New Trojan Test

[ErikAlbert]

Originally Posted by dja2k

How did it block it, by just saying its unknown and you clicked block?

dja2k

For "unknown" and "caution" programs you have three choices : Query (Default), Allow, Block.
Query means that Prevx1 will ask you what to do.

If a program is considered as "bad" in the Community Database, I don't think you will have a choice, it will be blocked.
If a program is considered as "caution" in the Community Database, than Prevx1 will act according your settings for "caution" programs.
If a program doesn't exist in the Community Database, than Prevx1 will act according your settings for "unknown" programs.
If the Community Database isn't available, than Prevx1 will act according your settings for "unknown" programs.

[dja2k]

Don't think you have to explain how it works, I was a beta tester for Prevx1 and I already know that, but what option do you have. If you have block, then I understand why it got blocked.

dja2k

[ErikAlbert]

Originally Posted by dja2k

Don't think you have to explain how it works, I was a beta tester for Prevx1 and I already know that, but what option do you have. If you have block, then I understand why it got blocked.

dja2k

I didn't know you were a beta tester. I block everything.
Caution = bad for me, so I block them.
I don't change my softwares often. So "unknown" is not a problem, I just block them.

I only install and try new softwares in test snapshots without Prevx1.

[dja2k]

Thanks ErikAlbert!

dja2k

[duke1959]

Cyberhawk popped up a warning right away.

[Rostek]

Hello!

I've downloaded it yesterday. I have seen popups from GMER alerting me before starting taskmgr.exe, telnet.exe and ftp.exe (and calc.exe of course and explorer.exe also ), and two from Jetico asking whetear to allow "acces to network" and - after running this test second time, when I accepted "acces to network" - alerting me before connection.

The test program has showed: "Your system is not secured! The attack demo collected listings of your data files and POSTED IT ON THE INTERNET..."
I said "Oh ****!"
I'm a stupid lame, I'm afraid of these all trojans, worms and other junk. But, I've though, that maybe this time something went wrong... As a stupid lame, I did an easiest test of this "trojan tester"

So I have PLUGED-OFF NETWORK CABLE FROM MODEM, SO THERE WAS PHYSICALLY NO CONNECTION TO INTERNET!!! Then I have run TrojDemo once again. It showed the same "(...) The attack demo collected listings of your data files and POSTED IT ON THE INTERNET..."

Yeah

Greetings to all.

[ErikAlbert]

Originally Posted by Rostek

So I have PLUGED-OFF NETWORK CABLE FROM MODEM, SO THERE WAS PHYSICALLY NO CONNECTION TO INTERNET!!! Then I have run TrojDemo once again. It showed the same "(...) The attack demo collected listings of your data files and POSTED IT ON THE INTERNET..."

Yeah

Greetings to all.

LOL. That's funny. Posted it on the internet without internet-connection. Must be a bad programming.

[aigle]

Ya. I know if I run it without intetrnet connection it says ur system is secure.

[duke1959]

I posted about this Test in the Comodo Personal Firewall Forum, and a few agreed the test is suspicious. I was just saying that at least some software detects it right away. Comodo and AVG Free didn't, but as long as I denied it access to the internet via fireFox by CPF, there shouldn't be any information going out. It was good to see Cyberhawk pop up a warning right away though. I may try the HIPS in Spyware Terminator later to see if it detects anything right away too.

[maddawgz]

Avg Suite failed miserably......i got pop ups everywhere my calculater too lol now i gotta reboot...Arghhhhhhh hope its innocent... anything i can use alongside AVG Suite Tx..MD

[aigle]

As in my experience this test seems buggy.