App Review [Battle Test] Final Battle Antivirus vs Ransomware (Manzaitest)

[MisterToto]

What a surprise concerning Norton and Comodo but I have to tell RMG152 he may be right
By the way, great review, can't wait to see more =)

 

[Manzai]

I don't understand french, but i think you use this settings:

Norton: Max settings.
BitDefender: Medium settings.
Emsisoft: Medium settings.
Qihoo: Medium settings (in this case i think it's good decision).
Trend micro: Medium++ settings.
Comodo: default? settings.
Tiranium ¿?.

Why using different configurations that can benefit a product or another?


PD: Good job, though I think it has not followed the correct methodology to obtain clear results in this test (besides what the commented settings)

Norton => SONAR
Bitdefender => The medium is sufficient (if not false positive)
Emsisoft => No configuration is necessary
TrendMicro => Extreme Sensibility
Comodo => Default Setting with Sandbox
Tiranium => Default

 

[omidomi]

congrate to all winner!
Good test manzai thank you!

 

[Mere]

That was awesome Test.

 

[tonibalas]

again manzai what a great review. i enjoy watching your videos and i can't wait for the next one.keep up the great work

 

[frogboy]

Great test just fantastic work.

 

[Neno]

I never liked one of your tests. So much (intentional) flaws.

 

[Manzai]

I never liked one of your tests. So much (intentional) flaws.

One explanation is better no ? ^^

 

[Fabian Wosar]

The test would have been more interesting if you had used actual ransomware.

 

[nsm0220]

The test would have been more interesting if you had used actual ransomware.

oh bo ho you are just upset that your BB fail that test and anyone can make ransomware you know. you should know that no av is foolproof.

 

[Manzai]

The test would have been more interesting if you had used actual ransomware.

Hello Emsisoft

I acknowledge that Emsisoft is a good product, but in my testing, it did not block Orion Ransomware.

I tell you, Ransomware connects to a remote host and downloads a file named "dontclose.exe." Emsisoft BB did not block all actions.

Then anyone with knowledge can encode malware few clicks. Emsisoft MUST block block any malicious software coded by a hacker or script kiddies.

 

[Fabian Wosar]

oh bo ho you are just upset that your BB fail that test and anyone can make ransomware you know.

Yeah, except that the file shown here is not ransomware. The window that is being displayed isn't even always on top and you can happily continue to use other applications. I get that the intent is to mimic a screen locker, but where is the actual screen lock for example?

I tell you, Ransomware connects to a remote host and downloads a file named "dontclose.exe." Emsisoft BB did not block all actions.

A behavior blocker is not intended to block all actions but to block malicious actions. The last Orion "ransomware" sample you shared was literally a .NET application with a normal form containing a background image combined with a #####ed up attempt to close certain processes running in the background. Why just an attempt? Because the author of the malware "forgot" that string comparisons are case sensitive and requesting active processes via WMI may return process names in inconsistent cases. There is no input blocking going on, no always on top windows, no attempt to process payments, no attempt to create and switch to a new desktop, not even input controls to type in an unlock code. You know, stuff that would be present if this would have been actual ransomware. Stuff a behavior blocker would look for to figure out whether the file is malicious or not. That is all missing from the Orion "ransomware" v3 sample you shared and apparently continues to be missing in the new version as well. But feel free to send me the new version as well. I will happily point out why it isn't malware .

Emsisoft MUST block block any malicious software coded by a hacker or script kiddies.

You are correct, we must block malicious software. The file you tested with is just not malicious. That is why I mentioned the test would be more interesting if you would choose to use actual ransomware, as the file you tested with clearly isn't.

 

[Dubseven]

I have tested myself the ransomware called "Orion" after the tests.
The file put a start-up key and kill with a defined timer interval the explorer.
A file that computer newbies will not know how to stop and the malicious program start-up all times with Windows.
This means, it's malicious.

I'm okay with you, it's not really a ransomware but more a screen-locker / home made malware. A screen-locker is malicious too.
And the activities and behavior are most like same a bit within ransomware and screen-locker malware.


Regards,

 

[Fabian Wosar]

The file put a start-up key and kill with a defined timer interval the explorer.

It attempts to kill. But the function is messed up in version 3.0 and given the fact that explorer.exe clearly continues to run in the VM as can be seen in the video it still is. Otherwise there wouldn't have been a taskbar anymore.

A file that computer newbies will not know how to stop and the malicious program start-up all times with Windows.

Yeah, right clicking the icon in the taskbar and selecting close is clearly too hardcore unless you are a professional.

I'm okay with you, it's not really a ransomware but more a screen-locker / home made malware. A screen-locker is malicious too.

Screenlockers are just a sub-type of ransomware. I still don't see the screen locking aspect though given that the window isn't even always on top and you can just Alt + Tab out of it. But that must be too hardcore as well?

 

[Neno]

Manzai tests are useless. And that is my last comment on them.

 

[Dubseven]

@Fabian Wosar We were probably not talking about the same malware.
I'm talking about the last Orion version that's working well and that you can't pass away with Alt + Tab.

@Neno Maybe you can respect his hard work a bit?
Lot of installations/uninstallations , lot of malware fiding time and recording and editing and uploading.

You can think that is useless but i can see the work that he put on this vidéos. This means, you can respect this work a bit.

 

[Fabian Wosar]

@Fabian Wosar We were probably not talking about the same malware.
I'm talking about the last Orion version that's working well and that you can't pass away with Alt + Tab.

As I mentioned before, I only ever got one sample for V3 which was a joke. But just judging by the video most of the flaws are still present. Explorer still running, no input blocking, etc.. Those details may not matter for a sandbox or a simple HIPS, but they do for a behavior blocker.

 

[Fabian Wosar]

Manzai tests are useless. And that is my last comment on them.

I wouldn't go that far. He clearly puts a lot of time into his videos. I just don't understand why he sometimes chooses not to go with actual malware but instead chooses to use some leaktest-like test tools instead. It's not like there aren't dozens of new Critroni and CryptoLocker copycats every day that could be used for testing.

 

[Sasa]

Manzai tests are useless. And that is my last comment on them.

Talk about yourself and dont be rude

 

[Neno]

Talk about yourself and dont be rude

I am not being rude at all. That is a summary of his tests. Last 5 are not the only flawed ones.