PaulBB
October 27th, 2006, 01:20 PM
-{ Quote: "The AVZ antivirus utility is intended for searching and deleting the following malicious programs:
· Spyware and Adware programs and modules (this is the main goal of this utility)
· Network and mail worms
· Trojan horses (including all their variations, in particular, Trojan-PSW, Trojan-Downloader, and Trojan-Spy) and backdoor programs (programs intended for remote control over the infected computer)
· Trojan horses intended for dialing purposes (Dialer, Trojan.Dialer, Porn-Dialer)
· Keyloggers and other programs that can be used for tracking user activities
This utility is a direct analogue of such programs as Trojan Hunter and LavaSoft Ad-aware 6. Its main goal is finding and removing adware and spyware modules, as well as Trojan horses.
It is necessary to mention that programs belonging to Spyware and Adware categories by definition are not viruses or Trojan horses. The track user activities and download information and program code to the infected computer mainly for the marketing goals. This means that the information being transmitted does not contain critical data, such as passwords, credit card numbers, etc. At the same time, the information that they download is mainly made up of promotion materials and updates. Nevertheless, the difference between Spyware and Trojan roses is very subtle, because of which accurate classification is hardly possible. My approach to malware classification and criteria used for this purpose are described in this on-line Help system.
The main feature of AVZ is the possibility of configuring the program reaction to the presence of any types of malicious programs. For example, it is possible to choose the mode in which the program will destroy viruses and Trojans detected, but deletion of Adware programs will be blocked.
Another specific feature of AVZ consists of multiple heuristic system checks, which are not based on the signature search mechanism. These include searching for rootkits, keyloggers, and various backdoors based on typical TCP/UDP ports. Such techniques of searching allow for finding new variants of malicious programs.
In addition to typical signature-based file searching, AVZ provides the built-in database containing digital signatures of tens of thousands of system files. Using this database allows for reducing the number of false actuations of heuristics and allows for solving a range of other problems. In particular, the file searching system provides a filter for excluding known files from the search results, the manager of running process and SPI settings highlights known processes with color, and when adding files to quarantine addition of trusted files known to AVZ is blocked.
As my experience has shown, Spyware programs can often be classified as Adware and vice versa. The reason for this is straightforward, because in most cases espionage aims at targeted promotion. Especially for such cases, I have introduced a generalized Spy category, which can be interpreted as Adware+Spyware. This is a convenient approach when dealing with programs of this class.
Program limitations:
1.Because the utility is mainly intended for eliminating Adware and Spyware modules, it currently does not support check of several types of archives, PE packers and documents. When eliminating Spyware these features are simply unneeded. Nevertheless, this utility is constantly being improved, and I plan to implement such functions.
2.The utility does not heal programs infected with computer viruses. For high quality and correct healing of infected programs specialized antivirus programs are needed (such as, for example, Kaspersky Antivirus Monitor, DrWeb, Norton Antivirus, Panda, etc.). I do not intend to re-invent the wheel trying to implement direct analogues of such programs. This is even truer, if you recall that viruses of this type are gradually becoming rare." }-
http://img161.imageshack.us/img161/9874/screen1ye5.png
http://img211.imageshack.us/img211/8899/screen2bh9.png
http://img158.imageshack.us/img158/8912/screen3lc6.png
http://img158.imageshack.us/img158/7645/screen4hc4.png
-{ Quote: "The main goals of the AVZ utility are as follows:
1. AV database. It allows for diagnosing malware programs known to AVZ and deleting them. Removal of malicious programs assumes automatic clean-up of all traces of the malware activity in the system registry and in INI files. In this respect, AVZ is convenient for express cleanup of the infected computer before using powerful antivirus products and scanning the computer using them.
2. Automatic scanning of the target computer and forming the scanning log in the HTML format. During system investigation, the files that were recognized as secure in the course of checking by the AVZ trusted objects database and Microsoft's security catalogue. This considerably reduces the log size. This mode is very convenient for on-line study of suspicious computer by the administrator, as well as for remote system investigation. The possibility of starting system scanning and quarantine by means of scripts allows for full automation of this operation. All that the end-user needs to do is starting the batch file.
3. Automatic quarantine of files that are not digitally signed by Microsoft and are not described in the AVZ trusted objects database for further investigation (manually or using powerful specialized antivirus software). This operating mode is convenient for qucikly collecting all unrecognized files for further analysis. In addition, AVZ provides quarantine by the list, and commands for adding files to quarantine in scripts. This simplifies the procedure of collecting suspicious files from remote computers.
4. Searching for rootkits and other API hooks supplied with the function of searching for hidden processes. In addition to analysis of hooks, AVZ provides the function for neutralizing user-mode and kernel-mode rootkits.
5. System recovery. AVZ includes microprograms for automatic correction of most typical Internet Explorer and Windows Explorer settings, resetting desktop settings to the default ones, neutralization of policies installed by Trojan horses. Antivirus programs do not carry out these operations. Because of this, normal operation of the system cannot be restored even after removal of Trojan horses or Spyware programs.
6. Automatic checking of SPI/LSP settings and correcting errors in automatic mode. This function allows to eliminate most typical LSP problems that take place after removal of certain Adware programs.
7. Searching files on the hard disk. The searching procedure is protected by the AVZ antirootkit. It provides several functions, useful for searching viruses and Trojan horse. In particular, this mechanism allows for excluding the files recognized as trusted by AVZ or digitally signed by Microsoft from the list of files found. This allows for considerable reduction of the search range.
8. Built-in scripting language that allows for controlling AVZ operation. Scripts provide the possibility to use AVZ in corporate network. In this case, it is possible to start AVZ from logon script or from autoruns list. In this case, AVZ will operate according to the script previously written by system administrator.
9. Analyzer of running processes that allows for searching and locating suspicious objects in the mode of the highest heuristics level.
10. The AVZGuard system that allows for protecting AVZ and any other applications specified by it against active malicious programs. This will also limit the influence of malicious programs on the system.
---------
Thus, AVZ is positioned as an interactive tools intended for studying the PC to detect and remove malicious programs." }-
This version is freely distributed and intended for non-commercial use.
Website (http://z-oleg.com/secur/avz/avzguard.php)
Download AVZ Antivirus 4.21 (eng) no install required (http://z-oleg.com/avz4en.zip)
· Spyware and Adware programs and modules (this is the main goal of this utility)
· Network and mail worms
· Trojan horses (including all their variations, in particular, Trojan-PSW, Trojan-Downloader, and Trojan-Spy) and backdoor programs (programs intended for remote control over the infected computer)
· Trojan horses intended for dialing purposes (Dialer, Trojan.Dialer, Porn-Dialer)
· Keyloggers and other programs that can be used for tracking user activities
This utility is a direct analogue of such programs as Trojan Hunter and LavaSoft Ad-aware 6. Its main goal is finding and removing adware and spyware modules, as well as Trojan horses.
It is necessary to mention that programs belonging to Spyware and Adware categories by definition are not viruses or Trojan horses. The track user activities and download information and program code to the infected computer mainly for the marketing goals. This means that the information being transmitted does not contain critical data, such as passwords, credit card numbers, etc. At the same time, the information that they download is mainly made up of promotion materials and updates. Nevertheless, the difference between Spyware and Trojan roses is very subtle, because of which accurate classification is hardly possible. My approach to malware classification and criteria used for this purpose are described in this on-line Help system.
The main feature of AVZ is the possibility of configuring the program reaction to the presence of any types of malicious programs. For example, it is possible to choose the mode in which the program will destroy viruses and Trojans detected, but deletion of Adware programs will be blocked.
Another specific feature of AVZ consists of multiple heuristic system checks, which are not based on the signature search mechanism. These include searching for rootkits, keyloggers, and various backdoors based on typical TCP/UDP ports. Such techniques of searching allow for finding new variants of malicious programs.
In addition to typical signature-based file searching, AVZ provides the built-in database containing digital signatures of tens of thousands of system files. Using this database allows for reducing the number of false actuations of heuristics and allows for solving a range of other problems. In particular, the file searching system provides a filter for excluding known files from the search results, the manager of running process and SPI settings highlights known processes with color, and when adding files to quarantine addition of trusted files known to AVZ is blocked.
As my experience has shown, Spyware programs can often be classified as Adware and vice versa. The reason for this is straightforward, because in most cases espionage aims at targeted promotion. Especially for such cases, I have introduced a generalized Spy category, which can be interpreted as Adware+Spyware. This is a convenient approach when dealing with programs of this class.
Program limitations:
1.Because the utility is mainly intended for eliminating Adware and Spyware modules, it currently does not support check of several types of archives, PE packers and documents. When eliminating Spyware these features are simply unneeded. Nevertheless, this utility is constantly being improved, and I plan to implement such functions.
2.The utility does not heal programs infected with computer viruses. For high quality and correct healing of infected programs specialized antivirus programs are needed (such as, for example, Kaspersky Antivirus Monitor, DrWeb, Norton Antivirus, Panda, etc.). I do not intend to re-invent the wheel trying to implement direct analogues of such programs. This is even truer, if you recall that viruses of this type are gradually becoming rare." }-
http://img161.imageshack.us/img161/9874/screen1ye5.png
http://img211.imageshack.us/img211/8899/screen2bh9.png
http://img158.imageshack.us/img158/8912/screen3lc6.png
http://img158.imageshack.us/img158/7645/screen4hc4.png
-{ Quote: "The main goals of the AVZ utility are as follows:
1. AV database. It allows for diagnosing malware programs known to AVZ and deleting them. Removal of malicious programs assumes automatic clean-up of all traces of the malware activity in the system registry and in INI files. In this respect, AVZ is convenient for express cleanup of the infected computer before using powerful antivirus products and scanning the computer using them.
2. Automatic scanning of the target computer and forming the scanning log in the HTML format. During system investigation, the files that were recognized as secure in the course of checking by the AVZ trusted objects database and Microsoft's security catalogue. This considerably reduces the log size. This mode is very convenient for on-line study of suspicious computer by the administrator, as well as for remote system investigation. The possibility of starting system scanning and quarantine by means of scripts allows for full automation of this operation. All that the end-user needs to do is starting the batch file.
3. Automatic quarantine of files that are not digitally signed by Microsoft and are not described in the AVZ trusted objects database for further investigation (manually or using powerful specialized antivirus software). This operating mode is convenient for qucikly collecting all unrecognized files for further analysis. In addition, AVZ provides quarantine by the list, and commands for adding files to quarantine in scripts. This simplifies the procedure of collecting suspicious files from remote computers.
4. Searching for rootkits and other API hooks supplied with the function of searching for hidden processes. In addition to analysis of hooks, AVZ provides the function for neutralizing user-mode and kernel-mode rootkits.
5. System recovery. AVZ includes microprograms for automatic correction of most typical Internet Explorer and Windows Explorer settings, resetting desktop settings to the default ones, neutralization of policies installed by Trojan horses. Antivirus programs do not carry out these operations. Because of this, normal operation of the system cannot be restored even after removal of Trojan horses or Spyware programs.
6. Automatic checking of SPI/LSP settings and correcting errors in automatic mode. This function allows to eliminate most typical LSP problems that take place after removal of certain Adware programs.
7. Searching files on the hard disk. The searching procedure is protected by the AVZ antirootkit. It provides several functions, useful for searching viruses and Trojan horse. In particular, this mechanism allows for excluding the files recognized as trusted by AVZ or digitally signed by Microsoft from the list of files found. This allows for considerable reduction of the search range.
8. Built-in scripting language that allows for controlling AVZ operation. Scripts provide the possibility to use AVZ in corporate network. In this case, it is possible to start AVZ from logon script or from autoruns list. In this case, AVZ will operate according to the script previously written by system administrator.
9. Analyzer of running processes that allows for searching and locating suspicious objects in the mode of the highest heuristics level.
10. The AVZGuard system that allows for protecting AVZ and any other applications specified by it against active malicious programs. This will also limit the influence of malicious programs on the system.
---------
Thus, AVZ is positioned as an interactive tools intended for studying the PC to detect and remove malicious programs." }-
This version is freely distributed and intended for non-commercial use.
Website (http://z-oleg.com/secur/avz/avzguard.php)
Download AVZ Antivirus 4.21 (eng) no install required (http://z-oleg.com/avz4en.zip)