App Review Shadow Defender vs Malware samples

It is advised to take all reviews with a grain of salt. In extreme cases some reviews use dramatization for entertainment purposes.
Status
Not open for further replies.
Umbra said:
As expected, classic malware testing on softwares like SD is futile; to truly test it; MBR-based ransomwares, bioskits/rootkits are the minimum requirements.
Click to expand...


You're right :)
But if I find one when testing other security product, will do re-test for sure

Also I show to some people who dont know how exactly this software works

thanks guys
 
  • Like
Reactions: shukla44, DardiM, Der.Reisende and 8 others
if you like to test hard-to-defeat software, what about running a test on ReHIPS?
The isolation won't give the malware even a chance, but you could make it much more interesting by running the samples from a non-isolated location, and let the HIPS alone fight the battle.
 
  • Like
Reactions: shukla44, DardiM, Der.Reisende and 3 others
SHvFl said:
It doesn't restrict driver loading so i guess it can't protect any kernel mode malware. I would assume that's one way to bypass any protection it offers.
Click to expand...
the malware can load all the drivers it wants, and muck up the windows kernel, and it's all okay. Because all changes to the system will be erased at reboot. that's the form of protection it is designed to offer. Your system gets temporarily infected, and then you wash it all away at reboot.
 
  • Like
Reactions: shukla44, DardiM, Der.Reisende and 3 others
shmu26 said:
the malware can load all the drivers it wants, and muck up the windows kernel, and it's all okay. Because all changes to the system will be erased at reboot. that's the form of protection it is designed to offer. Your system gets temporarily infected, and then you wash it all away at reboot.
Click to expand...
If you load your drivers you can disable SD. No? I am no malware expert but it's possible.
 
  • Like
Reactions: shukla44, DardiM, Der.Reisende and 3 others
SHvFl said:
If you load your drivers you can disable SD. No? I am no malware expert but it's possible.
Click to expand...
I don't think it is a problem, because you don't need SD to protect you anymore, at that point. It has done its job already, because it has virtualized your system.
 
  • Like
Reactions: DardiM, Der.Reisende, safe1st and 2 others
SHvFl said:
It doesn't restrict driver loading so i guess it can't protect any kernel mode malware. I would assume that's one way to bypass any protection it offers.
Click to expand...

SHvFl said:
If you load your drivers you can disable SD. No? I am no malware expert but it's possible.
Click to expand...

Writing to MBR and partitions are redirected , so the drivers would be also redirected. AFAIK , nothing bypassed SD yet. The last known bypass was a MBR exploitation , this bypass led to the implementation of the MBR protection of SD.
 
  • Like
Reactions: shukla44, DardiM, frogboy and 7 others
Status
Not open for further replies.

You may also like...