Twister-AntiTrojenVirus Thread.

[roger_m]

Originally Posted by Miyagi

From the Filseclab Chinese Website (Windows 7 Support):

Given the current anti-virus software more Windows7 not support the status quo, to protect the user's computer system security, safety laboratory in Fairbanks 2009-2-7 launch date of the latest safety tests Twister Anti patch, this patch can be achieved cost security Windows7 support 32 mission. Has the use of Windows7 (32 bit) beta users can install the latest version of Twister Anti safety second edition V7 R3 (7.32) and then manually download http://www.filseclab-us.com/down/immdrv_win7.zip, by which you can readme_cn.txt operation.

http://74.125.19.101/translate_c?hl=...fscjXXxARaNcxA

I installed the updated driver after you posted this, and after I rebooted today, Twister is fully functioning under Windows 7! The scanner is working on on demand on on acces, so I'm happy now

I ran a scan on the malware collection I posted about originally, and Twister detected the majority of the samples. Of the ones it missed many are just HTML files, and of the remaing exe files (which are very few), I've scanned a few so far at virscan.org all all came up clean except for one which was only idenitifed by on av program.

[roger_m]

The end of my last post should have read: all came up clean except for one, which was only identified by one av program

[Dregg Heda]

Thanks for all your replies Zimzi, Fuzzfas and Bellgamin. Initially I wanted a product with low FPs. But recently ive had a change of heart. I am now willing to consider a product which is a little more aggressive as long as there are reasonable reasons for the FPs produced and there is some way in which the makers of the app will inspect the flagged product to ascertain if it is really malware or an FP and get back to me. Does Twister offer this?

[Taliscicero]

Originally Posted by bellgamin

OT- It bears repeating that Filseclab/Twister folks will answer questions directly when you submit them using THIS query page.

P.S. I have never used that query page myself. Has anyone? If so, did Filseclab reply? If so, how long did it take for them to answer?

Took about 1-15 min's to get back to me ^^

[Fuzzfas]

Originally Posted by roger_m

I installed the updated driver after you posted this, and after I rebooted today, Twister is fully functioning under Windows 7! The scanner is working on on demand on on acces, so I'm happy now

Good. I honestly didn't expect them to fix this... They 're 20 people, but working like mad...

I ran a scan on the malware collection I posted about originally, and Twister detected the majority of the samples. Of the ones it missed many are just HTML files, and of the remaing exe files (which are very few), I've scanned a few so far at virscan.org all all came up clean except for one which was only idenitifed by on av program.

The fact that only 1 AV flagged it, may indicate it's FP... Specially if it is one of the "lesser" AVs. Also keep in mind, that Twister, won't always flag something on demand, but upon execution, when it's packed. Examples:

The installer wasn't flagged, but when installation began:

http://www.wilderssecurity.com/showp...&postcount=165

http://www.wilderssecurity.com/showp...&postcount=173

This isn't true only for signature based detection, but even more with FDDS. In PC Security labs tests, it appears that Twister is the best in signature-less detection, thanks to FDDS. So, when you do on-demand scan of a malware folder, Twister doesn't show its REAL detection rate.

[roger_m]

Originally Posted by Fuzzfas

Also keep in mind, that Twister, won't always flag something on demand, but upon execution, when it's packed. Examples:

The installer wasn't flagged, but when installation began:

http://www.wilderssecurity.com/showp...&postcount=165

http://www.wilderssecurity.com/showp...&postcount=173

Maybe support for unpacking 7-Zip archives should be added to Twister. The software in the links is packed with 7-Zip (as is all software from C-Net Media).

[Miyagi]

Can anyone access the Filseclab.com website?

http://filseclab.com

Looks like it's down.

[Fuzzfas]

Originally Posted by Miyagi

Can anyone access the Filseclab.com website?

http://filseclab.com

Looks like it's down.

Yes, this time i can't access it either. (I wish they were updating/redesigning it, but most likely not).

[Miyagi]

Thanks Fuzzfas. I'll wait.

[bellgamin]

It's down for me, too. However, Twister updated today so (hopefully) the AV server is okay.

[Miyagi]

As long as the AV updater is working that should be good!

[Fuzzfas]

My last definition update is of 3 hours, 30 minutes ago.

I am now trying to do manual update, it takes a while before saying "no new updates available". I get about 2 retries with any of the 5 update servers. So, i think their servers work, but they do have speed problem. Whatever it is, is affecting everything, but mainly the website.

[renegade08]

Originally Posted by Fuzzfas

My last definition update is of 3 hours, 30 minutes ago.

I am now trying to do manual update, it takes a while before saying "no new updates available". I get about 2 retries with any of the 5 update servers. So, i think their servers work, but they do have speed problem. Whatever it is, is affecting everything, but mainly the website.

Yep, their site is down.

[Fuzzfas]

Confirmation from the chinese forum that the next Twister will have improved FDDS. The translation from google is pityful, but at least, i understand that.

ROFLMAO @ "Twister anti Safety"!!!

Official developers of the technical description of the dynamic defense
Tags: defense official dynamic technology development
Hello everyone, I am a dynamic defensive Fairbanks designer, I am very happy to see everyone here for dynamic defense issues raised and recommendations made by the Company, I am here to explain to the U.S. defense of some of the principle of dynamic as well as the next step in the development of planning.

Meal cards for the dynamic test results questioned the defense can rest assured that the test meal card at the time of naming rules are not triggered by the name of the dynamic defense rules, that is to say the test results are no problem, users can download and renamed its own test. Fairbanks are the specific reasons for the name of the dynamic defense rules usually are in the actual testing process, after the virus actually generated some strange, there are regular but there is also a relatively high rate of file name, such as the very famous svch0st.exe , iexpl0re.exe, as well as to individual viruses have targeted the file name, such as: k23449222.sys is a virus often generated document, which has k +8 digit patterns. These laws are based on the actual summed up the virus, rather than arbitrarily established, so the file name card rice :081212-1-4. Exe does not trigger this format it the file name rules. In addition, according to the dynamic defense score level can have the file name to determine whether participation score, dynamic defensive display format similar 47.13008900, we can start the countdown third place behind the decimal point figures to determine if the number is 1,3,5,7,9, b or d that has the name of the participation score, or else that there is no name to participate in scoring, third in this case, the countdown is 9, so well-known sub-participation score. Name participation score is a complex process, such as svch0st.exe, iexpl0re.exe obvious camouflage this will be coupled with very high marks, while often also required k23449222.sys tie in with other conditions, such as it is running in C: \ Windows \ System32 directory will be coupled with very high scores, while running in a non-system directory will be coupled with lower scores. According to our actual test results, the virus often randomly generated a number of irregular pure digital files or 16-band digital file name, and therefore the number of file name will always be some fraction, of course, there are certain risks of false positives, so will the other auxiliary minutes after addition and subtraction conditions integrated judge. In short, these rules are based on the actual test virus when summed up. By our actual testing, this method is effective, timely discover and block specific types of viruses derived from the new variant, of course, this technology is only used for certain specific types of viruses, the viruses do not have these laws also need to rely on dynamic defense technology to determine the other. Other technologies also include threaded insert, DLL injection, the process of self-concealment and self-hidden directory, such as dozens of加壳determine the technical, involving no technology secrets to the list.

Official said on many occasions that the next version of the improvements include the improvement of the dynamic defense, the dynamic defensive improvement is a big innovation, our goal is to develop a higher recognition rate, lower false alarm rate, ease of use more dynamic defense system. Specific to the technology is more the behavior will increase the ability to identify a more precise analysis, such as: the introduction of networking activities to determine and document I / O operations to determine and so on. Of course the current best way to judge will still be retained, as determined on the basis of the name of this operation over the past two years proved very effective, it will still be retained, but the score ratio will be weakening, the introduction of additional mechanisms to judge.

Twister Anti safety is a comprehensive antivirus software, which not only have dynamic defense system, but also has very high recognition rate of the virus database engine. Set aside specific technical details, just look at the efficacy of the past two years according to user feedback and the actual operating results, it is satisfactory, and its defense capabilities are excellent, but also a variety of third-party evaluation score is good . Of course it should not be foolproof, we can not allow every user satisfaction, but as Fairbanks, the development team, we have been careful to listen to users comments and suggestions have been efforts to improve, always want to do to allow more customer satisfaction. I believe that the road is tortuous, but the future is still bright. 谢谢.

[Fuzzfas]

Possibly bad news... Twister v8, from what i understand, will have for the 40% completely rewritten code and they can't give a date of release?

Twister Anti V8 code to rewrite the overall rate of 40%

V8 indeed could not be completed on time and according to plan, development is still ongoing tension, at present we can not say that near the end, because there are still some technical issues pending resolution. But the update is still a big update, we do not deliberately set at one year development cycle for a major update often requires a longer period of time.

We are tentatively scheduled for completion in the second half, if the period would have required the introduction of Beta version of the circumstances. V8 will increase firewall features, a firewall is completely rewritten, dynamic defense function modules will be significantly increased by 50%, scanning engine will also be re-optimization, the overall rate of nearly 40 percent to rewrite, so the project is enormous. We will strive for the sooner the better.

Thanks

Zhu Yan-hui
2009-02-09

[Miyagi]

Thanks Fuzzfas. The first article almost brought World War 3 in my mind. I mean defense and meal cards? Where are we going? But anyway, I am glad to see them moving and being more active.

[Fuzzfas]

Originally Posted by Miyagi

Thanks Fuzzfas. The first article almost brought World War 3 in my mind. I mean defense and meal cards? Where are we going?

LOL! True! I can't understand much of the first article. He tries to explain how FDDS gives a score to suspicious activity, but other than that, i can't follow the words into a coherent conclusion.

It's also hilarious that Antivirus is translated in "AntiSafety" and Filseclab in "Fairbanks".

But anyway, I am glad to see them moving and being more active.

Yes, they 're doing a major change. Personally i more excited about the improved FDDS. If they manage to make it effective to the levels of TF, that would be amazing! The scanner is already decent enough, so improving it isn't a priority for me. Mostly needs bugfixing and reduction of FPs.

In my tests that i did on demand, the scanner is way lightning fast. If they only make it get "unstuck" from cab and jar files, it will do fine.

[Miyagi]

A-ha! Maybe time to grab more licenses.

[Miyagi]

OFF-TOPIC: If only Twister was in Hawaii, it would have been a great marketing from mother nature. (2 days ago)

Here and here.

[bellgamin]

Originally Posted by Miyagi

OFF-TOPIC: If only Twister was in Hawaii, it would have been a great marketing from mother nature. (2 days ago)

Here and here.

That HI twister had less wind power than a flatulent mongoose. An F-zero

Hey Fuzzy, thanks for the translations. I am looking forward to a power hike in FDD.

Oh yes -- the Fairbanks website is back online now.

[Fuzzfas]

Originally Posted by bellgamin

That HI twister had less wind power than a flatulent mongoose. An F-zero

LOL! Well, then, it's better to have always so feeble twisters. Must be interesting too to watch though. I 've never seen a real twister , except for TV news/documentaries.

Anyway, Twister could use that pubblicity! These people are the definition of a company that looks into the substance of a matter and neglects the appearance (i.e. the opposite of the natural). They have a good AV, with a crappy interface. Most rogue antiviruses have better skin. Their site goes down, their update servers stay functioning, even if slower. They only have 1 person that speaks english well (as he said in here), but he takes the time to reply to your mails. These people do very well the essential parts of the business, but are terrible in pubblicity and "glamour". Unfortunately thought, the latter is what attracts customers.

Hey Fuzzy, thanks for the translations. I am looking forward to a power hike in FDD.

Me too! I am eager actually! BB is the best thing an AV can add to its arsenal. It can be easy to use and effective. What techies and non techies want alike. And FDDs surely has room for progress in that field. I am very optimistic about it. Already in PCSL tests, Twister was one of the most effective antivirus when the signature wasn't included. Imagine what will happen with FDDS further enhanced!

Imagine a very strong FDDS in v8, coupled with TF or Mamutu! Already in the chinese forum, i saw that several users use : Twister + Micropoint for their security setup. With 2 strong BBs + say something like Sandboxie or DW, you can even drop classical HIPS alltogether. Chances of infections would be too slim.

Oh yes -- the Fairbanks website is back online now.

Yes and it's still the old one...

[Fuzzfas]

See... This is yet another reason i love the little underdog Twister. These people really try, even if language is also a problem. I had sent one of the fake antispywares to Mr. Chu, he replied that it doesn't show malicious activity. I told him that this is true, they are more like a "phishing" tool, detecting fake infections, urging the user to buy it. And i sent him a jotti's scan showing the program as "FakeAV" from one vendor, adding, that i don't know if they intend to detect it, but if they do, this labelling is IMHo the most appropriate.

This thing has gone over and over for 4-5 emails. In the last one he told me that he will talk about it with his senior staff and i told him that it's not necessary to always reply to me, cause i know they 're busy. Today he replied to me...again, just to say "Ok, i got that, thanks for your tips again, Best regards, Bright Chu".

I mean, you gotta love Mr. Chu. And this thing would never occur with one of the big AV vendors. Here you have a 20 person dev team, and only english speaking amongst them, is taking the trouble to reply back just to say "Thanks".

Mr. Bright Chu, i hope they give you a salary raise, cause you deserve it!

[GES/POR]

But then again alot of you lot make excellent suggestions n contributions to them so i dont c y their staff shouldnt be in contact with u - just because big boy vendors are arrogant and protect less then lil boy vendors doesnt mean they are better. Au contraire, they might have more bread but they lack in so many things

[Fuzzfas]

Originally Posted by GES/POR

But then again alot of you lot make excellent suggestions n contributions to them so i dont c y their staff shouldnt be in contact with u - just because big boy vendors are arrogant and protect less then lil boy vendors doesnt mean they are better. Au contraire, they might have more bread but they lack in so many things

True, true. In fact, the best support comes from the "small fish". And they 're also more willing to listen to the customers. You can see it in this forum too. The "big boys" don't have representatives (why should they care) in the forum. On the contrary you see Ilya, Cold Moon, Xiaoling, Katie, Eirik, PrevX (hope i didn't miss anyone) always ready to help.

As for Twister, i hope that they will hire some more with good english too, because Mr. Bright Chu had said that he is the only with good english in the team. So, poor fella, all english language emails, end up on his PC. And he is one of the devs too, not a dedicated support person.

[GES/POR]

[quote=Fuzzfas]

True, true. In fact, the best support comes from the "small fish". And they 're also more willing to listen to the customers. You can see it in this forum too. The "big boys" don't have representatives (why should they care) in the forum. On the contrary you see Ilya, Cold Moon, Xiaoling, Katie, Eirik, PrevX (hope i didn't miss anyone) always ready to help.

Nick S., Bruce(MBAM)

As for Twister, i hope that they will hire some more with good english too, because Mr. Bright Chu had said that he is the only with good english in the team. So, poor fella, all english language emails, end up on his PC. And he is one of the devs too, not a dedicated support person.

maybe we should return the favor n learn chinese for a change I allready know ni hao n wo ai ni