New Maymoons's Test: Killdisk Malware VS Behavioral Blocker

[maymoons]

1. Test Configuration
Windows Xp Sp3
Vmware on Vista Home Premium Sp1

2. Test Terms

* i am not professional tester. (i dont know who is a professional tester, is there any AV test school, sertification :thumbd:) But this test dont required professional tester. This is real word simulation.

*i tested this software(all the latest version)

-Comodo IS (without Av module)
-DefenseWall
-DriveSentry
-Malware Defender
-Mamutu
-Online Armour
-Prevx
-PR Safe Connect
-Sandboxie
-ThreatFire

* i tested this malware (all malware is well known, all malware is real from the real word. ther arent leak test. All malware is a living. you can see it in action video)

-trojan.killdisk.aaa
-trojan.killdisk.b
-trojan.killdisk.x
-win32.killdisk.z

* all tests are recorded to videos. all tests are transparent. Anybody can not say "you are liar" >:(

* i uploaded all videos to rapidshare. i dont want to see any mirror. i want to see how many download. Because i wont do new test with all software. i will do popularity analys, i will do new test with only 3-4 popular product. there is a download calculator on rapidshare. you can ask me why rapidshare (you can see here (http://www.wilderssecurity.com/showthread.php?t=226606))

* i spent 10 hours for the test. i want to regard. if you dont like conclusion, if yours favourite software failed, if ... Please dont attack me. i like criticism, but i dont like disrespect.



3. Introduction
You can see all malware on action.

http://rapidshare.com/files/173750670/01.Killdisk_vs_BM-introduction.rar

3. Conclusion

Test1 : Comodo (default settings)
http://rapidshare.com/files/173752581/02.Killdisk_vs_BM-comodo-default_settings-part_1.rar
http://rapidshare.com/files/173753225/03.Killdisk_vs_BM-comodo-default_settings-part_2.rar

Test 2: Comodo with maximum settings
http://rapidshare.com/files/173719075/04.Killdisk_vs_BM-comodo-maximum_settings.rar

Test 3: Defensewall
http://rapidshare.com/files/173719851/05.Killdisk_vs_BM-defensewall.rar


Test 4: Drivesentry (without signature database)
http://rapidshare.com/files/173731396/07.Killdisk_vs_BM-drive_sentry-without_signature_database.rar

Test 5: Drivesentry (with signature database)
http://rapidshare.com/files/173727705/06.Killdisk_vs_BM-drive_sentry-with_signature_database.rar

Test 6: Malware Defender
http://rapidshare.com/files/173732759/08.Killdisk_vs_BM-malware_defender.rar

Test 7: Mamutu
http://rapidshare.com/files/173736409/09.Killdisk_vs_BM-mamutu.rar

Test 8: Online Armour
http://rapidshare.com/files/173739455/10.Killdisk_vs_BM-online_armour.rar

Test 9: Prevx (without internet connection only herulistic dedection)
http://rapidshare.com/files/173740051/11.Killdisk_vs_BM-prevx_-without_internet_connection-part1.rar
http://rapidshare.com/files/173744315/13.Killdisk_vs_BM-prevx-without_internet_connection-part2.rar

Test 10: Prevx (with internet connection)
http://rapidshare.com/files/173741140/12.Killdisk_vs_BM-prevx-with_internet_connection_and_herulistic_max.rar

Test 11: PR Safe Connect
http://rapidshare.com/files/173746851/14.Killdisk_vs_BM-privaty_response_safe_connect.rar

Test 12:Sandboxie
http://rapidshare.com/files/173748138/15.Killdisk_vs_BM-sandboxie.rar

Test 13:Threatfire (without signature database)
http://rapidshare.com/files/173749620/16.Killdisk_vs_BM-threatfire-without_signature_database.rar

[Fuzzfas]

Interesting test idea :thumb: , but i would have prefered a link with all the results grouped too, since rapidshare doesn't allow you to download as free user more than 1 file per time. You need to wait before downloading the next time.

[s4u]

-{ Quote: "Interesting test idea :thumb: , but i would have prefered a link with all the results grouped too, since rapidshare doesn't allow you to download as free user more than 1 file per time. You need to wait before downloading the next time." }-
Yep. A result list would be nice indeed. Thanks

[maymoons]

-{ Quote: "Interesting test idea , but i would have prefered a link with all the results grouped too, since rapidshare doesn't allow you to download as free user more than 1 file per time. You need to wait before downloading the next time." }-

Sory. i want to count download, per by software.
i will do new test. i want to test all software. i am needing software popularity rate.

i have no too much time :)

i know RS limitations. you can use CryptLoad 1.1.5. it is RS automation software.

[LoneWolf]

What do I need to open this file with ???

[Pseudo]

-{ Quote: "What do I need to open this file with ???" }-
The RAR file?

[LoneWolf]

-{ Quote: "The RAR file?" }-

Yes, that one.

[Pseudo]

-{ Quote: "Yes, that one." }-
A lot of archiving software can unpack it (WinRAR (http://rarlabs.com/), WinZIP (http://winzip.com/), and 7-Zip (http://7-zip.org/) to name a few).

[LoneWolf]

-{ Quote: "A lot of archiving software can unpack it (WinRAR (http://rarlabs.com/), WinZIP (http://www.winzip.com/), and 7-Zip (http://7-zip.org/) to name a few)." }-

Thank you :thumb:

[Pseudo]

-{ Quote: "Thank you :thumb:" }-
Go with 7-Zip if you want no real limitations, it's open-source and opens a lot of archive files. ;)

[Criss]

Erm i wan to ask did prevx clean-up the last malware which it miss with medium heuristics??

[Pseudo]

It'll take a long time to download all of these files... :-\
Please post the final results.

[Criss]

-{ Quote: "It'll take a long time to download all of these files... :-\
Please post the final results." }-

i watched some of the video.

Sandboxie - all the malware is prevented

Prevx edge(with internet connection) - Able to detect all in high heuristics but wif middle heuristics only able to detect 3 of them.

Drivesentry - Not even one is detected.

[maymoons]

-{ Quote: "Prevx edge - Able to detect all in high heuristics but wif middle heuristics only able to detect 3 of them." }-

this is wrong. Watch it carefully.
i sent 2 videos,

1. tested it only herulistic (this test is important)
2. tested it with herulistic and malware database (this is not important)


my goal;
behavioral protection.
Not malware database dedection.

Already, all antiviruses can dedect samples. This is not key point.
(look at introduction file.)


Keypoint is a behavioral technology vs Malware.



-{ Quote: "It'll take a long time to download all of these files...
Please post the final results." }-

Hey guy, i give to 10 hours for the test, you can give 1-2 hours for downloading.

there are many important point in the tests. you must watch them.

i posted videos because some members say "your test is not good, your test is not real word, ..."

This is real word. Real malware. Real videos. i say this members; give it them. and see test is good/bad.

i dont want

prevx y/4
threatfire x/4

like message.

[Criss]

-{ Quote: "this is wrong. Watch it carefully.
i sent 2 videos,

1. tested it only herulistic (this test is important)
2. tested it with herulistic and malware database (this is not important)


my goal;
behavioral protection.
Not malware database dedection.

Already, all antiviruses can dedect samples. This is not key point.
(look at introduction file.)


Keypoint is a behavioral technology vs Malware.





Hey guy, i give to 10 hours for the test, you can give 1-2 hours for downloading.

there are many important point in the tests. you must watch them.

i posted videos because some members say "your test is not good, your test is not real word, ..."

This is real word. Real malware. Real videos. i say this members; give it them. and see test is good/bad.

i dont want

prevx y/4
threatfire x/4

like message." }-

o sry. i only watched the the Prevx with internet connection video. i should go edit my post.

[maymoons]

-{ Quote: " o sry. i only watched the the Prevx with internet connection video. i should go edit my post." }-

please...
Look at virus total report's attachment.
Viruses are already known.i have many unknown killdisk viruses but i select this 4 samples. Because All Av can dedected them.

Prevx Edge with internet collection catch them easily.
This is not success.

Success is a blocking without malware database.

Prevx Edge (with internet collection) for only information. Real test isnt that.

[BrendanK.]

So in other words this test was based on the core behavioral guard, not the signatures that come with it.

[Kees1958]

Maymoons,

Upload them om you tube, give matt some competition. I did teh test on DefenseWall some time ago, Malware Defender lately. But I won't spoil your party. After 10 hours testing and uploading.

:-X :thumb:

[MikeNash]

Hi Maymoons,

I watched only one of your videos (guess which one!) - I'll take your comments on board about learning mode. Probably, we need to make it stand out a bit more so the users get it.

The first reboot learning mode, as you saw, cannot be manually halted.


Mike

[maymoons]

-{ Quote: "But I won't spoil your party. After 10 hours testing and uploading." }-

Thank you.

-{ Quote: "Upload them om you tube, give matt some competition" }-

Youtube is blocked in my country.

i dont want competition.
This is my hobby.
ı dont want money, advertisement, ...

i tested more product than Matt.

i prefer this video for only wilderssecurity.

i learned many things in here
this is my "thank you"

[Kees1958]

Sorry maymoons,

Hope you noticed the thumbs up :thumb: for the thread you started. I do not understand the context of your thank you.

Regards Kees

[Hugger]

This thread is great. I hope you keep it going.

BUT I can't open the video after I download it with Free Download Manager.
I double click on it and get no reaction at all.
I dcn't know why. I'll have to wait.
Thanks for sharing your results.
Hugger

[Peter2150]

Hey Maymoons

You are doing something that probably is quite valuable, but you comment I spent 10 hours doing it so you can spend 1-2 hours downloading doesn't wash.

I am curious, but not curious enought to spend the time downloading. Sorry.

[trjam]

I agree. A simple link to reviews would be nice with just the results posted here. Great job you have done, but some simplfication for members here would help.

[icr]

Yeah I agree with pete2150
many here might be using dialup:-[
anyways u have done good job have dl one rar file:thumb: :thumb: :thumb:

[maymoons]

-{ Quote: "Yeah I agree with pete2150
many here might be using dialup
anyways u have done good job have dl one rar file
Reply With Quote" }-

This is special station for this test.
i want to see how many people download files, which software is popular.

i will upload one file next test.

But i want to little insight for this test.


-{ Quote: "This thread is great. I hope you keep it going.

BUT I can't open the video after I download it with Free Download Manager.
I double click on it and get no reaction at all.
I dcn't know why. I'll have to wait.
Thanks for sharing your results.
Hugger
Reply With Quote" }-

Thank you. wait my new test. you can use vlcplayer or k-lite codec pack (for the your problem)


-{ Quote: "You are doing something that probably is quite valuable, but you comment I spent 10 hours doing it so you can spend 1-2 hours downloading doesn't wash.

I am curious, but not curious enought to spend the time downloading. Sorry." }-


sory for you.
i prefer, you download it and show conc.


-{ Quote: "Yeah I agree with pete2150
many here might be using dialup
anyways u have done good job have dl one rar file" }-

i have same problem. i am uploading them max 25kb/s. i can upload all files 3 hours. and i cant download anythint this 3 hours.
But i am searching better presentation.

i posted screenshoot my old threat, some peoples sad that "too many screenshoots, like hell"
i was angry. anyway.

i want to transparent test, i want everybody can see all story.

i dont sale anythink, somebady can want download it, somebady cant want.
i cant to satisfy everyone.

You can sure, videos size are too small for 20-30 minutes.
if you download it you can see without any problem
youtube has a stop-play, stop-play problem with the large files.

i uploaded malware collection (5 gibs)
Av vendors sad that "please upload them again to ours ftp"

i uploaded test reports
Members sad that "i wont download them"

i have too hard life :)

[Ilya Rabinovich]

-{ Quote: "
BUT I can't open the video after I download it with Free Download Manager.
I double click on it and get no reaction at all.
I dcn't know why. I'll have to wait.
" }-
Check it doesn't interferer with DefenseWall.

[Einsturzende]

Ok, first to thank you maymoons, so thank you for testing, second I have request for you, could you please test Kaspersky IS 2009? (latest v.506) (please see intriguing screenshot)

204859

[maymoons]

From 3xist;


-{ Quote: "Hey manymoons. :)

I saw the video of CIS Max Settings. Just for your information, Paranoid Mode is not the full max settings of CIS. In CIS GUI, If you go to Miscellaneous>Manage My Configurations>Select "COMODO - Proactive Security" This will activate full Defense+ automatically for you.Or you can simply right click sys tray CIS icon, Choose Configuration and choose it from there. You won't need to worry about anything else since this is the default full Defense+ Security configuration, It's not a bug. :)

Thanks.
Josh
" }-

Thank you mate. i like Comodos fans. Comodo has many good fans. It will be on the race always

[djohn]

Hey maymoons your doing Good man.IMO the time it takes to extract and watch a video or two is not a big deal with Broadband,however dialup user would suffer and probably would give up after the first.I trust your findings enough if you where to just report as your findings minus the video.:thumb:

[maymoons]

-{ Quote: "I trust your findings enough" }-

You trust. Others???

-{ Quote: "Ok, first to thank you maymoons, so thank you for testing, second I have request for you, could you please test Kaspersky IS 2009? (latest v.506) (please see intriguing screenshot)" }-

i wont do test with kaspersky. Sory. I have no more time for this category. i am preparing new test.

@Ilya Rabinovich, Defensewall is too popular

[Einsturzende]

-{ Quote: "
i wont do test with kaspersky. Sory. I have no more time for this category. i am preparing new test." }-

Maybe you can send me samples to test in vmware myself? I have and can find some samples of killdisk from offensivecomputing but they are not the same :(

[maymoons]

-{ Quote: "Maybe you can send me samples to test in vmware myself?" }-

sory, i cant send malware files.
i am sending malware only av labs.

And kaspersky for Vista hasnt Low level disc access. (i remember, am i true?)
this is not good for the kaspersky user.

i want to test jiamin AV tonigth. (for myself)
its look like good.

But if i find time, i will test kaspersky for you.

[Saraceno]

Interesting testing maymoons. It's good how you show you don't take shortcuts, rebooting when necessary, waiting for the program/settings to load. :)

Only had time to look at a couple tonight, will check more later today.

Mamutu's paranoid mode does seem to make a difference.

[Saraceno]

And DefenseWall, how awesome a program is it? ;)

Great work Ilya. :thumb:

[Einsturzende]

-{ Quote: "sory, i cant send malware files.
i am sending malware only av labs.

And kaspersky for Vista hasnt Low level disc access. (i remember, am i true?)
this is not good for the kaspersky user.

i want to test jiamin AV tonigth. (for myself)
its look like good.

But if i find time, i will test kaspersky for you." }-

yes, you are right, on Vista to gain "designed for Vista" (or something) logo they must to comply to MS "guidelines" which forbid that kind of "defense" on Vista, and I agree with you " this is not good for the kaspersky user"

Edit: and please do test it if you find some spare time, many thanks :)

[maymoons]

-{ Quote: "Mamutu's paranoid mode does seem to make a difference." }-

Mamutu's paranoid mode has too many alert.
How can user decide its important or it isnt?

i think, it dont give userfriendly message. sad that "suspicious" why? any detailed information? there is no.

[Saraceno]

Just checking out threatfire maymoons! My wireless connection is a little slow tonight. :P ;D

[Fuzzfas]

-{ Quote: "Just checking out threatfire maymoons! My wireless connection is a little slow tonight. :P ;D" }-

TF performed fine and without the update database. Maybe it's irritating that doesn't have the "block" feature or that isn't as light as Mamutu, but i have always found it more convincing in default settings. (Mamutu in paranoid mode becomes noisy like a classical hips).

[Victek123]

-{ Quote: "TF performed fine and without the update database. Maybe it's irritating that doesn't have the "block" feature or that isn't as light as Mamutu, but i have always found it more convincing in default settings. (Mamutu in paranoid mode becomes noisy like a classical hips)." }-

Perhaps you could try DriveSentry as well?

[Fuzzfas]

-{ Quote: "Perhaps you could try DriveSentry as well?" }-

Maymoons did that (1st page).

I had installed DS some time ago (when Katie first appeared in the forum), but i had several bugs and most of all, constant CPU usage, which for me was unacceptable. See my post here:

http://www.wilderssecurity.com/showthread.php?t=209764&page=3


Since then they have launched many new versions, but the whole community thing doesn't appeal to me. And last i read, there was a memory leak. So, maybe i will try it again in the future, when it's more mature. But as long as i can have good security with very little CPU usage , i will avoid community based software (i run TF without community support too).

[Fuzzfas]

-{ Quote: "Mamutu's paranoid mode has too many alert.
How can user decide its important or it isnt?

i think, it dont give userfriendly message. sad that "suspicious" why? any detailed information? there is no." }-

I agree. Mamutu on paranoid isn't acting as a behaviour blocker anymore, it's more noisy than a classical HIPS, so you 'd rather run a classical HIPS.


Speaking of which, Comodo with default installation options, got busted, as expected. Since overwriting the MBR can be catastrophic, maybe Comodo should consider activating the "direct disk access" in default installation options. This made all the difference between the first and second part of the testing.


Good tests, interesting for any user.

[Hugger]

-{ Quote: "Check it doesn't interferer with DefenseWall." }-

Hi, Ilya.
Thanks. But I have already disabled DW and it makes no difference.
Hugger

[demoneye]

first 10x alot for your time mate , u do a good job!

for Mamutu lovers , it screw up in all 4 test.
when it set to paranoid mode , its screw "only" one trojan :thumbd:

[C.S.J]

I have to agree with Peter, if the results ain't 'in my face', I'd rather just not bother.

I certainly don't have a few hours to download some rapidshare links, some of us lead busy lives too.

[Einsturzende]

-{ Quote: "I have to agree with Peter, if the results ain't 'in my face', I'd rather just not bother.

I certainly don't have a few hours to download some rapidshare links, some of us lead busy lives too." }-

And I dont like your comment nor Peter's reason...

[subset]

-{ Quote: "
I certainly don't have a few hours to download some rapidshare links, some of us lead busy lives too." }-
Looks like you are not the targeted test object. ::)

"i want to count download, per by software... i am needing software popularity rate."
Stand in line and download your favorite video now! :wacko:
Seems like someone has his head in the clouds.

Cheers

[Martijn2]

I really enjoy reading your tests Maymoons, thumbs up for you :thumb:

[denniz]

-{ Quote: "
for Mamutu lovers , it screw up in all 4 test.
when it set to paranoid mode , its screw "only" one trojan :thumbd:
" }-

Yeah, really disappointed in Mamutu. For such a fancy program I would have thought it provided much better protection without using paranoid mode.

Mamutu :thumbd:

[jlo]

Just wondering?

I have bought A-Squared antimalware which his Mamutu built in.

Now when I was testing it did not give any alerts at all when run in Sandboxie. I let some malware run in Sandboxie and did not see a peep from IDS behaviour blocker untill Avast was warning me of malware via its SMTP scanner which I had not paused.

However when run under normal Vista I have seen plenty of IDS behaviour alerts.

I just wondered whether Mamatu runs properly under a virtual enviorment?

Cheers

Jlo

[demoneye]

-{ Quote: "Yeah, really disappointed in Mamutu. For such a fancy program I would have thought it provided much better protection without using paranoid mode.

Mamutu :thumbd:" }-

jep , and this was only 4 malware , i don't wana think what what will happened to a pc in the real willd surround by more than 4 ;D

BTW i was remark it is wired products to EMS represent in here , at other thread , and really not understood

[trjam]

-{ Quote: "And I dont like your comment nor Peter's reason..." }-
who cares, Lol

[demoneye]

-{ Quote: "Just wondering?

I have bought A-Squared antimalware which his Mamutu built in.

Now when I was testing it did not give any alerts at all when run in Sandboxie. I let some malware run in Sandboxie and did not see a peep from IDS behaviour blocker untill Avast was warning me of malware via its SMTP scanner which I had not paused.

" }-

according to EMSI mamutu doesn't detect/check malware run in SB environment

[demoneye]

SB + DW +MD passes all 4 tests ... nice

[Einsturzende]

-{ Quote: "who cares, Lol" }-
Changed any defense lately? Try something new and please if you dont care, why you even bother to post?

[BlueZannetti]

To all:

Stop with the personally directed comments or this thread will be closed. No additional warnings will be provided.

Blue

[Ilya Rabinovich]

-{ Quote: "@Ilya Rabinovich, Defensewall is too popular" }-
Here, at Wilders- yes, it's quite popular. But not the worldwide, definitely. :)

[EraserHW]

-{ Quote: "
Prevx Edge with internet collection catch them easily.
This is not success.

Success is a blocking without malware database.

Prevx Edge (with internet collection) for only information. Real test isnt that." }-

Hello,

I don't agree to this point. If you claim this, then looks like you haven't totally understood how does Prevx work.

It needs an internet connection, the connection to the central database is vital to get it working at best of its capabilities.

Even heuristic is mostly based on database connection, that is one of the best things of a community database and this allow us to be always up to date against new threats and update our heuristic rules in a few seconds.

By cutting off internet connection, you're cutting off big part of Prevx detection ability and you're not showing any real and trustable result.

[GES/POR]

-{ Quote: "Here, at Wilders- yes, it's quite popular. But not the worldwide, definitely. :)" }-

Not yet anyway ;)

[maymoons]

-{ Quote: "Hello,

I don't agree to this point. If you claim this, then looks like you haven't totally understood how does Prevx work.

It needs an internet connection, the connection to the central database is vital to get it working at best of its capabilities.

Even heuristic is mostly based on database connection, that is one of the best things of a community database and this allow us to be always up to date against new threats and update our heuristic rules in a few seconds.

By cutting off internet connection, you're cutting off big part of Prevx detection ability and you're not showing any real and trustable result.
Reply With Quote" }-


Prevx alerted all malware without internet connection.
Look at my first posts attachment.
But it can not stopped it.
It has a raw disc access protection (built in)
But it cant block.

It delete my samples with net connection
but its not behaviour dedection.
prevx database has not my 4st samples
it cant block it.

[Peter2150]

-{ Quote: "And I dont like your comment nor Peter's reason..." }-

Have you downloaded. First you have to wait 37 seconds, then they give you a slow download, and once down if you go back for another it won't let you download for some unknown amount of time.

Just not worth the bother.

[Einsturzende]

-{ Quote: "Have you downloaded. First you have to wait 37 seconds, then they give you a slow download, and once down if you go back for another it won't let you download for some unknown amount of time.

Just not worth the bother." }-

If you have "dynamic IP" (your IP DHCP you after each time you connect to internet), you can download it pretty fast...just disconnect - connect again download, repeat...
Rapidshare have IP based...hmmm..."timeout"

[Leolas]

-{ Quote: "If you have "dynamic IP" (your IP DHCP you after each time you connect to internet), you can download it pretty fast...just disconnect - connect again download, repeat...
Rapidshare have IP based...hmmm..."timeout"" }-

What if I don't have a dinamic IP? :what:

[mvdu]

I'm downloading the .rar files, but they still come up empty for me. Could DefenseWall be doing something? I still have problems running things sometimes with DW. BTW, I have the IZArc program.

I take it that DW passed all these tests, though.

[Einsturzende]

-{ Quote: "What if I don't have a dinamic IP? :what:" }-
You can try with fast (anonimus) proxy :P, or wait "for some unknown amount of time" it is known, it is written on the same url...

[trjam]

Maymoons, let me clear something up. We all appreciate what you do. Every single person here is very thankful for what you do. You spend a lot a time and effort to bring us some very useful information. So when any of us offer constructive feedback, it is not to make you look bad but to help you with your presentations for the future. Again, we all respect your work and thank you. Also we understand the lack of English and you know what, you do pretty good my friend. So keep it coming, but please, be open-minded to any feedback we may give you.

Always remember, we all respect fellow members here, and they should show the same for us. Take care my friend.

[bellgamin]

With dialup it's a no go. It's tedious even with DSL. Also Rapidshare repeatedly tries to sell me a better connection, & makes me click multiple times for download. (Sigh)

I appreciate the hard work that went into these tests but ---I will wait until some sort of summary report is provided.

P.S. - Since these tests cover Behavior Blockers (HIPS), they might better be posted in the "Other Anti-Malware Software" forum.

[Peter2150]

-{ Quote: "If you have "dynamic IP" (your IP DHCP you after each time you connect to internet), you can download it pretty fast...just disconnect - connect again download, repeat...
Rapidshare have IP based...hmmm..."timeout"" }-

Well, I don't, and haven't had the need. Not going to set it up just for this. I think the tester is doing something valuable, but he wants people to look at it, he's going to have to do it differently

[MikeNash]

I took a look at the Online Armor version of the video (took about 10 mins to download at home last night).

What I liked about it most was the way that the tests were done in the VM; You saw OA getting installed, running in learning mode - and a first set of tests performed. The VM was then reset, learning mode was allowed to complete - and the tests were performed again.

This is a remarkably open way of performing tests - if you had a web site that had the summary and the videos on it, I think it would become very popular with the members here.

There are not really very many good test sites out there - matousec's tests can be reproduced by anyone with the time and inclanation - but your tests are great because they allow anybody to verify them by simply watching a video.

The second thing about it - as happened with the Comodo chap who posts here - Vendors, users and representatives can see exactly what happened and provide comments. Did the app get installed correctly, did you react fairly and consistently to prompts? Well, it's easy to see - yes, at least on the video I watched.

This is also a very very good way for users to see security software in action, without the need to test it themselves.

Two thumbs up from me. I hope you take my comments on board and make a website out of this. It would rock.



Mike

[Tarnak]

-{ Quote: "With dialup it's a no go. It's tedious even with DSL. Also Rapidshare repeatedly tries to sell me a better connection, & makes me click multiple times for download. (Sigh)

I appreciate the hard work that went into these tests but ---I will wait until some sort of summary report is provided.

P.S. - Since these tests cover Behavior Blockers (HIPS), they might better be posted in the "Other Anti-Malware Software" forum." }-


-{ Quote: "Well, I don't, and haven't had the need. Not going to set it up just for this. I think the tester is doing something valuable, but he wants people to look at it, he's going to have to do it differently" }-

I am on dialup, so I concur with the above comments.;)

[Peter2150]

I agree totally with what Mike said. They just need to be more readily accessible.

Pete

[LowWaterMark]

No further "tests" like this will be allowed on this forum, if the results are only available via a paid rapidshare account - or, endless amounts of time waiting and downloading. We provide unlimited upload capacity here for screen shots and any images needed to document a point. All that appears to be in most of the RAR files, are uploaded images. So, they could be posted here, if needed.

We are NOT in the business of selling rapidshare accounts here.

If that is the only way to publish your results then they will not be posted here on Wilders Security Forums.

[Einsturzende]

maybe someone who knows can suggest alternative to youtube?
some service which is reachable from any part of the world..

[djohn]

Just got around to the Online Armor video,That was Awsome.:thumb:

[GES/POR]

-{ Quote: "No further "tests" like this will be allowed on this forum, if the results are only available via a paid rapidshare account - or, endless amounts of time waiting and downloading. We provide unlimited upload capacity here for screen shots and any images needed to document a point. All that appears to be in most of the RAR files, are uploaded images. So, they could be posted here, if needed.

We are NOT in the business of selling rapidshare accounts here.

If that is the only way to publish your results then they will not be posted here on Wilders Security Forums." }-

:'( I hope this wont stop the poster from doing his work for us

[Einsturzende]

Ok, I have question after watching movie and screenshot about prevx warning, it is at least unlogic, warning says that master boot record is infected, and at same time option is to block, what to block? infection is, not will, it can be only disinfect, what is wrong with my interpretation?

[LowWaterMark]

-{ Quote: ":'( I hope this wont stop the poster from doing his work for us" }-Not if he posts the results in a manner we all can access in a timely fashion. ;)

We need to verify links posted on the forum and most of us don't own rapidshare accounts. (I'm not about to buy one to verify all the files uploaded when I provide endless upload capacity here on my own webserver.)

[MikeNash]

-{ Quote: "maybe someone who knows can suggest alternative to youtube?
some service which is reachable from any part of the world.." }-


Maybe convert the files to flv and see if Wilders Forums will host them ?

[Saraceno]

There are other online video file sharing services apart from YouTube.

Dailymotion (http://www.dailymotion.com/) is just as good for embedding the videos in forums.

Maymoons, see if this is accessible from your country and load your videos there - streaming speed is good, very similar to YouTube: :thumb:
http://www.dailymotion.com

[maymoons]

Thank to everyone for interested.

i think some peoples cant understand me.

1. why do i send video? video has big size.

Because i think, users must watch all story. 1/4, 3/4 is not enougth. For example Prevx dedect but cant stopped. this is important. Comodo paranoid mode hasnt DDA access monitor. i changed some settings. All things are important point.

2nd important point is a trust.

2. Why do i upload them rapidshare?

i am not RS reseller. i searched file share sites. All free services (known) have some special keypoint and limit.
bandwith limit-deletion limit-waiting limit-upload limit-download limit-stability limit

i found RS. Because everybody use RS. Rs is a standart, well known,

i bougth premium members from RS. i paid it. i give to money. only for the test and malware collection upload. i dont win 1cent for this job, but i paid.

some people sad that "hey maymoons, i like your test, but i wont download, because you are using RS"

Hey boys, this is not my problem. This is your problem. Please dont say this. if you dont want donwnload, dont download it. i dont care it. this is your problem.

Some testers upload tests to youtube. in my country,nobady can access youtube. do "Some testers" care it? No. because this is my problem.

i sad that one billion times;
you can want to download, you cant want
you can like my test, you cant.

This is my personal effort, hobby, job

i dont want to wait somebody test some product.
i tested myself

if you have problem with my tests, RS or other things
you can do your own test and show us your job.


-{ Quote: "This is a remarkably open way of performing tests - if you had a web site that had the summary and the videos on it, I think it would become very popular with the members here.

There are not really very many good test sites out there - matousec's tests can be reproduced by anyone with the time and inclanation - but your tests are great because they allow anybody to verify them by simply watching a video.
" }-

-{ Quote: "Two thumbs up from me. I hope you take my comments on board and make a website out of this. It would rock.
" }-

Thank you.
i dont have website yet. this is extra expenses for me. i bougt VmWare, RS account, CPU+RAM upgrade.
now website ???

i cant give to cheer some members.

i started here, but maybe i continiue my personal website.

-{ Quote: "If that is the only way to publish your results then they will not be posted here on Wilders Security Forums.
" }-

This is coerce. i uploaded Rs again. Because you are coercing me. This is not friendly. you can block my post. this will your choice. i searched new presentation ways, but now i am not searching.

Some peoples not chivalrous in here. Sory.

-{ Quote: "Maymoons, let me clear something up. We all appreciate what you do. Every single person here is very thankful for what you do. You spend a lot a time and effort to bring us some very useful information. So when any of us offer constructive feedback, it is not to make you look bad but to help you with your presentations for the future. Again, we all respect your work and thank you. Also we understand the lack of English and you know what, you do pretty good my friend. So keep it coming, but please, be open-minded to any feedback we may give you.

Always remember, we all respect fellow members here, and they should show the same for us. Take care my friend." }-

Bu some people is chivalrous.

i sad that my old posts; you didnt read it.

-{ Quote: "
This is special station for this test.
i want to see how many people download files, which software is popular.
i will upload one file next test.
But i want to little insight for this test.
" }-

i am preparing new behavioral blocker test.


i am sure you will like my new test.


-{ Quote: "sory, i cant send malware files.
i am sending malware only av labs.

And kaspersky for Vista hasnt Low level disc access. (i remember, am i true?)
this is not good for the kaspersky user.

i want to test jiamin AV tonigth. (for myself)
its look like good.

But if i find time, i will test kaspersky for you.
Edit/Delete Message" }-

Sory Einsturzende.
i cant tested kaspersky. i am researching malware samples for the my new tests.

software popularity reports;

14 introduction
17 comodo-default_settings-part_1
9 comodo-default_settings-part_2
24 comodo-maximum_settings
37 defensewall
13 drive_sentry-with_signature_database
14 drive_sentry-without_signature_database
12 malware_defender
27 mamutu
32 online_armour
9 prevx_-without_internet_connection-part1
13 prevx-with_internet_connection_and_herulistic_max
11 prevx-without_internet_connection-part2
8 privaty_response_safe_connect
25 sandboxie
24 threatfire-without_signature_database

[BrendanK.]

I can upload your videos and I am able to add a password to protect them if you like, so that only Wilders' members have access to them. It's free so I'd be more then willing to do it. If anyone else would like to do it rather, as it does take time and effort, as well as bandwidth which is something I don't have a lot of. I'll PM the site to the person. It's very simple to get started.

[Ilya Rabinovich]

-{ Quote: "I'm downloading the .rar files, but they still come up empty for me. Could DefenseWall be doing something? I still have problems running things sometimes with DW. BTW, I have the IZArc program.

I take it that DW passed all these tests, though." }-
Try to add IZArc into the "Resource Protection" list and check again.

[LowWaterMark]

-{ Quote: "This is coerce. i uploaded Rs again. Because you are coercing me. This is not friendly. you can block my post. this will your choice. i searched new presentation ways, but now i am not searching.

Some peoples not chivalrous in here. Sory." }-As I said, we have to verify what is in links posted here to be sure they can be allowed. We can't just assume the contents are okay. Since most of us do not have RS accounts, we can not do this without a very great amount of effort. Therefore, posts with large numbers of Rapidshare links will not be allowed in the future.

I'm sorry you don't like that, but, we are not going to spend all that effort because you choose to use rapid share and put so many links in your posts here.

[maymoons]

ok. i can understand now. you are right
i sad that "i will upload one file to RS for the new tests"
is this problem?
can you download one large file?

[LowWaterMark]

-{ Quote: "can you download one large file?" }-Yes, that would be MUCH better. It's not the size of the downloads that is the issue, it's the waiting to get access (as free RS users) for file after file that is the problem.

[Pseudo]

-{ Quote: "ok. i can understand now. you are right
i sad that "i will upload one file to RS for the new tests"
is this problem?
can you download one large file?" }-
Using LZMA for compression will make the file considerably smaller.

[maymoons]

ok. there is no problem between you and me.
You are rigth your animadversion.
i will upload one file later

[maymoons]

-{ Quote: "Using LZMA for compression will make the file considerably smaller." }-

what is LZMA?
is it stabil?
has LZMA recovery recods option?
this is important for the corrupted download

[Pseudo]

-{ Quote: "what is LZMA?
is it stabil?
has LZMA recovery recods option?
this is important for the corrupted download" }-
http://en.wikipedia.org/wiki/LZMA
It was made for the 7z (7-Zip) format. If you don't use 7-Zip, you can use portable 7-Zip (http://portableapps.com/apps/utilities/7-zip_portable) to compress the file in LZMA/7z. The outcome is a file supported by all archive managers supporting multiple formats (pretty much :P), and a smaller file than RAR.

[Don johnson]

LZMA is 7z's compression method.

[maymoons]

there is not recovery recods.
if downloaded file is corrupted, archive cant be recovered.
winrar has this feature.

but its usable.

[Ilya Rabinovich]

-{ Quote: "Using LZMA for compression will make the file considerably smaller." }-
For already packed data there is no significant difference between various algorithms.

[Einsturzende]

yes, wmv is already very much compressed, ive heard smithmicro "stuffit" can do better job with already compressed media files, not sure...but that is commercial program, maybe some other codec with better compression ratio for recording movie will do smaller sized and still viewable movie.

-{ Quote: "Sory Einsturzende.
i cant tested kaspersky. i am researching malware samples for the my new tests." }-

maybe you can squeeze KIS in your new test, I would really like to see its HIPS in action compared with others, there is very few tests out there to see KIS HIPS capability

[Pseudo]

-{ Quote: "For already packed data there is no significant difference between various algorithms." }-
That's true.

[alex_s]

-{ Quote: "Just got around to the Online Armor video,That was Awsome.:thumb:" }-

Yep, our respected tester has a helthy sense of humor :)

[acr1965]

Thanks Maymoons for the tests and results.

Not to get too far off topic but anyone have any comments about Maymoons' post- Kaspersky not having low level disk access in Vista? Any comments on that?

[maymoons]

-{ Quote: "Thanks Maymoons for the tests and results.

Not to get too far off topic but anyone have any comments about Maymoons' post- Kaspersky not having low level disk access in Vista? Any comments on that?" }-

i read it on kaspersky forum's

[alex_s]

-{ Quote: "Thank to everyone for interested.
i think some peoples cant understand me.
" }-

Great job and I think rapidshare inconvinience is acceptable price for those who care. In a way this is freeware product with "some harmless ads". Keep up your own way :)

[GES/POR]

-{ Quote: "For already packed data there is no significant difference between various algorithms." }-

Im lost, i rar files and upload them - would it make a different in size and/or uploadtime if i 7zip it? - wich i never used btw

[Ilya Rabinovich]

-{ Quote: "Im lost, i rar files and upload them - would it make a different in size and/or uploadtime if i 7zip it? - wich i never used btw" }-
The difference is size for already packed data won't be any significant. Just try it by yourself you and you will see by your own eyes.

[Sputnik]

-{ Quote: "The difference is size for already packed data won't be any significant. Just try it by yourself you and you will see by your own eyes." }-
He's correct. See it as using an algorithm over an algorithm, like packing a box into a new box without damaging it :P

[GES/POR]

I mean instead of rarring it.

[Sputnik]

-{ Quote: "I mean instead of rarring it." }-
Ahhh, I understand you now. 7-Zip can give you a higher rate of compression then WinRAR, you might want to check out the comparison on their homepage (http://7-zip.org/).

[halcyon]

Thank you for your test.

I must say that for a person who has spent so much time analysing the software and then posting the results ONLY as Rapidshare downloadables, your motives appear VERY fishy to me.

Maybe you do this for RS kickbacks, maybe not.

Whatever the case, as long as you do this, I will just skip your tests. I don't have time to start downloading, waiting for next button to activate, downloading, waiting, un-archiving, playing back videos, analysing results.

You have done a service to the community by testing.

But you are doing a disservice to the community by forcing RARed RS downloads one by one.

You could have just posted 5 lines of text summarising the results in addition to the downloads.

Thus, I'll skip your tests.

Good luck for future tests.

[clocks]

-{ Quote: "Thank you for your test.

I must say that for a person who has spent so much time analysing the software and then posting the results ONLY as Rapidshare downloadables, your motives appear VERY fishy to me.

Maybe you do this for RS kickbacks, maybe not.

Whatever the case, as long as you do this, I will just skip your tests. I don't have time to start downloading, waiting for next button to activate, downloading, waiting, un-archiving, playing back videos, analysing results.

You have done a service to the community by testing.

But you are doing a disservice to the community by forcing RARed RS downloads one by one.

You could have just posted 5 lines of text summarising the results in addition to the downloads.

Thus, I'll skip your tests.

Good luck for future tests." }-

Are you serious dude? Maymoons was pasting pictures into their posts, but people complained about that. Therefore they turned to file hosting. I really doubt they are getting a kickback from rapidshare. That sound like crazy talk to me.

[djohn]

-{ Quote: "Are you serious dude? Maymoons was pasting pictures into their posts, but people complained about that. Therefore they turned to file hosting. I really doubt they are getting a kickback from rapidshare. That sound like crazy talk to me." }-

:thumb: Clocks

[GES/POR]

Can anyone give me summary of Sana? I downloaded the video and upon clicking/moving/etc. i get errors about file being damaged.

[Minimax2000]

-{ Quote: "
You could have just posted 5 lines of text summarising the results in addition to the downloads.

Thus, I'll skip your tests.

Good luck for future tests." }-
:thumb: halcyon

[aigle]

Hmmm..... I know the results but u did not add GesWall maymoons. Also i wil suggest to give a summary of results. Very important IMO.

Good testing. :thumb: I love to do that but no time.

[bellgamin]

I cannot open 7z. Rar is okay.

I tried RS download with broadband & they had speed of only 9.2 KBs. And now he says he is going to put even BIGGER files up there! This is making it nearly impossible for anyone to view his *tests* unless they have broadband AND time to waste.

Also, if you tell the fellow about download problems, he goes into a lengthy rant. Good grief! :ouch:

[Kayracc]

-{ Quote: "I cannot open 7z. Rar is okay.

I tried RS download with broadband & they had speed of only 9.2 KBs. And now he says he is going to put even BIGGER files up there! This is making it nearly impossible for anyone to view his *tests* unless they have broadband AND time to waste.

Also, if you tell the fellow about download problems, he goes into a lengthy rant. Good grief! :ouch:" }-


select the correct(or different server) on rapidshare for better speeds

that being said, you probably could have survived not posting, i see many if not all of your posts in the same nature :|

edit: more factual wise, many of the posts i've seen ;)

[osubuck]

-{ Quote: "Are you serious dude? Maymoons was pasting pictures into their posts, but people complained about that. Therefore they turned to file hosting. I really doubt they are getting a kickback from rapidshare. That sound like crazy talk to me." }-


Quite the contrary actually. Rapidshare has a benefit to it that if you get so many users downloading your file as a FREE USER, (unregistered) then that person gets free points to go toward a new premium account which would normally cost money. I have no idea if that is his intent or not, but it is a possibility.

[bellgamin]

-{ Quote: "select the correct(or different server) on rapidshare for better speeds" }-I looked again, but could find no options for non-paid users to change servers at RS. Elaborate please.

[MeFer]

-{ Quote: "I looked again, but could find no options for non-paid users to change servers at RS. Elaborate please." }-

On Advanced download setting

[chris2busy]

Dear OP.
You can transfor the downloads to "trafficshare downloads"
Trafficshare downloads are immediate,direct downloads (the users get the download pop-up immediately without waiting,and can download all videos wiithout waiting extra hours) and they also get the huge bandwidth reserved for premium members and last but not least,the downloads are counted the same,so you can still see how many downloaded that certain video and you also are credited with "RapidPoints PU" which is the same with casual rapidshare points..(poeple can this way download any number of videos simultanesiously-and you keep the points to extend your account free,trust me,i did it)

Result..the EXACT same thing as now but more happy faces on the forum.Also more people will downlod videos as it will not take forever..

Keep up the good work,hope we can see more of you videos!

[maymoons]

-{ Quote: "Dear OP.
You can transfor the downloads to "trafficshare downloads"
Trafficshare downloads are immediate,direct downloads (the users get the download pop-up immediately without waiting,and can download all videos wiithout waiting extra hours) and they also get the huge bandwidth reserved for premium members and last but not least,the downloads are counted the same,so you can still see how many downloaded that certain video and you also are credited with "RapidPoints PU" which is the same with casual rapidshare points..(poeple can this way download any number of videos simultanesiously-and you keep the points to extend your account free,trust me,i did it)

Result..the EXACT same thing as now but more happy faces on the forum.Also more people will downlod videos as it will not take forever..

Keep up the good work,hope we can see more of you videos!" }-


chris2busy (http://www.wilderssecurity.com/member.php?u=69115) thank you for information.
i didnt know this.

[chris2busy]

-{ Quote: "chris2busy (http://www.wilderssecurity.com/member.php?u=69115) thank you for information.
i didnt know this." }-

not a prob..been RS member for a couple years..Enjoy everyone!

[Coolio10]

-{ Quote: "not a prob..been RS member for a couple years..Enjoy everyone!" }-
Doesn't this take away from the uploaders limit? I guess it doesn't matter if he uploads small things like pictures.

[Saraceno]

Thank you maymoons.

For everyone reading this thread, the links are now direct download links. No need to wait 30 seconds, the download starts straight away. No rapidshare advertising page either. :thumb:

[Saraceno]

Online-Armor does a top job even after a user ignores the first warning and allows the threat to run. :)

Sandboxie, nothing left to say, free and unbeatable (hopefully all users know to run unknown files/threats as sandboxed)! ;D

Prevx Edge with an internet connection, and settings set to high, equals solid protection. Just shows it's light and effective. 8)

[Leolas]

-{ Quote: "Online-Armor does a top job even after a user ignores the first warning and allows the threat to run. :)

Sandboxie, nothing left to say, free and unbeatable (hopefully all users know to run unknown files/threats as sandboxed)! ;D

Prevx Edge with an internet connection, and settings set to high, equals solid protection. Just shows it's light and effective. 8)" }-

ThreatFire does an excellent job, and blocks them all

Comodo IS in default setting isn't good.

I watched only these 2 + OA, Sanboxie and Prevx (like you..) ;D

[maymoons]

-{ Quote: "This reason alone makes me think this person is trying to get rapidshare points to get another free account. " }-

this is ********.

i have 3 months Rs premium membership.
i have money, i can buy RS premium members.

read RS point strategy on the http://www.rapidshare.com/

-{ Quote: "Each time a Free Users downloads your files, you gain points. You get a RapidPoint for each download, provided that the file is bigger than 5 megabyte and the user has not generated more than 3 RapidPoints in the last hour. Premium users can generate for you up to 255 points per day. Your files have to be stored in the Collectors Zone or the Premium Zone so that we can assign the download to your account.
RapidPoints can be exchanged for a Premium Account, or to extend your Premium membership. For this, you can go to the menu option "Redeem RapidPoints" in the Free Zone or Premium Zone.
" }-

this is not easly.

if i want to RS point, i can upload antivirus+crack files to warez forums.


-{ Quote: "This reason alone makes me think this person is trying to get rapidshare points to get another free account. " }-

this is too excessive for me.

i am stopped RS upload and download, and deleted all files.

anybody cant download anymore my RS files.

you are not brainy.

i can earn 7 euro on 10 hours.
i dont need RS points.
this is stupid idea.

you can forget my all tests

many people delate me.
this is not good for me.
my efforts, moneys, times...
go to waste.


you can test yourself now. arena is yours.



ALL FILES DELETED. SORY FOR POLITE FRIENDS.

[djohn]

Maymoons,Bad apple always ruin the bunch sorry man to here that but If I where in your shoes I would be pissed off to.My graditude goes out to you thank you for your test and happy holidays.

[Leolas]

Thank you maymoons.. But you didn't have to delete them for that reason. They're just 2 users, and I don't care if you make money by making these videos, it was a very hard work!

[xXDarkStalkerxX]

Thanks Maymoons for all your work and dedication , very sad to see the reason of some people. Serious i like wilders security but some people here are more interested in " Mine is better than yours" , " Your test is ********" , " You suck" than helping and make productive things . Anyway continue to do what you want do Maymoons you rock man

[Miyagi]

Mind as well close the thread.

“Being ignorant is not so much a shame, as being unwilling to learn.” - Ben Franklin.

Don't expect people to follow you all the time. This is Reality! No offense intended but if there is no workaround, then there is no workaround. Period. What a shame. . .

[acr1965]

Maymoons chill out. Anyone who posts test results is going to come across some critics at some point. It comes with the territory. Just get a little thicker skin, face your critics and then get back to testing. Lots of feedback shows people are interested in your work.

It is maybe irony that you have 80,000 malware samples going against different security products. The results are analyzed to see which are the top programs. Then you get a couple malware-like pieces of criticism and and are ready to fold. Do not be like the poor anti-malware products that are criticized. Be strong, improve and post more tests!

[Hugger]

Maymoons,
There's always a piece of crap or two floating around any forum.
Don't let them ruin what you were obviously enjoying.
Hugger

[trjam]

-{ Quote: "this is ********.

i have 3 months Rs premium membership.
i have money, i can buy RS premium members.

read RS point strategy on the http://www.rapidshare.com/



this is not easly.

if i want to RS point, i can upload antivirus+crack files to warez forums.



this is too excessive for me.

i am stopped RS upload and download, and deleted all files.

anybody cant download anymore my RS files.

you are not brainy.

i can earn 7 euro on 10 hours.
i dont need RS points.
this is stupid idea.

you can forget my all tests

many people delate me.
this is not good for me.
my efforts, moneys, times...
go to waste.


you can test yourself now. arena is yours.



ALL FILES DELETED. SORY FOR POLITE FRIENDS. " }-
I would pretty much say this one has run its course. Your English is improving to.