Question If the site contains malware, should frontline page be blocked

[Parkinsond]

Yeah, but you have a problem yourself with not listening and beating around the bush in a circular manner.

Okay, I will agree whatever is declared, even if not convinced, to save myself headache of debate and make everyone happy.

 

[Parkinsond]

But it is exactly these statements that then mislead readers.

I posted the screenshot of VT results to avoid misleading anyone.

 

[Parkinsond]

But it is exactly these statements that then mislead readers.

Mislead = does not agree with my own pov.

 

[piquiteco]

I like his knowledge, it is undoubtful, but I cannot use harsh expressions and ask others to accept because this myself.

I understand, maybe you didn't agree with him, like always asking the same thing and many other things that may not make sense to him, as is the case with VT, a conversation that has been going on since 2010. He speaks bluntly, but you can't be offended by that.

 

[Trident]

You weren’t claiming that “files are not detected on VT by engines A, B, C” your claim was this:

and this applies to all contributing AV engines to VT, so this means those AVs which did not detect the jar file rely on behavioral analysis and have less efficient signatures than those which detected it, such as B and K.

This claim is absurd based on VT results.

You now twist and turn “I simply said this, I simply said that”.

Of course, and did not declare "McAfee is bad", just stated web extension by McAfee, Norton safe web, and Symantec browser protection did not block website, and on VT, McAfee, ESET, Symantec, Avast, AVG, Avira, MD, and others did not detect the jar file, that simple.

You think I won’t go first page and copy what you said?

 

[piquiteco]

Only trafficlight blocked it.

So you install BD Free, since you like Bitdefender TrafficLight.

 

[Parkinsond]

So you install BD Free, since you like Bitdefender TrafficLight.

No, B free is buggy and resource hog, just trafficlight is good.

 

[piquiteco]

Maybe DNS services like Quad9 would help? Just a thought

Yes, almost all DNS services blocked the .Jar file, as shown in the screenshot below from Osprey.

Spoiler: Osprey Block IKov.jar

 

[piquiteco]

I have no K installed on my PC, just describing the results page of VT, everyone can interpret VT results the way he/she likes.

I know more, this post was for @Divergent. I was referring to his post #42. You are literally mixing things up, be careful not to get lost in the MT forum.

 

[SeriousHoax]

Let's simplify things @Parkinsond

Malware detection on VT does not always match with the result of on-device detection of the same product. Command line VT scanner has limitations.
I have seen many cases where a .js file detected by both Kaspersky and ESET on a real machine but not detected on VT even after several days. Same with .jar file, same with even .exe files on some occasions. Even if it seems odd, it is normal.

Same happens for malicious/phishing website detection from time to time. Once I submitted a phishing site to Bitdefender after checking on VT and TrafficLight extension.
Some minutes later I got a response from BD telling me that it is detected by their product and suggested me to update my system. So, I fired up my VM, updated and it was indeed detected by Bitdefender on a real system.

So, don't just blindly have an opinion on an AV based on their VT result alone. It can be misleading.

Regarding McAfee not blocking the site, well Lionel Messi is the greatest footballer of all time, but he didn't score or assist in every match he played. Even the GOAT had many bad days.
I'm not saying that McAfee is the GOAT of AV products, but you understand my point.

 

[Parkinsond]

I have seen many cases where a .js file detected by both Kaspersky and ESET on a real machine but not detected on VT

I know; I have seen the reverse: file detected by MD on VT but not by MD on my PC.
I use MD, so I am not a fan for any AV, even MD; just using it because it is pre-installed.
I may be the least knowledgeable, but also the least biased; just describing results, not interpreting; MT members are grown up, and wise enough to interpret themselves.

 

[ForgottenSeer 123960]

I know; I have seen the reverse: file detected by MD on VT but not by MD on my PC.
I use MD, so I am not a fan for any AV, even MD; just using it because it is pre-installed.
I may be the least knowledgeable, but also the least biased; just describing results, not interpreting; MT members are grown up, and wise enough to interpret themselves.

Emphasizing community benefit, let's be direct. The consistent conclusion from the responses is that Virustotal results are not a definitive measure of a product's true abilities. To move forward, could you please clarify what specific question you're trying to answer that hasn't been addressed? I'm asking because a long, back-and-forth thread can obscure the useful information for future users who might have the same question. We want to make sure the key answers are easy to find for everyone.

 

[Parkinsond]

Emphasizing community benefit, let's be direct. The consistent conclusion from the responses is that Virustotal results are not a definitive measure of a product's true abilities. To move forward, could you please clarify what specific question you're trying to answer that hasn't been addressed? I'm asking because a long, back-and-forth thread can obscure the useful information for future users who might have the same question. We want to make sure the key answers are easy to find for everyone.

Excuse me, you are quoting response to Serioushoax, was not for you.

 

[Trident]

I may be the least knowledgeable, but also the least biased; just describing results, not interpreting

You sure though?

and this applies to all contributing AV engines to VT, so this means those AVs which did not detect the jar file rely on behavioral analysis and have less efficient signatures than those which detected it, such as B and K.

 

[Parkinsond]

You sure though?

Refer to VT results webpage.

 

[Trident]

Refer to VT results webpage.

Why would I refer to VT page, it is your comment that I am referring to.

 

[Parkinsond]

Why would I refer to VT page, it is your comment that I am referring to.

It is based on VT results; refer to VT webpage to get what is the statement based on.

 

[Moonhorse]

There was lightning storm so i took a break from computer, but you have created interesting read here while i was away.

What i wanted to ask is that: is it enough if the malware is caught on the site containing malware ( when downloaded) as i gave site as example or should antiviruses block the page in first priority so the downloading of possible malware is prevented by blocking the website?

i wanted to submit this domain to mcafee but could not find way to submit urls to them, even i asked from the chat too. Only malware samples are ones you could submit to them

 

[piquiteco]

Comparing the efficiency of different extensions, not the entire AV.

Extensions will not miraculously detect all pages with malware. They are not antivirus software, they are just an add-on for your browser. Your AV software is what detects malware on your computer. Just because the extensions of the products you mentioned did not detect it, does not mean that the product would not detect the .Jar file on your machine if it were installed. I believe you read the posts by @Divergent #42 and @SeriousHoax #70. Read these two posts carefully, as they are very clear, and I believe you will understand. I have nothing to add to these members' posts; for me, they were perfect.

 

[SeriousHoax]

i wanted to submit this domain to mcafee but could not find way to submit urls to them, even i asked from the chat too. Only malware samples are ones you could submit to them

This is the site to submit websites to McAfee

https://sitelookup.mcafee.com/