Welcome to nsane.forums

Welcome to nsane.forums, like most online communities you need to register to view parts of our community or to make contributions, but don't worry: this is a free and simple process that requires minimal information. Be a part of nsane.forums by signing in or creating an account.

  • Access special members only forums
  • Start new topics and reply to others
  • Subscribe to topics and forums to get automatic updates

Petrovic

SE Labs: Home Anti-Malware Protection(Oct-Dec 2016)

12 posts in this topic

it looks like a commercial  for paid Antivirus

 

Quote

SE Labs was created by Simon Edwards, the former technical director of the now-defunct Dennis Technology Labs. Simon is also the former chairman of the Anti-Malware Testing Standards Organization (AMTSO), to which SE Labs and Sophos both belong. In other words, he knows a thing or two about testing security products.

 

it the own by the same person who was over the Dennis Technology Labs test before . Any test that scores any Antivirus as 100% is not true all it would take is one 0day malware sample that the engine has no signature for malware too evade them. Even the 1st picture and the 2 picture if you compare them is a oxymoron .

 

i watched a documentary about Stuxnet malware it was very interesting most of the world  was infected with it  and didn't  even know it but lucky for most it was harmless unless it found what it was looking for . check it out it's Alex Gibney's 2016 documentary Zero Days.

Edited by steven36
1 person liked / thanked this

Share this post


Link to post
Share on other sites

still using any of these but 1 of the above is better than using  malwarebytes  here  is a good example

 

Is "2 out of 3" good enough for Anti-Malware?

https://isc.sans.edu/forums/diary/Is+2+out+of+3+good+enough+for+AntiMalware/21485/
https://www.virustotal.com/en/file/8acb71453b9759a64eea060949ad87bae3d6f070b04daf2f70ed124b1a905399/analysis/
https://www.virustotal.com/en/file/f732887b200563bfdd89f516fc30139ea21e8adbd3280df3436c289bc154383a/analysis/
https://www.virustotal.com/en/file/a9b4a38e515ee10e1dc8eda13ac9abd8c11c0eece4ac1cb1c746015d17ff5a0c/analysis/

Proof that using  a Antivirus is better than using those Anti-Malware scammers like SAS and malwarebytes 

 

Also proof you better take these test with a grain of salt. because Trend micro scores 94% and fails to find this Trojan but ones that scored lower in there test found it what's up with that?

Quote

Even if your anti-malware solution doesn't detect the downloader, there is still a chance that it will detect the malware that is downloaded by the JavaScript. This often leads to a false sense of security in that you will see, often multiple times, popups that your anti-malware solution did remove malicious code from your system. But these downloaders can be rather persistent. One sample I looked at yesterday took about 15 minutes, and about a dozen of "malware found" popups, until it finally downloaded a version of Locky that was not detected, and I ended up with another encrypted system.

So what can you do?

 

  • The less malware reaches the user, the better. Filter as much on mail servers and proxies as you can using generic filters ("zipped VBscripts" and the list. We talked about this before).
  • Once you notice a possible infection, NEVER trust anti-malware to clean your system. It is probably best to shut down the system as soon as you notice "malware found" popups. This way, you MAY prevent the final successful install, and you may be able to save some of your files from being encrypted.
  • Just like you should not rely on anti-malware: Blocklists of bad URLs and the like are just as bad (ours included). They will help you in hindsight to figure out who got infected yesterday (or an hour ago if they are good), but they will not consistently prevent exploitation.

 

The issue with anti-malware missing the downloader, and then hoping that the downloaded malware will be detected, isn't new, and going back at least to the famous "WMF" incident more than 10 years ago, when anti-virus was suggested as a mitigation for the vulnerability, even though it didn't detect actual exploitation of the vulnerability but instead only the additional malware downloaded via the exploit. 10+ years later... not much changed.  We are still making it too easy for the bad guys.

Not much has changed  in the last 10 years prevention is best and once you get infected its best too save what you can and reformat  or make back ups and use those but in this day and age  there is Trojan downloaders  that download ransomware   . if you're anti-malware fails to detect the downloader you will be in for a really bad day !

    Edited by steven36

    Share this post


    Link to post
    Share on other sites

    Is it just me to find strange that bitdefender doesn't appear?!

    Edited by TrasMontano
    1 person liked / thanked this

    Share this post


    Link to post
    Share on other sites
    16 minutes ago, TrasMontano said:

    Is it just me to find strange that bitdefender doesn't appear?!

    Neither does Avira.  Strange!

    Share this post


    Link to post
    Share on other sites
    8 hours ago, steven36 said:

    still using any of these but 1 of the above is better than using  malwarebytes  here  is a good example

     

    Is "2 out of 3" good enough for Anti-Malware?

    
    https://isc.sans.edu/forums/diary/Is+2+out+of+3+good+enough+for+AntiMalware/21485/
    
    https://www.virustotal.com/en/file/8acb71453b9759a64eea060949ad87bae3d6f070b04daf2f70ed124b1a905399/analysis/
    https://www.virustotal.com/en/file/f732887b200563bfdd89f516fc30139ea21e8adbd3280df3436c289bc154383a/analysis/
    https://www.virustotal.com/en/file/a9b4a38e515ee10e1dc8eda13ac9abd8c11c0eece4ac1cb1c746015d17ff5a0c/analysis/

    Proof that using  a Antivirus is better than using those Anti-Malware scammers like SAS and malwarebytes 

     

    Also proof you better take these test with a grain of salt. because Trend micro scores 94% and fails to find this Trojan but ones that scored lower in there test found it what's up with that?

    Not much has changed  in the last 10 years prevention is best and once you get infected its best too save what you can and reformat  or make back ups and use those but in this day and age  there is Trojan downloaders  that download ransomware   . if you're anti-malware fails to detect the downloader you will be in for a really bad day !

     

    Why not both?

     

    I run one of those AV's and HitmanPro Alert  both in real time and they seem to compliment each other well.

     

    Of course I think the best way it to just run your browser in a sandbox that is set to delete everything on exit.

    Share this post


    Link to post
    Share on other sites
    9 minutes ago, Cobaltius said:

     

    Why not both?

     

    I run one of those AV's and HitmanPro Alert  both in real time and they seem to compliment each other well.

     

    Of course I think the best way it to just run your browser in a sandbox that is set to delete everything on exit.

    HitmanPro is not running 2 real-times that's just a on-demand scanner there's nothing wrong with getting a second opinion even though ive used hitman pro and malwarebytes for on-demand for years and it never finds nothing but false positives it seems i just been wasting my time. i use NOD32 in real time since 2014 .

    1 person liked / thanked this

    Share this post


    Link to post
    Share on other sites

    I have found over the years that the best AV programs are the ones that have the best heuristics but those are also the ones that produce the most false positives.  Their advantage is they can catch zero day exploits that haven't been coded into their database.  I have used malwarebytes as a one time check and then removed it.  I have also used spybot, superantispyware, and hitman pro to check systems.  The best tool though seems to be combofix.  I have had excellent results with it over the last 10 years or so.  I don't run any AV on my systems because i have them secured to the point that any malware/ransomware is incapable of running on the systems.  I also use virtual machines, sandboxes, and honeypots on my system.  I test my systems monthly against the latest 70-115GB of collected malware that is made available for testing through professional contacts.  Depending upon your level of knowledge on computer security would depend on whether you need an AV program or any other third party program on your system to protect it.  And let's be totally honest, it also depends on how stupid you are to run cracks, keygens, and other possible sources of malware on your system, along with your aptitude to not click links in emails and webpages that you know absolutely nothing about.  And the ultimate stupid action is to run hacked/cracked security software to secure your system.  If there is one program you should buy it is your security software.

     

    19 hours ago, steven36 said:

    i watched a documentary about Stuxnet malware it was very interesting most of the world  was infected with it  and didn't  even know it but lucky for most it was harmless unless it found what it was looking for . check it out it's Alex Gibney's 2016 documentary Zero Days.

     

    I am thoroughly familiar with stuxnet and this documentary has a lot of speculation and false information in it that is presented as fact because the fact is that data is still classified and if it was presented in a documentary he and his source could be prosecuted.

    2 people liked / thanked this

    Share this post


    Link to post
    Share on other sites
    10 hours ago, steven36 said:

    HitmanPro is not running 2 real-times that's just a on-demand scanner there's nothing wrong with getting a second opinion even though ive used hitman pro and malwarebytes for on-demand for years and it never finds nothing but false positives it seems i just been wasting my time. i use NOD32 in real time since 2014 .

     

    Not Hitman pro, it is Hitman Pro Alert which is a real time scanner https://www.hitmanpro.com/alert.aspx 

    Share this post


    Link to post
    Share on other sites
    53 minutes ago, Cobaltius said:

     

    Not Hitman pro, it is Hitman Pro Alert which is a real time scanner https://www.hitmanpro.com/alert.aspx 

    well i never used  it so i couldn't tell you ether way to be honest  . it's kind of hard  for me to have a opinion on something i never used because dont have any history with it  ..

    1 person liked / thanked this

    Share this post


    Link to post
    Share on other sites

    I constantly get emails to click on fedex and facebook..neither which I use.Common sense prevails for me and should for all.Its a pity fu88ked up humans want to hurt others.

    Share this post


    Link to post
    Share on other sites

    Create an account or sign in to comment

    You need to be a member in order to leave a comment

    Create an account

    Sign up for a new account in our community. It's easy!


    Register a new account

    Sign in

    Already have an account? Sign in here.


    Sign In Now