Universal Virus Sniffer

Found this new piece of russian software on Softpedia:

Source

Screenshots:
http://www.softpedia.com/progScreenshots/Universal-Virus-Sniffer-Screenshot-168474.html

 

Interesting software. But the homepage ~dsrt.jino-net.ru~ is red at WOT and also listed in Vipre Blacklist..

 

@ PaulBB

Thanks for the info/link Never heard of it until today I DL'd it earlier but havn't played with it yet, but it seems quite comprehensive

@ sg09

I'm guessing, the reason for the alerts is, they have might have malware on there for testing etc As it's in Russian i can't say for sure. I have a feeling it's legit, but don't take my word for it.

Like to see a few tests with this

 

@CloneRanger: Please update us with the info after your test..

 

http://translate.google.com/translate?hl=en&sl=ru&tl=en&u=http://dsrt.jino-net.ru/uvs.htm

P.S. Running Vipre, no problem to access site.

 

FAQ extracted from(English language file & docs only [ZIP 64Kb]) the file I downloaded as per screenshot:

F.A.Q.

Q: uVS? What is it?
A: uVS is a powerful antivirus removal tool designed to ease the process of detecting and
eliminating unknown 0-day viruses, rootkits, and bootkits.
It's NOT designed to replace your antivirus!.

Q: Is it really simple?
A: It's really simple, but only for ADVANCED users with GREAT knowledge of Windows registry.
If you are ORDINARY user than use it ONLY under helper's supervision.
It is a VERY SHARP tool and you can accidentally kill your OS.

Q: What about compatibility?
A: Win2k, WinXP x86/x64, Win2k3 x86/x64, Vista x86/x64, Win7 x86/x64,
(!) Windows PE 1.x 64Mb RAM.
(without digital signature checking feature)
(!) Windows PE 2.x-3.x 384mb RAM.
(with digital signature checking feature and with support the offline CatRoot)
You can check offline Windows Seven x64 under Win2k, WinXP (!)x86 only(!), Vista x86/x64, WinPE,
and vice-versa.

Q: Why Virus Base is empty?
A: uVS is a hunting tool, not antivirus! You can fill Virus Base by yourself if needed.

Q: Can I add signature to the Virus Base directly from malware file?
A: Yes. Use file's context menu or "Add signatures button".

How to kill trojans.
(1) locate malware in the list (you can use F1, F4, F6 and special categories to help yourself)
(2) Right click on file and select "Copy to Zoo" (if you needed sample of it)
(3) Right click on file and select "Add the signature to the Virus Base"
(4) Set name and length of the signature.
(5) Go to (1) and repeat process with next malware.
(6) Press "Check all List" button.
(7) If you see any false detection go to Virus Base and correct signature's length.
( Press "Kill all viruses" button.

Hotkeys.
F1 - Hide/Show known and verified files.
Ctrl+F1 - Hide/Show verified files.
Alt+F1 - Hide/Show known files.
F2 - Hide missed files and the files with not empty company name
F3 - Load "Company name" and signatures.
Ctrl+F3 - Enable autoload of "Company name".
F4 - Verify files by SHA1 Base
F5 - Refresh.
F6 - Check digital signatures.
F7 - Check the list by the Virus Base.
F8 - Rise/Sink main Window.
F9 - Hide all topmost windows and mark their owners.
Ctrl+O - Open OS Image
Ñtrl+P - Scan mode Normal/Alternative
(In Alternative mode you can see stealth processes)
Ctrl+S - Save the list.
Ñtrl+B - Lock/Unlock Service Manager.
Enter - File information.
Del - Delete from list.
Alt+Up - Prev category.
Alt+Down - Next category.
Alt+F - Run external file manager with raised privileges.
Alt+L - Log mode on/off.
Alt+T - Tweaks.
Alt+U - Open "Installed Applications" window

Settings.ini
[Settings]
bLogBL=1 - Enables log file of the restricted MD5 hashes (bl.log)

P.S. My emphasis

 

It was catched by Bad Website list... I think you have unchecked it..

 

Is this in Vipre > Settings > Active Protection? ...I can't find it.

 

I'll report it to Sunbelt... I have "Bad Website Blocking" unchecked but ClearCloud still blocked it...

 

Nope, it's in
Firewall > View Settings > Web Filtering > Enable Bad Website Blocking

 

I see now it relates to Vipre Premium, which I don't have.

"I find that 'Bad Website blocking' option in the firewall really stinks...", > Why has Vipre started ad blocking without my consent - http://supportforums.sunbeltsoftware.com/messageview.aspx?catid=23&threadid=4783

 

I havn't tested it extensively, just a fairly quick run round the block.

One of the nice things about it is, no install required Usually apps that need to deal with certain nasties have to install a driver/service, so i'm wondering if it could handle extremely bad stuff ?

Anyway, i was surprised at ALL the various options and tests etc you can do with it In a way it reminds me of the excellent AVZ And that's Russian too.

It found about 5 files that it thought were suspicious, but aren't, but better to flag them just in case

One of the unique tests involve running a BAIT file to see if malware you "might" have in your comp bites at it. Naturally as i'm free of nasties nothing showed up

I think it has a place in your toolkit, so i recommend you try it Be SURE to read the info/help files first, because it's designed to Eliminate !

 

All clear! They fixed it!

 

Universal Virus Sniffer 3.45 Released

Change Log
· Minor Bugfix.

Download Link
hxxp://dsrt.jino-net.ru/files/uvs_v345engfull.zip