McAfee TP IS - January 2022 Report

[harlan4096]

McAfee TP - January 2022 Report

Due to the small number of samples used in this tests, you should take results with a grain of salt. We encourage you to compare these results with others and take informed decisions on what security products to use.

__

System Status Abbreviations:

P : Protected
NC : Not Clean
I : Infected
E : Encrypted
* : Partially Blocked
* : BB Dynamic Bonus Test (only Behavior Blocker module running)

Second Opinion Scanners Status Abbreviations:

C : Clean
I : Infected

Additional Abbreviations:

WV : WiseVector StopX
HMP : HitManPro
NPE : Norton Power Eraser
EEK: EmsiSoft Emergency Kit
KVRT : Kaspersky Virus Removal Tool

BSR : Before System Reboot
ASR : After System Reboot

January 2022​	Samples Pack​	Static Detection​	Dynamic Detection​	Total Detection​	System Files Encrypted​	2nd Opinion Scanners​	System Final Status​	Thread Link​
04/01/2022​	3​	2 / 3​	1* / 1​	2 + 1* / 3​	No​	C: WV HMP I: NPE KVRT​	BSR: I ASR: NC​	Post#2​
06/01/2022​	2​	0 / 2​	0 / 2​	0 / 2​	No​	C: WV HMP I: NPE KVRT​	BSR: I ASR: I​	Post#3​
13/01/2022​	1​	0 / 1​	0 / 1​	0 / 1​	No​	C: WV EEK I: KVRT​	BSR: I ASR: I​	Post#2​
15/01/2022​	2​	1 / 2​	0 / 1​	1 / 2​	No​	C: WV EEK I: EEK NPE KVRT​	BSR: I ASR: I​	Post#2​
18/01/2022​	1​	0 / 1​	0 / 1​	0 / 1​	No​	C​	P​	Post#3​
21/01/2022​	3​	1 / 3​	0 / 2​	1 / 3​	No​	I​	BSR: I ASR: I​	Post#2​
25/01/2022​	4​	3 / 4​	1 / 1​	4 / 4​	No​	C​	NC​	Post#2​
28/01/2022​	2​	1 / 2​	1 / 1​	2 / 2​	No​	C​	P​	Post#2​
31/01/2022​	5​	0 / 5​	3 + 1* / 5​	3 + 1* / 5​	No​	I​	BSR: I ASR: I​	Post#2​
/01/2022​	-​	/​	/​	/​	No Yes​	C: WV EEK HMP NPE KVRT I: WV EEK HMP NPE KVRT​	P NC I​	Post#​

 

[upnorth]

Great choice @harlan4096 . Looking forward to the results. Last time McAfee was tested :

Malware Hub Report - McAfee Total Protection - September 2020 Report

McAfree Total Protection - September 2020 Report Due to the small number of samples used in this tests, you should take results with a grain of salt. We encourage you to compare these results with others and take informed decisions on what security products to use. __ C: Clean / P: Protected /...

malwaretips.com

 

[harlan4096]

This is a new version, even GUI changed, we will see protection hehe...

 

[WiseVector]

I believe all in-memory threats being detected by KVRT can also be detected by WVSX with memory protection enabled.
WVSX's quick scan can only detect file-based threats but no in-memory threats.

 

[harlan4096]

I already took that for granted, but I'm using in my tests WVSX with all the resident protection modules disabled to not interfere in the dynamic test of the tested product

 

[upnorth]

I believe all in-memory threats being detected by KVRT can also be detected by WVSX with memory protection enabled.
WVSX's quick scan can only detect file-based threats but no in-memory threats.

This needs to be mentioned!

It's not only memory threats. WVSX have not been able to catch dropped payloads that other SOS tools/vendors have. I strongly recommend you check back a few on the latest tests and analyse them. But just as @harlan4096 clearly mentioned and personal I thought was crystal clear, he can not have also WVSX fully enabled when he obviously at the moment is testing McAfee. That's not how testing in the Hub works.

 

[WiseVector]

It's not only memory threats. WVSX have not been able to catch dropped payloads that other SOS tools/vendors have.

That's true.
I said all in-memory threats (MEM:Trojan.Win32.SEPEH by KVRT) but not all threats can be detected .

I strongly recommend you check back a few on the latest tests and analyse them.

I'm a big fan of the tests. I read every post of them.

 

[harlan4096]

Thanks, in future tests, for Second Opinion Scanning, I will enable in WVSX -> Real-Time Deep Memory Inspection and Instruction Traces

Also, Second Opinion Scanning with WVSX, I don't run a Quick Scan (quite slow / time-consuming), but a Selective Scan over system folders:

C:\ProgramData\
C:\Users\

And sometimes some additional folders in C:\ created by malware during dynamic test

 

[harlan4096]

But it's true that for some months since I changed from WVSX 2.73 to 3.x, WVSX in my tests, while SOS, it is getting fewer detections, probably because of a change in the internal structure of WVSX

Probably those 2 mentioned modules (disabled so far) may do the difference, We'll see

 

[WiseVector]

Honestly, the missed samples are scripts in the recent tests. WVSX is not good at static detection of scripts. But the behavior detection can perform pretty well to block malicious scripts.

 

[harlan4096]

Yeah, I know and thought the same

 

[harlan4096]

See my last malware test

 

[upnorth]

Submit samples to Labs for suspected malware detection failure

Submit a sample to Labs if an infected file isn't detected or cleaned.

www.mcafee.com

 

[upnorth]

Last day today for McAfee in the Malware Hub, and personal I would say it looks pretty similar as previous test 2020. The developers has for sure some improvements that needs to be implemented, but hopefully some of the submissions help.

Big thanks @harlan4096 for another great test and well created thread!

Disclaimer!

This test shows how an antivirus behaves with certain threats, in a specific environment and under certain conditions. We encourage you to compare these results with others and take informed decisions on what security products to use. Before buying an antivirus you should consider factors such as price, ease of use, compatibility, and support. Installing a free trial version allows an antivirus to be tested in everyday use before purchase.

 

[harlan4096]

They implemented AMSI, this way now McAfee can detect malicious scripts, but still missing some, room for improvement