Reply to thread

Message

<blockquote data-quote="SeriousHoax" data-source="post: 971130" data-attributes="member: 78686">1) I tested Avira Free against a MBR destroyer. Avira already had an offline signature for it, but for some reason didn&#039;t detect the file itself before or after execution. But stopped two exe files that the malware spawned. Malware couldn&#039;t write to MBR but still managed to damage the system somehow as the system became unresponsive. Restaring the system didn&#039;t fix it either. This was a weird behavior.2) Avira is not so good at malware removal. Looks like it can&#039;t delete malware associated scheduled task and registry entries. At least its real time protection can&#039;t. Either it doesn&#039;t have a correlation engine, or what it has is very weak and basic, like the other two products I&#039;m about to mention below. I tested some AV product&#039;s removal ability on an already infected system. I infected the system with a SmokeLoader malware. The malware created an entry in the roaming folder, created a scheduled task and a couple of registry entries associated with it, and was calling home to a malicious domain via explorer.exe.Avira, ESET, F-Secure only detected the infected file in the roaming folder when I tried to access it but didn&#039;t remove the scheduled task and registry entries associated with it. ESET and F-Secure (and BD, Avast, K) were able to detect and block the malicious connection made via explorer.exe as both products have system-wide web protection which Avira doesn&#039;t (F-Secure can&#039;t detect HTTPS connection outside the browser, only HTTP). Since they couldn&#039;t delete the malware properly, the malware kept coming back.Kaspersky, Microsoft Defender, Avast/AVG, Bitdefender, Norton were able to remove the malware related scheduled task. Microsoft Defender and Kaspersky also removed two additional registry entries connected to the malware. Maybe Avast, Bitdefender and Norton did too, but I forgot to check. Removing the scheduled task was enough to get rid of the malware persistency (I&#039;m not a malware analyst BTW, so I could be wrong about this).Avira is light and it&#039;s pretty good. Lighter than F-Secure in system impact and ram usage, since it doesn&#039;t have anything like DeepGuard. Malware prevention is the key so malware removal isn&#039;t prioritized nowadays in home products. But if you use such an AV, then keep a capable seconds opinion scanner like Kaspersky Virus Removal Tool (The best) just in case. Specially if someone else like kids use your PC.</blockquote>

[QUOTE="SeriousHoax, post: 971130, member: 78686"] 1) I tested Avira Free against a MBR destroyer. Avira already had an offline signature for it, but for some reason didn't detect the file itself before or after execution. But stopped two exe files that the malware spawned. Malware couldn't write to MBR but still managed to damage the system somehow as the system became unresponsive. Restaring the system didn't fix it either. This was a weird behavior. 2) Avira is not so good at malware removal. Looks like it can't delete malware associated scheduled task and registry entries. At least its real time protection can't. Either it doesn't have a correlation engine, or what it has is very weak and basic, like the other two products I'm about to mention below. I tested some AV product's removal ability on an already infected system. I infected the system with a SmokeLoader malware. The malware created an entry in the roaming folder, created a scheduled task and a couple of registry entries associated with it, and was calling home to a malicious domain via explorer.exe. Avira, ESET, F-Secure only detected the infected file in the roaming folder when I tried to access it but didn't remove the scheduled task and registry entries associated with it. ESET and F-Secure (and BD, Avast, K) were able to detect and block the malicious connection made via explorer.exe as both products have system-wide web protection which Avira doesn't (F-Secure can't detect HTTPS connection outside the browser, only HTTP). Since they couldn't delete the malware properly, the malware kept coming back. Kaspersky, Microsoft Defender, Avast/AVG, Bitdefender, Norton were able to remove the malware related scheduled task. Microsoft Defender and Kaspersky also removed two additional registry entries connected to the malware. Maybe Avast, Bitdefender and Norton did too, but I forgot to check. Removing the scheduled task was enough to get rid of the malware persistency (I'm not a malware analyst BTW, so I could be wrong about this). Avira is light and it's pretty good. Lighter than F-Secure in system impact and ram usage, since it doesn't have anything like DeepGuard. Malware prevention is the key so malware removal isn't prioritized nowadays in home products. But if you use such an AV, then keep a capable seconds opinion scanner like Kaspersky Virus Removal Tool (The best) just in case. Specially if someone else like kids use your PC. [/QUOTE]

Verification