Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [antivirus]

Antivirus or anti-virus software is used to prevent, detect, and remove malware, including but not limited to computer viruses, computer worm, trojan horses, spyware and adware.

1
vote
0answers
27 views

Best Antivirus for Android [on hold]

Please suggest best Antivirus, thanks
0
votes
0answers
27 views

How to view sophos antivirus scan results [closed]

I'm using sophos antivirus on the command line (sav-protect) on my Ubuntu 16.04. After running a scan, the software detected "28 errors" and "0 threats". I wanted more information on the scan results, ...
-2
votes
0answers
37 views

How can I prevent Windows from automatically deleting malicious files? [migrated]

I am working on a presentation and want to copy an old exploit code (github-file) to a file in Sublime3 with nice syntax, highlighting, and so on. But when I try to save the file, Windows ...
0
votes
1answer
85 views

What is “JTI/Suspect.131328” from McAfee? [closed]

Using McAfee Endpoint Security 10.6 on Windows 10 it is the second time I got the: Warning. I cannot find anything related to it while Googling around: "JTI/Suspect.131328" The question: is this ...
2
votes
1answer
4k views

CVE-2019-0903 detected by just one anti-virus service

On my Windows 8.1 computer I created an MS Word document containing a couple images I downloaded from the internet, and exported it as PDF. The MS Word version is 14.0.7232.5000, 64 bit. I sent that ...
0
votes
1answer
149 views

How to inject a malware in a video

Is it possible to trigger an antivirus program to alarm by playing a video? I don't want to run malware, I only want the AV to do something. Can I put EICAR in the metadata? The video file shoudn't ...
6
votes
2answers
220 views

Suppose antivirus provider turned malicious: What do we do?

It was recently reported that the hacking group Fxmsp "...claimed to have secured access to three leading antivirus companies," and that they "...extracted sensitive source code from antivirus ...
-2
votes
2answers
93 views

Antivirus and malware fingerprints

I´m a student in IT security and I would like to know how the malware fingerprints work in common AntiVirus. I understand that when a malware is detected it's because the binary fingerprint is known ...
0
votes
2answers
61 views

Can 3rd party AVs have accessed to my Windows PC and Android phone even after uninstalling and removing them?

Before we start this, I have paranoia issues (doctor diagnosed, not self-diagnosed) so things might at some points seem like an extremely far reach, but please bear with me. I bought an AV yesterday ...
0
votes
1answer
88 views

What are the heuristic detection techniques most often used in modern AVs? [closed]

Whenever I read books or academic papers and the subject of heuristic malware detection is brought up they always say the same thing: "it can be either static or dynamic", "it may use emulation", "may ...
0
votes
1answer
60 views

How do AV vendors select malware signatures?

AVs use signatures to identify malware which are often strings of bytes or regular expressions thought to be unique to that malware. Do reverse engineers select these signatures by hand or do they use ...
2
votes
3answers
165 views

Is fileless malware is a new type of attack or the media just bringing them now more to our attention to promote sales of related “new” solutions?

I feel there are so many articles talking about fileless malware, so I was trying to understand is it a new type of attack or those articles are just kind of promoting new cyber solutions?
1
vote
1answer
105 views

How does android antivirus scan root files like “/data/data”

I want to know how does android antivirus scan packages private files in "/data/data" directory. I read somewhere that they check the file name with their database and declare it as malware but how ...
0
votes
1answer
262 views

Is there something fishy on Kaspersky Internet Security or I am missing something?

Whenever I turn on my computer, a notification pops up - You need to restart you PC (I have added screenshot). I did, but it keeps coming. So went to notification center and saw which application is ...
0
votes
1answer
110 views

ClamAV detects virus in Modsec Audit logs

I have a Xen VM running Debian Stretch with Apache2 to play around with. I have installed ClamAV and Modsecurity (not doing anything just logging at the moment). I keep getting emails from ClamAV ...
1
vote
0answers
53 views

How to test behavioral detection of antivirus

I want to test to see if my antiviruses are working correctly and if possible to see which one is better. As each antivirus has two parts I want to test both. For signature-based detection, I use ...
2
votes
1answer
101 views

Antivirus recall and precision not accuracy [closed]

I am studying antiviruses how antiviruses work at my university. This is just the very basics. He asked in our opinion which we think is better: recall or precision. Why does my professor say he ...
0
votes
1answer
105 views

How can I explain our system admins that AV can't protect our enterprise machines from attacks leverage on USBninja? [closed]

Was hoping to get your support to help to explain to our system admins how come the AV can't protect our enterprise from attacks that can be generated from USBninja. How can I explain our system ...
-1
votes
1answer
75 views

Is there any example of a network-based anti-virus system? [closed]

Is there any example of network-based anti-virus system? There are two types of anti-virus systems; one is host-based, and the other is network-based. We often see host-based anti-virus systems(...
3
votes
1answer
110 views

Is there any risk in adding exceptions in the antivirus software for paths that are only writable by Administrator?

Sometimes antivirus administrators don't want to add any exceptions for the antivirus software. My question is what is the risk of adding paths that whose permissions are correctly configured to allow ...
0
votes
0answers
45 views

Why should we use antivirus scanning on our NAS?

When using non-persistent VDI windows instances that running AV but the storage is on NAS, should we also install AV on the NAS to do real-time scanning or it's good enough that we have AV running on ...
1
vote
3answers
85 views

How to detect a virus /malware missed by antivirus program

I was On FB page,accidentally clicked an ad. Another window opened up and locked the browser with background audio message, purportedly from MS, warning about security compromise on my PC. Unplugged ...
0
votes
0answers
69 views

What's the deal with .LNK (Windows shortcuts) files?

Today Ms Security Essentials thought that a .lnk in my computer was infected and quarantined it. It seemed legit to me, just a shortcut to my H2 (database) console script, which I had installed (in ...
2
votes
1answer
49 views

Verifying Host Sterility After Running Malware Tests on Virtual Machine

I know that "VM escape" is becoming a common issue now with malware testing. I'm just wondering if there's any way of verifying if the host system is clean from any infection after running a malware ...
1
vote
1answer
76 views

How did antivirus vendors find malware to include in traditional AV signatures?

Forgive me if it's a silly question, but I'm genuinely curious. How do traditional AV (signature-based only) vendors get the malware to analyse and include in definition files? Also, what's the ...
0
votes
1answer
105 views

Can ClamAV detect CSV Injection?

I'm allowing users to upload CSV files. Other users can download these files. I'm aware that CSV could be an attack vector. Would a ClamAV (or other AV) scan offer protection against such a file? ...
46
votes
8answers
10k views

Replacing Windows 7 security updates with anti-virus?

Microsoft has announced Windows 7 will no longer be receiving updates after January 14, 2020: Here. I hate windows 10's forced updates and telemetry so I have always stuck with Windows 7, but it may ...
1
vote
2answers
184 views

Do Anti-Virus programs scan running processes?

If I have malicious software running, and I can see it in the Task Manager, is an AV program expected to scan the processes running and test if they are a virus/malware? Or, does AV have to: Detect ...
2
votes
1answer
87 views

Real time Anti-virus communication with API hooks

I'm writing a simple user-space, real-time, anti-virus project, with normal permissions. Reading about many techniques an AV vendor works, I eventually chose to implement inline APIs hooks. I have ...
0
votes
1answer
174 views

Strange and unknown user name on Windows 10

Today I was through folder information and, when I switched to the security tab, I observed that there were 5 users listed there. In this list, there was also a user called "yupgyzmhuma". I tried ...
1
vote
0answers
41 views

Does Local API Hooks trigger Anti-Virus Flags? [closed]

If I do API hooking on my local Address Space (without doing dll injection on other process), will the AVs be triggered?
1
vote
1answer
41 views

Multiple outbound TCP/8333 connections containing the EICAR test string

An IPS / IDS / UTM detects 50 connections from a single client containing Virus/Worm Eicar test string within half an hour. The destinations are IP addresses all around the world on port TCP/8333. A ...
0
votes
1answer
212 views

Cmd shuts down computer immediately after windows boots up and logs into the default account/user

as the title suggests, after I login to default/main account which has administration privileges, after desktop loads almost instantly CMD opens and shuts down the computer, only way I found to stop ...
0
votes
1answer
90 views

How to analyze and track what data a software sends?

How can i track which program sends data over my network and can i see the contents of it? If we have a AV software installed in a VM , can we see what it's sending from your pc when doing a scan?
2
votes
1answer
58 views

What information can antivirus software collect?

If you take Dr web for example, it lists personal data and statistics, what do those mean? https://free.drweb.com/cureit/send_statistics/
3
votes
1answer
199 views

How does AVG insert its signature into Gmail emails?

I just sent an email from gmail loaded in my Chrome web browser. Also on the Windows 7 computer is AVG "anti-virus". Turns out AVG somehow managed to insert a signature into the email I sent out. ...
0
votes
4answers
106 views

Trend Micro showing security warning on website. Unsure how to resolve it

I have a client with a website that sells a book. When someone clicks a button to purchase the book, a form is supposed to pop up (and does). However, I received a screenshot showing that, when that ...
1
vote
1answer
74 views

Avast antivirus virus alarm while programming [closed]

I was programming a function pointer in C on CodeBlocks. When I compiled and ran it, Avast showed an alert message and quarantined the .exe. Is there a solution? Or do I need to disable Avast while ...
0
votes
2answers
145 views

How to hide a process in Windows?

Is there a way to make a process hidden without using any Administrator-level priviledges? I am building an antivirus which I want to protect from malware's actions, such as ending the process, or ...
0
votes
1answer
103 views

Knowledge Base about Windows Defender

I am trying to find more information on the alerts that come up from Windows Defender and include one of the following: Remediation Status: What is it?, what are all the different types? and what ...
0
votes
1answer
91 views

Bitdefender showing lot of Getting Suspicious Connection Blocked from Chrome extension Toby

I'm using GetToby Chrome extension to manage my tabs and save them for later. Lately, I've been getting lots of notifications from BitDefender about blocked suspicious attempt: chrome.exe attempted ...
147
votes
20answers
39k views

Has it been mathematically proven that antivirus can't detect all viruses?

What analysis was Bruce Schneier referencing when he wrote: Viruses have no “cure.” It’s been mathematically proven that it is always possible to write a virus that any existing antivirus program ...
-1
votes
1answer
50 views

How does an antivirus flag homemade malware? [duplicate]

Say I made some malware in python or c# or whatever language, How would an antivirus detect that the program has malicious intent because how does the antivirus know that the program is malicious ...
1
vote
1answer
179 views

Why does windows defender scan my computer multiple times [closed]

Occasionally, Windows Defender sends me a notification that my device was scanned. This occurrence is quite ordinary and boring, but I actually devoted two seconds to reading the entire message once, ...
1
vote
1answer
126 views

Explaining malware avoidance tactics

Most "how tos" regarding malware list this: Install Antivirus software. Install latest antivirus software. Run antivirus software regularly. Install latest operating system. Install any patches to ...
1
vote
1answer
891 views

How to (temporarily) disable McAfee Endpoint Security on an enterprise workstation?

I need to temporarily disable McAfee Endpoint Security on an enterprise workstation after having obtained local administrative privileges. The McAfee Endpoint Security settings are protected by a ...
3
votes
3answers
80 views

Why does VirusTotal have two different reports for the same hash depending on FILE vs URL submission?

Why would the same SHA256 Hash of a file have totally different VirusTotal results at the same time? Submitting a file to VirusTotal via File upload results in numerous hits for malware. ...
2
votes
0answers
483 views

Where is the Administrator password for McAfee Endpoint Security stored on the local machine?

Where is the Administrator password for McAfee Endpoint Security stored on the local machine? I've tried to locate the Administrator password for McAfee Endpoint Security in the registry on the local ...
0
votes
0answers
114 views

Heuristics-based vs behavioral malware detection

I'm working on my thesis and I have a couple questions about differences between heuristics-based and behavioral malware detection. Does heuristics-based detection rely only on statically examining ...
1
vote
0answers
95 views

How to prevent the ransomware to run with administrator privileges?

We have been attacked by the ransomware recently (adobe li). The strange thing is that ransomware was able to gain unimaginable high privileges. The virus of the ransomware has been located on the ...