Question Is computer safe if my av detected a malware during installation in Shadow defender shadow mode?

SumTingWong

Level 26
Thread author
Verified
Top poster
Apr 2, 2018
1,593
So i ran shadow defender and put all my drives into shadow mode. I then installed aimersoft imusic and upon installation, eset detected javascript password stealer malware. I then click clean, open up shadow defender then click exit shadow mode and reboot. After exit shadow defender shadow mode and reboot, i ran hitmanpro, malwarebytes, norton power eraser and eset and no malware detected. So am i safe???
 

RoboMan

Level 34
Verified
Top poster
Content Creator
Well-known
Jun 24, 2016
2,350
I think i did but dont remember well
From Shadow Defender website:
Shadow Defender can run your system in a virtual environment called 'Shadow Mode'. 'Shadow Mode' redirects each system change to a virtual environment with no change to your real environment. If you experience malicious activities and/or unwanted changes, perform a reboot to restore your system back to its original state, as if nothing happened.
Whatever changes or alterations this program did into your system, was actually written into a virtual enviroment, a.k.a Shadow Mode. When you rebooted your system, all changes were rollbacked and deleted. Therefore there's no need even for a malware scan. You're safe.
 

SomeRandomCat

Level 3
Well-known
Dec 23, 2020
124
Been a while since I played around with Shadow Defender.

Does 'exit shadow mode and reboot' discard changes on reboot, or keep them? I think it discards them, but I'm sure someone here knows for sure.

Edit: It depends on whether he choose to Discard or Commit changes?
 
Last edited:

ichito

Level 11
Verified
Top poster
Content Creator
Well-known
Dec 12, 2013
518
So i ran shadow defender and put all my drives into shadow mode. I then installed aimersoft imusic and upon installation, eset detected javascript password stealer malware. I then click clean, open up shadow defender then click exit shadow mode and reboot. After exit shadow defender shadow mode and reboot, i ran hitmanpro, malwarebytes, norton power eraser and eset and no malware detected. So am i safe???
Actually no way to get infected using Shadow Mode (basically on system disk). Everything depends on what disk/disks are out off virtualization and it's hard to explain a lot of possible configuration. Here is my review about SD so you can probably get useful information
 

Andy Ful

From Hard_Configurator Tools
Verified
Honorary Member
Top poster
Developer
Well-known
Dec 23, 2014
7,183

SumTingWong,​

You cannot be maximally safe when using ShadowDefender in this way. If you are infected while being in Shadow Mode then after reboot the malware will be wiped out from the protected disks. But, your system could be compromised anyway if the malware called home and transferred personal data:
  1. Passwords used in web browsers.
  2. User and Admin credentials.
  3. Personal files.
  4. Information about the system, local network, installed applications, etc.
Furthermore, other devices in your home network could be compromised too, for example:
  1. Network drives.
  2. Other computers.
So, you have to use an offline application installer and disconnect your computer from the local network (not only from the Internet).(y)

If the file from OP was downloaded from the developer website (imusic-win_setup_full2400.exe ) then it is safe. It is an application downloader:
VirusTotal
This downloader downloads and executes the offline installer imusic-win_full2400.exe:
VirusTotal
 
Last edited:

amirr

Level 26
Verified
Top poster
Well-known
Jan 26, 2020
1,400
Maybe off-topic, but I thought to ask. Do we need a program like ShadowDefender if we have Kaspersky Internet Security or Eset Internet Security?
Thank you.
 

SumTingWong

Level 26
Thread author
Verified
Top poster
Apr 2, 2018
1,593

SumTingWong,​

You cannot be maximally safe when using ShadowDefender in this way. If you are infected while being in Shadow Mode then after reboot the malware will be wiped out from the protected disks. But, your system could be compromised anyway if the malware called home and transferred personal data:
  1. Passwords used in web browsers.
  2. User and Admin credentials.
  3. Personal files.
  4. Information about the system, local network, installed applications, etc.
Furthermore, other devices in your home network could be compromised too, for example:
  1. Network drives.
  2. Other computers.
So, you have to use an offline application installer and disconnect your computer from the local network (not only from the Internet).(y)

If the file from OP was downloaded from the developer website (imusic-win_setup_full2400.exe ) then it is safe. It is an application downloader:
VirusTotal
This downloader downloads and executes the offline installer imusic-win_full2400.exe:
VirusTotal

But ESET detected something during installation from the installer, and the thread is Javascript Password stealer malware.