AV testing!

omidomi

omidomi

Level 71
Thread author
Verified
Honorary Member
Top Poster
Malware Hunter
Well-known
Forum Veteran
Apr 5, 2014
6,017
43,487
6,988
32
Fallout New Vegas :D
I find a tool in Github whom Test your AV Vulnerability here:
BreakingMalware/AVulnerabilityChecker · GitHub
i want all member test it with their AVs to see which program is vulnerable and which one is no vulnerable, I test EIS its safe.
stay for your test :)
*These avs pass the test successfully:
Windows Defender
Avira AV Pro + Firefox = not vulnerable
Norton
Emsisoft
Kaspersky
Watchdog anti malware
Eset
Qihoo
Sophos
AVG
Bitdefender
Firefox + Webroot = Passed
Firefox + Avira Pro = Passed
Agnitium
Secure Alive
McAfee
Avira AV Pro + HitmanPro.Alert + Firefox
Avira AV Pro + HitmanPro.Alert + Chrome
*These avs failed in the test :
Chrome + Webroot = Failed
Avira AV Pro + Chrome
Chrome + Avira Pro
Baidu
Bitdefender Internet Security 2016
Trend Micro
Avast
Bullgaurd
 
Last edited:
  • Like
Reactions: AtlBo, JM Safe, bitbizket and 15 others
Piteko21 said:
I can run this tool, safely and normaly, on my personal laptop without any virtualization software?
Click to expand...
its better use virtualization software(may be 0.0000000001% damage your system) but i test it without any virtualization software and do't have any problem :D
 
  • Like
Reactions: LabZero, Der.Reisende, Rishi and 4 others
Piteko21 said:
I can run this tool, safely and normaly, on my personal laptop without any virtualization software?
Click to expand...

Personally I've always run tools like this in a VM (which I already did). Mostly due to paranoia and I like to test tools like this with multiple AV and a VM is the best way to do that. I haven't seen this tool do anything negative to the system but then again, I didn't check the system beyond memory via task manager. Run it on your host at your own risk. I personally don't recommend it. VM is a nice controlled/sterile environment to run these test so nothing else gets in the way and alters tests.
 
  • Like
Reactions: Oxygen, LabZero, Hangtooth and 6 others
It marks me as safe,and I ran it normally. I am not really sure if it's a good idea to run it in VMs(it checks for repetitive memory allocation addresses).But you can for safety. See GoogleProjectZeroBlog.Eset used to have a packer vulnerability, fixed earlier in July 2015 according to this,fixed within 2 days :).

2015_12_11_18_48_21_Untitled.jpg


Pale Moon is not detected by the exploit scanner(awesome), must use the big three. I had used IE 11.
 

Attachments

  • upload_2015-12-11_18-57-31.png
    upload_2015-12-11_18-57-31.png
    81.1 KB · Views: 515
Last edited:
  • Like
Reactions: frogboy, bitbizket, LabZero and 7 others
Rishi said:
It's safe for me, and you can run it normally, I am not convinced it's a good idea to run it in VMs(it checks for repetitive memory allocation addresses. See GoogleProjectZeroBlog.Eset used to have a packer vulnerability, fixed earlier in July 2015 according to this,within 2 days :).

2015_12_11_18_48_21_Untitled.jpg


Pale Moon is not detected by the exploit scanner(awesome), must use the big three. I had used IE 11.
Click to expand...

The test works fine in a VM. I used an AV that was vulnerable (Webroot), and one that wasn't (Windows Defender). Ran the test multiple times to make sure I got the same result using both IE 11 and Google Chrome.
 
  • Like
Reactions: Hangtooth, Der.Reisende, kev216 and 2 others
OokamiCreed said:
The test works fine in a VM. I used an AV that was vulnerable (Webroot), and one that wasn't (Windows Defender). Ran the test multiple times to make sure I got the same result using both IE 11 and Google Chrome.
Click to expand...
Could you try Kaspersky and SOPHOS as mentioned in that blog? Or any generous forum member blessed with a powerful VM and some spare time.
 
Last edited:
  • Like
Reactions: Der.Reisende, OokamiCreed, kev216 and 1 other person
Tested on VM with outdated IE 8 which turn out to be not vulnerable to exploitable constant RWX address, guess seems it should depends on the programs that can be alongside for that as mentioned where some AV's contains security risks.
 
  • Like
Reactions: Kent, Hangtooth, Sr. Normal and 5 others
Rishi said:
Could you try Kaspersky and SOPHOS as mentioned in that blog? Or any generous forum member blessed with a powerful VM and some spare time.
Click to expand...
Taken from: Kaspersky Vulnerability Report 22th September:
Description

Kaspersky Lab has fixed vulnerability in Kaspersky Anti-Virus which allowed for allocation of RWX memory regions at predictable addresses. This vulnerability could have been exploited only if a 3rd party application contained vulnerability such as stack based buffer-overflow. CVSS score of this vulnerability is 1.9 (AV:L/AC:M/Au:N/C: p /I:N/A:N)
List of affected products
Kaspersky Anti-Virus 2015 MR2
Kaspersky Internet Security 2015 MR2
Fixed Versions
The fixes are included in the autoupdated patch for latest products versions that was released on 22 Sep. Please update latest products versions.
Acknowledgments
We would like to extend our thanks to enSilo company for reporting this vulnerability to Kaspersky Lab.
Click to expand...
 
  • Like
Reactions: Cats-4_Owners-2, Sr. Normal, Der.Reisende and 4 others
You must log in or register to reply here.

You may also like...