App Review These 3 top-tier AV's failed to stop 10 variants of script Clipper malware

[Khushal]

Content source

https://www.youtube.com/watch?v=pwKurrUVVj8

Verdict: ESET Security Ultimate, BitDefender Free and Malwarebytes Trial all failed to detect 10/10 samples, ending at 0% detection/stop rate.

 

[tiktoshi]

Please test it, and thank you in advance.

Post in thread 'POLAR ANTIVIRUS free'

Dec 20, 2025

I played around with it a bit, and yes, it no longer uses Ikarus. It has VirusTotal and its own engine (it downloads its definitions via GitHub).

Here is its interface.

Spoiler: Interface

View attachment 293887View attachment 293888View attachment 293889View attachment 293890

VirusTotal is clearly indicated with the choice of “engines” used (Kaspersky, Avast, etc.), somewhat like Secureaplus/CatchPulse.
Note that the antivirus does not provide the API key; you will have to enter it yourself (unfortunately, it does not indicate that one is required or how to do so).

Spoiler: VT

View attachment 293891

The Polar engine (very little...

• tiktoshi

• 
• 
• 

Release POLAR ANTIVIRUS · tiktoshi40-netizen/polupdate

🐻‍❄️ POLAR ANTIVIRUS POLAR ANTIVIRUS is a modern, lightweight, and powerful security solution designed to provide multi-layered protection for your Windows environment. Combining local signature-ba...

github.com

 

[Parkinsond]

Verdict: ESET Security Ultimate, BitDefender Free and Malwarebytes Trial all failed to detect 10/10 samples, ending at 0% detection/stop rate.

Any AV can skip script samples, including K you like, so either use K version with app control or use any other AV bundled with its own app control module or with MS app control.

And after all such measures, there is no 100% guarantee to be infection-free than your knowledeg of how to get infected to avoid being exposed at the first place.

 

[Khushal]

Any AV can skip script samples, including K you like, so either use K version with app control or use any other AV bundled with its own app control module or with MS app control.

And after all such measures, there is no 100% guarantee to be infection-free than your knowledeg of how to get infected to avoid being exposed at the first place.

I don't like K I only admire its near perfection and according to him these 10 were missed by K as well.

 

[Parkinsond]

near perfection

Well-said; near perfection, no product is perfect.

 

[Sorrento]

Kaspersky is still for me the best solution I've found, however on a personal basis I don't rate some of the YouTube videos very highly at all, & anything in life can be bypassed or broken, its the way things but we can do all we can to avoid malware getting on to our systems in the first place, they don't drop out of the sky they have to be downloaded somehow, so for me that's the first line of defence, not a perfect solution though, but what is?

 

[Parkinsond]

Kaspersky is still for me the best solution I've found, however on a personal basis I don't rate some of the YouTube videos very highly at all, & anything in life can be bypassed or broken, its the way things but we can do all we can to avoid malware getting on to our systems in the first place, they don't drop out of the sky they have to be downloaded somehow, so for me that's the first line of defence, not a perfect solution though, but what is?

The most stealthy method of infection currently are the compromised websites with browser-in-browser malware; can skip web protection and even user cautious behavior.

 

[Sampei.Nihira]

The most stealthy method of infection currently are the compromised websites with browser-in-browser malware; can skip web protection and even user cautious behavior.

But they don't bypass an adblock with dynamic filtering set to Medium Mode.
Even Enhanced Easy Mode, (only block 3p-frames) is better than nothing (Easy Mode).

P.S.

Many users in this forum should consider using their adblocker, now in 2026, with a leap in quality, setting at least the simplest mode of dynamic filtering.

 

[Sorrento]

The most stealthy method of infection currently are the compromised websites with browser-in-browser malware; can skip web protection and even user cautious behavior.

Just out of pure interest have you encountered this issue yourself, because as far as I am aware I have yet to??

 

[Parkinsond]

Just out of pure interest have you encountered this issue yourself, because as far as I am aware I have yet to??

Not yet; definitely I'll declare on MT if I stumbled over one.

 

[Parkinsond]

But they don't bypass an adblock with dynamic filtering set to Medium Mode.
Even Enhanced Easy Mode, (only block 3p-frames) is better than nothing (Easy Mode).

P.S.

Many users in this forum should consider using their adblocker, now in 2026, with a leap in quality, setting at least the simplest mode of dynamic filtering.

The real dilemma is the compromised legitimate adblocker may be the portal for such attack

 

[Shadowra]

Quite surprised by Bitdefender's result (which claims to be the best in Behavior), but let's not kid ourselves: no antivirus will protect you 100%.

 

[Khushal]

Quite surprised by Bitdefender's result (which claims to be the best in Behavior), but let's not kid ourselves: no antivirus will protect you 100%.

and K as well

 

[Divergent]

Quite surprised by Bitdefender's result (which claims to be the best in Behavior), but let's not kid ourselves: no antivirus will protect you 100%.

Executing malware directly from the desktop exploits Contextual Scoring Bias. Modern EDRs like Bitdefender use a weighted scoring system where a file's location influences its initial "threat score." Because the Desktop is a frequent location for legitimate user-initiated software (installers, tools), the behavioral engine may allow more "initial" actions before reaching the block threshold, compared to a file executing from a hidden or temporary directory.

 

[ForgottenSeer 114717]

Executing malware directly from the desktop exploits Contextual Scoring Bias. Modern EDRs like Bitdefender use a weighted scoring system where a file's location influences its initial "threat score." Because the Desktop is a frequent location for legitimate user-initiated software (installers, tools), the behavioral engine may allow more "initial" actions before reaching the block threshold, compared to a file executing from a hidden or temporary directory.

At least use a free DropBox or similar cloud storage instance and then create a .LNK file to download the sample with a command line switch to execute it. Let's say download it to a writable non-admin access directory in System Space (C:\Windows\<some_non.admin_folder_path>).

Shakira say, where "HIPS" is used in a substitution cipher to mean "Divergent."