Through the Eyes of a Keylogger versus HIPS

http://www.aplin.com.au/?page_id=531

It seems interesting. Tried it with CFP.

Keys logging -- CFP Passed
Logging of Applications launched n web sites visited --- CFP Failed
Clipbpard logging ---- CFP failed
Screen capture ---- CFP PASSED

 

GesWall

Keys logging -- GW Passed
Logging of Applications launched n web sites visited --- GW Failed
Clipbpard logging ---- GW failed
Screen capture ---- GW Passed

 

DefenseWall:
Keys logging -- Passed (inform about this event, but if you don't click Terminate button - then failed (keys still will be logging)
Logging of Applications launched n web sites visited --- Failed
Clipboard logging ---- Passed (DW inform about this event, and again you have to press Terminate button on notification to close rogue application)
Screen capture ---- Passed


Online Armor (paid v.3.1.0.26):
Keys logging -- Passed
Logging of Applications launched n web sites visited --- Failed
Clipboard logging ---- Passed/Failed (OA only shows an information about that the running software will be able to record what you type - no any information about Clipboard logging)
Screen capture ---- Passed

 

Thanks for adding this.

 

Thank you for the infos.

 

You are wecome

BTW i sent this file to Jotti and 3 AV found this file as a malicious software:
F-Secure Anti-Virus Found Trojan.Win32.VB.kll
Kaspersky Anti-Virus Found Trojan.Win32.VB.kll
Sophos Antivirus Found Mal/VB-G

I wonder if thats FP or not

 

Not exactly HIPS but Zemana is supposedly designed to prevent exactly these type of things.

Results:

Keys logging -- Passed
Logging of Applications launched and web sites visited --- Failed
Clipbpard logging ---- Failed
Screen capture ---- Passed

Cheers

 

Zemana Antilogger stops this, the one pop-up - blocked, cannot get it to run anymore, simply won't start:

 

Allow it once and see if u get more alerts about clipboard and screen logging?

 

Will do in a little while when I have a spare minute.

 

1-OPFW

Pop-up for all but failed all also.
Keys logging Passed
Screen capture Failed
Clipbpard logging Failed

2-ZEMANA

Pop-up for all but;
Keys logging Passed
Screen capture Passed
Clipbpard logging Failed

 

I think it depemnds on settings. I had set it to



This I think lets the application launch but should alert on potentially harmful actions. Basically I wanted to see whether Zemana recognised the applications activities as 'potentially harmful'.

Got this which I blocked:



But result still this



Cheers

 

Can any of you confirm if what I am experiencing corresponds to the reality of things or not.

I tested this, and after that, I noticed something odd with some keys of my keyboard.

I've noticed that now, everytime I press ~~ ^^ ´´ ``, they appear twice. I'm not sure whether or not all of you have these same keys on your keyboard, because some languages may not have such accents, or all of them.

Can you tell me if you're also experiencing it?


Thanks

 

I thought Zemana prevented clipboard logging. Are there any programs that do?

 

Allowed it once and it runs, allows everything. Also tried it with different settings in Zemana and it was blocked without any pop-up at all. Screenshot of settings below. PrevxEdge also blocked it. Needless to say DefenseWall blocks it with a Terminate option.

 

Yes, I see. It's these we have different, hence the different results



I set it like this as I wanted to see how it performed on all 4 areas. Wheras I think on your settings if it recognises even 1 of the 4 it will permanantly block the application.

cheers

 

When I tested first time I had Zemana in default settings, it looks as though yours are in Expert Mode. I tried the 'Custom settings' the second time to see what would happen
Perhaps have a go in Expert settings tomorrow.

 

Tested with Malware Defender 2.1.0 beta.
Got an alert every time in all 4 tests.








Chose deny and kill process on each alert.
MD passed with flying colors.

 

cool thanks buddy

 

m00nbl00d - I confirm they appear twice ; it is normal ...

 

Can anyone confirm. No doubt I've done something wrong but I did as LoneWolf and sure enough MD passed all. Used deny and kill but not create rule. I the ran the app again and chose the combined test. This is what I got. No pop ups from MD.



Rule looks like this



As I say I'm sure its me and something to do with my original decisions but but some confirmation that others see MD passing would be nice.

Cheers

 

Edge wont even let it run. Also disable Edge and it still grabs it.

 

Prevx disabled and still nabs it.

 

I tried Netchina and EQSecure (default ruleset) and both would kill the app initially and then let it run after that. I didn't create any rules either.

 

Are some in here crazy blocking the app from running does not mean a pass..


Comodo passes then as well.. and so does most HIPS probably.