Questions tagged [antivirus]
Antivirus or anti-virus software is used to prevent, detect, and remove malware, including but not limited to computer viruses, computer worm, trojan horses, spyware and adware.
715
questions
0
votes
0
answers
57
views
Sophos home blocks explorer.exe from encrypting several files (ransomware?)
Here's what happened:
I was transferring a quite large number of small files (.CSV, .PNG above all) from an old USB stick that never gave me any problem from one (allegedly safe) laptop (win10, win ...
- 101
0
votes
0
answers
5
views
Using low level keyboard windows hook to read key presses & still being 'trusted' [migrated]
I am developing software for my client.
The software is a game controller configuration and enhancement software that runs on Windows machines.
I needed a feature to map keyboard keypresses to ...
- 101
1
vote
1
answer
87
views
Understanding XDR Detection Methods
I'm interested in security and redteaming in particular, and as I'm learning about the subject I'm trying to find out what kind of things a blue team EDR/XDR solution will look for as part of its ...
- 11
0
votes
1
answer
61
views
Any (opensource) tool that we can use to detect if our computers has been installed applications that have proxies services
Read something like this on reddit "someone can also be a regular user who does not read terms and conditions of apps that they install. Some apps might include code that will enable them to run ...
- 127
1
vote
1
answer
106
views
How outgoing tunnels are not stopped by AV or firewalls?
How can an attacker with initial access to a server behind a firewall, which only has SSH, HTTPS, and HTTP ports open, maintain remote access to the server even after the SSH port is closed by the ...
- 1,357
2
votes
1
answer
213
views
How does the AV inject their own DLL in each new process?
I know that most of the AV are injecting their own DLL in order to do userland API filtering, in functions such as WriteProcessMemory or CreateRemoteThread.
But how can they do that? Because from what ...
- 171
1
vote
1
answer
520
views
Validate File Uploads in PHP: PDFs and images
We're trying to secure our upload forms in PHP regarding image uploads and PDF files. For this purpose, we're currently trying to do the following in all cases, according to our research done so far:
...
- 129
1
vote
0
answers
37
views
Best practice: checking backups of CMS-websites for viruses (code, database, and files)?
I've got backup files of several CMS-based websites on my local computer (Microsoft Windows) that need to get checked for viruses. Are there anti-virus scanners that catch viruses in the code, in ...
- 111
0
votes
1
answer
120
views
Do viruses survive in other drive and than re infect after resetting the PC?
Backstory:
I got infected while installing some shady software and at that time I kept Windows Defender off, (I have very much faith on my shady website) by turning its features off. But when I ...
0
votes
2
answers
206
views
Chance of virus/malware and non-executable files
I’ve seen this question being asked so many times, but I still have questions.
I know that to execute malicious code from non-executable files such as videos (mp4), audios (mp3) and documents (pdf), ...
0
votes
1
answer
70
views
Using a program that likely has a trojan horse? [closed]
OP wants to back up his Blu-ray/4K collection to a HDD.
OP suspects that a very popular program that makes MKVs is actually a trojan horse that infects host computer's USB drives, which can later be ...
0
votes
0
answers
127
views
Font file flagged as malicious by antivirus
BitDefender (Free edition) for Windows identified the CascadiaCode.ttf font file as malware and moved it from the Fonts folder into quarantine.
My Windows 11 install is like a day old, so maybe it's ...
- 101
1
vote
0
answers
24
views
In CiscoAMP can one determine how long the scan of a file took based on the times between scans in history.db?
We need to prove to our corporate security that scans in AMP are hurting our business.
I found the following old documentation on FireAMP, which seems to indicate you can extract information on what ...
- 1,387
0
votes
1
answer
151
views
Malicious python packages and antivirus
I just learnt that in PyPi you can find malicious python packages. For example, you could install a package and in the setup.py there could be code that search for your ssh or aws keys and send them ...
- 1
-1
votes
1
answer
459
views
How can Firefox scan a downloaded file for virus
I was downloading a simple metasploit file from a CTF writeup when Firefox prevented the download: "File contains a virus or a malware".
I was working on my Linux without any antivirus ...
2
votes
1
answer
143
views
When a detection tool fires no alert, how to tell the difference if the environment is safe or just something is wrong with the tool
For example, if an antivirus gives no alert for a couple of months, how do you confirm if the antivirus is working to prevent viruses, and not just hung?
- 121
0
votes
1
answer
101
views
Is it safe to copy an encrypted file from quarantine to another computer for analysis?
Is it safe to configure the antivirus to automatically copy the file from the quarantine to a network share?
The antivirus should copy the encrypted archive (with password intact) from the quarantine ...
0
votes
1
answer
90
views
Does email provider scan mails for viruses?
Imagine I am on [email protected] and I send a mail to [email protected] with an eicar.txt as an attachement. Will the email be stopped because it contains the eicar.txt ?
In case there is an email ...
- 1
0
votes
0
answers
54
views
How do high-quality antiviruses recognize viruses? [duplicate]
How do high-quality antiviruses recognize viruses? I heard that such programs use virus databases. How high quality can an antivirus that uses free databases be, which databases are the best among ...
1
vote
0
answers
316
views
What does it mean when Google anti-virus engine reports "Detected"?
I need to convert a ton of directories of JPEGs into PDFs or EPUBs.
So I downloaded this: https://ci.appveyor.com/project/josch/img2pdf/build/artifacts
Being scared that it might be malware, as any ...
- 11
1
vote
0
answers
54
views
Can you exclude scanning of a particular app or file on Avast Antivirus for Samsung?
I have Avast pro for my Samsung. I searched the whole app but I cant find the option to exclude/whitelist an app or file from scanning. Is there such an option for android? I looked through their ...
- 11
1
vote
1
answer
83
views
Can I trust companies that test antimalware software? [closed]
Do they lie? I mean companies something like AV-TEST, AV-Comparatives, Virus Bulleting, ERG Effitas, etc.
- 11
2
votes
0
answers
229
views
What is the most efficient way to get new executables whitelisted by Norton? [closed]
We developed an application (see https://embeetle.com). To avoid false positives, all our executables and DLLs are code-signed with an Extended Verification Code Signing Certificate from Sectigo. ...
- 121
0
votes
1
answer
152
views
Windows Security deletes my USB virus as soon as I plug it in
I am studying ethical hacking and I work in the cybersecurity department of a company.
I have been testing a hacking program but some PCs delete this executable as soon as I plug in the USB and some ...
- 1
0
votes
0
answers
124
views
Same miner detection by Kaspersky Anti-Virus after every boot up
I recently bought and downloaded Kaspersky. Since I downloaded it, after every reboot, it keeps detecting what seems to be a crypto miner. Every time it claims to delete it.
Should I be worried ?
Name:...
- 101
0
votes
3
answers
813
views
Is it safe to use pirated software if AVs don't detect anything malicious about it?
I want to know whether it's safe to use a pirated software if during all of the processes including (downloading, running installer, installing, using and scanning installed files) the system's ...
user279925
2
votes
1
answer
73
views
Signature-based antivirus for mobile devices is impossible?
In the OWASP MASVS it says:
Smartphones are like small computers, and mobile apps are just like classic software, so surely the security requirements are similar? But it doesn’t work like that. ...
- 21
0
votes
1
answer
163
views
What are the best security practices when when using VirtualBox on Windows 11 with an old OS?
Got a cheap new laptop to play old games with a VM of Windows XP/7, with the host being Windows 11.
Using a WiFi that isn't my own (as I don't plan on connecting to the internet with this laptop) I ...
- 1
0
votes
1
answer
251
views
No antiviruses scan graphics cards VRAM for malware?
As I know, for antiviruses the VRAM is a blindspot, so casual Windows users like me can't do much about it. They have an antivirus, which doesn't even search for malware in VRAM.
What's the answer for ...
- 39
0
votes
2
answers
428
views
What exactly is Application.Hacktool.AMZ?
I have been using Windows Product Key Viewer for ages to read current Windows' serial number. I had never any hack- or virus-related issue about this application.
A few days ago I have installed ...
- 3,619
-1
votes
3
answers
126
views
Do some malware/viruses stay on the internet basically indefinitely?
Biological viruses stay in the population essentially indefinitely. We have immune systems, but this somehow doesn't cause virus strains to completely disappear after some time, as everyone's immune ...
- 99
14
votes
6
answers
4k
views
Is it acceptable to exclude folders in antivirus?
A technical problem has arisen, and the vendor's first suggested solution is to exclude the program's folders from our antivirus. There are multiple reasons I am hesitant to do so:
Primarily: If a ...
- 251
0
votes
0
answers
33
views
Why this Hello World exe flagged as malicious on Virustotal? [duplicate]
I am compiling the following source code:
#include <stdio.h>
int main()
{
printf("Hello World!");
}
As you can see, it's just a normal program that print out Hello World! to ...
- 111
0
votes
1
answer
189
views
Non executable virus?
Bitdefender detected
.class -- File path: ...\tetra-1.12.2.jar => .../GuiStats.class -- Threat name: Java.Trojan.GenericGBA.31135
.tif -- File path: ...\crash-81154...60f8.tif -- Threat name: ...
1
vote
1
answer
164
views
Are most viruses detected eventually?
My question is being asked in the case that I am currently infected. Many viruses are zero-day viruses, and in addition, I only occasionally install MalwareBytes, which seems to be the agreed-upon all ...
- 11
0
votes
1
answer
49
views
Is EDR the same as NGAV (next gen antivirus)?
I have searched online and still do not fully understand. Some sites treat them as different and others treat them as if they are the same.
Can anyone please tell me if they are the same?
Thank you
2
votes
0
answers
122
views
Kaspersky Total Security Data Vault encryption AES256 BUT with "effective key-length 56bit"
While comparing Kaspersky Total Security (KST) with Kaspersky Internet Security (KIS). One of the "extras" of KTS is the added "feature" of "Data Vaults", which "...
- 454
2
votes
0
answers
1k
views
C# Hello World program detected as virus
I just wrote and compiled a Hello World program in C# (I'm using Visual Studio 2022) and when I sent the file to VirusTotal, 1 antivirus program detected the exe as unsafe (VirusTotal results of C# ...
- 21
2
votes
2
answers
5k
views
Microsoft Defender flagged Surfshark.exe as "Misleading:Win32/Lodi"
Can this be safely ignored?
VirusTotal shows that Microsoft is the only security vendor that flagged this file as malicious. I did not modify my Surfshark installation in any way, except for an update ...
0
votes
1
answer
106
views
What's the point in blocking content upload by extension?
In a web application I manage, we have installed an option to let the users to upload files. The files are stored directly in the database. The security department of the company have requested us to ...
- 121
0
votes
0
answers
87
views
Spam popup using Google news
The other day I was using Google News, clicked a Politico link, and got a popup saying Google had selected me to get a free iPad if I answered some survey questions. I didn't fall for it but I had ...
- 101
0
votes
2
answers
57
views
How do AV interact with malicious executables in remote shares?
I mainly use Linux and am not very familiar with Windows shares so my apologies if this question sounds noobish.
Say I'm attacking a Windows machine and host an SMB share from my Linux machine with ...
- 3,482
1
vote
0
answers
183
views
What is the difference between malware signatures and malware artifacts?
I am trying to analyse some malware samples but I am trying to understand the differen between malware signatures and malware artifacts. As far as I understand (and from what I've understood from this ...
- 31
2
votes
0
answers
438
views
Can a virus infect windows 10 bootable media?
I created a bootable windows 10 usb from my friend's computer. I used the official tool from microsoft. I was dumb enough to not check my friend's computer beforehand (turns out he had Utorrent Web ...
- 29
0
votes
1
answer
1k
views
Can two antivirus softwares work on one android phone?
Scenario: You have one antivirus installed on your phone. You suspect that your phone might have malware on it so you do a system scan and your AV doesn't find anything. So you decide to download ...
- 1
0
votes
1
answer
133
views
Malware dropper uses "^" character in syntax of cmd.exe before calling mshta.exe to download file?
I found a malicious Excel file that was using an embedded HTA program as its dropper to download a powershell program from a malicious IP. The dropper was on a hidden sheet in the file. After ...
- 1
0
votes
1
answer
324
views
Microsoft site iso download flagged by Defender as hacktool while creating bootable USB through rufus [closed]
Iso of 32 bit Windows 10 professional english version downloaded from Microsoft's website by using chrome's developer tools to spoof a chromeOS signature, so as to avoid using Microsoft's download ...
1
vote
0
answers
116
views
Why doesn't Defender get suspicious if a program adds exceptions to the Defender?
One can simply add exceptions to the Windows Defender by running this command in Powershell:
Add-MpPreference -ExclusionPath <your_path>
Why does Windows Defender not immediately flag programs ...
- 41
-1
votes
2
answers
151
views
I accidentally clicked on ransomware link. Antivirus cleaned the files successfully
I am researching information regarding locker ransomware. I did a search for "Locker ransomware github". I clicked on the link in GitHub and found the link to view code and clicked that link ...
0
votes
1
answer
156
views
Windows Defender Exclusions
If a virus added itself to windows defender exclusions, it will never be scanned.
However would windows defender still remove its startup registry keys and scheduled tasks?
Windows defender is the ...
