Q&A Is computer safe if my av detected a malware during installation in Shadow defender shadow mode?

SumTingWong

Level 26
Verified
Apr 2, 2018
1,564
So i ran shadow defender and put all my drives into shadow mode. I then installed aimersoft imusic and upon installation, eset detected javascript password stealer malware. I then click clean, open up shadow defender then click exit shadow mode and reboot. After exit shadow defender shadow mode and reboot, i ran hitmanpro, malwarebytes, norton power eraser and eset and no malware detected. So am i safe???
 

RoboMan

Level 32
Verified
Content Creator
Jun 24, 2016
2,186
I think i did but dont remember well
From Shadow Defender website:
Shadow Defender can run your system in a virtual environment called 'Shadow Mode'. 'Shadow Mode' redirects each system change to a virtual environment with no change to your real environment. If you experience malicious activities and/or unwanted changes, perform a reboot to restore your system back to its original state, as if nothing happened.
Whatever changes or alterations this program did into your system, was actually written into a virtual enviroment, a.k.a Shadow Mode. When you rebooted your system, all changes were rollbacked and deleted. Therefore there's no need even for a malware scan. You're safe.
 

SomeRandomCat

Level 3
Dec 23, 2020
124
Been a while since I played around with Shadow Defender.

Does 'exit shadow mode and reboot' discard changes on reboot, or keep them? I think it discards them, but I'm sure someone here knows for sure.

Edit: It depends on whether he choose to Discard or Commit changes?
 
Last edited:

ichito

Level 10
Verified
Content Creator
Dec 12, 2013
478
So i ran shadow defender and put all my drives into shadow mode. I then installed aimersoft imusic and upon installation, eset detected javascript password stealer malware. I then click clean, open up shadow defender then click exit shadow mode and reboot. After exit shadow defender shadow mode and reboot, i ran hitmanpro, malwarebytes, norton power eraser and eset and no malware detected. So am i safe???
Actually no way to get infected using Shadow Mode (basically on system disk). Everything depends on what disk/disks are out off virtualization and it's hard to explain a lot of possible configuration. Here is my review about SD so you can probably get useful information
 

Andy Ful

Level 72
Verified
Trusted
Content Creator
Dec 23, 2014
6,129

SumTingWong,​

You cannot be maximally safe when using ShadowDefender in this way. If you are infected while being in Shadow Mode then after reboot the malware will be wiped out from the protected disks. But, your system could be compromised anyway if the malware called home and transferred personal data:
  1. Passwords used in web browsers.
  2. User and Admin credentials.
  3. Personal files.
  4. Information about the system, local network, installed applications, etc.
Furthermore, other devices in your home network could be compromised too, for example:
  1. Network drives.
  2. Other computers.
So, you have to use an offline application installer and disconnect your computer from the local network (not only from the Internet).(y)

If the file from OP was downloaded from the developer website (imusic-win_setup_full2400.exe ) then it is safe. It is an application downloader:
VirusTotal
This downloader downloads and executes the offline installer imusic-win_full2400.exe:
VirusTotal
 
Last edited:

amirr

Level 16
Verified
Jan 26, 2020
788
Maybe off-topic, but I thought to ask. Do we need a program like ShadowDefender if we have Kaspersky Internet Security or Eset Internet Security?
Thank you.
 

SumTingWong

Level 26
Verified
Apr 2, 2018
1,564

SumTingWong,​

You cannot be maximally safe when using ShadowDefender in this way. If you are infected while being in Shadow Mode then after reboot the malware will be wiped out from the protected disks. But, your system could be compromised anyway if the malware called home and transferred personal data:
  1. Passwords used in web browsers.
  2. User and Admin credentials.
  3. Personal files.
  4. Information about the system, local network, installed applications, etc.
Furthermore, other devices in your home network could be compromised too, for example:
  1. Network drives.
  2. Other computers.
So, you have to use an offline application installer and disconnect your computer from the local network (not only from the Internet).(y)

If the file from OP was downloaded from the developer website (imusic-win_setup_full2400.exe ) then it is safe. It is an application downloader:
VirusTotal
This downloader downloads and executes the offline installer imusic-win_full2400.exe:
VirusTotal

But ESET detected something during installation from the installer, and the thread is Javascript Password stealer malware.
 
Top