Well... looking at that screen, I don't think this is guaranteedJust as long as they do not classify VS as BlackMagic, I will be happy.
ClipBanker and SAP are like the sun and the moon.
Any real-time software that uses non-traditional ways to find malware?
- Thread starter Nagisa
- Start date
Please provide comments and solutions that are helpful to the author of this topic.
ClipBanker and SAP are like the sun and the moon.
In that case, I would consider it to be malware rather than a PUP.
I think this might be helpful:
I'll try execute some of the PUPs in this archive, as I am curious.
So, after a scan 15 files were left, 110 were removed.
I tried to execute them, only 3 seem to be working:
One of them is scam software (Re-image).
Everything else crashes immediately.
I'll try execute some of the PUPs in this archive, as I am curious.
So, after a scan 15 files were left, 110 were removed.
I tried to execute them, only 3 seem to be working:
One of them is scam software (Re-image).
Everything else crashes immediately.
Last edited by a moderator:
- May 31, 2017
- 1,742
This is not surprising... the 94 out of 125 files that WV classified as malicious were not filtered or inspected in anyway... I simply counted them as a correct verdict. However, I inspected the files that WV missed to ensure they were 1) valid executables and 2) malicious, and this was after I scanned the malpack for duplicates. This actually works in WV's favor, but I believe it is the only fair way to run the test. So the test was not up to lab standards, but it was pretty close
. But anyway, this would explain why some of the files are not valid executables (and did not execute). Basically, they are files that WV determined to be malicious and I counted them as a correct verdict without inspecting them further.BTW, just curious, are they crashing with or without SBIE?
- Dec 3, 2018
- 63
Have you heard about our Lord and Savior, Webroot? Well, let me tell you about the non-traditional way to salvation!
(I'm sorry, I could not resist the temptation!)
(I'm sorry, I could not resist the temptation!)
- Mar 16, 2019
- 3,878
I also downloaded these samples and tested WD, AVG and Emsisoft. WD has the highest detection rate among this, followed by Emsisoft and AVG. It detected 119 out of 125, 6 files were left. So, 95.2% detection. The PUP's are classified accurately as well. After checking on VT, it seems even overall among all the big guns WD has the best detection rate for this pack. These are very old samples though, from 2017.
Last edited by a moderator:
- Apr 28, 2015
- 8,951
Tested KTS2021MR2 with that 125 samples pack, result: 111 / 125 (88,8%, 14 samples remaining)...
Last edited:
- Aug 21, 2018
- 505
Some results that i've done:
Malwarebytes Free: 118 out of 125
Avast Premium: 132 out of 125 <---
G Data AV: 115 out of 125
FortiClient: 88 out of 125 <---
Kind regards,
-sepik
Malwarebytes Free: 118 out of 125
Avast Premium: 132 out of 125 <---
G Data AV: 115 out of 125
FortiClient: 88 out of 125 <---
Kind regards,
-sepik
My test was with AVG earlier and 15 files remained, not sure how many remain now. Some of them may have matched more than one signature.Some results that i've done:
Malwarebytes Free: 118 out of 125
Avast Premium: 132 out of 125 <---
G Data AV: 115 out of 125
FortiClient: 88 out of 125 <---
Kind regards,
-sepik
- Mar 16, 2019
- 3,878
Don't look at the numbers in the scan window. Check how many files are left behind. Btw, I did submit undetected samples to Avast. So some change may happen.
Same here.
- Mar 16, 2019
- 3,878
After on demand scan without execution? Since when Comodo started to have good signatures!
Most of the files remaining after AVG scan won't execute, with the exception of few that look like Chinese/Turkish game clients and might not even be a PUP (just like SAP is far cry from ClipBanker). One was removed by IDP (Behavioural Blocker), majority just gives an error on execution.After on demand scan without execution? Since when Comodo started to have good signatures!
COMODO uses reputation, doesn't it?
Last edited by a moderator:
- Mar 16, 2019
- 3,878
Right. I noticed that too. Since these are very old samples, all AVs I think detected the obvious malicious/pup samples. The remainders are either broken or not worthy enough for them to create signatures. Some products are more or less aggressive about PUPs hence the difference.
One of them is a fully legit, but not too popular game client, named Alawar: Alawar - Wikipedia
That wasn't in the sample, Alawar is the name of my virtual pc
I know that company from some arkanoid games i played long time ago.Yeah, I noticed that after I posted. Your user account name is AlawarThat wasn't in the sample, Alawar is the name of my virtual pc
- Mar 9, 2014
- 617
I think several have been using behavior blocking, etc.
Yeah, almost all, but that’s been around for ages now. Not sure if it can be considered non-traditional
Similar threads
