Reply to thread

Message

<blockquote data-quote="RoboMan" data-source="post: 1049930" data-attributes="member: 53544">Aforementioned, antiviruses have different &quot;capes&quot; of protection to ensure your safety. If it failed to protect you via signature (static detection), and it also failed at file launch (dynamic detection), then there&#039;s still ways it can detect it afterwards. Let me give you an example:Imaginate you executed a malware file that wasn&#039;t on the antivirus database. At first, the malware will be active and working. If it doesn&#039;t behave suspicious at all, chances are it remains undetected. Now the &quot;issue&quot; begins when it starts behaving like a virus, since antivirus monitor files and their actions in look for weird behaviour. <ul>
<li data-xf-list-type="ul">If this malicious file starts screen recording or capturing keys, this will trigger an alert in the antivirus, which will probably check the file for a signature or hash that matches with a screen capturing software, or else possibly flag it as malicious.</li>
<li data-xf-list-type="ul">If this malicious file starts calling back home constantly, sending information from here to there, this will probably trigger the antivirus, whom&#039;s firewall will have detected the destination host or IP as malicious.</li>
</ul>Depending on the antivirus&#039; technology and the way the file is detected, different actions may be taken. For example, internet connection can be shut down for the file, a full system or memory scan may start, or the whole file may be quarantined.About half a year ago, I wasn&#039;t careful and got infected out of stupidy. But the scenario was similar to what I&#039;m describing. Here&#039;s the post on my infection: <a href="https://malwaretips.com/threads/how-i-got-infected-last-time-thread.57614/page-7#post-1015706" target="_blank">How I got infected last time thread</a>You will see that the file was detected due to the internet connections the file established with the host. These connections were blocked by Norton&#039;s Firewall, so no information was stolen... but the main executable creating this connections wasn&#039;t quarantined nor blocked, so it was an endless loop of blocked connections that kept repeating, until I had to find another way to delete the payload.</blockquote>

[QUOTE="RoboMan, post: 1049930, member: 53544"] Aforementioned, antiviruses have different "capes" of protection to ensure your safety. If it failed to protect you via signature (static detection), and it also failed at file launch (dynamic detection), then there's still ways it can detect it afterwards. Let me give you an example: Imaginate you executed a malware file that wasn't on the antivirus database. At first, the malware will be active and working. If it doesn't behave suspicious at all, chances are it remains undetected. Now the "issue" begins when it starts [B]behaving like a virus[/B], since antivirus monitor files and their actions in look for weird behaviour. [LIST] [*]If this malicious file starts [U]screen recording or capturing keys[/U], this will trigger an alert in the antivirus, which will probably check the file for a signature or hash that matches with a screen capturing software, or else possibly flag it as malicious. [*]If this malicious file starts [U]calling back home[/U] constantly, sending information from here to there, this will probably trigger the antivirus, whom's firewall will have detected the destination host or IP as malicious. [/LIST] Depending on the antivirus' technology and the way the file is detected, different actions may be taken. For example,[B] [U]internet connection can be shut down[/U][/B] for the file, a full [U][B]system or memory scan[/B][/U] may start, or the whole file may be [U][B]quarantined[/B][/U]. About half a year ago, I wasn't careful and got infected out of stupidy. But the scenario was similar to what I'm describing. Here's the post on my infection: [URL="https://malwaretips.com/threads/how-i-got-infected-last-time-thread.57614/page-7#post-1015706"]How I got infected last time thread[/URL] You will see that the file was detected due to the internet connections the file established with the host. These connections were blocked by Norton's Firewall, so no information was stolen... but the main executable creating this connections wasn't quarantined nor blocked, so it was an endless loop of blocked connections that kept repeating, until I had to find another way to delete the payload. [/QUOTE]

Verification