Assigned Evjl's Rain Zemana Report - January 2017

[SHvFl]

I don't know the answer on that question.

No worries. Thanks for the info.

 

[AtlBo]

Discussion has become lively and a very informative thread. Looking forward to the results of further testing. Thanks for the work so far with this.

A side topic while we await further analysis of Zemana...Curious if anyone thinks that a-v/sig based apps ever look for key words in the title of a file like Cerber or another single word that might give away a test sample?

I installed a program called KnowBe4 Ran Sim that simulates ransomeware. 360 TS seemed to know the ten test files before the test started (almost). Grabbed them all in one alert. No surprise since probably the program has been around for some time. I was forced to restore the files to the program to run the test and then rerun with a-v off, which I was planning to do anyway. Still, it's difficult to ascertain which method of detection is being applied with 360. Log says it was File Protection but not the method of detection.

 

[TwinHeadedEagle]

No worries. Thanks for the info.

No problem, I don't know 100% how ZAM Real-time works under the hood so I didn't want to give you a partial answer. What I am sure is when you see a window that Zemana blocked a harmful file, that is a 99.99% malicious file. How ZAM determines it, is what I don't know. It could be a cloud engine detection, behavior detection or Pandora detection (that has many checks whether some file is good or bad), but again I am not competent to answer that question.

 

[Evjl's Rain]

the video was successfully recored. ~20 minutes uncut. Now uploading.
sorry for the long video because I don't have an SSD and recording + testing made it so slow

 

[MalwareBlockerYT]

View attachment 131620

Zemana Antimalware with Pandora.pdf

Spoiler: Links to the separate tests

https://malwaretips.com/threads/5-1-17-5.67224/#post-584518
https://malwaretips.com/threads/5-1-17-6.67199/#post-584792
https://malwaretips.com/threads/6-1-17-7.67234/#post-584625
https://malwaretips.com/threads/06-01-2017-10.67259/#post-584842
https://malwaretips.com/threads/mixed-samples-3.67295/#post-585272
https://malwaretips.com/threads/08-01-2017-3.67309/#post-585462
https://malwaretips.com/threads/9-1-2017-8.67354/#post-585924
https://malwaretips.com/threads/10-01-2017-4.67373/#post-586105
https://malwaretips.com/threads/spora-ransomware.67407/#post-586431
https://malwaretips.com/threads/11-1-2017-6.67436/#post-586684

Nice report From my testing Zemana does pretty well but yeah it doesn't pick up everything...

 

[Evjl's Rain]

Containment: VMware Workstation 12.5.2 build-4638234
Guest/OS: Windows 7 Pro SP1
Product: Zemana Antimalware Premium (latest), with Pandora
Static: Not tested
Dynamic: 5/7 (2 samples left in the folder but ZAM blocked a dropped .vbs file of 1 of the samples)
Total: 5/7
System Final Status: Infected (by second opinion scanners, including ZAM itself)

NOTE: AutoKMS.exe is not an infection

Final verdict: ZAM did a much better job than my previous tests. However, Pandora still let 1 malware pass through. It dropped a file and created an entry on boot. The realtime protection should be improved

EDIT: My mistake, it should be 5/7 in total. I removed some steps to decrease the video length. Forgot to count it properly

 

[Evjl's Rain]

Cool. Can you also explain how to know if pandora or signatures detected something from the alert? Is it possible?

According to what I saw. If it is detected by signature, there will be a red popup
Pandora -> yellow popup

 

[ant_gamal]

I wait for the another product at this test

Malwarebytes
Antispyware
Emsisoft