best anti-trojan software

Discussion in 'other anti-trojan software' started by sundown, Dec 1, 2002.

Thread Status:
Not open for further replies.
Page 2 of 2
  1. Paul Wilders

    Paul Wilders Administrator

    Joined:
    Jul 1, 2001
    Posts:
    12,475
    Location:
    The Netherlands
    Robert and all,

    First: we've got some fully licensed PestPatrol v4 copies stashed over here, ready for testing and reviewing. Could take some time before we have finished that one.

    One of the main problems in regard to trojans/backdoors in regard to v3.2 has been the detection/cleaning issue. An example:

    Take a nastie - for example Lithium, Optix, Bionet - and pack the server using UPX v1.22 or PETITE. PestPatrol could not handle these. Most probably this is related to the fact, packing and unpacking requiers a "stub" and sometimes doesn't get overwritten. This can push memory off by 16/32/64 bytes from where it would normally "land". Sort of dithering the addresses up to 4k could take care of the problem.

    Anyway, let's drop the technical talk. We will test the new version - and the review will be up on our antitrojans page ;).

    regards.

    paul
     
    Paul Wilders, Dec 7, 2002
    #26
  2. Pretender

    Pretender Registered Member

    Joined:
    Apr 23, 2002
    Posts:
    670
    Location:
    Virtual Paradise

    What you say siro_O?? Me no comprenday(sp) o_O
     
    Pretender, Dec 7, 2002
    #27
  3. robert

    robert Guest

    What you say siro_O?? Me no comprenday(sp)


    Yo Pretender :)


    Go With The Flow


    Robert
     
    robert, Dec 7, 2002
    #28
  4. Paul Wilders

    Paul Wilders Administrator

    Joined:
    Jul 1, 2001
    Posts:
    12,475
    Location:
    The Netherlands
    Robert,

    Never mind - I obviously got carried away in technical talk ;).

    Although I strongly recommend against fooling around with trojans/backdoors, the example provided would be a (not "the") proof of the pudding.

    regards.

    paul
     
    Paul Wilders, Dec 8, 2002
    #29
  5. caligula

    caligula Registered Member

    Joined:
    Feb 20, 2002
    Posts:
    5
    TrojanHunterz can't cope with Armadillo packer. use it with Optix Killer: will finish it once and for all. :rolleyes:.
     
    caligula, Dec 28, 2002
    #30
  6. Judgedredd

    Judgedredd Guest

    What is Armadillo packer o_O?

    Optic Killer is in TrojansHunters data base. So i really don't know where you are coming from.

    Regards Judgedredd
     
    Judgedredd, Jan 17, 2003
    #31
  7. Paul Wilders

    Paul Wilders Administrator

    Joined:
    Jul 1, 2001
    Posts:
    12,475
    Location:
    The Netherlands
    Hi Judge,

    It's a packer - as there are several.

    A trojan(server) can be used "out of the box" - meaning unpacked for example - and this "orginal" is databased and therefore will be detected. In case a server has been packed - for example with a not-covered packer like Armadillo - it goes undetected. If combined with a real nasty like Optix, most ATs are dead meat :rolleyes:

    I don't know either - just jumping in ;).

    regards.

    paul
     
    Paul Wilders, Jan 17, 2003
    #32
  8. Magnus Mischel

    Magnus Mischel Security Expert

    Joined:
    Oct 24, 2002
    Posts:
    185
    Not true, TrojanHunter does deal correctly with the Armadillo packer, and identifies trojans packed with it.
     
    Magnus Mischel, Jan 18, 2003
    #33
  9. JacK

    JacK Registered Member

    Joined:
    Jun 20, 2002
    Posts:
    737
    Location:
    Belgium -Li?ge
    Hi Magnus,

    I didn't know.

    Great product, indeed.

    I'll try to use FSG 1.33 or PEBundle 2.36 with Exe Bundle 2.2
    on a known trojan and see if I can cheat TH

    Hold on the rope ;)
     
    JacK, Jan 18, 2003
    #34
  10. DrSeltsam

    DrSeltsam Guest

    Partly right. Any memory scanning packer has problems with Armadillo. Its quite easy to say why ...

    Armadillo has several packing and crypting modes. A few modes are using memory copy and encryption techniques. This means only a few parts of the exe file are unpacked and decrypted in memory.

    Every programm consists of a main routine and several subroutines. Most packer (as far as i know all besides Armadillo) will unpack the main and the subroutines if the program is started. So memory scanning is no problem.

    Armadillo will in some cases (if you are using special settings) only unpack the main routine and leave the other things packed/crypted. Than it runs the main routine and if a subroutine is called it will unpack/decrypt it.

    There are several mechanisms Armadillo uses. It depends on how good/bad the chosen signatures are. If you take a signature of the main routine there wouldn't be a real problem. If you use a signature of one of a subroutine the chances are high that it will miss the trojan.

    TrojanHunter can most times deal with armadillo packed trojans. It has only some problems if you pack a very tiny trojan.

    BTW:
    This behaviour of Armadillo is the reason why most av programs that uses unpacking like mc afee or kav had big problems with Armadillo and still have few problems.
     
    DrSeltsam, Jan 18, 2003
    #35
  11. Magnus Mischel

    Magnus Mischel Security Expert

    Joined:
    Oct 24, 2002
    Posts:
    185
    TrojanHunter correctly identifies and removes Armadillo-packed trojans protected even with the highest Armadillo security level. If anyone has any other information or findings, I welcome them to e-mail security@misec.net describing the problem, but as of now there are no known issues with Armadillo or any other packer.
     
    Magnus Mischel, Jan 18, 2003
    #36
  12. spy1

    spy1 Registered Member

    Joined:
    Dec 29, 2002
    Posts:
    3,139
    Location:
    Clover, SC
    Magnus - Are there any known conflicts between TH and TDS?

    Or, is there anything special you have to do if you want to have both programs on your computer? Pete
     
    spy1, Jan 18, 2003
    #37
  13. Magnus Mischel

    Magnus Mischel Security Expert

    Joined:
    Oct 24, 2002
    Posts:
    185
    No conflicts have been reported that I know of.
     
    Magnus Mischel, Jan 18, 2003
    #38
  14. the Tester

    the Tester Registered Member

    Joined:
    Jul 28, 2002
    Posts:
    2,854
    Location:
    The Gateway to the Blue Hills,WI.
    Spy1.I have Trojan Hunter and TDS-3.I have TH guard always running and TDS-3 has exec protect activated.I do a full system scan with each program on average once a week.I haven't had any problems whatsoever yet!
     
    the Tester, Jan 18, 2003
    #39
Page 2 of 2
Thread Status:
Not open for further replies.
  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Accept Learn More...