Questions tagged [antivirus]

Antivirus or anti-virus software is used to prevent, detect, and remove malware, including but not limited to computer viruses, computer worm, trojan horses, spyware and adware.

Filter by
Sorted by
Tagged with
-1
votes
3answers
100 views

How dangerous can a file be with no detected malware?

Let's say there is file which successfully passed all scans by all antivirus software there is on VirusTotal. Does it mean that it can't be dangerous. If no, what kind of dangers we can expect?
0
votes
0answers
30 views

Bypassing Windows Defender VBA custum code

I've recently wrote a simple keylogger using classic dll-injection technique. I wanted to simulate a real phishing attack where user opens office document with macros and by enabling them he downloads ...
3
votes
3answers
181 views

Why is a fully-patched OS less important than AV?

How to explain to traditional people why they should upgrade their old Windows XP device? <- The interesting point made in the highest upvoted answer to this Q is that a fully patched OS is largely ...
2
votes
1answer
66 views

Wannacry testing in lab - Not getting SMB scan attempts

So I booted up two windows 7 64bit sp1 versions in virtualbox and shared their network and the operating systems are vulnerable to the SMB exploit that the wannacry ransomware is using. The Issue is ...
1
vote
3answers
149 views

If we integrate CDR in our email solution, do we really need Sandbox as well?

In the case of social engineering attack vector is an email sent with a malicious attachment like XSL file, I am not really understanding where we will need Sandbox solution if we can just use CDR (...
2
votes
1answer
125 views

Would my USB interface be infected if I attached and immediately detached an infected USB device?

Two days ago, someone gave me their pen drive to copy some songs from. As soon as I inserted the drive into my laptop's USB interface, Windows Defender immediately warned me that the drive was ...
5
votes
1answer
217 views

Can a virus that's in a file stream infect a computer?

I have a java web application that accepts base64 image strings from users. These strings are first converted to a byte stream after which the stream is scanned for viruses. After that the file is ...
1
vote
2answers
90 views

Should Anti Virus and Anti Malware layer be the first layer in web application stack or can it seat behind services?

Can you have Anti Virus and Anti Malware layer sitting deep with the microservice layer and have the malicious file flow through all the services ? Argument being the file is in memory and not getting ...
0
votes
0answers
21 views

Kaspersky detection locally 3 years old file, clean on virus total. Compromised? [duplicate]

I just got a warning on a file locally: Weird, as I have this program for like 2 o 3 years, Just before got cleaned, I upload to virus total, totally clean on cloud. https://www.virustotal.com/gui/...
0
votes
1answer
77 views

Can Avast check my WI-FI password for strength?

I've been greeted by this popup this morning: Can Avast actually check my WI-FI password for strength? Or is it just "marketing scare" so that I upgrade to the paid version instead of using the free ...
0
votes
2answers
73 views

Python Antivirus comparing hashes [closed]

I'm writing an antivirus in python mostly to learn and for research purposes, I do understand it would be more efficient to do this in something like C and eventually I will port this over. So far I ...
1
vote
0answers
88 views

How can you stay safe from spyware used by governments? [closed]

It is a fact that antivirus software can't detect all the spyware/viruses/malware that exist. And when they get detected, new ones are created. An example is the pegasus spyware for ios created by ...
1
vote
0answers
31 views

FYP ideas in Applications of Machine Learning in Cyber Security domain [closed]

I am a Computer Science Engineering undergraduate aspiring to pursue a career in the field of cyber security. I have some experience in web application security, memory and network forensics fields. I ...
0
votes
1answer
115 views

“Harmless” script which downloads malicious script

What if I code a program without malicious code which would pass in every antivirus scan and after the virus scan and user giving special rights to it, it downloads and executes the real virus? Since ...
1
vote
0answers
60 views

Defense Evasion - Unhooking Windows API

Since most of EDR vendor hook userland APIs, Is Unhooking Windows API or DLL Unhooking is the best way to bypass EDR Protection?
1
vote
0answers
109 views

ClamAV Bytecode run timed out

I have the following output by ClamAV: Starting a daily scan of /root directory. Amount of data to be scanned is 205M. Starting a daily scan of /var/www directory. Amount of data to be scanned is ...
-2
votes
1answer
137 views

How long is a typical malware signature?

I read in Peter Szor's Art of Computer Virus Research and Defense that, in the past, a 16-byte malware signature was sufficient to 16-bit detect malware, but that longer signatures are necessary for ...
2
votes
1answer
82 views

What are the best practices for anti-virus / anti-malware when using containers?

One of the SOC 2 controls is apparently around ensuring antivirus/anti-spam/anti-malware is running on production servers. I've been googling to see if there are any recommendation/best practices for ...
2
votes
1answer
157 views

How does malware evade initial discovery?

I've been reading a lot about polymorphic and metamorphic malware and how they evade signature-based detection once they have been discovered. These techniques seem to be utilized to evade recurrent ...
0
votes
1answer
109 views

How do i scan my AWS S3 buckets for malicious content/objects?

I am setting up AWS SFTP which uses s3 to store files. I am setting up sftp to exchange files with third party organisations. When i receive files i want to ensure no malicious content is received. ...
1
vote
0answers
299 views

How unwise is it to exclude WSL from Windows Defender?

Windows Defender often takes up a significant amount of CPU time due to I/O operations in WSL. For example, if I'm working on web development and using tools like npm or yarn, downloading packages ...
4
votes
1answer
344 views

What are some of the benign use cases of injecting bytes into another process and creating remote thread?

Lets say, you are developing an AV, and marked any type of injecting into another process (for example openning it and writing to it) and creating remote thread malicious. If so, what will be some of ...
0
votes
1answer
109 views

How can Runtime-Crypters stay FUD

A Runtime Crypter always works with the same principle: It decrypts its payload, starts up a process in suspended state, inserts the payload and resumes the suspended process under false flag. All ...
3
votes
1answer
122 views

Antivirus settings for developers and build machines?

I work in a company that has strict antivirus policy. Each computer must have an up-to date antivirus with all the bells and whistles turned on. But as a developers, this is giving us problems. ...
0
votes
0answers
68 views

Unknown process attempted to execute code

This morning I booted up my computer and not long afterward, got a notification from ByteFence (unsubscribed) that an unknown process attempted to execute a command that was deemed unwanted. ByteFence ...
0
votes
0answers
38 views

Test antivirus with virus/malware (No EICAR) [duplicate]

I am currently testing a new AI/Machine Learning antivirus solution. I installed it on a laptop and i manage through the dashboard on a different laptop. I am now testing how quickly it picks up stuff ...
1
vote
1answer
399 views

Difference between system uptime and last boot time in windows

As it shows in attached pictures, there is a "Difference between system uptime and last boot time" in my windows, it becomes an issue because AV, SIEM or every monitoring system shows a different time ...
2
votes
0answers
124 views

Can developers stop their software from being flagged as malicious by AV products?

This may not be the correct community for this question, I apologize if that's the case. Scenario: A software development company has created a collection of small desktop applications. They have ...
2
votes
1answer
125 views

Platform as a Service and Anti Virus

We currently use a PaaS solution for our web application and db for a Ruby on Rails environment and PostgreSQL. In an on-premise solution, we had servers that we managed ourselves and had antivirus ...
1
vote
1answer
84 views

Virus from a printer kiosk?

I encountered a puzzling situation the other day when I plugged in a USB flash drive. Windows defender displayed an alert saying that a threat had been quarantined, specifically the Jenxcus VBS virus. ...
-1
votes
1answer
53 views

Does the term “malware signature” always refer to a pattern of bytes? [duplicate]

I know that traditionally a malware signature is a pattern of bytes in a program. While reading Joxean Koret and Elias Bachaalany's "Antivirus Hacker's Handbook" I saw that the authors categorized the ...
0
votes
1answer
139 views

Norton Symantec Flagging my python script as Trojan.Bayrob9

I have symantec endpoint protection on my computer. I have the python script: import subprocess import os from ftplib import FTP os.chdir("public_html2") data=subprocess.check_output(["git", "diff","-...
0
votes
0answers
29 views

How to remove a very stealthy virus? [duplicate]

I have a virus on my laptop preventing me from installing antivirus, or updating windows or even opening task manager. i tried running a virus scanner from a portable scanners, the virus disappears ...
0
votes
0answers
27 views

Is there any anti-virus that only uses behaviour-based malware detection? [duplicate]

I would like to know any antivirus software that uses strictly only a behaviour-based malware detection technique as the aim of my research is to compare behavioural-based and signature-based malware ...
0
votes
2answers
125 views

how common is it for an antivirus program to give false positive?

Often antivirus programs trigger a false alarm that a certain file is corrupted or infected. My question is that how common is that and if it is too common, can we really rely on them. Along with ...
4
votes
0answers
44 views

What is the most efficient approach to automate testing a malware sample on many different AVs without using online services? [closed]

So let's say you want to automate changing parts of malware and testing it on many different AVs, and you want all this process to be automated, i believe people who gave the AVLeak talk in black hat ...
0
votes
1answer
125 views

How do AVs scan the file in websites that claim they don't send the files to AVs like Nodistribute.com? [closed]

So for example one of the famous alternatives to Virustotal aka Nodistribute.com claims that it doesn't send the file to AVs, but if it doesn't, then how can they scan it? just by checking the hash? ...
0
votes
1answer
121 views

What is “rule-based” analysis in malware detection?

I've read a few articles that describe the heuristic detection used by AVs as being either "weight-based" or "rule-based". The weight-based aspect seems to make sense, but I don't understand what "...
1
vote
3answers
130 views

Can any Windows app install a kernel driver? if not, then how can Anti-Viruses install kernel drivers?

Can any application install a kernel driver? if not, then how Windows decides who can and who cannot? If AVs can install kernel drivers, considering they are an application with an installer just like ...
0
votes
0answers
49 views

Are all “behavioral detection” of malware a form of heuristic detection? [duplicate]

A lot of articles I read seem to lump behavioral detection together with heuristic detection. From what I know, one of the defining features of heuristic detection is that it can be used to detect new ...
0
votes
1answer
97 views

USB read only permission and antivirus

We would like to block write permissions to USB drives. We will allow user read-only permissions to the USB drive. By doing that, do we still allow the Antivirus to scan the USB drive and delete, if ...
0
votes
2answers
139 views

Can I rely on Operating System (OS) Anti Virus (AV) scanning to scan files shares?

I have an EC2 instance with an Windows OS with anti virus installed. I have a requirement to attach a file share to the OS where the application is hosted. The file share is Amazon Fsx ( Amazon's ...
7
votes
2answers
698 views

How do AV scanners in VirusTotal check if a file is malicious or not and how trustworthy is its report?

So i have seen many times that people provide the virus total report for a file to prove its not a virus but i just checked and when i submit a file its not even uploading it (i checked my bandwidth),...
0
votes
0answers
58 views

Will my Windows driver stop being reported as malware if signed? [duplicate]

I have developed an IRP hooking based driver for one of my clients. Avast oes not complain about it but his AV suite reports it as malware. The lient will eventually sign this driver, but will it ...
1
vote
1answer
67 views

Is it correct to say that AVs use the same signature-based detection methods in emulation as they do on static binaries?

Many malwares can be packed or encrypted and AVs will emulate their execution to allow them to unpack or decrypt themselves. Once they do, are AVs simply using the same hashing or pattern-matching ...
0
votes
3answers
84 views

Can antiviruses scan /var

I was wondering if antiviruses could scan /var or if it was off limits i am trying to understand how antiviruses work and there impact on the file system and any limitations imposed on scanning ...
1
vote
1answer
57 views

Are the malware signatures used by AVs primarily created by human analysts or by automated means?

I've only ever read about human analysts creating signatures, but it seems like automated signature derivation would be less time-consuming and I'm surprised that I'm not seeing more about automated ...
0
votes
4answers
130 views

Scanning USB stick with multiple Antivirus tools [closed]

I realise that having multiple AVs is not recommended, but I have a specific question. My boss supplied me with a laptop which has like 5 different AVs (some of them are more like portable "launch ...
2
votes
1answer
65 views

When writing software do all programs have a signature? [closed]

I have always been curious if all software have a signature for whatever reason or is only related to AV.
0
votes
0answers
48 views

Antivirus and it's role in detecting payload execution?

My first question is this: 1) Antivirus software works using signature based detection. Signature based detection evaluates items (maybe not the right word?) based upon a big database of known threats....