Questions tagged [antivirus]

Antivirus or anti-virus software is used to prevent, detect, and remove malware, including but not limited to computer viruses, computer worm, trojan horses, spyware and adware.

Filter by
Sorted by
Tagged with
-1
votes
1answer
67 views

Where are sandboxes used for malware detection?

I am currently researching sandboxes for malware detection, and I have one very basic question that I could not find an answer to yet: In everyday life, who actually uses sandboxes? A normal user has ...
0
votes
1answer
79 views

Utilising 3rd-party AV definitions with ClamAV engine

I have ClamAV/engine pretty widely deployed on most of my Linux/UNIX/POSIX & other boxes - including gateways & at-rest storage, but I've found the ClamAV definitions... lacking... sometimes. ...
1
vote
1answer
103 views

How to stop 3rd party libraries from being reported as malicious, if they were part of malicious programs in the past?

Some are standard user space dll’s and another one is actually a windows driver. The libraries alone are not dangerous and are pure utilities but they can be used by bad guys, like most software tools....
0
votes
1answer
76 views

Security Tools - File Encryption vs Corruption

When security tools quarantine files, why do they tend to use encryption, rather than simple file corruption? The main goal of quarantining a file is to make it impossible to run on a system. This ...
0
votes
0answers
57 views

Is there any point in using an antivirus on Linux? [duplicate]

Root privilege is already a requirement in order to be able to run commands that may impact your system. But, lately, there seems to be surge in malware (e.g. ransomware etc.) that isn't limited to ...
6
votes
0answers
235 views

Windows Defender catches Trojan right after clean install

I recently upgraded some desktop PC components (GPU, SSD). I decided to perform a clean install of Windows 10 onto the SSD. I used a USB created using the Installation Media tool provided by Microsoft,...
0
votes
1answer
68 views

Detect what antivirus installed on Windows Operating system

If we want to detect all Antivirus/Endpoint protection currently installed on a Windows machine? What is the best approach? Is there a list of registry locations we can read/iterate? Industry ...
8
votes
4answers
6k views

Can a virus infection spread from a PC to a PCB and back to a PC?

We have some equipment that is linked to PC's. These PC's acquire data from the equipment that they send to a server through an internal network. Furthermore these PC's are used to mediate ...
1
vote
0answers
44 views

What is known about the sandbox used for file parsers in MalwareBytes on Android?

Malwarebytes on Android includes a file scanner. Is it known or claimed to be sandboxed, by anything more than the Android sandbox for the Malwarebytes app? Or does it avoid using any parser code in ...
2
votes
1answer
141 views

Is there a way to record CPU operations for a given process as they occur in a standard, production OS environment?

Doing malware analysis I'm interested in being able to log every instruction the CPU executes for a given process. I was hoping this was perhaps possible in a standard VM environment, even if not ...
1
vote
2answers
167 views

How to securely create a bootable USB drive from a possibly infected system?

I'm not sure about my system so I want to completely wipe my HDD and reinstall Windows 10. But I realized that an infected system can also infect a USB bootable drive. Unfortunately, I don't have ...
0
votes
0answers
49 views

Whitelisting our app to prevent connection blocking?

We publish a Windows desktop app, and while I've run VirusTotal on all of our files with no hits, some security software blocks incoming connections on ports we use, leading to frequent user support ...
1
vote
1answer
105 views

What's the point of Empire if all payloads get flagged?

I've been reading about how powerful frameworks such as Empire and Metasploit are but I'm confused about something. Say I gain access through a custom reverse-shell which I self-coded (so it bypasses ...
1
vote
1answer
186 views

How to run PrintSpoofer in memory from powershell?

PrintSpoofer uses named pipe impersonation to elevate on Windows 10 to SYSTEM from a user with SeImpersonatePrivilege (Local Service, Network Service, Administrator etc.). The compiled version is ...
1
vote
0answers
92 views

How to know if I had scanned a file on VirusTotal? [closed]

A few weeks ago, I was using VirusTotal to check a few files on my computer to see if they were viruses. But I do not remember if I had scanned a particular file. Is there is a way to check that? And ...
1
vote
1answer
279 views

If a file has previously been scanned by VirusTotal, will the VirusTotal website always indicate this fact?

I recently downloaded a very popular open-source application. Usually, I compile open-source applications myself after reading the source code. But my compiler box was busy with many tasks, so I ...
2
votes
4answers
239 views

Can a antivirus software detect a malware that steals data?

For example, consider a software that wants to package all txt files in the /user/Desktop directory and upload them to its own server. I am not a programmer, but I know it can be done very easily with ...
0
votes
1answer
103 views

Can a hacker install known-vulnerable software on a machine in order to control the PC and elude antivirus?

I recently discovered that on one of my PCs the SolarWinds software was installed. I didn't install this software on my machine. I also saw that SolarWinds was cracked by Russian hackers and also ...
2
votes
1answer
91 views

How to evaluate anti-virus solutions [closed]

Some people want to know what is the "best antivirus", I am a little disappointed and it's difficult for me to answer this question. I think Windows Defender is good but I can't give ...
1
vote
1answer
109 views

How does malware avoid AV's when using a simple DLL injection technique?

As far as I understand it, a simple approach for a malware DLL injection would require 2 DLLs. The first for the DLL side loading, while the malicious DLL remains encrypted. And then this 'loader' ...
0
votes
3answers
109 views

Is is safe to skip virus scanning for image files?

Among other things, I use clamscan on my web servers website directories to help find compromised websites. Unfortunately the time to do this scan is becoming onerous. Are there any good reasons not ...
16
votes
1answer
5k views

Norton detects intrusion attempt from virtual machine - how is this possible?

Sometimes I have to fix an infected WordPress website. I always check the infected website from a virtual machine (Oracle VM VirtualBox). I'm also running Norton 360 DeluXe on the host machine. In the ...
8
votes
3answers
6k views

Trojan "Win32/Tnega!MSR" found by Windows Defender - aliases used by other antiviruses?

Recently I had a Windows 10 (64 bit) PC where Windows Defender would report that if found and (apparently) removed a "threat" it calls Win32/Tnega!MSR. Unfortunately, the removal was ...
0
votes
0answers
35 views

Are there some viruses that write assembly code instead of machine code, and use an external assembler?

Like the question says, I am wondering if there are some viruses that do not write machine code themselves, but instead output assembly code and invoke an external assembler? That sounds like a ...
0
votes
1answer
96 views

What is the use case for antimalware manual scans?

I am not able to understand what use is the manual antimalware scan? All antivirus software has a manual anti-malware scan. I understand if it's the first time someone installs it on their infected/...
0
votes
2answers
112 views

Does malware that comes through outdated apps go away if I uninstall the apps?

I was reading this and this article. The first article itself is about why software updates are extremely important for security, and the second one also mentions the following: "Make sure your ...
0
votes
2answers
516 views

Making My Own Custom Payload [closed]

I have tried many different tools to avoid being detected by an AV while using meterpreter exploit. Here is a list of tools I have tried: Shellter, Posh C2, Hack the World, Veil, Fat Rat, and many ...
1
vote
1answer
147 views

Why does Kaspersky anti-virus not consider this executable as malicious?

I was trying to learn file I/O and related function in C, and thus tried to create a baby-version of a virus. Following is the exact code: #include <stdio.h> #include <stdlib.h> int main(...
1
vote
1answer
86 views

Virus scanning uploaded images to database

I have a database for a chat app to which users can upload images. These images get scanned before they are made available to other users in a conversation. But when the antivirus gets an update, ...
2
votes
0answers
76 views

Why do Windows AV software detect strings with case-sensitivitely?

As Windows is case-insensitive, the string mimikatz can be evaluated the same as MIMIKATZ or MimIkaTZ. A naive method of AV evasion by switching cases of some characters in suspicious string has been ...
1
vote
1answer
1k views

Is it safe to use an executable if only unknown antiviruses detected something?

Recently I downloaded Open Shell application and checked it via VirusTotal. Most famous antiviruses like Bitdefender, Nrothon, Kaspersky found nothing. But some of antiviruses thing there are some bad ...
2
votes
1answer
107 views

How can antiviruses protect our computers if virus maker checks them with antiviruses?

I would like to know if we can really trust antiviruses because virus makers check their virus with antiviruses before releasing them. So how can we place our confidence in antiviruses?
4
votes
3answers
162 views

Is there any proof in support of these basic security guidelines?

The Tech Solidarity organization provides a list of basic security guidelines, described by Jeff Atwood as ... pure gold and has been vetted by many industry professionals ... From that same ...
0
votes
0answers
417 views

How to prevent amsi bypass powershell Windows 10

I have found a well known way to bypass an antivirus solution and run well known malicious powershell scripts. The method is the 6+ year old way of shutting down amsi and running the powershell script ...
0
votes
1answer
3k views

Remote Access Trojan (RAT) -- How to detect, how to remove [duplicate]

Is there a guaranteed way to: Know there is a Remote Access Trojan in my PC? Remove it completely and successfully from my PC? Note: Assume that the hacker doesn't leave any hint of their activity (...
0
votes
0answers
113 views

Why does my antivirus keep alerting me that someone attempted to remote access my computer?

I have purchased AVG's premium service to use on a Windows 10 operating system, but it almost seems like since I have gotten it, (had it for about a month now) it keeps alerting me that it has blocked ...
1
vote
1answer
193 views

Virtual machine protection

Let's say I have VirtualBox or Vmware Workstation on a Windows 10 Pro host, hosting Windows or a Linux distribution such as Ubuntu or CentoS). If I have an antivirus or Internet Security software on ...
0
votes
2answers
941 views

Obfuscating an .exe file

Is there a way to obfuscate an existing .exe file? I'm in a situation where I cannot transfer the winPEAS.exe file (for PrivEsc purposes) on a Win10 machine because of the AV blocking the executable. ...
0
votes
1answer
145 views

Antivirus evasion for reverse tcp

I'm trying to do reverse tcp in an exe payload. To do antivirus evasion, I've tried to use Veil evasion, The fat rat, and also Phantom evasion, but even if the exe wasn't deleted by antivirus (I use ...
1
vote
1answer
100 views

Wiping a hard drive before reinstallation

A few years ago, I left a new laptop at a sketchy computer shop to downgrade the OS to Windows 7. The experience was a disaster. My goal now is to install Cinnamon Linux on the laptop and remove ...
0
votes
0answers
196 views

Does SandBoxie have a virus?

When I try to download SandBoxie in the 64-bit version, at this link: SandBoxie and I analyze it with VirusTotal, it tells me that it's safe, but when I analyze some relative files, called: ...
1
vote
2answers
160 views

Why don't antivirus definition files get detected as malware

I was wondering... if antiviruses store virus definition files that contain virus signatures then why wouldn't they get detected as malware by themselves or Windows Defender or any other AV out there?
2
votes
0answers
276 views

How do EDR prevent you from uninstalling even as local admin?

I have an CrowdStrike EDR and it seems like the only way to disable this on all OS is to provide maintenance-token or ask CrowdStrike to disable the defences so you can uninstall it. I also have a ...
2
votes
0answers
135 views

Using other programming languages for malware against EDR?

As an example, one of the most basic malware to inject into a process to get a C2 beacon goes like this: Get Handle of a process -> VirtualAllocEx -> WriteProcessMemory -> CreateRemoteThread ...
0
votes
2answers
169 views

What does the bizarre text mean at VirusTotal?

I downloaded Bitcoin Core from here: https://bitcoin.org/bin/bitcoin-core-0.20.0/bitcoin-0.20.0-win64-setup.exe I then uploaded it to VirusTotal: https://www.virustotal.com/gui/file/...
-2
votes
1answer
1k views

How am I supposed to interpret a VirusTotal result of "some engines think this is malware"? [closed]

I just scanned another installer/EXE with VirusTotal. I've come to depend on this crappy service owned by the evil Google, in spite of its ambiguous messages and extremely confusing interface, because ...
0
votes
0answers
27 views

Invisible virus [duplicate]

Recently my brother brought a usb from his friends to copy stuff from and ended up infecting my pc in the process. I tried to solve the problem by installing kaspersky and doing a full scan of my ...
0
votes
2answers
61 views

Porbable virus in Windows 10 [duplicate]

I have a windows 10 machine with AVG Free antivirus. Lately everytime I boot the machine up as soon as it gets to the desktop Chrome opens up on its own with a suspicios add to download stuff I do not ...
0
votes
0answers
80 views

Why don't antivirus detect malicious XSS files?

I have a system with an uploading file feature and it's protected by an antivirus that scans the uploaded files. The AV detects malicious files like EICAR files, msfvenom payloads...but not a JS file ...
1
vote
1answer
42 views

Determining if software installed onto vm is malware or not

I've tried searching for methods of scanning files within virtualbox, but most (if not all) of what I find is discussion about studying programs that are already known to be malware. I'm trying to ...

1
2 3 4 5
14