App Review Second Opinion Scanners- Part 1

[cruelsister]

Content source

https://www.youtube.com/watch?v=9mUk9ihpd4U&t=314s

Tested are Malwarebytes (free), Sophos Scan & Clean (a free version of HitManPro), and Emsisoft Emergency Kit against a couple of malware files with common dropping and persistence techniques.

 

[Thales]

What scanners will be in the second part?

 

[brambedkar59]

What scanners will be in the second part?

NPE/KVRT most likely.

 

[Stopspying]

Sophos Scan and Clean asks for a business address email before you can download it.

 

[Jan Willy]

The thread of (many?) lost illusions.

 

[eonline]

Sophos Scan and Clean asks for a business address email before you can download it.

I could download it without any problem using a common email.
I really did not know that there was this free disinfection tool, which is seen in the video, has to improve.

 

[Petrovic]

it`s not correct test
no detection (cloud, signature) from dropped file - not perform decently.
this scanners based on cloud, signature based. not a behavior
for undetected malware need to use other tools (autoruns, etc....)

 

[upnorth]

@cruelsister , a small headsup. I'm surprised no one has mentioned this. It's just basic help anyway.

The video link has by accident been copied wrong as it autostart on 05:14, and I strongly doubt that is what you want?

 

[plat]

When somebody says "all at defaults, not that this matters" (@0:45 in video), you already suspect the outcome. aka: lousy.

 

[Andrezj]

typical user runs scan, it returns no findings, user thinks system is safe
security software can not compensate for what a user does not know

 

[cruelsister]

@cruelsister , a small headsup. I'm surprised no one has mentioned this. It's just basic help anyway.

The video link has by accident been copied wrong as it autostart on 05:14, and I strongly doubt that is what you want?

YIKES!!!! Thank you for the correction!

 

[cruelsister]

typical user runs scan, it returns no findings, user thinks system is safe
security software can not compensate for what a user does not know

Well said! Like UAC, Windows firewall, WD, this group of things belong to what one can term "feel good" security. Running them makes one feel safe but actually they are doing much, much less than what is the common assumption. They are actually dangerous because one may still "feel good" while actually have a terminal disease.

 

[Stopspying]

I could download it without any problem using a common email.
I really did not know that there was this free disinfection tool, which is seen in the video, has to improve.

Thanks for this post, it convinced me to investigate further.

I'd seen the 'business address email' notification in the past when I'd tried to download Sophos Scan & Clean, so I tried again today using a Yahoo email that I use for unimportant registrations, sign-ups etc and I got the same result, as the screenshot shows. Then I made another attempt to download it with another personal email address and a VPN using a USA server, this also resulted in the same 'business' email issue failure. I'm in the UK BTW. So I tried again, with a different personal email address and using a VPN to suggest that I'm in Argentina ;-) Hey ho, result, thanks. Now I can scan using Sophos Scan & Clean knowing that I'll get a clean bill of health thanks to cruelsister's research!

Ssshh, don't tell Sophos!

Edit - I should have stated that the business email issue may arise due to the "End user Terms of Use & Export Compliance" regulations.

​

 

[goodjohnjr]

Sophos Scan and Clean asks for a business address email before you can download it.

That is annoying / unnecessary of Sophos, try this link: Cybersecurity Delivered | Sophos Security Solutions

 

[Stopspying]

That is annoying / unnecessary of Sophos, try this link: Cybersecurity Delivered | Sophos Security Solutions

Thanks, but clicking through from the landing page took me to the same page that I screenshot above, with the same demand for a business address email. I don't know if the email thing is a location-based demand or not. If others find the same problem the VPN route might be their best bet too.

 

[Digmor Crusher]

Just wondering, if EEK didn't do that well does this mean that the protection level in Emsisoft AV is not that great as well??

 

[eonline]

Thanks, but clicking through from the landing page took me to the same page that I screenshot above, with the same demand for a business address email. I don't know if the email thing is a location-based demand or not. If others find the same problem the VPN route might be their best bet too.

End User Terms of Use & Export Compliance

Sophos export compliance check

download.sophos.com

Let's see if you can download it from this link, fingers crossed.

 

[Kongo]

Just wondering, if EEK didn't do that well does this mean that the protection level in Emsisoft AV is not that great as well??

No, that's defenitely the wrong conclusion. EEK only does static scanning without using any of EAM behavioural protection components. Most AV's rely a lot on their behavioural or AI capabilities to detect and block scripting malware.

 

[oldschool]

Just wondering, if EEK didn't do that well does this mean that the protection level in Emsisoft AV is not that great as well??

See @Petrovic post #7 above.

 

[goodjohnjr]

Thanks, but clicking through from the landing page took me to the same page that I screenshot above, with the same demand for a business address email. I don't know if the email thing is a location-based demand or not. If others find the same problem the VPN route might be their best bet too.

Interesting, I tried it with my Gmail account, and it worked; but I was using a paid VPN for the first time, in my case AdGuard VPN.

If you do want the Sophos Scan & Clean file, maybe I can send it to you somehow, or perhaps you will decide to use Norton Power Eraser and / or ESET Online Scanner and / or Malwarebytes AdwCleaner instead.