Reply to thread

Message

<blockquote data-quote="MacDefender" data-source="post: 945476" data-attributes="member: 83059">First result looked pretty good!So in terms of signatures:<ul>
<li data-xf-list-type="ul">Trojan:W32/....!Online: F-Secure Online (their own cloud)</li>
<li data-xf-list-type="ul">Worm:VBS/...: In-house engine (not sure which)</li>
<li data-xf-list-type="ul">HEUR/APC: Avira Cloud</li>
<li data-xf-list-type="ul">Exploit.EXP:/OfcKit: Avira Signatures</li>
</ul>So half of the detections are from F-Secure&#039;s in-house engines and plus a DeepGuard hit, it once against shows that F-Secure brings a lot more to the table than just the Avira engine.The dynamic DeepGuard hit is because it tried to drop an AutoRun, which DeepGuard is extremely sensitive against. You can see Dr. Web missed an AutoRun in the same sample pack.And not sure if the last miss was just good at waiting longer for a trigger, but it didn&#039;t seem to do anything harmful and all that was left was a DLL with an incorrect extension (probably staged secondary payload from one of the tests). F-Secure doesn&#039;t care about that file extension and it&#039;s not going to execute until it&#039;s renamed as a DLL anyway.</blockquote>

[QUOTE="MacDefender, post: 945476, member: 83059"] First result looked pretty good! So in terms of signatures: [LIST] [*]Trojan:W32/....!Online: [B]F-Secure Online[/B] (their own cloud) [*]Worm:VBS/...: In-house engine (not sure which) [*]HEUR/APC: [B]Avira Cloud[/B] [*]Exploit.EXP:/OfcKit: [B]Avira Signatures[/B] [/LIST] So half of the detections are from F-Secure's in-house engines and plus a DeepGuard hit, it once against shows that F-Secure brings a lot more to the table than just the Avira engine. The dynamic DeepGuard hit is because it tried to drop an AutoRun, which DeepGuard is extremely sensitive against. You can see Dr. Web missed an AutoRun in the same sample pack. And not sure if the last miss was just good at waiting longer for a trigger, but it didn't seem to do anything harmful and all that was left was a DLL with an incorrect extension (probably staged secondary payload from one of the tests). F-Secure doesn't care about that file extension and it's not going to execute until it's renamed as a DLL anyway. [/QUOTE]

Verification