Reply to thread

Message

<blockquote data-quote="cruelsister" data-source="post: 759946" data-attributes="member: 7463">Hi Guys!- I have to be REALLY careful with this post otherwise I&#039;ll be getting a bunch of &quot;Number 1 Fangirl&quot; t-shirts in the mail.1). The points made above regarding the sandbox flush prior to do a 2nd opinion scan are valid. 2). Would have been nice to see MSCONFIG entries.3). Would have been nice if the &quot;malware&quot; used in the test was verified. Personally I&#039;m not impressed with numbers- Quality over Quantity is always the best option.4). Notice Malware(384) and mdscsfud.exe are identical. It seems to be this one:&nbsp;<a href="https://www.virustotal.com/#/file/0378791da283849a537ac8925c2609b3fa660c0ed64d59e8e64fb6bfa6a4be2f/details" target="_blank">VirusTotal</a>Something that was first seen in 2010 and last scanned in 2014 (I guess it is a plus that it at least zero-decade). It seems to have been a Windows Desktop Widget, and sadly I can&#039;t find this file anywhere. IF it is indeed a Widget, sandbox at PL may have allowed the drop to Appdata (kind of like something changing the Desktop Wallpaper). I would have loved to see if that guy would have restarted after a reboot.5). And Finally, Leo sould know that neither HMP nor MB will pick up worms. Some manual analysis would have been nice.</blockquote>

[QUOTE="cruelsister, post: 759946, member: 7463"] Hi Guys!- I have to be REALLY careful with this post otherwise I'll be getting a bunch of "Number 1 Fangirl" t-shirts in the mail. 1). The points made above regarding the sandbox flush prior to do a 2nd opinion scan are valid. 2). Would have been nice to see MSCONFIG entries. 3). Would have been nice if the "malware" used in the test was verified. Personally I'm not impressed with numbers- Quality over Quantity is always the best option. 4). Notice Malware(384) and mdscsfud.exe are identical. It seems to be this one: [URL="https://www.virustotal.com/#/file/0378791da283849a537ac8925c2609b3fa660c0ed64d59e8e64fb6bfa6a4be2f/details"]VirusTotal[/URL] Something that was first seen in 2010 and last scanned in 2014 (I guess it is a plus that it at least zero-decade). It seems to have been a Windows Desktop Widget, and sadly I can't find this file anywhere. IF it is indeed a Widget, sandbox at PL may have allowed the drop to Appdata (kind of like something changing the Desktop Wallpaper). I would have loved to see if that guy would have restarted after a reboot. 5). And Finally, Leo sould know that neither HMP nor MB will pick up worms. Some manual analysis would have been nice. [/QUOTE]

Verification