A pure heuristic antivirus software--- ByteHero

this software is from china,and it is completely depend on heuristic technology to detect virus and trojan etc.It is not any signature get involved.so anyone can try it
website:http://www.bytehero.com/english.asp

 

Ikarus doesn't like this hero.

Gerard

 

Ikarus doesn't like a lot of things.

Last I checked with a laptop of mine, with a2, Ikarus engine claimed several trojans on editors for well-known PC game ... Official editors even.


So, I am afraid Ikarus really isn't the thing you can place your faith in No offence to anyone but they do have horrible rate for f/p's.

 

Several other AV's have this FP then

Gerard

 

9 out of 41 on VirusTotal.

 

The exe. gets hits on jotti's from Ikarus,CP Secure, and Sophos as a "trojan- Flux, Generic A or Pakes".

 

Comodo, F-Prot, F-Secure, McAfee, PCTools detect it as well.

Gerard

 

NOD didn't show up as one of those detecting it on my upload to Virus Total, and yet it did detect it when I first tried to download it - a variant of Win32/Packed.Themida application..

Is this one of those examples of the real life AV functionality not being fully replicated by the up load scanners..??

 

mse says is clean iobit 360 also says clean ...... but my mind says no to a software without any serious page and adress to contact.... anyone can put a malicious file to internet with an email for contact

 

prevx doesnt like it eiether. says its a backdoor trojan.

 

As lodore has noted, Prevx does not like it !

I downloaded it and compared it with the Prevx www -



The file size matches Exactly ! might not be the same, but ?



Prevx didn't jump when i unpacked the RAR, but did when i right scanned it

 

I uploaded this file to ThreatExpert and the result was inconclusive.It's possible that the software protection used could be triggering a FP as certain malware use similar methodology.

http://www.threatexpert.com/report.aspx?md5=9f4212b3108dbf25a92086e25623a7b2

 

My Eset Smart Security blocked it.

 

Many trojans have a threatexpert report like that.

 

I ran the file past MalwareBytes and SuperAntiSpyware just to see what they would say and neither found it to be malicious.

 

It's Themida packed, making it hard to analyse.

Strange, Oreans always claimed that Avira reports *every* Themida file...

 

A2 AntiMalware (Ikarus scan engine) has just updated it's database and now says it's clean.

 

This looks like a "greyware" find.
No definitive consensus yet.

 

MSE scanned the download, you could tell it was using its cloud ability because it hung on a few files till finished, but came back clean with it. I would say any detection is a FP.

 

Comodo Instant Malware Analysis result:

http://camas.comodo.com/cgi-bin/sub...348bafe09f116089911ec0dba4a1fa75702ecd242eba3

 

NIS2009 Doesn't detect anything, here's the Anubis report of the .exe

http://anubis.iseclab.org/?action=result&task_id=158d20982eaedfad41d5678eb8acd223e&format=html

So... Who's game?

 

At the end of the day, I probabily wont use it regardless of its status.

 

Best post of the thread.

 

There is always some curious dumb who will use it.

So, I did it.

Avira, Threatfire and Malwarebyte did not find malware, there were no problems with OS etc. Looks like crapware rather than the malware. Slow scanning speed and very poor detection when testing with a smaller number of newer malware samples (Avira, Avast and Threatfire, for example, detect all of the samples).

 

I'll analyze this sample shortly but any legitimate software company, let alone an "AV", which packs its files with Themida is doing something very, very wrong