Questions tagged [anti-virus]

Antivirus is software used to prevent, detect and remove malware.

Filter by
Sorted by
Tagged with
0 votes
0 answers
15 views

Is it possible to whitelist file extension in Juniper SRX UTM AntiVirus module for specific website

I have a SRX300 running 21.2R3-S2.9 and syslog got message:juniper.srx300 RT_UTM: AV_FILE_NOT_SCANNED_PASSED_MT: AntiVirus: SESSION_ID=47244670993 source-zone "TRUST" destination-zone "...
0 votes
1 answer
101 views

Large test virus file for ClamAV

I need a test file larger than 10K that will trigger ClamAV As per Large Virus File with EICAR-Test-Signature not identified by the clamav library , ClamAV will not detect the EICAR test virus when it ...
  • 634
0 votes
1 answer
722 views

My six year-old WPF executable is suddenly being detected as MSIL/AgentTesla.FU!MTB by Windows Defender

I wrote this app years ago, for my own personal use, never published it anywhere. I wondered if a virus might have been able to infect it, but even restoring the exe from six years ago doesn't solve ...
  • 202
0 votes
0 answers
790 views

MDATP installation in Docker on Linux Image

Was anyone able to install MDATP on a Linux Docker image? We tried CentOS, Debian, and Ubuntu and all have the same issue. I installed MDATP successful when the Linux box is a full host but not in ...
-2 votes
1 answer
113 views

Hundreds of suspicious messages coming from random sources [closed]

I'm having a serious problem and I'm getting out of options. Out of the blue, my Windows 10 laptop with McAfee started reporting hundreds of suspicious messages blocked by the laptop firewall (I don't ...
  • 3
3 votes
1 answer
5k views

clamav-daemon start condition failed, /var/lib/clamav/daily.{c[vl]d,inc} was not met

After installing Modoboa(Open Source Mail Hosting), I Tried to start clamav-daemon, but i faced start condition failed. systemctl status clamav-daemon.service clamav-daemon.service - Clam ...
-5 votes
2 answers
129 views

Can I report malicious ip addresses for money?

My servers get attacks from thousands of ip addresses everyday. I have an idea. Can I report those malicious ip addresses, or use the resource to earn some money? How? You may think these attacks are ...
  • 69
1 vote
0 answers
73 views

Zimbra sends alarms for service restarts by its cronjobs

I'm trying to solve an issue where we get ~8 nightly mails from Zimbra OSE 8. They'll look i.e. like this one: Dec 21 00:46:15 hostname zmconfigd[16202]: Service status change: exhostname amavis ...
1 vote
1 answer
160 views

A Batch script to call virustotal api and add a windows firewall rule if a baddie is detected?

Basically, when I connect to any site, it loads not only stuff on that server, but also stuff like background images, scripts, icons, fonts from third party sites. I was wondering if it would be ...
  • 11
-1 votes
1 answer
950 views

Strange Virus/Spyware blocked notification on frequently used vendor site

See screen shot above. This Virus warning appears when a user attempts to download an .exe from a frequently used Vendor website. This just started a few days ago. As far as I'm aware we don't have ...
  • 208
1 vote
2 answers
5k views

Sending a file to a remote clamd instance

I may be misunderstanding how to utilize clamd. I've got a situation where I have a media server that isn't quite powerfull enough to scan files as well as host the other services it is running (...
-2 votes
1 answer
44 views

How to avoid Antivirus Firewall blocking?

I just released a game that requires a PC and a mobile phone to communicate via UDP in a local area network. I have a mechanism that adds rules to the Windows firewall for the game. However, some ...
  • 1
2 votes
0 answers
976 views

ClamAV for the host running docker containers - inotify/fanotify limits

I'm implementing anti-virus solution for Linux with ClamAV daemon running in On-Access mode, watching the created/opened files for malicious content at the host system AND in docker containers, ...
  • 141
1 vote
1 answer
67 views

Is there a server side or cloud-side Windows Defender installation administration tool for admins?

I am considering starting the wide use of Windows Defender antivirus on Windows 10, so I am looking is there a way to get a feedback from machines running Windows 10 Defender? It would also be nice ...
  • 362
0 votes
3 answers
1k views

How can I prevent a service from being stopped in Task Manager (Or McAfee EPO)

I have a service that should never be stopped and am looking into different ways to prevent stopping the process. This is a managed environment connected to Active Directory. Can any Windows-based ...
0 votes
1 answer
50 views

Which files to scan for viruses (or how to reduce the cost of a full scan) on Linux (Debian)?

It may be irrelevant but anyway: I'm using clamscan to check my system. The problem is that a full system scan needs far more than one day. When you plan to do one scan a day, that's not acceptable....
  • 101
0 votes
1 answer
109 views

Sophos Antivirus or other Firewall/AV blocking Tomcat or AmazonS3Client listObjects() method?

I have a pair of Java/Tomcat web applications running on a third party (customer) server, and of late, those applications can no longer list or download objects from AmazonS3. This is a "nothing ...
0 votes
1 answer
330 views

Windows defender real-time protection "disabled"

Initially windows defender was disabled for some reason in Windows server 2016. I enabled it from gpedit.msc by disabling "Turn off windows defender". When opening Windows defender, it shows real-...
  • 1
2 votes
2 answers
195 views

How to ask antivirus software to work slower and hence use less disk access?

It is our policy for our end-user's computers (usually laptops) to have high power CPUs, GPUs, RAMs (no less than 16GB) and HDD space (1TB), but we save money by choosing lower rotation speed of HDD. ...
  • 111
2 votes
0 answers
23 views

How to prevent the installation of third-party AVs for a domain using GPOs?

Our organization uses a particular AV that we manage, but we currently have no way to enforce users not to install any other AVs, which has started to become an issue. I know windows can typically ...
  • 21
2 votes
0 answers
2k views

Suricata logs "A Network Trojan was detected". Is it false positive?

I use the Suricata as IDS on the local network that it doesn't the internet. It logged a few alerts from some clients that said A Network Trojan was detected. All log's properties are in the following:...
  • 326
2 votes
3 answers
1k views

What do Windows Defender Powershell ThreatAction enums map to?

I'm looking at a default Defender configuration in Server 2016. I'm not sure how to discover what these '0' mean for the ThreatDefaultAction: HighThreatDefaultAction : 0 ...
  • 295
0 votes
0 answers
42 views

windows server 2016 hacked for the third time [duplicate]

hello everyone I'm using a windows server 2016 as web server that runs a WebLogic application on a specific port (7001) and I have almost done every thing I know or I read about on the internet to ...
0 votes
0 answers
269 views

Install Antivirus on Windows Server 2008 R2

So, I have a CIS Microsoft Windows Server 2008 R2 - Level 1 image that needs to have an Anti-Virus installed and set to scan every day. This must be done with PowerShell so I can fit it into the ...
  • 101
0 votes
0 answers
71 views

Trend Micro Anti-Virus / Deep Security Unattended Installation

I would greatly appreciate if someone with operational knowledge about Trend Micro Deep Security, could verify or debunk the following statement: The software cannot be installed unattended client-...
4 votes
2 answers
9k views

Scan the full filesystem in parallel with clamscan

I run a clamav scan weekly on my servers. There is one server with a raid6 cluster of 30TB of disk space where the scan take more than 24h to run. So I wonder how can I run clamscan on the whole ...
  • 165
1 vote
2 answers
3k views

How to remove active_desktop_launcher.exe by KuGou [duplicate]

Hi I am running Windows Server 2012 R2. And I am facing a strange problem. There active_desktop_launcher.exe service is randomly get executed and takes up 100% of CPU utilization slowing the whole ...
3 votes
1 answer
31k views

Using Windows Defender on Windows Server 2012R2 & 2016

We have to renew our Anti-Virus licensing with McAffee. However, we only have a handful of Windows Servers (2012R2 & 2016) that are running as a DC, Exchange, Backup and File server. Would it be a ...
1 vote
0 answers
261 views

windows Antimalware using high CPU with local TCP links

I have observed a problems with Windows Antimalware Service Executable using high CPU when two processes on my computer are communicating over TCP. If I disable realtime scanning in defender the ...
  • 111
1 vote
0 answers
25 views

How to find complete installer location which is installed using small size initiator .exe on Windows 10

Some time companies give small setup.exe file, for example 2 MB .exe of Kaspersky which we run and that will connect to the company server, download complete installer/setup and install the software. ...
  • 11
5 votes
2 answers
2k views

Why is IPScan detected as a virus?

Does anyone have a definitive answer to why Angry IP Scanner (IPScan) is detected as a virus (hacktool) by so many antivirus vendors, while similar tools such as Nmap and Advanced IP Scanner are not? ...
  • 1,039
-1 votes
1 answer
732 views

ESET Endpoint Protection - License will soon be overused

ESET Remote Administrator (ERA) keeps warning me that my license will soon be overused. The number of units in use, listed by License Management doesn't match the the number of computers I have ...
  • 66
1 vote
3 answers
83 views

Physical and software firewall

I wanted to know if having two firewalls is usefull at all. I'm an apprentice in a company and the I'm the only one in my company who knows little about networking. We have a cisco firewall and each ...
3 votes
6 answers
11k views

Trying to update windows defender from UNC path continuously fails

I'm trying to update Windows Defender (on Win 10) using definistions stored on a UNC path. I'm setting the path the the mpam-fe.exe file like this Set-MpPreference -...
0 votes
2 answers
1k views

TFS 2017 anti-virus exclusion

Does anyone know if there is an official anti-virus exclusion list from Microsoft that lists which folders and processes should be excluded from anti-virus on the TFS 2017 application server? This ...
9 votes
4 answers
30k views

Is it safe to purge %WinDir%\assembly\NativeImages*\Temp\?

On my Windows Server 2008 R2 (SBS 2011) i have found more than 25 GB of files that seem to be junk: %WinDir%\assembly\NativeImages_v2.0.50727_32\Temp\ - 6.9 GB (656 files in 675 folders) %WinDir%\...
  • 261
-1 votes
2 answers
701 views

Update64.exe Using All CPU Resources

I have tried finding out what Update64.exe really does. I think it might be a virus but there's not much out there on the topic. Does anyone know how to fix this? It's using pretty much 80-100% of CPU....
0 votes
0 answers
90 views

Sage2.0 Ransomware and Tomcat 7

We have a tomcat server running on window 2012 server which seems to be constantly being attached by Sage 2.0 ransomeware. Some details of the sever, 1) Tomcat is running on port 80 and 8080. 2) ...
0 votes
1 answer
30 views

Watch Guard Total Security working over VPN

We have a warehouse and 4 other showroom locations. All the 4 locations are connect to the warehouse through a VPN. If we get a watch guard for each location and connect through a VPN. Would it be ...
49 votes
8 answers
8k views

Are zipped EXE files harmless for Linux servers?

I ran a malware scanner on my site, and it marked a bunch of zipped EXE files as potential risk files (these files got uploaded by users). Since I'm able to uncompress the files on my Mac I assume ...
  • 592
13 votes
4 answers
79k views

Where are windows 10 defender offline scan logs/results?

I can't find any events or log files, are there such records somewhere or WD reports only if it finds something? Windows 10 pro, drive is encrypted with bitlocker (might affects somehow?)
  • 131
4 votes
1 answer
5k views

Windows 10 Notification Bug – Check Virus Protection

I have a bit of an issue on a Windows 10 Pro Machine on the Anniversary update with Trend Micro Installed. For some unknown reason I get this popup about every 5 minutes up to a total of about 200+ ...
0 votes
2 answers
3k views

How can I install anti-virus software on all my network devices?

I have 20 laptops connected to a router wirelessly. Is there any way I can install an anti-virus program on those devices? What is the best way to do this? (It would be hard to manually install a ...
5 votes
1 answer
4k views

How to scan for Windows viruses on Linux servers?

I have a CentOS server storing files for windows users. How do I scan for windows viruses in these files, and meanwhile prevent quarantine and other measures? I do not want the files altered in any ...
  • 279
1 vote
1 answer
953 views

Why is MsMpEng.exe using 100% Disk I/O for minutes to scan one small file?

Occasionally (maybe once a day), when I download any file with my browser and first try to open the download, my Windows 8 box CPU spikes to 100% for a minute or more. The file doesn't open until ...
2 votes
1 answer
961 views

Windows Server 2012 web server maxing out on application start - could antivirus be responsible?

We have a Windows Server 2012 R2 web server running IIS 8.5 hosting a number of ASP.NET applications each in their own app pool. The server was originally specced to cope with expected load, but since ...
0 votes
1 answer
392 views

Who is injecting TCP RST packets?

I work for a very large organisation and I am having issues with a device injecting RST packets to cut off a connection from one of my servers to another. I suspect it is some sort of anti-virus ...
  • 123
2 votes
1 answer
332 views

How to get SCEP to notify the user when they just downloaded a virus?

We're using Microsoft's System Center Endpoint Protection (SCEP) as our antivirus solution. We have it set within SCCM to send the help desk and the sysadmins an email when a virus detection is found....
  • 1,862
0 votes
2 answers
93 views

Ransomware infection: What to do [duplicate]

t seems that somehow our domain computers have been infected by rasomware, turning files into encrypted files ending with .crypted. Lots of file have been changed and we do have back up. At the same ...
3 votes
1 answer
560 views

How can I get Windows to forget it had antivirus installed?

We purchased a networking and software solution for PCI compliance: TrustWave. We started to install the antivirus but realized that it was not required on the machines it was being installed on and ...
  • 690

1
2 3 4 5
7