Questions tagged [antivirus]

Antivirus or anti-virus software is used to prevent, detect, and remove malware, including but not limited to computer viruses, computer worm, trojan horses, spyware and adware.

38 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
4
votes
1answer
1k views

Linux antivirus and files bigger then 4GB

I wish to scan files that are bigger then 4GB. For example video files. I noticed many antivirus software are limited to a maximum of 4GB (ClamAV for example). So: Is there a antivirus software ...
3
votes
0answers
1k views

Where is the Administrator password for McAfee Endpoint Security stored on the local machine?

Where is the Administrator password for McAfee Endpoint Security stored on the local machine? I've tried to locate the Administrator password for McAfee Endpoint Security in the registry on the local ...
3
votes
0answers
245 views

How do I update Windows Defender to use old definition files?

I'm attempting to replicate a customer's issue locally. One of the differences is our Windows Defender definition file versions. The current version seems to be 1.269.694.0, and I'm looking for ...
3
votes
0answers
254 views

What does Memory Scanning refer to in the Context of Malware Detection Wanna Cry

When reading https://www.zionsecurity.com/sites/default/files/what_to_expect_from_your_antivirus.pdf It mentions: It is almost impossible to protect against new malware that will use the ...
2
votes
1answer
157 views

How does malware evade initial discovery?

I've been reading a lot about polymorphic and metamorphic malware and how they evade signature-based detection once they have been discovered. These techniques seem to be utilized to evade recurrent ...
2
votes
0answers
124 views

Can developers stop their software from being flagged as malicious by AV products?

This may not be the correct community for this question, I apologize if that's the case. Scenario: A software development company has created a collection of small desktop applications. They have ...
2
votes
1answer
550 views

Antivirus warns about processes trying to access my webcam

For the last two weeks I am constantly getting notifications from my antivirus about attempts of using my webcam. I have always chosen "Block access", often after checking "remember for this ...
2
votes
1answer
152 views

How does Malwarebytes intercept web traffic?

I use Malwarebytes and the web filter functionality puzzles me. As far as my research has found, antivirus engines typically use a proxy to intercept web requests which typically there would be ...
1
vote
0answers
60 views

Defense Evasion - Unhooking Windows API

Since most of EDR vendor hook userland APIs, Is Unhooking Windows API or DLL Unhooking is the best way to bypass EDR Protection?
1
vote
0answers
119 views

ClamAV Bytecode run timed out

I have the following output by ClamAV: Starting a daily scan of /root directory. Amount of data to be scanned is 205M. Starting a daily scan of /var/www directory. Amount of data to be scanned is ...
1
vote
0answers
308 views

How unwise is it to exclude WSL from Windows Defender?

Windows Defender often takes up a significant amount of CPU time due to I/O operations in WSL. For example, if I'm working on web development and using tools like npm or yarn, downloading packages ...
1
vote
0answers
173 views

How to prevent the ransomware to run with administrator privileges?

We have been attacked by the ransomware recently (adobe li). The strange thing is that ransomware was able to gain unimaginable high privileges. The virus of the ransomware has been located on the ...
1
vote
0answers
158 views

Which Anti-Virus companies share their signature databases?

I recently heard that AVG and AVAST shared their malware signature databases (avast forum) Which AV vendors share their signature databases or use the same engine for detecting malwares? Based on ...
1
vote
0answers
188 views

How to find out if ClamAV current version has signature for specific Exploit/Trojan/Worm etc. or not?

I installed ClamAV(version 0.99.2/23581/Thu Jul 20 16:15:14 2017) and updated the installation to have latest signatures. I found on this website (https://lists.gt.net/clamav/virusdb/69755?page=last) ...
1
vote
0answers
318 views

Heuristic Malware Detection Methods

I would like to know some basic heuristic detection methods in detail because when I do research there is only a general overview of heuristics and not what methods are used to achieve it. I would ...
1
vote
0answers
507 views

Is “Virus Scanner Plus” a legitimate product?

I have "Virus Scanner Plus" (ostensibly) by Bitdefender installed on my Mac from the App Store (and have had for a few years). But, although the app was recently updated in the App Store, it is not ...
1
vote
0answers
409 views

Is it possible to obfuscate binaries with UPX or similar software?

Warez scene groups often compress their binary executables using UPX or similar software. I've heard somewhere that they do this to obscure the algorithms they use from other groups, but I find this ...
1
vote
0answers
103 views

How do the antivirus safe browsers work?

Let's refer to safe browsers like Avast Safe Zone, Bitdefender Safe Pay and all those browsing tools -generally included into the paid antivirus suites- which are supposed to protect users data from ...
1
vote
0answers
141 views

Does running a PowerShell script using an embedded System.Managment.Automation DLL prevent it from being scanned by AMSI?

A new feature called Antimalware Scan Interface, that allow AVs to 'see' Powershell commands executed, was introduced in Powershell v5. According to adsecurity, this feature seems to rely on the ...
1
vote
0answers
55 views

To which extent are paid alternatives to Apple's Xprotect worth it?

Mac OS X ships with Xprotect, Apple's mechanism to detect and remove malware. System software security holes are patched decently quickly. In a world of fragmented, code-signed, sandboxed apps, what ...
1
vote
0answers
181 views

How dangerous is Exploit.LNK.BadLnk.a (v)?

I have encountered a supposed low level eploit on my network at work, by the name of: Exploit.LNK.BadLnk.a (v). I have torn through pages of entries on google trying to find information on this bit of ...
1
vote
1answer
235 views

Setting a domain in Veil-Evasion for payload

Can we set a domian, i.e., abccorp.com instead of the IP when we use set LHOST in Veil-Evasion? Is there anyway to do it? Thanks
0
votes
0answers
36 views

Bypassing Windows Defender VBA custum code

I've recently wrote a simple keylogger using classic dll-injection technique. I wanted to simulate a real phishing attack where user opens office document with macros and by enabling them he downloads ...
0
votes
1answer
112 views

How can Runtime-Crypters stay FUD

A Runtime Crypter always works with the same principle: It decrypts its payload, starts up a process in suspended state, inserts the payload and resumes the suspended process under false flag. All ...
0
votes
0answers
68 views

Unknown process attempted to execute code

This morning I booted up my computer and not long afterward, got a notification from ByteFence (unsubscribed) that an unknown process attempted to execute a command that was deemed unwanted. ByteFence ...
0
votes
1answer
139 views

Norton Symantec Flagging my python script as Trojan.Bayrob9

I have symantec endpoint protection on my computer. I have the python script: import subprocess import os from ftplib import FTP os.chdir("public_html2") data=subprocess.check_output(["git", "diff","-...
0
votes
1answer
121 views

What is “rule-based” analysis in malware detection?

I've read a few articles that describe the heuristic detection used by AVs as being either "weight-based" or "rule-based". The weight-based aspect seems to make sense, but I don't understand what "...
0
votes
0answers
48 views

Antivirus and it's role in detecting payload execution?

My first question is this: 1) Antivirus software works using signature based detection. Signature based detection evaluates items (maybe not the right word?) based upon a big database of known threats....
0
votes
0answers
69 views

How to test behavioral detection of antivirus

I want to test to see if my antiviruses are working correctly and if possible to see which one is better. As each antivirus has two parts I want to test both. For signature-based detection, I use ...
0
votes
0answers
67 views

Why should we use antivirus scanning on our NAS?

When using non-persistent VDI windows instances that running AV but the storage is on NAS, should we also install AV on the NAS to do real-time scanning or it's good enough that we have AV running on ...
0
votes
0answers
96 views

What's the deal with .LNK (Windows shortcuts) files?

Today Ms Security Essentials thought that a .lnk in my computer was infected and quarantined it. It seemed legit to me, just a shortcut to my H2 (database) console script, which I had installed (in ...
0
votes
1answer
1k views

Bitdefender showing lot of Getting Suspicious Connection Blocked from Chrome extension Toby

I'm using GetToby Chrome extension to manage my tabs and save them for later. Lately, I've been getting lots of notifications from BitDefender about blocked suspicious attempt: chrome.exe attempted ...
0
votes
0answers
160 views

Heuristics-based vs behavioral malware detection

I'm working on my thesis and I have a couple questions about differences between heuristics-based and behavioral malware detection. Does heuristics-based detection rely only on statically examining ...
0
votes
1answer
259 views

Virustotal detecting threats in Suricata rule set

Virustotal scans are detecting threats from the Suricata default rule pack located https://rules.emergingthreats.net/open/suricata-4.0/ Is this a false positive? https://www.virustotal.com/#/file/...
0
votes
0answers
36 views

Creating exceptions / rules for online backup programme

The desktop client for a backup provider i use called Backblaze is with very high CPU usage; around 60% of a 2.7ghz i7. I contacted Backblaze's support and they informed me that Avast anti virus and ...
0
votes
0answers
861 views

Application Privilege Control in Kaspersky blocks program with no digital signature

I made a small application that displays hello world to the console output and attempted to open it in another computer that had Kaspersky fully updated. When I ran the application, Kaspersky gave a ...
-1
votes
1answer
76 views

Standards and Guidelines Pro/Con Anti Malware programs

For a whitepaper about anti-malware products used in combination with (server side) applications and infrastructure components (database server) I am looking for standards, guidelines and codified ...
-1
votes
2answers
84 views

How to protect against simple web distributed viruses

I work as a data recovery consultant and a surprisingly large number of my clients are individuals that caught a virus from "The Internet". A lot of people would browse dodgy websites, download all ...