Advice Request MAV antivirus, anyone heard of it?

[Tutman]

I can't find much information or a good review when doing a search.

MAV

Anti Malware, Junk Cleaner and Speed Booster

mavcodebreak.herokuapp.com

 

[Kongo]

And another job for @Shadowra !

 

[entropism]

Multiple typos and engrish, looks like a 1 man operation. I wouldn't use this if you paid me.

Oh, and they don't even have their own developer account with Google? It seems to be a generic "dev" account that multiple people release their app under. This isn't even worth looking at.

 

[Mr.NoName]

Nothing to special.. I could help with it because this is not very sirious:
foreach (Process process2 in Process.GetProcessesByName(Path.GetFileNameWithoutExtension(file)))
{
Application.DoEvents();
process2.Kill();
Thread.Sleep(100);
}
return "JS.Droppper.Trojan";

If the person need some advice or help with the project fell free to write me. As i reverse engineer it i see a lot of spaghetti code and nothing logical... Why T Fu. It uses pictures for UI instead of using some costume lib. Nowadays over the wev there are many libs. that are free for commercial use

 

[RoboMan]

foreach (Process process2 in Process.GetProcessesByName(Path.GetFileNameWithoutExtension(file)))
{
Application.DoEvents();
process2.Kill();
Thread.Sleep(100);
}
return "JS.Droppper.Trojan";

Coding is my passion

 

[Shadowra]

Hello

Being still on vacations, I wanted to try it quickly on a virtual machine that I had created on the PC where I am.
The installation goes well, but when the software starts, it freezes Windows and an error is returned (similar to VB.net or Autoit) .
I don't know if it's the family PC that is not powerful enough (an i3 9100F) or the software that is covered with bugs, but I'll look at it on my PC when I come back

 

[Andrew3000]

VirusTotal

VirusTotal

www.virustotal.com

Is flagged by ESET

 

[Mr.NoName]

It's not malware as i see but it's not that operational as it is written.... For first approach is very good but far away from one good looking software with big defence modules

 

[struppigel]

VirusTotal

VirusTotal

www.virustotal.com

Is flagged by ESET

This is a false positive. It is an antimalware program but not malware.

I decoded the signature DB it ships with. What MAV does is computing the fuzzy hash of files and compare that to a database containing 22302 fuzzy hashes and signature names.

This is a blocklist database but with fuzzy hashes instead of a cryptographic ones (which are more commonly used by AV software). 22302 blocklisted hashes are not much. The big AVs have several million blocklist entries, so it is a different magnitude here. Those blocklist entries of the big AV companies are additionally to their other signatures like pattern and behaviour based detections.

Additionally to this signature db there is one false positive prone heuristic detection for JS malware (the snippet that was posted above) that checks the presence of at least 1 in 9 different strings for files ending with .html, .htm, .hta, or .chm.

So to sum this up, it is not fraud, it is not malware, but it also doesn't have notable detection capabilities.

 

[Mr.NoName]

This is a false positive. It is an antimalware program but not malware.

I decoded the signature DB it ships with. What MAV does is computing the fuzzy hash of files and compare that to a database containing 22302 fuzzy hashes and signature names.

View attachment 263234

This is a blocklist database but with fuzzy hashes instead of a cryptographic ones (which are more commonly used by AV software). 22302 blocklisted hashes are not much. The big AVs have several million blocklist entries, so it is a different magnitude here. Those blocklist entries of the big AV companies are additionally to their other signatures like pattern and behaviour based detections.

Additionally to this signature db there is one very false positive prone heuristic detection for JS malware (the snippet that was posted above) that checks the presence of at least 1 in 9 different strings for files ending with .html, .htm, .hta, or .chm.

So to sum this up, it is not fraud, it is not malware, but it also doesn't have notable detection capabilities.

With Little help from MT community this may become something good don't you think?

 

[Shadowra]

This is a false positive. It is an antimalware program but not malware.

I decoded the signature DB it ships with. What MAV does is computing the fuzzy hash of files and compare that to a database containing 22302 fuzzy hashes and signature names.

View attachment 263234

This is a blocklist database but with fuzzy hashes instead of a cryptographic ones (which are more commonly used by AV software). 22302 blocklisted hashes are not much. The big AVs have several million blocklist entries, so it is a different magnitude here. Those blocklist entries of the big AV companies are additionally to their other signatures like pattern and behaviour based detections.

Additionally to this signature db there is one very false positive prone heuristic detection for JS malware (the snippet that was posted above) that checks the presence of at least 1 in 9 different strings for files ending with .html, .htm, .hta, or .chm.

So to sum this up, it is not fraud, it is not malware, but it also doesn't have notable detection capabilities.

Hello

Do you advise me to test it in video or is it useless because the database is quite small?

 

[Mr.NoName]

Who knows the developer or developers?

 

[ScandinavianFish]

Another false positive (?).

 

[struppigel]

Do you advise me to test it in video or is it useless because the database is quite small?

I personally would not bother. It doesn't detect EICAR which should be the minimum to expect a detection for.

Another false positive (?).

That's their official website. It is also the site they download the most current version and signature databases from.

 

[ScandinavianFish]

I personally would not bother. It doesn't even detect EICAR.



That's their official website. It is also the site they download the most current version and signature databases from.

I am fully aware of the fact it blocked the official site.

 

[struppigel]

Ah, you mean the screenshot is from MAV? I did not get that, sorry. I thought you were asking if that is an FP by another security software.

 

[struppigel]

With Little help from MT community this may become something good don't you think?

Yes, sure. Everything has to start somewhere.
There is a reason that most of the small companies license other engines like Bitdefender's and add their own engine and protection modules on top of that. It provides a solid protection basis as long as there are not enough people and own technologies to carry the weight.

 

[Mr.NoName]

Yes, sure. Everything has to start somewhere.
There is a reason that most of the small companies license other engines like Bitdefender's and add their own engine and protection modules on top of that. It provides a solid protection basis as long as there are not enough people and own technologies to carry the weight.

I've been wondering what would it be if all MT members that are work together on one single anti-malware solution. With all of this knowledge and experience... I think if someday this happens it would be something good and extraordinary.