Crystal Security 3.7 BETA

  • Like
Reactions: stefanos, Overlord, conceptualclarity and 5 others
Petrovic said:
https://www.crystalsecurity.eu/downloads/crystal_security_3.7.0.28_setup.msi - Interactive analysis - ANY.RUN
Click to expand...

Hi @Petrovic

Thank you for the feedback.

Static engine updates information about malware via Feeds. Feeds collects information about malware.
Feed includes hashes and urls but only hashes of malware are stored locally. URLs of malware are only temporarily loaded.
It seems that Any Run service analysis captured temporarily loaded URLs during analysis.

Regards,
Kardo
 
  • Like
Reactions: JM Safe, Petrovic, harlan4096 and 1 other person
  • Like
Reactions: brambedkar59, _CyberGhosT_, vtqhtr413 and 3 others
  • Like
Reactions: brambedkar59, Andrew999, vtqhtr413 and 1 other person
Windows Defender flags the install file as a trojan.
ScreenHunter_134 Dec. 21 16.08.jpg
 
  • Like
Reactions: harlan4096, vtqhtr413, Kardo Kristal and 2 others
ticklemefeet said:
Windows Defender flags the install file as a trojan.
Click to expand...

Hi @ticklemefeet

Thank you for your feedback.

I just tried to check the installer file on my computer and here is clean.
The installer file is not detected by Windows Defender.

Can you please send False Positive report to Microsoft?

Regards,
Kardo
 
  • Like
Reactions: brambedkar59, harlan4096 and vtqhtr413
Kardo Kristal said:
Hi @ticklemefeet

Thank you for your feedback.

I just tried to check the installer file on my computer and here is clean.
The installer file is not detected by Windows Defender.

Can you please send False Positive report to Microsoft?

Regards,
Kardo
Click to expand...

I am on the latest insider update. Maybe that is why. Not sure how to send the file since it deletes it right after download. It delets the install file and the portable file. It does not quarantine it or offer a way to white list the file. This is something you will have to submit to MS I am afraid.
 
  • Like
Reactions: brambedkar59, oldschool, vtqhtr413 and 2 others
ticklemefeet said:
I am on the latest insider update. Maybe that is why. Not sure how to send the file since it deletes it right after download. It delets the install file and the portable file. It does not quarantine it or offer a way to white list the file. This is something you will have to submit to MS I am afraid.
Click to expand...
Are you using any of the Defender tweakers ( Config Defender, NVT OSA, System hardeners)?

It's not starting at boot for me most of the time now since the last few Windows updates?

Windows 7 home 64bit
 
  • Like
Reactions: brambedkar59, stefanos and oldschool
In2an3_PpG said:
@Kardo Kristal

Is the dynamic engine scanning with sources like VT or what does it do?
Click to expand...

Hi @In2an3_PpG

Thank you for your interest. :)

Dynamic engine uses local rules set to identify file status.
Currently there are about 15 different rules in rules set.

Some examples of rules: File signature, file age, extension, location, file visibility...
Dynamic engine does not require database updates and it can work without internet connection.

All data collected in the file is compared with the rules set.
When certain combination of rules are detected then Dynamic engine can determine the file status.

Regards,
Kardo
 
Last edited:
  • Like
Reactions: Fel Grossi, vtqhtr413 and harlan4096
  • Like
Reactions: vtqhtr413 and harlan4096

You may also like...