdoor. Digging further, I found the ...
user avatar
  • 133
6 votes
2 answers
358 views

Do antivirus programs increase your attack surface and potentially give more power to malware?

When I was a student one of my professors used to say that an antivirus actually increases your attack surface by injecting itself into system processes and let's say opening more doors for ...
user avatar
0 votes
3 answers
294 views

Can spyware be downloaded and installed on Android phone in a minute or less?

Following Scenario: You unlock your phone and you give it to someone so they can promply check it out (since it's a new phone). Now let's presume that the very exact person has intentions to install ...
user avatar
0 votes
1 answer
159 views

Utilising 3rd-party AV definitions with ClamAV engine

I have ClamAV/engine pretty widely deployed on most of my Linux/UNIX/POSIX & other boxes - including gateways & at-rest storage, but I've found the ClamAV definitions... lacking... sometimes. ...
user avatar
  • 65
1 vote
0 answers
141 views

How to stop 3rd party libraries from being reported as malicious, if they were part of malicious programs in the past?

Some are standard user space dll’s and another one is actually a windows driver. The libraries alone are not dangerous and are pure utilities but they can be used by bad guys, like most software tools....
user avatar
  • 131
0 votes
1 answer
123 views

Security Tools - File Encryption vs Corruption

When security tools quarantine files, why do they tend to use encryption, rather than simple file corruption? The main goal of quarantining a file is to make it impossible to run on a system. This ...
user avatar
0 votes
0 answers
141 views

Is there any point in using an antivirus on Linux? [duplicate]

Root privilege is already a requirement in order to be able to run commands that may impact your system. But, lately, there seems to be surge in malware (e.g. ransomware etc.) that isn't limited to ...
user avatar
  • 101
5 votes
0 answers
353 views

Windows Defender catches Trojan right after clean install

I recently upgraded some desktop PC components (GPU, SSD). I decided to perform a clean install of Windows 10 onto the SSD. I used a USB created using the Installation Media tool provided by Microsoft,...
user avatar
  • 51
0 votes
1 answer
230 views

Detect what antivirus installed on Windows Operating system

If we want to detect all Antivirus/Endpoint protection currently installed on a Windows machine? What is the best approach? Is there a list of registry locations we can read/iterate? Industry ...
user avatar
  • 103
8 votes
4 answers
6k views

Can a virus infection spread from a PC to a PCB and back to a PC?

We have some equipment that is linked to PC's. These PC's acquire data from the equipment that they send to a server through an internal network. Furthermore these PC's are used to mediate ...
user avatar
  • 105
1 vote
0 answers
90 views

What is known about the sandbox used for file parsers in MalwareBytes on Android?

Malwarebytes on Android includes a file scanner. Is it known or claimed to be sandboxed, by anything more than the Android sandbox for the Malwarebytes app? Or does it avoid using any parser code in ...
user avatar
2 votes
1 answer
188 views

Is there a way to record CPU operations for a given process as they occur in a standard, production OS environment?

Doing malware analysis I'm interested in being able to log every instruction the CPU executes for a given process. I was hoping this was perhaps possible in a standard VM environment, even if not ...
user avatar
  • 1,290
1 vote
2 answers
372 views

How to securely create a bootable USB drive from a possibly infected system?

I'm not sure about my system so I want to completely wipe my HDD and reinstall Windows 10. But I realized that an infected system can also infect a USB bootable drive. Unfortunately, I don't have ...
user avatar
0 votes
0 answers
91 views

Whitelisting our app to prevent connection blocking?

We publish a Windows desktop app, and while I've run VirusTotal on all of our files with no hits, some security software blocks incoming connections on ports we use, leading to frequent user support ...
user avatar
1 vote
1 answer
176 views

What's the point of Empire if all payloads get flagged?

I've been reading about how powerful frameworks such as Empire and Metasploit are but I'm confused about something. Say I gain access through a custom reverse-shell which I self-coded (so it bypasses ...
user avatar
  • 13
1 vote
1 answer
485 views

How to run PrintSpoofer in memory from powershell?

PrintSpoofer uses named pipe impersonation to elevate on Windows 10 to SYSTEM from a user with SeImpersonatePrivilege (Local Service, Network Service, Administrator etc.). The compiled version is ...
user avatar
  • 123
1 vote
0 answers
209 views

How to know if I had scanned a file on VirusTotal? [closed]

A few weeks ago, I was using VirusTotal to check a few files on my computer to see if they were viruses. But I do not remember if I had scanned a particular file. Is there is a way to check that? And ...
user avatar
  • 71
1 vote
1 answer
570 views

If a file has previously been scanned by VirusTotal, will the VirusTotal website always indicate this fact?

I recently downloaded a very popular open-source application. Usually, I compile open-source applications myself after reading the source code. But my compiler box was busy with many tasks, so I ...
user avatar
2 votes
4 answers
297 views

Can a antivirus software detect a malware that steals data?

For example, consider a software that wants to package all txt files in the /user/Desktop directory and upload them to its own server. I am not a programmer, but I know it can be done very easily with ...
user avatar
  • 23
0 votes
1 answer
142 views

Can a hacker install known-vulnerable software on a machine in order to control the PC and elude antivirus?

I recently discovered that on one of my PCs the SolarWinds software was installed. I didn't install this software on my machine. I also saw that SolarWinds was cracked by Russian hackers and also ...
user avatar
2 votes
1 answer
134 views

How to evaluate anti-virus solutions [closed]

Some people want to know what is the "best antivirus", I am a little disappointed and it's difficult for me to answer this question. I think Windows Defender is good but I can't give ...
user avatar
1 vote
1 answer
177 views

How does malware avoid AV's when using a simple DLL injection technique?

As far as I understand it, a simple approach for a malware DLL injection would require 2 DLLs. The first for the DLL side loading, while the malicious DLL remains encrypted. And then this 'loader' ...
user avatar
0 votes
3 answers
216 views

Is is safe to skip virus scanning for image files?

Among other things, I use clamscan on my web servers website directories to help find compromised websites. Unfortunately the time to do this scan is becoming onerous. Are there any good reasons not ...
user avatar
  • 593
15 votes
1 answer
5k views

Norton detects intrusion attempt from virtual machine - how is this possible?

Sometimes I have to fix an infected WordPress website. I always check the infected website from a virtual machine (Oracle VM VirtualBox). I'm also running Norton 360 DeluXe on the host machine. In the ...
user avatar
  • 153
8 votes
3 answers
10k views

Trojan "Win32/Tnega!MSR" found by Windows Defender - aliases used by other antiviruses?

Recently I had a Windows 10 (64 bit) PC where Windows Defender would report that if found and (apparently) removed a "threat" it calls Win32/Tnega!MSR. Unfortunately, the removal was ...
user avatar
  • 183
0 votes
0 answers
113 views

Are there some viruses that write assembly code instead of machine code, and use an external assembler?

Like the question says, I am wondering if there are some viruses that do not write machine code themselves, but instead output assembly code and invoke an external assembler? That sounds like a ...
user avatar
0 votes
1 answer
157 views

What is the use case for antimalware manual scans?

I am not able to understand what use is the manual antimalware scan? All antivirus software has a manual anti-malware scan. I understand if it's the first time someone installs it on their infected/...
user avatar
  • 339

1
2 3 4 5
14