Antivir Issue

Hi All,

One thing I've noticed about Antivir is that even if you execute a malicious program on your PC it will still run...Antivir will pop saying it's malware...but the program will still execute.

Example:

I executed Martin's Undetectable Keylogger...Antivir popped up and warned me but the program was still able to execute and log my keyboard strokes.

Anyone else also experience this?

Best Regards,
Toby

 

Ideally, and normally, a real-time scanner will of course catch a file before it is run. My guess is that AntiVir only caught this executable in memory after it had done its unpacking. At that point, the warning is pretty much informational.

Like I said, just a wild-assed guess.

 

Antivir did catch it before it was run...but yet it still executed.

 

Can you send me the file? 4d5nbbb02 at sneakemail.com. No problem if you can't or won't.

 

Why? You can download it here:
http://www.winsite.com/bin/Info?26000000037599

 

Oh gee, I'm sorry, I didn't have Martin's Not-Quite-So-Undetectable Keylogger bookmarked.

 

I downloaded the file. The moment I extracted it, AntiVir detected it. So, I have no idea what you're talking about, unless you have AntiVir misconfigured, or this detection falls under one of the "Extended threat categories" (I doubt it, since it's classified as a trojan).

 

Now you can bookmark it.

 

Ok...let me say this again...execute the file. Don't extract it...execute it.

 

Downloaded fine. Then when I:

Tried to extract it, AntiVir caught it.
If I tried to run it from within WinZip (i.e., not extracting it first, just trying to run it), AntiVir caught it.
If I extracted it and had AntiVir ignore it (i.e., let me extract it to my hard drive), when I tried to run it AntiVir caught it.

Basically, AntiVir caught it no matter what I did.

BTW - SSM also caught it.

 

Really? Damn that is not what happened to me...can you do me a favor and do it again just to confirm? with winrar would be preferable...because that's what I use.

Please note: my Antivir detected it as well but did not prevent it from executing. Please make sure the program doesn't open in the background.

 

Toby: check your settings, you might have set it to "ignore" by default, or you might have clicked ignore which would allow access to the file.
Otherwise all access _will_ be blocked.

 

Yeah..I just did...everything is configured properly.

 

In any case, upon extraction the AV catches it. That's tons better than executing it.

Better still, scan the file before even thinking of extracting it. My AV detects the executable in the archive as having a keylogger. Needless to say, I deleted the blighter!

 

As a follow-up, VirusTotal reports that 10 AVs detect this at the time of analysis.

 

It,s just new detection. I remember few months back, only Antivir was detecting it by heuristics.

 

Avast missed this big time !


Edit:Update. I tried sending keylogger.exe to virustotal and a msg from avast popped up saying the file was suspicios. I wonderhow come the mail scanner caught it but when I opened thekeylogger nothing happened ?

 

good news for the avg suite, both avg and ewido caught it, and both signatures are in the suite

 

I downloaded the keylogger and as I extract it, Avira caugh it...

 

Strange avast missed this.Ewido caught it right away.

Any of u using avast and caught the keylogger ? I am not sure maybe I didnt configure avast right ?

 

Yeah...though my only concern is going to a "nasty" site that tries to execute something automatically...then I'm screwed.

Regards,
Toby

 

So go there in a SandBox.

 

Not using Avast but have in the past - maybe turn the resident up to High and see if that works to detect it?