App Review VoodooShield Review

[MalwareBlockerYT]

Hi all,

This is my review/test of VoodooShield Free. I personally really like this software & am using it on my Host PC right now. Please watch the video for results

Sample Details:

- All from MalwareTips
- 18 Items that are executed
- 2 Items were missed because I renamed them to .exe when they should have been Javascript files! Opps...
- Some of the latest malware samples uploaded & some from late November.

In future tests:

- I will be executing the latest MalwareTips samples
- I will be executing some of the latest threats from Malcode & VXVault & other sources
- I will verify all files to double check for false positives

But here's the video:



Thanks for watching & hopefully you've enjoyed Any feedback is appreciated & I will see you all in the next video

 

[Antimalware18]

Great review! +1 from me.

A little note though. Voodooshield with auto-quarantine any file with over 5 detection's on virustotal which cannot be changed in the free version.

 

[MalwareBlockerYT]

Great review! +1 from me.

A little note though. Voodooshield with auto-quarantine any file with over 5 detection's on virustotal which cannot be changed in the free version.

Thanks & cheers for the correction - I have it set to over 3 on mine because I use the Pro edition

 

[SHvFl]

I enjoyed the video. Any idea what it will get if you only relied on VAi and disabled VT because from what i saw most samples were probably old with many VT detections?

 

[XIII]

I know it might have been an honest mistake, and it would've been a lot of work to redo, but you have to understand that people look for professionalism and accuracy in these type of videos. Giving files the wrong extensions and then missing them is the same thing as leaving those samples out of the video entirely.

The second piece of feedback, is that I recommend you always use the Recommended/Default action for these videos. In this case, it would've been Quarantine instead of Block, as they will work differently, and in a very rare chance, may result in infection. You'd also have to doubleback and delete your Quarantined files and make sure they are removed completely.

 

[Evjl's Rain]

I enjoyed the video. Any idea what it will get if you only relied on VAi and disabled VT because from what i saw most samples were probably old with many VT detections?

there will be a lot more false positives, VT will tell better

 

[MalwareBlockerYT]

I enjoyed the video. Any idea what it will get if you only relied on VAi and disabled VT because from what i saw most samples were probably old with many VT detections?

Thanks & I believe that VoodooAI is actually quite good. From what I've seen it does a good job of classifying malicious files - I think it would still do pretty well in this test. Like I said at the top:

- All from MalwareTips
- 18 Items that are executed
- 2 Items were missed because I renamed them to .exe when they should have been Javascript files! Opps...
- Some of the latest malware samples uploaded & some from late November.

I will be changing this in future tests slightly as already mentioned

 

[Evjl's Rain]

- 2 Items were missed because I renamed them to .exe when they should have been Javascript files! Opps...

I suggestnext time, you can zip the files and create a password so AV won't scan the zip file
It's better than renaming in batch cuz some files can be hta or js or msi

 

[SHvFl]

there will be a lot more false positives, VT will tell better

Sure but many malware morfe every minute to bypass the VT detection. So if you are one of the unlucky to drop on the new payload gg you lost. VT and signatures it's the past and for sure me personally will not rely on them. It's pure chance getting protected like buying a lottery.

 

[MalwareBlockerYT]

I know it might have been an honest mistake, and it would've been a lot of work to redo, but you have to understand that people look for professionalism and accuracy in these type of videos. Giving files the wrong extensions and then missing them is the same thing as leaving those samples out of the video entirely.

The second piece of feedback, is that I recommend you always use the Recommended/Default action for these videos. In this case, it would've been Quarantine instead of Block, as they will work differently, and in a very rare chance, may result in infection. You'd also have to doubleback and delete your Quarantined files and make sure they are removed completely.

At least I was honest about missing the two files. Does it really matter than I missed 2 Javascript files that would most likely both be blocked anyway? I understand that lots of people look for professionalism but trust me it's harder than you think! When you try to do this as well as Coursework, Revision, major exams & still have a social life well it's pretty difficult at times.

Yes I could have clicked on Quarantine but at the end of the day the files were all Blocked & so would all be Quarantined if I clicked the other button. I understand your point but an infection that way would have been extremely unlikely.

I suggestnext time, you can zip the files and create a password so AV won't scan the zip file
It's better than renaming in batch cuz some files can be hta or js or msi

That is a very good idea! I should have thought of that Thanks.

Never said you weren't.

Yes it does.

Don't assume what I think. I've made review videos in the past, I'm doing malware analysis now, as well as some programming projects, all while doing finals review, and 3 finals back to back to back. I don't care about any of that though, if you're not looking for feedback, edit your main post to reflect that.

I am looking for feedback but constructive criticism. I understand your 2nd point but you didn't explain your 1st point: "Giving files the wrong extensions and then missing them is the same thing as leaving those samples out of the video entirely." Yes it is like missing them out of the video but why do you think this is extremely bad? In previous Prevention tests I had about 10 files + that would never execute & for the first time I've started to put together a folder of files which I test before the video to make sure that they execute & I've started to check all of those files for false positives.

I think I have a way of fixing the slightly distorted voice overs. It's my editing software that is messing with the audio quality & so I will need to make the voice over quieter to stop the distortion. As soon as I bring in my audio my editing software will amplify the audio volume causing distortion. In future videos hopefully this will be resolved.

 

[AtlBo]

Another excellent video. Thanks for the video and review.

Some considerations or observations:
Thinking of the masses of typical normal users who may find your video, could you perhaps carve out a little bit of time (at the end?) to place the products you review into a concept of layering? For example, I think I would find it helpful to know that this anti-executable may or may not stop a well designed memory infection, so I could look for this in another product. Another might be, what is the scope of the sandbox and how does it compare to the sandboxing of other products? Does VS sandboxing block all changes to the system, etc.? Overall, I personally think of VS as a last line of defense, considering it does turn off UAC.

A picture graphic or something to explain how a product fits in with other security products would be very beneficial and might even be something you could use over and over by classifying each given product as a specific type of protection all while using the same graphic in different videos. Great you went over the VT input in VS, which is great for everyday users, but the restrictions on free I think could be an issue too and maybe worth a little bit more discussion than just mentioning. Seriously, great work, but a little bit of big picture context at the end perhaps?

A little note though. Voodooshield with auto-quarantine any file with over 5 detection's on virustotal which cannot be changed in the free version.

Thanks for this. I was not aware that this was the default for AS.

I agree with SHvF1 about the luck of the draw problem with VS. I don't know what it would be, but it seems the developers need a second angle on anti-executable to add to VS. Virus Total is a great start, though.

 

[XhenEd]

Overall, I personally think of VS as a last line of defense, considering it does turn off UAC.

No, it doesn't. It suggests you to turn off UAC (which I personally wouldn't recommend doing), but it doesn't turn off UAC by itself or force you to.

 

[AtlBo]

OK, thanks for the information.

 

[Av Gurus]

No, it doesn't. It suggests you to turn off UAC (which I personally wouldn't recommend doing), but it doesn't turn off UAC by itself or force you to.

It does not!

 

[Exterminator]

During installation VoodooShield turns UAC off but you can re-enable it with VodooShield installed.

First of all to @MalwareBlockerYT thank you for spending the time to do your reviews and post them here and asking for member feedback.
There is a way to offer constructive feedback without being condescending and "tooting your own horn".
It would be nice if everyone remembers this and reply in a respectful manner.

 

[Av Gurus]

During installation VoodooShield turns UAC off

It does not!
Here a some picture of installation (i don't want to record video now):


Can you show that?

 

[askmark]

I agree with SHvF1 about the luck of the draw problem with VS. I don't know what it would be, but it seems the developers need a second angle on anti-executable to add to VS. Virus Total is a great start, though.

But VS does have a "second angle" as it doesn't just rely on VT results to determine if a file is malware or safe. It also uses what it calls VoodooAi to identify malware. This is completely signatureless and instead relies on machine learning and artificial intelligence to analyze files for maliciousness. This means VS can also detect zero day as well as known malware. The best of both worlds.

 

[Exterminator]

It does not!
Here a some picture of installation (i don't want to record video now):
View attachment 126388 View attachment 126389 View attachment 126390 View attachment 126391

Can you show that?

I have not used it in a while but I installing on VM

 

[Av Gurus]

That was in version 2, from version 3 that is not happening any more.

 

[Exterminator]

That was in version 2, from version 3 that is not happening any more.

I just installed version 3.48 and you are correct