Reply to thread

Message

<blockquote data-quote="harlan4096" data-source="post: 968813" data-attributes="member: 36043">Some comments / what I see in the malware pack:<ul>
<li data-xf-list-type="ul">As in most of the video tests in general, many samples even can&#039;t run (probably are not even malware).</li>
<li data-xf-list-type="ul">Others samples are probably legit (or even with a valid digital signing), or considered legit by some av firms, but not for others. Probably Apps with bundle “adware/PUP/PUA”, where the installation, in many cases, depends on the user selection, and this is the reason some avs firms don&#039;t consider them in their detections.</li>
</ul>Also, it would be interesting to differentiate in final Second Opinion Results:<ol>
<li data-xf-list-type="ol">How many of the defections of Second Opinion Scanners are actually resident running (or are just inactive leftovers/remnants, see point 2.)&nbsp; -&gt; System Infected</li>
<li data-xf-list-type="ol">How many of the defections of Second Opinion Scanners are just inactive (not detected in original sample folder) -&gt; System Not Clean</li>
</ol>In Hub, before running SOS, I delete all the original samples (of course, those that are not active running). I don&#039;t count in final Second Opinion Scanners results the original samples remained and not active running, or those original samples that probably remained, but their payload were blocked/detected in dynamic.Different method, different criteria he he <img src="data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7" class="smilie smilie--sprite smilie--sprite109" alt=":)" title="Smile&nbsp; &nbsp; :)" loading="lazy" data-shortname=":)" /></blockquote>

[QUOTE="harlan4096, post: 968813, member: 36043"] Some comments / what I see in the malware pack: [LIST] [*]As in most of the video tests in general, many samples even can't run (probably are not even malware). [*]Others samples are probably legit (or even with a valid digital signing), or considered legit by some av firms, but not for others. Probably Apps with bundle “adware/PUP/PUA”, where the installation, in many cases, depends on the user selection, and this is the reason some avs firms don't consider them in their detections. [/LIST] Also, it would be interesting to differentiate in final Second Opinion Results: [LIST=1] [*]How many of the defections of Second Opinion Scanners are actually resident running (or are just inactive leftovers/remnants, see point 2.) -> System Infected [*]How many of the defections of Second Opinion Scanners are just inactive (not detected in original sample folder) -> System Not Clean [/LIST] In Hub, before running SOS, I delete all the original samples (of course, those that are not active running). I don't count in final Second Opinion Scanners results the original samples remained and not active running, or those original samples that probably remained, but their payload were blocked/detected in dynamic. Different method, different criteria he he :) [/QUOTE]

Verification