most AV's disabled

Discussion in 'other anti-malware software' started by overangry, Jun 15, 2010.

Thread Status:
Not open for further replies.
  1. overangry

    overangry Registered Member

    Joined:
    Apr 4, 2009
    Posts:
    309
    How can it be that these AV's CIS, NIS, AVAST are dissabled by a new threat( gotnewupdate0005.....exe) I downloaded from MDL?
    I would have thought that they deploy differnt forms of self protecion.
    I haven't tried other products, except for BufferZone which was unefected.

    EDIT: I forgot to mention that the AV's faild to start after rebooting.
     
    Last edited: Jun 15, 2010
  2. Franklin

    Franklin Registered Member

    Joined:
    May 12, 2005
    Posts:
    2,517
    Location:
    West Aussie
    Probably because the authors of that rogue have made sure that it isn't detected by most AV's before releasing it.

    Once most AV's start detecting the installer then they release a new morphed undetected version.

    While Antimalware Doctor was up and running I tried out Safe Returner against it and it killed the rogue's process and the rogue was inactive after reboot.

    gotnewupdate005002.exe - Result: 13/41 (31.71%)

    AMD.JPG
     
    Last edited: Jun 15, 2010
  3. sg09

    sg09 Registered Member

    Joined:
    Jul 11, 2009
    Posts:
    2,713
    Location:
    Kolkata, India
    Which one inactive? Rogue or Safe returner?
     
  4. overangry

    overangry Registered Member

    Joined:
    Apr 4, 2009
    Posts:
    309
    I'm sure the AV's will update shortly.
    On another note, CIS was the only AV enabling me to send them a smple of this malware.
    It captured by the sandbox, the sandbox on the other hand failed in preventing it's execution, allowing changes to the real system.
     
  5. Franklin

    Franklin Registered Member

    Joined:
    May 12, 2005
    Posts:
    2,517
    Location:
    West Aussie
    The rogue was inactive. Safe Returner kicked it's butt as did Malwarebytes.
     
  6. sg09

    sg09 Registered Member

    Joined:
    Jul 11, 2009
    Posts:
    2,713
    Location:
    Kolkata, India
    Well done by Safe returner...:) Is it better that Norton Power Eraser?
     
  7. Franklin

    Franklin Registered Member

    Joined:
    May 12, 2005
    Posts:
    2,517
    Location:
    West Aussie
    Sorry, haven't tried Norton Power Eraser.
     
  8. sg09

    sg09 Registered Member

    Joined:
    Jul 11, 2009
    Posts:
    2,713
    Location:
    Kolkata, India
    Ok, I have heard that does a lots of FP. Safe returner did any FP?
     
  9. Franklin

    Franklin Registered Member

    Joined:
    May 12, 2005
    Posts:
    2,517
    Location:
    West Aussie
    Only when selecting Advanced it did show some FP's but it does give a warning when going to Advanced mode.

    Best if we keep any future talk on Safe Returner in the Safe Returner thread.
     
  10. sg09

    sg09 Registered Member

    Joined:
    Jul 11, 2009
    Posts:
    2,713
    Location:
    Kolkata, India
    Ohh sure..:)
     
Thread Status:
Not open for further replies.