So i did test all free AV and was Surprised.

[Arequire]

@Slerion , perhaps you should take out the link and ask an admin/moderator how to proceed? The thread has had a lot of posts and a noob member of the happy clicker crew might be tempted to have a look at your samples . Sounds silly, but I'm sure we all know that such behaviour is to be expected at all times.

You could give the link privately, but I would still advise you speak to the admin first. No one wants to listen to complaints from people getting infected by clicking on something in their forums.

@Slerion Agree with this. Even on a forum dedicated to cybersecurity there's always going to be someone who ends up getting a little too curious for their own good. Especially people who are convinced their security configuration is strong enough to handle any malware they execute outside a VM.

Edit: It's in the vault now so I'd remove the link from this thread. New members and guests can't access the vault and there's appropriate warnings to dissuade people from downloading and executing random malware there.

 

[Amelith Nargothrond]

I have shared your malware package here (the vault): https://malwaretips.com/threads/courtesy-of-slerion-a-pack-of-862-malware-samples.70789/

Kindly reconsider leaving the download link here, publicly available.

Thank you again!

 

[Slerion]

I have shared your malware package here (the vault): https://malwaretips.com/threads/courtesy-of-slerion-a-pack-of-862-malware-samples.70789/

Kindly reconsider leaving the download link here.

Thank you again!

i wanted to edit the Link out but i cant find the comment anymore its gone probably can anyone else still see it ? if not ask me for the link to the malware pack

 

[Amelith Nargothrond]

i wanted to edit the Link out but i cant find the comment anymore its gone probably can anyone else still see it ? if not ask me for the link to the malware pack

I think a moderator deleted your original post with the link. It's in the vault now, so everybody is safe

Will be very interesting to see the results!

 

[Slerion]

I think a moderator deleted your original post with the link. It's in the vault now, so everybody is safe

Will be very interesting to see the results!

oh yeah !

 

[mamamia]

Test for Kaspersky??.-

 

[brod56]

I tend to take every test result with a grain of salt, but I just cant stand how Comodo improved its detection rate from one day to another...
Nothing against the software, just saying

 

[brod56]

I completely agree. Paid products are not better than free products if we know what we are doing and find a good combo
for example, WD/avast/avira/BD free + Voodooshield free/comodo firewall => paid products = who are better, except lockdown products?

Agree 100%. The best protection is a default-deny solution, which is absolutely free.
I feel like the AV market/business is just encouraging new malware every single day, which is sad.

 

[blueblackwow65]

So Comodo did very well in tests by detection(av) or prevention(sandbox,etc)?

 

[roger_m]

So here for everyone that dont want to believe me .

I had a look at your screenshots, and it appears that around 12 of the files are not malicious, e.g. PUPs.

 

[jamescv7]

A part of experimentation test is the possible change of a result.

Did anyone see an experiment where consistent result will be shown? It's not right? Therefore a test done in antivirus have different factors regardless the reputation of a samples taken.

Since the samples are taken from weeks to month, then some AV are already managed to flagged it down compare to others.

I should agree on different methodologies which ensure no false positives and everything is malicious even PUP; but let's take it that the OP follow it correctly then accept the fact where a unique result is occur.

-----------------

Fact: Avira lately are behind on the on-demand scanner test thus surprisingly other AV's excel on that case. (I've witnessed some Youtube reviews way back before); Avast Free become a good alternative next to Avira.

 

[Slerion]

Test for Kaspersky??.-

No because its paid.

I had a look at your screenshots, and it appears that around 12 of the files are not malicious, e.g. PUPs.

as i said its a mixed test. and Pups / pua are Most time malicious ( and werent many included ). or do you want something like these hard core reinstalling cpu eating toolbars or ad injectors installed because you didnt look or wasnt even asked ? or someone less techsavy installed something ? its a low risk threat but its a threat.

 

[Slerion]

A part of experimentation test is the possible change of a result.

Did anyone see an experiment where consistent result will be shown? It's not right? Therefore a test done in antivirus have different factors regardless the reputation of a samples taken.

Since the samples are taken from weeks to month, then some AV are already managed to flagged it down compare to others.

I should agree on different methodologies which ensure no false positives and everything is malicious even PUP; but let's take it that the OP follow it correctly then accept the fact where a unique result is occur.

-----------------

Fact: Avira lately are behind on the on-demand scanner test thus surprisingly other AV's excel on that case. (I've witnessed some Youtube reviews way back before); Avast Free become a good alternative next to Avira.

thanks but only 50% of the files are days to weeks and months old

the other 50% was less than a day old to see short and long term protection ( was actually a test just for myself ) but i shared it.

 

[Tiny]

Strange. My post was deleted. Was there something offensive in there?

 

[Slerion]

Strange. My post was deleted. Was there something offensive in there?

ask the mods / admins or did it include a link to my malware pack ? ( BTW if someone wants it look in the malware vault or pm me )

 

[erreale]

I did a quick test. Emsisoft IS 744/862
EIS left 128 files.
ZAM 30/128
NPE 22/128
HitmanPro 8/128
However, many files (legitimate or malware) are present multiple times.

 

[DJ Panda]

Response from Dan, developer of Voodoosheild. I had emailed him earlier about the pack.

There were some clean samples in this pack of 862 files, and since I tested VS on AutoPilot, it automatically allowed them… they are below. There were some duplicates as well, and they are sorted by duplicates.

Antivirus scan for 9068f4fcfd2aa78ed5130d7af1f70bafe3388d3443991c372cb430bb64eb9a82 at 2017-03-31 09:14:32 UTC - VirusTotal

Antivirus scan for 6525a053c5c2dbe16d73b927a3e5277ca8278958a524dce09da231393f00fdc7 at 2017-04-18 21:05:23 UTC - VirusTotal

Antivirus scan for 5b602304faf88737a24a3ad74f92938ea60eed8bdc4532131a31bce5a58be98a at 2017-04-14 10:21:32 UTC - VirusTotal

Antivirus scan for 27cbbd716b164077fefc280b721b53797ac02db97fe1f5b29050ae1b3508140f at 2017-01-21 02:10:19 UTC - VirusTotal

Antivirus scan for f58c376baaf6bab32f62e0863cb9c40a70a0a4da69dc0fe10ba9c0d8656d92eb at 2017-02-24 00:43:21 UTC - VirusTotal

https://virustotal.com/en/file/d73c...efc5b09937e5300cb0ecaffda70f4efdef0/analysis/



https://virustotal.com/en/file/58b7...7e70a7938a5f9816847072d1ad7397215ed/analysis/

https://virustotal.com/en/file/58b7...7e70a7938a5f9816847072d1ad7397215ed/analysis/



https://virustotal.com/en/file/c290...2873ecb7e58e7fae289842d28e6a0983290/analysis/

https://virustotal.com/en/file/c290...2873ecb7e58e7fae289842d28e6a0983290/analysis/



https://virustotal.com/en/file/b327...739aa3925f19ae0871dec32e9d27933082d/analysis/

https://virustotal.com/en/file/b327...739aa3925f19ae0871dec32e9d27933082d/analysis/

https://virustotal.com/en/file/b327...739aa3925f19ae0871dec32e9d27933082d/analysis/

https://virustotal.com/en/file/b327...739aa3925f19ae0871dec32e9d27933082d/analysis/

https://virustotal.com/en/file/b327...739aa3925f19ae0871dec32e9d27933082d/analysis/

https://virustotal.com/en/file/b327...739aa3925f19ae0871dec32e9d27933082d/analysis/

https://virustotal.com/en/file/b327...739aa3925f19ae0871dec32e9d27933082d/analysis/

https://virustotal.com/en/file/b327...739aa3925f19ae0871dec32e9d27933082d/analysis/

https://virustotal.com/en/file/b327...739aa3925f19ae0871dec32e9d27933082d/analysis/



The only questionable file is the first one in the list… all the rest were clean. This file is “ScreenConnect Client”, and Cuckoo did not like it for obvious reasons (the Cuckoo analysis is below), but I would guess this file is clean as well.



http://voodooshield.ddns.net:8080/analysis/5960/



There were also a handful of clean files that were not known to the blacklist, but they were created and signed by Auslogics, so these were clean files as well, but VS blocks unknown files by default, even in AutoPilot mode.



Here are the results: www.voodooshield.com/artwork/Report862.txt



In the end, VS auto allowed the 19 clean files and blocked everything else, so that is probably as close to 100% as you can get… the blacklist and VoodooAi are an amazing combo, and they are highly optimized to work well together.



There are almost always a handful of clean files in malware packs… although, for the life of me, I have no idea why this always seems to happen .

Dan is currently uploading a video right now. Should be out shortly.

 

[Slerion]

Response from Dan, developer of Voodoosheild. I had emailed him earlier about the pack.

There were some clean samples in this pack of 862 files, and since I tested VS on AutoPilot, it automatically allowed them… they are below. There were some duplicates as well, and they are sorted by duplicates.

Antivirus scan for 9068f4fcfd2aa78ed5130d7af1f70bafe3388d3443991c372cb430bb64eb9a82 at 2017-03-31 09:14:32 UTC - VirusTotal

Antivirus scan for 6525a053c5c2dbe16d73b927a3e5277ca8278958a524dce09da231393f00fdc7 at 2017-04-18 21:05:23 UTC - VirusTotal

Antivirus scan for 5b602304faf88737a24a3ad74f92938ea60eed8bdc4532131a31bce5a58be98a at 2017-04-14 10:21:32 UTC - VirusTotal

Antivirus scan for 27cbbd716b164077fefc280b721b53797ac02db97fe1f5b29050ae1b3508140f at 2017-01-21 02:10:19 UTC - VirusTotal

Antivirus scan for f58c376baaf6bab32f62e0863cb9c40a70a0a4da69dc0fe10ba9c0d8656d92eb at 2017-02-24 00:43:21 UTC - VirusTotal

https://virustotal.com/en/file/d73c...efc5b09937e5300cb0ecaffda70f4efdef0/analysis/



https://virustotal.com/en/file/58b7...7e70a7938a5f9816847072d1ad7397215ed/analysis/

https://virustotal.com/en/file/58b7...7e70a7938a5f9816847072d1ad7397215ed/analysis/



https://virustotal.com/en/file/c290...2873ecb7e58e7fae289842d28e6a0983290/analysis/

https://virustotal.com/en/file/c290...2873ecb7e58e7fae289842d28e6a0983290/analysis/



https://virustotal.com/en/file/b327...739aa3925f19ae0871dec32e9d27933082d/analysis/

https://virustotal.com/en/file/b327...739aa3925f19ae0871dec32e9d27933082d/analysis/

https://virustotal.com/en/file/b327...739aa3925f19ae0871dec32e9d27933082d/analysis/

https://virustotal.com/en/file/b327...739aa3925f19ae0871dec32e9d27933082d/analysis/

https://virustotal.com/en/file/b327...739aa3925f19ae0871dec32e9d27933082d/analysis/

https://virustotal.com/en/file/b327...739aa3925f19ae0871dec32e9d27933082d/analysis/

https://virustotal.com/en/file/b327...739aa3925f19ae0871dec32e9d27933082d/analysis/

https://virustotal.com/en/file/b327...739aa3925f19ae0871dec32e9d27933082d/analysis/

https://virustotal.com/en/file/b327...739aa3925f19ae0871dec32e9d27933082d/analysis/



The only questionable file is the first one in the list… all the rest were clean. This file is “ScreenConnect Client”, and Cuckoo did not like it for obvious reasons (the Cuckoo analysis is below), but I would guess this file is clean as well.



http://voodooshield.ddns.net:8080/analysis/5960/



There were also a handful of clean files that were not known to the blacklist, but they were created and signed by Auslogics, so these were clean files as well, but VS blocks unknown files by default, even in AutoPilot mode.



Here are the results: www.voodooshield.com/artwork/Report862.txt



In the end, VS auto allowed the 19 clean files and blocked everything else, so that is probably as close to 100% as you can get… the blacklist and VoodooAi are an amazing combo, and they are highly optimized to work well together.



There are almost always a handful of clean files in malware packs… although, for the life of me, I have no idea why this always seems to happen .

Dan is currently uploading a video right now. Should be out shortly.

do you mean clean as in truly clean or in the part like auslogics. they like to add Pua / pups to their installers

 

[Deleted member 178]

Strange. My post was deleted. Was there something offensive in there?

ask the mods / admins or did it include a link to my malware pack ? ( BTW if someone wants it look in the malware vault or pm me )

Posting links publicly are forbidden, and the post related to it were deleted as well.

 

[DJ Panda]

do you mean clean as in truly clean or in the part like auslogics. they like to add Pua / pups to their installers

Truly clean files from my understanding. It is a similar situation with CCleaner. Its a legit program, but it sometimes has the chrome installer bundled with it.