App Review ESET Online Scanner vs Malware

[cruelsister]

Content source

https://youtu.be/UaVXo7zldWM

 

[ZeroDay]

Thanks for the test. I honestly thought ESET would have done a better job.

 

[ErzCrz]

Wow, I had expected better results. I wonder how Microsoft Defender scan would have fared. Great video as always

 

[Moonhorse]

So emsi, eset, f-secure as second opinion scanners arent doing job that well

I feel like norton power eraser is the only option to go with , until cruel posts his next video

 

[Stargazer_Steve]

I still use Hitman Pro scanner occasionally, is that not reccomended these days?

 

[cartaphilus]

I still use HMP myself. The creators themselves even stated that they focus on specific malware for their scanner so it's not wholly inclusive.

I don't use eset online scanner because I run eset but damn that's a horrid result. Goes to show how important are the deep OS hooks that online scanners can't get.

As a side note. Today I learned that Karen is an actual real language and not something entitled people speak when wanting to talk to the manager.

 

[Freki123]

I feel like norton power eraser is the only option to go with , until cruel posts his next video

You could also try KVRT.

 

[cruelsister]

I still use Hitman Pro scanner occasionally, is that not reccomended these days?

Just like Malwarebyes, HitManPro (or Sophos Scan&Clean) are horrible against non-exe types infections (Scriptors). Personally I find these to be a total waste of time to use.

 

[Stargazer_Steve]

Just like Malwarebyes, HitManPro (or Sophos Scan&Clean) are horrible against non-exe types infections (Scriptors). Personally I find these to be a total waste of time to use.

Good to know, thank you!

 

[cruelsister]

You could also try KVRT.

Actually I'm just preparing a KVRT video. As K laughs at the malware used in this video, My cat suggested a different type of malware be used.

 

[cartaphilus]

Just like Malwarebyes, HitManPro (or Sophos Scan&Clean) are horrible against non-exe types infections (Scriptors). Personally I find these to be a total waste of time to use.

Eh, since I have HMPA installed the scan only takes about 1 min so a nice third opinion. But yeah it's a glorified cookie finder

 

[Xeno1234]

Actually I'm just preparing a KVRT video. As K laughs at the malware used in this video, My cat suggested a different type of malware be used.

Very interested to see the KVRT Disinfection Process. I know Kaspersky uses advanced disinfection which im pretty sure is the best disinfection, but I dont think KVRT has that.

 

[N31R]

Very interested to see the KVRT Disinfection Process. I know Kaspersky uses advanced disinfection which im pretty sure is the best disinfection, but I dont think KVRT has that.

KVRT has a bit more limited advanced disinfection. Once the advanced disinfection starts, it will prevent any executables from starting and will delete files and associated registry entries from the system. However, it doesn't have the ability to delete undetected files/changes created by malware in sensitive system locations, compared to KAV/KIS that have System Watcher. KAV/KIS can reference the chain of file/registry creation/modification of a malicious file that is detected after infection by signatures/scanning (unrelated to behavioral detection on execution), so even if System Watcher fails to detect malware on execution, once the file is detected its associated files logged by System Watcher will be rolled back as well.

 

[Xeno1234]

KVRT has a bit more limited advanced disinfection. Once the advanced disinfection starts, it will prevent any executables from starting and will delete files and associated registry entries from the system. However, it doesn't have the ability to delete undetected files/changes created by malware in sensitive system locations, compared to KAV/KIS that have System Watcher. KAV/KIS can reference the chain of file/registry creation/modification of a malicious file that is detected after infection by signatures/scanning (unrelated to behavioral detection on execution), so even if System Watcher fails to detect malware on execution, once the file is detected its associated files logged by System Watcher will be rolled back as well.

Yeah. I'd assume KIS/KAV Advanced Disinfection is better since it has active logs. Has Kaspersky's Advanced Disnifection ever not fully disinfected a system.

 

[Nikola Milanovic]

Do a Xcitium test too

 

[Xtwillight]

I don't think any scanner, creates a complete cleanup.
Malware Removal also shows us here in the forum that never a tool It alone manages to remove all the manipulations of malware infection.
Even if none of these scanners show something, can still change on the real PC but are also on a virtual PC.
That is why malware fighter and malware analysts work with other tools, for example
Farbar Recovery Scan Tool, RKill and further tools.
Because they know what they look and how it is fought (deleted).
Small changes can form weak points in the system.

 

[cruelsister]

I don't think any scanner, creates a complete cleanup

Perhaps not, but it's important to know which are better and more importantly which are of dubious value and are dangerous as they give the User a false sense of security.

malware analysts work with other tools, for example
Farbar Recovery Scan Tool, RKill

These would fall into the latter category mentioned above.

 

[rashmi]

It's a disappointment to see that the ESET online scanner detected the threats but couldn't neutralize them. The premium products fare much better. I have ESET Premium and Norton Power Eraser for the on-demand scanner. I also use CCE, i.e., Comodo Cleaning Essential, to see a quick verdict for the system. @cruelsister, can you test KillSwitch and the Autorun Analyzer from CCE Tools against your malware? KillSwitch and Autorun scan processes and files and give trusted, malicious, and unknown verdicts.

 

[cartaphilus]

Another comment. If eset were to be installed as a resident scanner then it would again pickup those variants as it booted. Most likely it would remove them with higher success than the online version. At least it would keep alerting the user to their persistence which would allow the user to bring bigger guns if necessary.

But I agree a false sense of security is being presented by Eset scanner that the threat was dealt with.

 

[Xtwillight]

Perhaps not, but it's important to know which are better and more importantly which are of dubious value and are dangerous as they give the User a false sense of security.

These would fall into the latter category mentioned above.

What you write is correct.

I just want to draw attention to it,
that a complete clean-up by such tools is unlikely.

Many tools fail because the active part of a malware in memory is not deleted first.
This requires that almost all active processes in Windows are deleted first.
are eliminated, the PC is shut down and restarted in safe mode and then the malware parts are deleted

It is certainly important to know which tool helps best.

Translated with DeepL.com (free version)