Questions tagged [antivirus]

Antivirus or anti-virus software is used to prevent, detect, and remove malware, including but not limited to computer viruses, computer worm, trojan horses, spyware and adware.

Filter by
Sorted by
Tagged with
4
votes
1answer
410 views

What are some of the benign use cases of injecting bytes into another process and creating remote thread?

Lets say, you are developing an AV, and marked any type of injecting into another process (for example openning it and writing to it) and creating remote thread malicious. If so, what will be some of ...
0
votes
1answer
588 views

How can Runtime-Crypters stay FUD

A Runtime Crypter always works with the same principle: It decrypts its payload, starts up a process in suspended state, inserts the payload and resumes the suspended process under false flag. All ...
3
votes
1answer
370 views

Antivirus settings for developers and build machines?

I work in a company that has strict antivirus policy. Each computer must have an up-to date antivirus with all the bells and whistles turned on. But as a developers, this is giving us problems. ...
0
votes
0answers
71 views

Unknown process attempted to execute code

This morning I booted up my computer and not long afterward, got a notification from ByteFence (unsubscribed) that an unknown process attempted to execute a command that was deemed unwanted. ByteFence ...
0
votes
0answers
46 views

Test antivirus with virus/malware (No EICAR) [duplicate]

I am currently testing a new AI/Machine Learning antivirus solution. I installed it on a laptop and i manage through the dashboard on a different laptop. I am now testing how quickly it picks up stuff ...
1
vote
1answer
1k views

Difference between system uptime and last boot time in windows

As it shows in attached pictures, there is a "Difference between system uptime and last boot time" in my windows, it becomes an issue because AV, SIEM or every monitoring system shows a different time ...
2
votes
0answers
226 views

Can developers stop their software from being flagged as malicious by AV products?

This may not be the correct community for this question, I apologize if that's the case. Scenario: A software development company has created a collection of small desktop applications. They have ...
2
votes
1answer
407 views

Platform as a Service and Anti Virus

We currently use a PaaS solution for our web application and db for a Ruby on Rails environment and PostgreSQL. In an on-premise solution, we had servers that we managed ourselves and had antivirus ...
1
vote
1answer
332 views

Virus from a printer kiosk?

I encountered a puzzling situation the other day when I plugged in a USB flash drive. Windows defender displayed an alert saying that a threat had been quarantined, specifically the Jenxcus VBS virus. ...
-1
votes
1answer
87 views

Does the term "malware signature" always refer to a pattern of bytes? [duplicate]

I know that traditionally a malware signature is a pattern of bytes in a program. While reading Joxean Koret and Elias Bachaalany's "Antivirus Hacker's Handbook" I saw that the authors categorized the ...
0
votes
1answer
492 views

Norton Symantec Flagging my python script as Trojan.Bayrob9

I have symantec endpoint protection on my computer. I have the python script: import subprocess import os from ftplib import FTP os.chdir("public_html2") data=subprocess.check_output(["git", "diff","-...
0
votes
0answers
30 views

How to remove a very stealthy virus? [duplicate]

I have a virus on my laptop preventing me from installing antivirus, or updating windows or even opening task manager. i tried running a virus scanner from a portable scanners, the virus disappears ...
0
votes
0answers
33 views

Is there any anti-virus that only uses behaviour-based malware detection? [duplicate]

I would like to know any antivirus software that uses strictly only a behaviour-based malware detection technique as the aim of my research is to compare behavioural-based and signature-based malware ...
1
vote
4answers
1k views

how common is it for an antivirus program to give false positive?

Often antivirus programs trigger a false alarm that a certain file is corrupted or infected. My question is that how common is that and if it is too common, can we really rely on them. Along with ...
4
votes
0answers
60 views

What is the most efficient approach to automate testing a malware sample on many different AVs without using online services? [closed]

So let's say you want to automate changing parts of malware and testing it on many different AVs, and you want all this process to be automated, i believe people who gave the AVLeak talk in black hat ...
0
votes
1answer
510 views

How do AVs scan the file in websites that claim they don't send the files to AVs like Nodistribute.com? [closed]

So for example one of the famous alternatives to Virustotal aka Nodistribute.com claims that it doesn't send the file to AVs, but if it doesn't, then how can they scan it? just by checking the hash? ...
1
vote
1answer
416 views

What is "rule-based" analysis in malware detection?

I've read a few articles that describe the heuristic detection used by AVs as being either "weight-based" or "rule-based". The weight-based aspect seems to make sense, but I don't understand what "...
1
vote
3answers
442 views

Can any Windows app install a kernel driver? if not, then how can Anti-Viruses install kernel drivers?

Can any application install a kernel driver? if not, then how Windows decides who can and who cannot? If AVs can install kernel drivers, considering they are an application with an installer just like ...
1
vote
1answer
348 views

USB read only permission and antivirus

We would like to block write permissions to USB drives. We will allow user read-only permissions to the USB drive. By doing that, do we still allow the Antivirus to scan the USB drive and delete, if ...
0
votes
2answers
257 views

Can I rely on Operating System (OS) Anti Virus (AV) scanning to scan files shares?

I have an EC2 instance with an Windows OS with anti virus installed. I have a requirement to attach a file share to the OS where the application is hosted. The file share is Amazon Fsx ( Amazon's ...
7
votes
2answers
2k views

How do AV scanners in VirusTotal check if a file is malicious or not and how trustworthy is its report?

So i have seen many times that people provide the virus total report for a file to prove its not a virus but i just checked and when i submit a file its not even uploading it (i checked my bandwidth),...
1
vote
1answer
88 views

Is it correct to say that AVs use the same signature-based detection methods in emulation as they do on static binaries?

Many malwares can be packed or encrypted and AVs will emulate their execution to allow them to unpack or decrypt themselves. Once they do, are AVs simply using the same hashing or pattern-matching ...
0
votes
3answers
113 views

Can antiviruses scan /var

I was wondering if antiviruses could scan /var or if it was off limits i am trying to understand how antiviruses work and there impact on the file system and any limitations imposed on scanning ...
1
vote
1answer
65 views

Are the malware signatures used by AVs primarily created by human analysts or by automated means?

I've only ever read about human analysts creating signatures, but it seems like automated signature derivation would be less time-consuming and I'm surprised that I'm not seeing more about automated ...
0
votes
4answers
299 views

Scanning USB stick with multiple Antivirus tools [closed]

I realise that having multiple AVs is not recommended, but I have a specific question. My boss supplied me with a laptop which has like 5 different AVs (some of them are more like portable "launch ...
2
votes
1answer
70 views

When writing software do all programs have a signature? [closed]

I have always been curious if all software have a signature for whatever reason or is only related to AV.
0
votes
0answers
65 views

Antivirus and it's role in detecting payload execution?

My first question is this: 1) Antivirus software works using signature based detection. Signature based detection evaluates items (maybe not the right word?) based upon a big database of known threats....
0
votes
3answers
168 views

Are there types of malware that are so time-intensive to detect that AV vendors simply choose to not detect them? [closed]

I've been reading a lot about how AVs use different heuristic methods to detect obfuscated malware and it seems like some of these methods are very time/processor intensive. For example, to detect ...
1
vote
0answers
54 views

Best Antivirus for Android [closed]

Please suggest best Antivirus, thanks
0
votes
1answer
968 views

What is "JTI/Suspect.131328" from McAfee? [closed]

Using McAfee Endpoint Security 10.6 on Windows 10 it is the second time I got the: Warning. I cannot find anything related to it while Googling around: "JTI/Suspect.131328" The question: is this ...
2
votes
1answer
4k views

CVE-2019-0903 detected by just one anti-virus service

On my Windows 8.1 computer I created an MS Word document containing a couple images I downloaded from the internet, and exported it as PDF. The MS Word version is 14.0.7232.5000, 64 bit. I sent that ...
4
votes
1answer
3k views

How to inject a malware in a video

Is it possible to trigger an antivirus program to alarm by playing a video? I don't want to run malware, I only want the AV to do something. Can I put EICAR in the metadata? The video file shoudn't ...
6
votes
2answers
263 views

Suppose antivirus provider turned malicious: What do we do?

It was recently reported that the hacking group Fxmsp "...claimed to have secured access to three leading antivirus companies," and that they "...extracted sensitive source code from antivirus ...
-2
votes
2answers
515 views

Antivirus and malware fingerprints

I´m a student in IT security and I would like to know how the malware fingerprints work in common AntiVirus. I understand that when a malware is detected it's because the binary fingerprint is known ...
0
votes
2answers
85 views

Can 3rd party AVs have accessed to my Windows PC and Android phone even after uninstalling and removing them?

Before we start this, I have paranoia issues (doctor diagnosed, not self-diagnosed) so things might at some points seem like an extremely far reach, but please bear with me. I bought an AV yesterday ...
0
votes
1answer
219 views

What are the heuristic detection techniques most often used in modern AVs? [closed]

Whenever I read books or academic papers and the subject of heuristic malware detection is brought up they always say the same thing: "it can be either static or dynamic", "it may use emulation", "may ...
0
votes
1answer
134 views

How do AV vendors select malware signatures?

AVs use signatures to identify malware which are often strings of bytes or regular expressions thought to be unique to that malware. Do reverse engineers select these signatures by hand or do they use ...
2
votes
3answers
264 views

Is fileless malware is a new type of attack or the media just bringing them now more to our attention to promote sales of related "new" solutions?

I feel there are so many articles talking about fileless malware, so I was trying to understand is it a new type of attack or those articles are just kind of promoting new cyber solutions?
1
vote
1answer
436 views

How does android antivirus scan root files like "/data/data"

I want to know how does android antivirus scan packages private files in "/data/data" directory. I read somewhere that they check the file name with their database and declare it as malware but how ...
0
votes
1answer
1k views

Is there something fishy on Kaspersky Internet Security or I am missing something?

Whenever I turn on my computer, a notification pops up - You need to restart you PC (I have added screenshot). I did, but it keeps coming. So went to notification center and saw which application is ...
0
votes
1answer
596 views

ClamAV detects virus in Modsec Audit logs

I have a Xen VM running Debian Stretch with Apache2 to play around with. I have installed ClamAV and Modsecurity (not doing anything just logging at the moment). I keep getting emails from ClamAV ...
0
votes
0answers
155 views

How to test behavioral detection of antivirus

I want to test to see if my antiviruses are working correctly and if possible to see which one is better. As each antivirus has two parts I want to test both. For signature-based detection, I use ...
2
votes
1answer
157 views

Antivirus recall and precision not accuracy [closed]

I am studying antiviruses how antiviruses work at my university. This is just the very basics. He asked in our opinion which we think is better: recall or precision. Why does my professor say he ...
0
votes
1answer
126 views

How can I explain our system admins that AV can't protect our enterprise machines from attacks leverage on USBninja? [closed]

Was hoping to get your support to help to explain to our system admins how come the AV can't protect our enterprise from attacks that can be generated from USBninja. How can I explain our system ...
-1
votes
1answer
302 views

Is there any example of a network-based anti-virus system? [closed]

Is there any example of network-based anti-virus system? There are two types of anti-virus systems; one is host-based, and the other is network-based. We often see host-based anti-virus systems(...
3
votes
1answer
114 views

Is there any risk in adding exceptions in the antivirus software for paths that are only writable by Administrator?

Sometimes antivirus administrators don't want to add any exceptions for the antivirus software. My question is what is the risk of adding paths that whose permissions are correctly configured to allow ...
1
vote
4answers
359 views

How to detect a virus /malware missed by antivirus program

I was on a Facebook page and I accidentally clicked an ad. Another window opened up and locked the browser with a background audio message, purportedly from Microsoft, warning about security ...
0
votes
0answers
161 views

What's the deal with .LNK (Windows shortcuts) files?

Today Ms Security Essentials thought that a .lnk in my computer was infected and quarantined it. It seemed legit to me, just a shortcut to my H2 (database) console script, which I had installed (in ...
3
votes
1answer
129 views

Verifying Host Sterility After Running Malware Tests on Virtual Machine

I know that "VM escape" is becoming a common issue now with malware testing. I'm just wondering if there's any way of verifying if the host system is clean from any infection after running a malware ...
1
vote
1answer
87 views

How did antivirus vendors find malware to include in traditional AV signatures?

Forgive me if it's a silly question, but I'm genuinely curious. How do traditional AV (signature-based only) vendors get the malware to analyse and include in definition files? Also, what's the ...

1 2
3
4 5
14