Advice Request Is computer safe if my av detected a malware during installation in Shadow defender shadow mode?

[SumTingWong]

So i ran shadow defender and put all my drives into shadow mode. I then installed aimersoft imusic and upon installation, eset detected javascript password stealer malware. I then click clean, open up shadow defender then click exit shadow mode and reboot. After exit shadow defender shadow mode and reboot, i ran hitmanpro, malwarebytes, norton power eraser and eset and no malware detected. So am i safe???

 

[RoboMan]

Did you read how shadow mode works before installing the product?

 

[SumTingWong]

Did you read how shadow mode works before installing the product?

I think i did but dont remember well

 

[RoboMan]

I think i did but dont remember well

From Shadow Defender website:

Shadow Defender can run your system in a virtual environment called 'Shadow Mode'. 'Shadow Mode' redirects each system change to a virtual environment with no change to your real environment. If you experience malicious activities and/or unwanted changes, perform a reboot to restore your system back to its original state, as if nothing happened.

Whatever changes or alterations this program did into your system, was actually written into a virtual enviroment, a.k.a Shadow Mode. When you rebooted your system, all changes were rollbacked and deleted. Therefore there's no need even for a malware scan. You're safe.

 

[Venustus]

So am i safe???

Just to be on the safer side I do not allow network connections even in shadow mode....

 

[Ink]

Where did you download the file from?

Aimersoft iMusic is shareware.

 

[Venustus]

Where did you download the file from?

That's a good point

 

[SumTingWong]

Where did you download the file from?

Aimersoft iMusic is shareware.

(Official)Aimersoft show up on google search.

 

[SomeRandomCat]

Been a while since I played around with Shadow Defender.

Does 'exit shadow mode and reboot' discard changes on reboot, or keep them? I think it discards them, but I'm sure someone here knows for sure.

Edit: It depends on whether he choose to Discard or Commit changes?

 

[Venustus]

Does 'exit shadow mode and reboot' discard changes on reboot

Yes it does

 

[tipo]

If you were in shadow mode and didn't commit anything, you are safe as @RoboMan said.

 

[cambell7]

I am using shadow defender for years. Never had any probs in shadow mode.

 

[Ink]

(Official)Aimersoft show up on google search.

Did you check the executable with VirusTotal or AnyRun

 

[ichito]

So i ran shadow defender and put all my drives into shadow mode. I then installed aimersoft imusic and upon installation, eset detected javascript password stealer malware. I then click clean, open up shadow defender then click exit shadow mode and reboot. After exit shadow defender shadow mode and reboot, i ran hitmanpro, malwarebytes, norton power eraser and eset and no malware detected. So am i safe???

Actually no way to get infected using Shadow Mode (basically on system disk). Everything depends on what disk/disks are out off virtualization and it's hard to explain a lot of possible configuration. Here is my review about SD so you can probably get useful information

Shadow Defender - An Unobjective Review :)

This review is based on my review originaly published on Polish forum SG.pl ca 5 years ago. I decided post it here because SD after such period is still efficient and strong at the same level as in the past. Of cource SD was updated few time since those times but there was rather minor changes...

malwaretips.com

 

[Andy Ful]

SumTingWong,​

You cannot be maximally safe when using ShadowDefender in this way. If you are infected while being in Shadow Mode then after reboot the malware will be wiped out from the protected disks. But, your system could be compromised anyway if the malware called home and transferred personal data:

1. Passwords used in web browsers.
2. User and Admin credentials.
3. Personal files.
4. Information about the system, local network, installed applications, etc.

Furthermore, other devices in your home network could be compromised too, for example:

1. Network drives.
2. Other computers.

So, you have to use an offline application installer and disconnect your computer from the local network (not only from the Internet).

If the file from OP was downloaded from the developer website (imusic-win_setup_full2400.exe ) then it is safe. It is an application downloader:
VirusTotal
This downloader downloads and executes the offline installer imusic-win_full2400.exe:
VirusTotal

 

[amirr]

Maybe off-topic, but I thought to ask. Do we need a program like ShadowDefender if we have Kaspersky Internet Security or Eset Internet Security?
Thank you.

 

[Andy Ful]

Maybe off-topic, but I thought to ask. Do we need a program like ShadowDefender if we have Kaspersky Internet Security or Eset Internet Security?
Thank you.

Yes. Shadowdefender is an excellent solution for trying/testing software.

 

[SumTingWong]

SumTingWong,​

You cannot be maximally safe when using ShadowDefender in this way. If you are infected while being in Shadow Mode then after reboot the malware will be wiped out from the protected disks. But, your system could be compromised anyway if the malware called home and transferred personal data:

1. Passwords used in web browsers.
2. User and Admin credentials.
3. Personal files.
4. Information about the system, local network, installed applications, etc.

Furthermore, other devices in your home network could be compromised too, for example:

1. Network drives.
2. Other computers.

So, you have to use an offline application installer and disconnect your computer from the local network (not only from the Internet).

If the file from OP was downloaded from the developer website (imusic-win_setup_full2400.exe ) then it is safe. It is an application downloader:
VirusTotal
This downloader downloads and executes the offline installer imusic-win_full2400.exe:
VirusTotal

But ESET detected something during installation from the installer, and the thread is Javascript Password stealer malware.

 

[SumTingWong]

Did you check the executable with VirusTotal or AnyRun

On Virustotal.com says clean.

 

[SomeRandomCat]

Do you know if ESET mentioned anything about 'Heur' in the detection? Maybe it was a false positive?