Bravo F-secure! (Winner of AV-C Performance Test October 2020)

[upnorth]

Looks like a bug of the removal engine.

Very possible, but also hard to fully investigate as you already uninstalled and can't send any support tool report. If you still have the samples, you can always contribute anyway and help with this possible " bug ". Either send me the hash or submit the samples directly to F-Secure.

 

[SeriousHoax]

Very possible, but also hard to fully investigate as you already uninstalled and can't send any support tool report. If you still have the samples, you can always contribute anyway and help with this possible " bug ". Either send me the hash or submit the samples directly to F-Secure.

I can send you the files in PM if you want to check whether you can reproduce the same bug in your system.

 

[upnorth]

I can send you the files in PM if you want to check whether you can reproduce the same bug in your system.

Please do!

 

[SeriousHoax]

Please do!

I tried to send you a PM but looks like I can't. It doesn't let me.

 

[upnorth]

I tried to send you a PM but looks like I can't. It doesn't let me.

It's a basic account setting, but do like this instead. Post the link in my profile or your own and I'll delete/edit that as soon I have the link.

 

[upnorth]

Followed your instructions and just as you said, F-Secure did delete the file as soon I accessed the folder where I saved it. But, I was very able to not just restore the file, but also exclude it. Simply went to quarantine, and clicked Allowed and F-Secure asked if I really wanted to exclude the file and also allow it to be executed. It was of course not automatic executed/run but when or if I wanted. Refreshed the page where I had the folder and, Voilà the file was back.

 

[SeriousHoax]

Followed your instructions and just as you said, F-Secure did delete the file as soon I accessed the folder where I saved it. But, I was very able to not just restore the file, but also exclude it. Simply went to quarantine, and clicked Allowed and F-Secure asked if I really wanted to exclude the file and also allow it to be executed. It was of course not automatic executed/run but when or if I wanted. Refreshed the page where I had the folder and, Voilà the file was back.

It's a random bug then. Not reproducible every time. Did F-Secure asked for system restart?

 

[upnorth]

It's a random bug then. Not reproducible every time. Did F-Secure asked for system restart?

Nope it didn't and that is not something I personal see or recall much on my own system. Still, it was a interesting test. I'll see if I can find any more information about this possible bug on their forum as normally when it's a general bug, those get report a lot.

 

[SeriousHoax]

Nope it didn't and that is not something I personal see or recall much on my own system. Still, it was a interesting test. I'll see if I can find any more information about this possible bug on their forum as normally when it's a general bug, those get report a lot.

The other one was related to sandboxie driver which was already installed on the system. Since it's a driver with a process that was already running, it probably caused F-Secure to ask for system restart. Then the sample I pointed you out was also detected. So I think you have check the other one to see if the bug happens.

 

[upnorth]

The other one was related to sandboxie driver which was already installed on the system. Since it's a driver with a process that was already running, it probably caused F-Secure to ask for system restart. Then the sample I pointed you out was also detected. So I think you have check the other one to see if the bug happens.

Nah, I'm fine and satisfied enough and as I said, I will check their forum. Thanks anyway.

 

[SeriousHoax]

Nah, I'm fine and satisfied enough and as I said, I will check their forum. Thanks anyway.

Ok, let me know if anyone else want to try this or point them to my comment on how to reproduce this. The sandboxie method is the correct way to test it. I suggested you the wrong method of reproducing. Sorry about that.

 

[SeriousHoax]

Ok I was able to reproduce it again but there's a weird pattern to it that I missed the last time and might be possible to avoid in a different way. But the bug is there. I'll share the details tomorrow.

 

[upnorth]

A small tip! F-Secure even got an official channel for bug reports, except their support.

F-Secure Bug Bounty pays off and pays out more than €100,000 - F-Secure Blog

No software is perfect. Even security applications can have issues that need to be fixed. So four years ago, F-Secure invited security researchers to find vulnerabilities in our products. And the results have paid off for our customers and bug hunters that find and report vulnerabilities...

blog.f-secure.com

Vulnerability Reward Program | F-Secure

www.f-secure.com

Almost forgot one thing! @SeriousHoax , about your upcoming bug test. Create a new thread instead. Point to this with a link if you like.

 

[LDogg]

Aww and I had to uninstall F-Secure because my subscription ran out.

~LDogg