App Review AVG vs Symantec Antivirus: This One Cleaned Better

It is advised to take all reviews with a grain of salt. In extreme cases some reviews use dramatization for entertainment purposes.
Content created by
NB Infotech
If a default deny anti-exe like CyberLock or AppGuard would block it. Then I know something bad is happening. No need to question why. No need to wait for detection signatures. CL likes to prompt you. AG just notifies you.

By the way AppGuard does seem to slow down my 2020 laptop.
 
I do not know if as efficient as AppGuard or not.
AG has it's own different logic. It is not reputation based nor signature based. If it runs from a user writable dir it is blocked. If a guarded application like Office or Adobe PDF tries to run it and it attempts messing with memory of another app it is blocked, attempts messing with registry it is blocked. If it uses OS utils the wrong way it is blocked. I am still evaluating it so i don't have all the answers. Hard to say if it is efficient, I does things differently, can't compare apple to orange. Shadowra did a test and it blocked every single one.
 
AG has it's own different logic. It is not reputation based nor signature based. If it runs from a user writable dir it is blocked. If a guarded application like Office or Adobe PDF tries to run it and it attempts messing with memory of another app it is blocked, attempts messing with registry it is blocked. If it uses OS utils the wrong way it is blocked. I am still evaluating it so i don't have all the answers. Hard to say if it is efficient, I does things differently, can't compare apple to orange. Shadowra did a test and it blocked every single one.
Looks very aggressive; the decision depends to what extenst it can impair the usability experience.
 
the decision depends to what extenst it can impair the usability experience.
AG guards applications and stops them from doing harmful things. It does not protect the guarded app itself. The guarded app is stopped from doing harmful things. ChatGPT explains it as stopping the chain at the source. Office and PDF reads untrusted docx and untrusted PDFs, so something has to stop them from being weaponized. If they spawn a child process, that child process is similarly 'contained' - no memory injection, no registry modifcation, no calling OS utils in the wrong way.

I thought I was being smart and since mmc (gpedit.msc, services.msc ...) is a lolbin, I decided to add it to the guarded list. And then run gpedit. And it stopped at several occcasions resulting in 'not working'. So I have to remove it from the guarded list. And then gpedit works perfectly. It behaves differently depending if it was started on its own or started some other way. Danb says Cyberlock also watches the parent process of a process to determine whether it can be allowed to run.
 
Last edited:
A third one not detected even by Symantec, but only by behavioral analysis of VT and sandbox of HA.



Screenshot_4-2-2026_10551_www.virustotal.com.jpeg



Creates a process in suspended mode (likely for process injection)
details"powershell.exe" called "CreateProcessW" with parameter ""%WINDIR%\system32\msiexec.exe" /i "%TEMP%\s1480922090.msi" /qn /norestart" - (UID: 00000000-00005524)
Loads the task scheduler interface DLL
details"Crisp.exe" loaded module "%WINDIR%\SysWOW64\mstask.dll" at 729F0000
Writes data to a remote process
details"powershell.exe" wrote 000011C0 bytes to a remote process "%WINDIR%\System32\msiexec.exe" (Handle: 3192)
"powershell.exe" wrote 00000008 bytes to a remote process "C:\Windows\System32\msiexec.exe" (Handle: 3192)
Uses network protocols on unusual ports
detailsTCP traffic to 178.17.59.26 on port 5506
TCP traffic to 91.84.123.231 on port 3333
TCP traffic to 91.84.123.231 on port 3334
Checks for files associated with bitcoin mining software
details"PlaneV128.exe" opened file "%APPDATA%\Bitcoin"
"PlaneV128.exe" opened file "%LOCALAPPDATA%\Bitcoin"
Tries to steal Crypto currency wallets information (file access)
details"PlaneV128.exe" trying to touch file "%LOCALAPPDATA%\Coinomi\Coinomi\wallets"
"PlaneV128.exe" trying to touch file "%APPDATA%\Electrum\wallets"
"PlaneV128.exe" trying to touch file "%APPDATA%\Exodus\exodus.wallet"
Tries to steal browser sensitive information (file access)
details"PlaneV128.exe" trying to open a file "%APPDATA%\Mozilla\Firefox\Profiles\5xz6ua91.default-release\cert9.db"
"PlaneV128.exe" trying to open a file "%APPDATA%\Mozilla\Firefox\Profiles\5xz6ua91.default-release\compatibility.ini"
"PlaneV128.exe" trying to open a file "%APPDATA%\Mozilla\Firefox\Profiles\5xz6ua91.default-release\key4.db"
"PlaneV128.exe" trying to open a file "%APPDATA%\Mozilla\Firefox\Profiles\5xz6ua91.default-release\cookies.sqlite"
"PlaneV128.exe" trying to open a file "%APPDATA%\Mozilla\Firefox\Profiles\lfdjd4n4.default\cookies.sqlite"
"PlaneV128.exe" trying to open a file "%LOCALAPPDATA%\BraveSoftware\Brave-Browser\User Data"
"PlaneV128.exe" trying to open a file "%LOCALAPPDATA%\CocCoc\Browser\User Data"
"PlaneV128.exe" trying to open a file "%LOCALAPPDATA%\Tencent\QQBrowser\User Data"
"PlaneV128.exe" trying to open a file "%LOCALAPPDATA%\Slimjet\User Data"
"PlaneV128.exe" trying to open a file "%LOCALAPPDATA%\Vivaldi\User Data"
Executes WMI queries in order to detect local security applications
details"PlaneV128.exe" issued a query "SELECT * FROM AntiVirusProduct"