Reply to thread

Message

<blockquote data-quote="cruelsister" data-source="post: 985831" data-attributes="member: 7463">As Scripts have been mentioned above I thought it would be nice to get an idea of the relative efficacy of these (from the poll) scanners versus some old wormy standards. In order to do so I infected a Windows 11 x64 system with 7 worms, one of which will spawn a malicious executable, whereas the others just hang out in Local or Roaming with simple registry startup entries to propagate themselves on reboot.So the point of this (very, very simple) 2nd opinion scanner test would be to determine if any detections are made on initial scan, then analyze the system on reboot to see if any worms are still extent, followed by a 2nd scan, reboot, then final manual analysis.Results- of these scanners, all detected and eradicated the malicious exe file. All but HMP/Sophos Scan&amp;Clean (yes, I actually tested both) found some of the persistence entries.So, out of 7 infections:1). HMP/Sophos):&nbsp; 1/72). MB- 2/73). ESET- 1/74). EEK- 3/75). NPE- 7/76). KVRT- 7/7For the persistence registry entries, only NPE (1 detection and deletion) and KVRT had any effect on these. KVRT actually detected and deleted all, so was the only one that left the system pristine.Note that using other Scriptors with different mechanisms would no doubt give somewhat different results, but I am hoping that one will get a feel for how these guys work.</blockquote>

[QUOTE="cruelsister, post: 985831, member: 7463"] As Scripts have been mentioned above I thought it would be nice to get an idea of the relative efficacy of these (from the poll) scanners versus some old wormy standards. In order to do so I infected a Windows 11 x64 system with 7 worms, one of which will spawn a malicious executable, whereas the others just hang out in Local or Roaming with simple registry startup entries to propagate themselves on reboot. So the point of this (very, very simple) 2nd opinion scanner test would be to determine if any detections are made on initial scan, then analyze the system on reboot to see if any worms are still extent, followed by a 2nd scan, reboot, then final manual analysis. Results- of these scanners, all detected and eradicated the malicious exe file. All but HMP/Sophos Scan&Clean (yes, I actually tested both) found some of the persistence entries. So, out of 7 infections: 1). HMP/Sophos): 1/7 2). MB- 2/7 3). ESET- 1/7 4). EEK- 3/7 5). NPE- 7/7 6). KVRT- 7/7 For the persistence registry entries, only NPE (1 detection and deletion) and KVRT had any effect on these. KVRT actually detected and deleted all, so was the only one that left the system pristine. Note that using other Scriptors with different mechanisms would no doubt give somewhat different results, but I am hoping that one will get a feel for how these guys work. [/QUOTE]

Verification