83 votes
Accepted

Are zipped EXE files harmless for Linux servers?

If they are indeed zipped Windows exe files, they should be harmless to your Linux system, unless you have something like Wine in place that could try to execute them. But if they are in your web ...
  • 97.3k
62 votes

Are zipped EXE files harmless for Linux servers?

Since I'm able to uncompress the files on my mac I assume these are real zip files and not just something like renamed php files. While you're probably right in this case, your assumption might not ...
32 votes

Run antivirus software on linux DNS servers. Does it make sense?

Sometimes auditors are idiots... This is uncommon request, though. I would counter the auditors recommendation by securing/limiting access to servers, adding an IDS or file-integrity monitoring or ...
  • 195k
17 votes

Run antivirus software on linux DNS servers. Does it make sense?

The first thing you need to understand about auditors is they may not know anything about how the technology in scope is used in the real world. There are a lot of DNS security vulnerabilities ...
  • 34.3k
13 votes
Accepted

Run antivirus software on linux DNS servers. Does it make sense?

One aspect of this is that recommending "anti-virus" to be on everything is a safe bet, for the auditor. Security audits aren't entirely about actual technical safety. Often they are also about ...
  • 3,772
10 votes

Run antivirus software on linux DNS servers. Does it make sense?

Typical modern anti-virus software does more accurately attempt to find malware and is not only limited to viruses. Depending on the actual implementation of a server (dedicated box for a dedicated ...
10 votes

Where are windows 10 defender offline scan logs/results?

Windows Defender adds entries to the Event Viewer in the following location: Event Viewer >> Applications and Services Logs >> Microsoft >> Windows >> Windows Defender >> Operational Where you'll ...
  • 135
8 votes

How to scan only last 24 hours files with clamav

I stumbled onto this page, when I was looking for a clamscan script. I followed above advice and got it working with: #!/usr/bin/bash # Create Hourly Cron Job With Clamscan # Directories to scan ...
  • 101
7 votes

Run antivirus software on linux DNS servers. Does it make sense?

DNS servers have become popular with PCI auditors this year. The important thing to recognize is that while DNS servers do not handle sensitive data, they support your environments which do. As such, ...
  • 31.9k
7 votes
Accepted

Do I need an antivirus program in each virtual machine?

No, you should not be using AV software on the host to scan your VHD location. You can install AV software on the host but you need to exclude several Hyper-V related folders from the real time AV ...
  • 108k
7 votes

Where are windows 10 defender offline scan logs/results?

According to Microsoft, any threats detected by the offline scanner will show up in the Threat History (where the online scanner also records any viruses found): Where can I find scan results? ...
7 votes
Accepted

Is it safe to purge %WinDir%\assembly\NativeImages*\Temp\?

it certainly isn't normal behaviour. something must have gone wrong. i have checked multiple machines. including different windows versions. most of them do not show these symptoms. after doing ...
  • 261
6 votes
Accepted

Is it possible to check the progress of of a currently running clamAV scan?

AFAICT, this is not possible—you can either have all scanned files printed to the console, or just print infected files. Then at the end, ClamAV will print a summary. I haven't been able to find a way ...
  • 1,357
6 votes

Do I need an antivirus program in each virtual machine?

You need to install AV which is specially designed for Hyper-V. It will install itself into host but it will scan VMs and their vRAM, on-disk images and also intercept traffic between VMs and host ...
5 votes
Accepted

Can I report malicious ip addresses for money?

Short answer - no. Setting a honeypot server to collect such IPs is easy and cheap and the information quickly becomes stale. Most of the scans come from short lived cloud/vps servers. Cloud providers ...
4 votes
Accepted

Is there a quick & easy solution to protect server 2012 against malware?

If you want the Microsoft security product for Windows Servers, it is System Center EndPoint Protection (SCEP) 2012 R2, which is included with System Center Configuration Manager 2012 R2. It is ...
  • 34.3k
4 votes
Accepted

Gateway Anti-Virus vs Desktop Anti-Virus

There are many more ways for virii to enter your workstations than ONLY from the network. There are also many protocols that can encrypt or obfuscate data in such a way to render gateway antivirus ...
  • 7,349
4 votes
Accepted

How can I get Windows to forget it had antivirus installed?

Never tested it, but it would be a script like this: On Error Resume Next Set shell = CreateObject("WScript.Shell") Set getOSVersion = shell.exec("%comspec% /c ver") version = getOSVersion.stdout....
  • 16.3k
4 votes

Who is injecting TCP RST packets?

The only way you'll be able to sort this out is to perform packet captures at various places along the path to determine where the RST packets are coming from. I'm assuming that you do not have the ...
  • 108k
4 votes
Accepted

Trying to update windows defender from UNC path continuously fails

I have never done this before, but your question made me curious and I started doing some testing. I was able to reproduce your issue. It's clear that not many people do this, because there is zero ...
  • 3,290
4 votes
Accepted

Scan the full filesystem in parallel with clamscan

You've got two separate questions: Parallelize clamdscan - apart from combining --multiscan and --fdscan there's little you can do. Alternatively, you can run multiple instances of clamscan on ...
  • 8,664
4 votes
Accepted

clamav-daemon start condition failed, /var/lib/clamav/daily.{c[vl]d,inc} was not met

After some sort of tries, finally I downloaded daily.cvd and main.cvd manually with wget command directly from clamav.net/downloads and move them to my server with scp command and put them to /var/lib/...
3 votes

Malware vs Viruses

Malware is software written specifically to harm and infect the host system. Malware includes viruses along with other types of software such as trojan horses, worms, spyware, and adware. Advanced ...
3 votes

MsMpEng.exe high CPU usage on Windows Server 2012

You might find it under Endpoint Protection or System Center Endpoint Protection, there you can set excluded filetypes and such under settings.
  • 161
3 votes

Setting affinity for virus protection on workstations - best practice?

While an appealing idea at first, you should consider than antivirus scans are generally bound by disk I/O performance, rather then CPU speed. In other word, with PC using classical mechanical disk, ...
3 votes
Accepted

How to install AV on existing Azure VM using agent tools?

From Preview Portal: Browse -> Virtual Machines -> Select VM -> All Settings -> Extensions -> Add -> Select Extension -> Create. Using Powershell: https://msdn.microsoft.com/en-us/library/azure/...
  • 3,804
3 votes

Do I need an antivirus program in each virtual machine?

@BaronSamedi is right, best approach is a VM-aware agentless AV solution. 5nine has 3 AV options to choose from including Vipre, Kaspersky, and IIRC ThreatTrack. An alternative may be ESET, they ...
  • 5,181
3 votes

Physical and software firewall

Some of the relevant theories/considerations are: defence in depth: rather than relying only on the fence around your property (the perimeter firewall) to keep all your belongings safe, you also ...
  • 72.5k
2 votes
Accepted

Block attachment files without extensions in Postfix via mime_header_checks?

How about adding /name="[^>]*[^.]{7}"/ REJECT It will match if there is dot anywhere else than for separating the (max. 4 character) extension NAME="=?ISO-8859-1?Q?document?=" NAME="=?ISO-8859-1?...
  • 43.3k

Only top scored, non community-wiki answers of a minimum length are eligible