Questions tagged [antivirus]

Antivirus or anti-virus software is used to prevent, detect, and remove malware, including but not limited to computer viruses, computer worm, trojan horses, spyware and adware.

Filter by
Sorted by
Tagged with
1
vote
1answer
374 views

If a file has previously been scanned by VirusTotal, will the VirusTotal website always indicate this fact?

I recently downloaded a very popular open-source application. Usually, I compile open-source applications myself after reading the source code. But my compiler box was busy with many tasks, so I ...
2
votes
1answer
234 views

Explaining malware avoidance tactics

Most "how tos" regarding malware list this: Install Antivirus software. Install latest antivirus software. Run antivirus software regularly. Install latest operating system. Install any patches to ...
3
votes
0answers
62 views

Why doesn't Defender get suspicious if a program adds exceptions to the Defender?

One can simply add exceptions to the Windows Defender by running this command in Powershell: Add-MpPreference -ExclusionPath <your_path> Why does Windows Defender not immediately flag programs ...
2
votes
4answers
8k views

What is the difference between Heuristic-based and Behaviour-based virus scanning?

I'm struggling to see the difference as all papers and notes I've read seem to contradict each other. Can someone please explain to me the difference between heuristic and behaviour based virus ...
-1
votes
2answers
64 views

I accidentally clicked on ransomware link. Antivirus cleaned the files successfully

I am researching information regarding locker ransomware. I did a search for "Locker ransomware github". I clicked on the link in GitHub and found the link to view code and clicked that link ...
0
votes
1answer
29 views

Windows Defender Exclusions

If a virus added itself to windows defender exclusions, it will never be scanned. However would windows defender still remove its startup registry keys and scheduled tasks? Windows defender is the ...
178
votes
11answers
32k views

Help! My home PC has been infected by a virus! What do I do now?

This is an attempt to ask a canonical question as discussed in this old meta post. The goal is to create something helpful that can be used as a duplicate when non experts ask about virus infections. ...
1
vote
2answers
1k views

Bypassing Windows Defender VBA custom code

I've recently written a simple keylogger using classic DLL-injection technique. I wanted to simulate a real phishing attack where the user opens an Office document with macros and by enabling them he ...
0
votes
1answer
51 views

How can I have my process detect if antivirus injected a module or DLL to it?

I am writing an installer process (.exe). My installer deploys different components. It will add registry entries, copy files, copy files over the network, remote execute, remote PowerShell, local ...
0
votes
0answers
40 views

Antivirus denies Chrome

Our AV (Carbon Black) has denied chrmstp.exe (Chrome installer). I did some digging as to why and I found that it thought that it was attempting to install a backdoor. Digging further, I found the ...
23
votes
3answers
7k views

How does a crypter for bypassing antivirus detection work?

I am talking about crypters used to encrypt files like viruses and keyloggers for the sole purpose of bypassing antivirus detection. How do they work?
6
votes
2answers
287 views

Do antivirus programs increase your attack surface and potentially give more power to malware?

When I was a student one of my professors used to say that an antivirus actually increases your attack surface by injecting itself into system processes and let's say opening more doors for ...
0
votes
1answer
120 views

What is the use case for antimalware manual scans?

I am not able to understand what use is the manual antimalware scan? All antivirus software has a manual anti-malware scan. I understand if it's the first time someone installs it on their infected/...
0
votes
1answer
528 views

Norton Symantec Flagging my python script as Trojan.Bayrob9

I have symantec endpoint protection on my computer. I have the python script: import subprocess import os from ftplib import FTP os.chdir("public_html2") data=subprocess.check_output(["git", "diff","-...
0
votes
3answers
179 views

Can spyware be downloaded and installed on Android phone in a minute or less?

Following Scenario: You unlock your phone and you give it to someone so they can promply check it out (since it's a new phone). Now let's presume that the very exact person has intentions to install ...
1
vote
5answers
1k views

how common is it for an antivirus program to give false positive?

Often antivirus programs trigger a false alarm that a certain file is corrupted or infected. My question is that how common is that and if it is too common, can we really rely on them. Along with ...
0
votes
1answer
105 views

Utilising 3rd-party AV definitions with ClamAV engine

I have ClamAV/engine pretty widely deployed on most of my Linux/UNIX/POSIX & other boxes - including gateways & at-rest storage, but I've found the ClamAV definitions... lacking... sometimes. ...
0
votes
1answer
632 views

How can Runtime-Crypters stay FUD

A Runtime Crypter always works with the same principle: It decrypts its payload, starts up a process in suspended state, inserts the payload and resumes the suspended process under false flag. All ...
1
vote
0answers
118 views

How to stop 3rd party libraries from being reported as malicious, if they were part of malicious programs in the past?

Some are standard user space dll’s and another one is actually a windows driver. The libraries alone are not dangerous and are pure utilities but they can be used by bad guys, like most software tools....
0
votes
1answer
214 views

Securely analyze and format a USB flash drive

I need to scan the contents of a USB stick with several antivirus software. I have several ways to do this. Either I mount the key, I scan its contents (I may place the suspicious files in ...
3
votes
1answer
7k views

Windows PE file and Malwares

Trying to understand how and why any virus, malware, worm or code injection is successful after all in a Windows Portable Executable format. I was going through the PE structure documentation, Part 1 ...
3
votes
3answers
5k views

Gmail warns about encrypted PDF file

I recently received a PDF file that, when attached to a gmail message, causes a warning to be displayed as follows: Encrypted attachment warning – Be careful with this attachment. This message ...
12
votes
1answer
1k views

How does one properly check foreign USB Drives before getting them in your Network? Is the presented approach considered "safe"?

Current Situation: I´m currently employed at an Hospital and with rising danger of ransomware etc. spread by usb drives we decided to block all USB-Ports (roundabout 600 Clients/Windows only) via ...
0
votes
1answer
93 views

Does a Windows 10 endpoint check software installations for malware if they are installed through GPO / SCCM / Software Center?

I'm trying to get a view on what extra security checks our packaging team could do when they download a potentially infected installer from the web before they package an MSI or EXE (assuming that the ...
4
votes
1answer
2k views

How to detect malware in linux

Is there any way to detect rootkit/malware in linux servers? While for windows users the easiest way is to leave it for an antivirus/anti-malware application, but when you have a Linux machine that ...
2
votes
1answer
949 views

Antivirus warns about processes trying to access my webcam

For the last two weeks I am constantly getting notifications from my antivirus about attempts of using my webcam. I have always chosen "Block access", often after checking "remember for this ...
1
vote
1answer
285 views

How to run PrintSpoofer in memory from powershell?

PrintSpoofer uses named pipe impersonation to elevate on Windows 10 to SYSTEM from a user with SeImpersonatePrivilege (Local Service, Network Service, Administrator etc.). The compiled version is ...
0
votes
1answer
2k views

Virustotal detecting threats in Suricata rule set

Virustotal scans are detecting threats from the Suricata default rule pack located https://rules.emergingthreats.net/open/suricata-4.0/ Is this a false positive? https://www.virustotal.com/#/file/...
1
vote
1answer
221 views

Virtual machine protection

Let's say I have VirtualBox or Vmware Workstation on a Windows 10 Pro host, hosting Windows or a Linux distribution such as Ubuntu or CentoS). If I have an antivirus or Internet Security software on ...
0
votes
1answer
96 views

Security Tools - File Encryption vs Corruption

When security tools quarantine files, why do they tend to use encryption, rather than simple file corruption? The main goal of quarantining a file is to make it impossible to run on a system. This ...
0
votes
0answers
88 views

Is there any point in using an antivirus on Linux? [duplicate]

Root privilege is already a requirement in order to be able to run commands that may impact your system. But, lately, there seems to be surge in malware (e.g. ransomware etc.) that isn't limited to ...
6
votes
0answers
282 views

Windows Defender catches Trojan right after clean install

I recently upgraded some desktop PC components (GPU, SSD). I decided to perform a clean install of Windows 10 onto the SSD. I used a USB created using the Installation Media tool provided by Microsoft,...
0
votes
1answer
118 views

Detect what antivirus installed on Windows Operating system

If we want to detect all Antivirus/Endpoint protection currently installed on a Windows machine? What is the best approach? Is there a list of registry locations we can read/iterate? Industry ...
1
vote
4answers
398 views

How to detect a virus /malware missed by antivirus program

I was on a Facebook page and I accidentally clicked an ad. Another window opened up and locked the browser with a background audio message, purportedly from Microsoft, warning about security ...
8
votes
4answers
6k views

Can a virus infection spread from a PC to a PCB and back to a PC?

We have some equipment that is linked to PC's. These PC's acquire data from the equipment that they send to a server through an internal network. Furthermore these PC's are used to mediate ...
115
votes
10answers
20k views

Alternatives to anti-virus for keeping oneself safe

I have read a lot of articles that talk about how using an AV is less safe than not having one for more intermediate PC users who are careful with what they click and download. For example, here are ...
2
votes
1answer
157 views

Is there a way to record CPU operations for a given process as they occur in a standard, production OS environment?

Doing malware analysis I'm interested in being able to log every instruction the CPU executes for a given process. I was hoping this was perhaps possible in a standard VM environment, even if not ...
3
votes
1answer
693 views

Is there a name for an anti-virus station / kiosk?

I am not able to define the exact term for a station that is meant to scan whatever media coming from outside a company and that have the following specifications: The station should never be on any ...
1
vote
2answers
218 views

How to securely create a bootable USB drive from a possibly infected system?

I'm not sure about my system so I want to completely wipe my HDD and reinstall Windows 10. But I realized that an infected system can also infect a USB bootable drive. Unfortunately, I don't have ...
1
vote
0answers
60 views

What is known about the sandbox used for file parsers in MalwareBytes on Android?

Malwarebytes on Android includes a file scanner. Is it known or claimed to be sandboxed, by anything more than the Android sandbox for the Malwarebytes app? Or does it avoid using any parser code in ...
4
votes
1answer
1k views

Does anti-virus/security software protect against NTFS ADS?

I know that NTFS has features called ADS which may be used to hide malware. So does antivirus/security software, such as Norton 360, protect against this type of attack?
0
votes
4answers
3k views

How do i scan my AWS S3 buckets for malicious content/objects?

I am setting up AWS SFTP which uses s3 to store files. I am setting up sftp to exchange files with third party organisations. When i receive files i want to ensure no malicious content is received. ...
0
votes
0answers
64 views

Whitelisting our app to prevent connection blocking?

We publish a Windows desktop app, and while I've run VirusTotal on all of our files with no hits, some security software blocks incoming connections on ports we use, leading to frequent user support ...
1
vote
1answer
458 views

What is "rule-based" analysis in malware detection?

I've read a few articles that describe the heuristic detection used by AVs as being either "weight-based" or "rule-based". The weight-based aspect seems to make sense, but I don't understand what "...
1
vote
1answer
12k views

Windows Defender found threats in Kali Linux disc image

Last week, I downloaded Kali Linux from the official https://www.kali.org/ website for educational purpose. I left the downloaded disc image (.iso) on my desktop. Yesterday, Windows Defender decided ...
1
vote
1answer
126 views

What's the point of Empire if all payloads get flagged?

I've been reading about how powerful frameworks such as Empire and Metasploit are but I'm confused about something. Say I gain access through a custom reverse-shell which I self-coded (so it bypasses ...
2
votes
4answers
261 views

Can a antivirus software detect a malware that steals data?

For example, consider a software that wants to package all txt files in the /user/Desktop directory and upload them to its own server. I am not a programmer, but I know it can be done very easily with ...
1
vote
1answer
162 views

Antivirus/DPI Solution with openvpn server

I wish to set up a system that I log into with openVPN on my Raspberry Pi 4. I have already set up an openVPN server with a PKI infrastructure as well as other services that run on the Pi (like pi ...
1
vote
2answers
2k views

Why would a bat file that just starts a program be considered a virus?

My friend's computer was having a lot of viruses so he wanted me to download an operating system for him. So he gave me a flash memory. When I opened the flash my antivirus (Kaspersky Total Security) ...
4
votes
1answer
2k views

How unwise is it to exclude WSL from Windows Defender?

Windows Defender often takes up a significant amount of CPU time due to I/O operations in WSL. For example, if I'm working on web development and using tools like npm or yarn, downloading packages ...

1
2 3 4 5
14