Reply to thread

Message

<blockquote data-quote="ForgottenSeer 103564" data-source="post: 1066108">I would like to request tests done a certain way, does not matter which product, or by whom its performed.1. Using analysis tools to help demonstrate the malware and what it does to the system, and also how the product reacts.Process Explorer with virustotal enabled for spawned processes to be uploaded in realtime and scanned.Autoruns with virustotal enabled to show start up entries as they are added to the registry.Wireshark To show connections made to C&amp;C servers, packets sent back and forth, payloads dropped on system, IP of C&amp;C servers, ect.2. A look through the systemThis would include most common places malware drops and where traces would likely be left over after a product &quot;Removes&quot; the malware, such as User/Appdata folder, ect.3. Last but not least, most importantly... What damage was done to the system stopping and removing the malware by the product. This i find very important, is the system now corrupted from removal, is the system usable/stable. Scans with sfc /scannow and DISM would most certainly help shed light on things as such for example. Product has a problem if it cripples the system upon removal and even worse yet, does not inform the user it did so.To me, this shows and teaches users about the malware and how it operates now days, how the products address this, and what damage can result from it, what kind of information can be seen being removed from the system, ect. It reflects on how well the program will keep users safe as well as how it does handling its job and keeping the system usable. That latter part important for those that play &quot;Admin&quot; for older and younger family members. I feel in my opinion, if testing is to be done for sake of teaching, it should reflect accurate, realistic results/information</blockquote>

[QUOTE="ForgottenSeer 103564, post: 1066108"] I would like to request tests done a certain way, does not matter which product, or by whom its performed. 1. Using analysis tools to help demonstrate the malware and what it does to the system, and also how the product reacts. [B][U]Process Explorer[/U][/B] with virustotal enabled for spawned processes to be uploaded in realtime and scanned. [B][U]Autoruns[/U][/B] with virustotal enabled to show start up entries as they are added to the registry. [B][U]Wireshark[/U][/B] To show connections made to C&C servers, packets sent back and forth, payloads dropped on system, IP of C&C servers, ect. 2. A look through the system This would include most common places malware drops and where traces would likely be left over after a product "Removes" the malware, such as User/Appdata folder, ect. 3. Last but not least, most importantly... What damage was done to the system stopping and removing the malware by the product. This i find very important, is the system now corrupted from removal, is the system usable/stable. Scans with sfc /scannow and DISM would most certainly help shed light on things as such for example. Product has a problem if it cripples the system upon removal and even worse yet, does not inform the user it did so. To me, this shows and teaches users about the malware and how it operates now days, how the products address this, and what damage can result from it, what kind of information can be seen being removed from the system, ect. It reflects on how well the program will keep users safe as well as how it does handling its job and keeping the system usable. That latter part important for those that play "Admin" for older and younger family members. I feel in my opinion, if testing is to be done for sake of teaching, it should reflect accurate, realistic results/information [/QUOTE]

Verification