Questions tagged [anti-virus]
Antivirus is software used to prevent, detect and remove malware.
41
questions with no upvoted or accepted answers
3
votes
0
answers
249
views
Linux Malware Detection Monitoring: Clean files after hit
I'm using LMD ("Maldet") for scanning a web server with different projects. For this purpose I'm using the inotify-monitoring.
Well, the inotify-log shows, that the modified files are noticed, but I ...
2
votes
0
answers
1k
views
ClamAV for the host running docker containers - inotify/fanotify limits
I'm implementing anti-virus solution for Linux with ClamAV daemon running in On-Access mode, watching the created/opened files for malicious content at the host system AND in docker containers, ...
2
votes
0
answers
33
views
How to prevent the installation of third-party AVs for a domain using GPOs?
Our organization uses a particular AV that we manage, but we currently have no way to enforce users not to install any other AVs, which has started to become an issue. I know windows can typically ...
2
votes
0
answers
2k
views
Suricata logs "A Network Trojan was detected". Is it false positive?
I use the Suricata as IDS on the local network that it doesn't the internet. It logged a few alerts from some clients that said A Network Trojan was detected.
All log's properties are in the following:...
2
votes
1
answer
1k
views
Why is MsMpEng.exe using 100% Disk I/O for minutes to scan one small file?
Occasionally (maybe once a day), when I download any file with my browser and first try to open the download, my Windows 8 box CPU spikes to 100% for a minute or more. The file doesn't open until ...
2
votes
1
answer
353
views
How to get SCEP to notify the user when they just downloaded a virus?
We're using Microsoft's System Center Endpoint Protection (SCEP) as our antivirus solution. We have it set within SCCM to send the help desk and the sysadmins an email when a virus detection is found....
2
votes
0
answers
146
views
How do I restore 1/2 of all files in a VSS image? aka Previous Version in bulk?
Suppose I have many files that were virus infected in bulk. It isn't the entire drive, but 1/2 of it.
I don't want to right click each folder and restore a previous version. Is there a way to do ...
2
votes
1
answer
262
views
Does anyone have references/metrics on the value of installing antivirus software - especially on servers?
I strongly dislike antivirus software. In my opinion, the av software behaves much like a virus. The recent Symantec incident of actually causing server crashes, resource use, software interference, ...
1
vote
0
answers
178
views
Zimbra sends alarms for service restarts by its cronjobs
I'm trying to solve an issue where we get ~8 nightly mails from Zimbra OSE 8.
They'll look i.e. like this one:
Dec 21 00:46:15 hostname zmconfigd[16202]: Service status change:
exhostname amavis ...
1
vote
1
answer
220
views
A Batch script to call virustotal api and add a windows firewall rule if a baddie is detected?
Basically, when I connect to any site, it loads not only stuff on that server, but also stuff like background images, scripts, icons, fonts from third party sites. I was wondering if it would be ...
1
vote
0
answers
296
views
windows Antimalware using high CPU with local TCP links
I have observed a problems with Windows Antimalware Service Executable using high CPU when two processes on my computer are communicating over TCP. If I disable realtime scanning in defender the ...
1
vote
0
answers
27
views
How to find complete installer location which is installed using small size initiator .exe on Windows 10
Some time companies give small setup.exe file, for example 2 MB .exe of Kaspersky which we run and that will connect to the company server, download complete installer/setup and install the software. ...
1
vote
0
answers
78
views
How to fix erroneous virus detection?
We make free software available on our web site. A few years ago, one of the virus scanners started complaining about some of our executables. We rebuilt everything from source code, verified things ...
1
vote
0
answers
46
views
Trend Smart Scan server updates thrash the disk
Every 2 hours, Trend Worry Free business updates Smart Scan.
This process requires Trend to thrash through 6 gigabytes of data - this causes two issues
The file cache, full of LOB data, is lost and ...
1
vote
0
answers
186
views
Web sites freeze after clicking link - unexplainable ACK packet
We have a sporadic problem accessing some internal links on websites. (Windows Firefox, Internet Explorer, Chrome)
Behaviour
On first clicking a link, the browser will load infinitely. The second ...
1
vote
0
answers
92
views
Viruses bypassing Trend ScanMail - Could it be a licensing issue or a mime issue
I have some SCR viruses being sent in a ZIP file that are bypassing the Trend Scanner on Exchange 2010 SP1 CU7.
There are a few reasons I can think this would be occurring
The email message has ...
1
vote
0
answers
116
views
How to stop Forefront from blocking my program?
(I'm not sure if this should go on StackOverflow.)
I have a program running at a customer site for ten years now. It takes their data and uses it to fill out web forms. It works by attaching itself ...
1
vote
0
answers
639
views
Windows SBS 2003 SP2 freezing after installing Trend Micro WFBS
I'm new in charge of a server running Windows SBS 2003 with SP 2.
First thing after I got in charge of the system was to update the old WFBS 3.7 to the current version.
Now the users reporting that ...
1
vote
0
answers
195
views
cgpav not scanning in CommuniGate Pro
I have setup cgpav and cgpsa. Spamassassin works fine - the cgpav filter seems to run, cgpro log files just show OK when it receives an email with a known virus (eicar test virus), however, if run ...
1
vote
1
answer
557
views
Permission problems with Clamfs
been trying to get clamfs working on Ubuntu 10.4. It seems like everything is working, clamfs locates infected files and prevents me from opening these.
But I am having permission troubles with a ...
1
vote
1
answer
476
views
Forefront Client Security On Server with Exchange 2010
If we install Forefront Client Security on a Server which already has Forefront for Exchange 2010 is it smart enough to exclude all of the exchange directories/process/file extensions as suggested by ...
0
votes
0
answers
147
views
ClamAV didn't see virus inside an Archive
/home/folder/clam_daily.sh: OK
/home/folder/.sudo_as_admin_successful: Empty file
/home/folder/.selected_editor: OK
/home/folder/PROTECTAgentInstaller.tar.gz: OK
/home/folder/.bash_logout: OK
/home/...
0
votes
0
answers
51
views
How to allow file in windows virus and threat protection in Windows Server Core
In Windows Server 2022 with GUI, when Windows Security incorrect detect file as virus and threat and quarantined threat, I can allowed threats from Windows Security settings.
But I do not know how to ...
0
votes
0
answers
1k
views
MDATP installation in Docker on Linux Image
Was anyone able to install MDATP on a Linux Docker image?
We tried CentOS, Debian, and Ubuntu and all have the same issue. I installed MDATP successful when the Linux box is a full host but not in ...
0
votes
1
answer
176
views
Sophos Antivirus or other Firewall/AV blocking Tomcat or AmazonS3Client listObjects() method?
I have a pair of Java/Tomcat web applications running on a third party (customer) server, and of late, those applications can no longer list or download objects from AmazonS3.
This is a "nothing ...
0
votes
0
answers
408
views
Install Antivirus on Windows Server 2008 R2
So, I have a CIS Microsoft Windows Server 2008 R2 - Level 1 image that needs to have an Anti-Virus installed and set to scan every day. This must be done with PowerShell so I can fit it into the ...
0
votes
0
answers
80
views
Trend Micro Anti-Virus / Deep Security Unattended Installation
I would greatly appreciate if someone with operational knowledge about Trend Micro Deep Security, could verify or debunk the following statement:
The software cannot be installed unattended client-...
0
votes
0
answers
92
views
Sage2.0 Ransomware and Tomcat 7
We have a tomcat server running on window 2012 server which seems to be constantly being attached by Sage 2.0 ransomeware. Some details of the sever,
1) Tomcat is running on port 80 and 8080.
2) ...
0
votes
1
answer
689
views
Remove McAfee branding from Windows login
McAfee Enterprise plasters its brand over everything on the PC. Everything.
The latest is that since installing disk encryption, the McAfee logo is placed over the user account picture on the ...
0
votes
0
answers
165
views
Inter-VLAN Malicious Code Scanning
I am trying to find an inbuilt solution on a Cisco Catayst 3750X Switch to scan all traffic routed from one VLAN to another for malicious code.
The situation is that we currently have a development ...
0
votes
0
answers
74
views
Windows Share Meltdown, Unexplainable
I am having precisely the exact symptoms on my server as is described in this article.
This includes statements that
the specified network name is no longer available
and
RPC Server is too busy to ...
0
votes
1
answer
145
views
Strange ports on default install of W7
I have a base new install of windows 7, and when I went to look for something else I saw the attached netstat output.
What concerns me is that this is Windows + Truecrypt + drivers, nothing else ...
0
votes
1
answer
178
views
Updating Mcafee Group Shield on Exchange Server
So I don't actually have a problem yet, but I might.
You see my fathers company have 10 computers and an exchange server with Mcafee Group Shield.
lately they've had issues with mails from customers ...
0
votes
1
answer
347
views
Sophos Enterprise Console 4.5, Mac Client 7 Not Auto-Populating SEC Info
I have Sophos Endpoint Security and Control, which includes Sophos Enterprise Console (SEC). I'm currently running version 4.5 of SEC, which is an older version. I subscribe to Mac updates, and SEC ...
0
votes
1
answer
456
views
Windows defender real-time protection "disabled"
Initially windows defender was disabled for some reason in Windows server 2016. I enabled it from gpedit.msc by disabling "Turn off windows defender".
When opening Windows defender, it shows real-...
-1
votes
0
answers
18
views
An executable compiled from source triggers a Windows Defender quarantine on just one computer
Can anyone suggest next steps for the following virus alert scenario?
We have a new employee (located in the United States) who was shipped a brand new laptop directly from Dell USA. It has Windows ...
-1
votes
1
answer
757
views
ESET Endpoint Protection - License will soon be overused
ESET Remote Administrator (ERA) keeps warning me that my license will soon be overused. The number of units in use, listed by License Management doesn't match the the number of computers I have ...
-1
votes
1
answer
1k
views
Trend Micro OfficeScan with Windows 7 Embedded and FBWF
I'm running up a bunch of HP Thin Terminals with Windows 7 Embedded Standard. I've enabled FBWF on the terminals and applications will be accessed by users via Citrix.
Very little needs to exist on ...
-1
votes
1
answer
1k
views
long access times and errors in iis application
I am having an issue with an IIS application (details of environment at the end of the message).
The web site works great most of the time and I cannot reproduce any error in our test system. On the ...
-1
votes
2
answers
705
views
Update64.exe Using All CPU Resources
I have tried finding out what Update64.exe really does. I think it might be a virus but there's not much out there on the topic. Does anyone know how to fix this? It's using pretty much 80-100% of CPU....
-2
votes
1
answer
49
views
How to avoid Antivirus Firewall blocking?
I just released a game that requires a PC and a mobile phone to communicate via UDP in a local area network. I have a mechanism that adds rules to the Windows firewall for the game.
However, some ...