Need to know where to download those fake AV Trojens?

Mikoyan · 9 Dec 2009 at 13:17

Hey guys want to test our AV and ideally need those fake AV's that install such as SWP2009 demo, etc.

How can I get the link too see where to download I dont want to go to pron sites im at work lol

Ta

doggs · 9 Dec 2009 at 13:21

Try some doddgy porn sites

I've been told they sometimes contains crapware.

Rainmaker · 9 Dec 2009 at 15:37

Check your trust email.

cokecan · 9 Dec 2009 at 15:45

Rainmaker said:
Check your trust email.

It's a trap! lol don't open the email attachments

Rainmaker · 9 Dec 2009 at 15:46

cokecan72 said:
It's a trap! lol don't open the email attachments

LOL!

Sin_Chase · 9 Dec 2009 at 15:49

http://www.eicar.org/anti_virus_test_file.htm

Mikoyan · 9 Dec 2009 at 16:36

LOL!

Rainmaker\Lee much appreciated mate, great information by the way :cool:

Cheers also Sin!

theheyes · 9 Dec 2009 at 16:41

Sin_Chase said:
http://www.eicar.org/anti_virus_test_file.htm

This. You should only really test real viruses in a VM or properly configured "lab" computer - don't just shotgun a production computer connected to your work network to test.

SiriusB · 9 Dec 2009 at 17:32

Ooh never knew about this. Just tried the double-zip file and NOD32 slapped it down before the "Save to" box popped up on my browser!

*strokes NOD* Good boy.

Rainmaker · 9 Dec 2009 at 17:33

SiriusB said:
Ooh never knew about this. Just tried the double-zip file and NOD32 slapped it down before the "Save to" box popped up on my browser!

*strokes NOD* Good boy.

I wouldn't get too excited, NOD let through about 25% of the zero day malware I tested it on.

SiriusB · 9 Dec 2009 at 17:48

Eset might be interested to know that

Mikoyan · 9 Dec 2009 at 17:48

your using nod32 also Rainmaker? same!

Im finding some of our clients are able to run these fake AV and it is a nightmare to remove...but then I think shouldnt nod stop this?

I wanted to try it on a lab pc and see if it just allows it, do these 2 options help?

Detect unsafe and detect unwanted applications?

Rainmaker · 9 Dec 2009 at 17:48

SiriusB said:
Eset might be interested to know that

ESET confirmed several new variants of malware and thanked me for my contributions. As did Norton, Avira, Avast and Comodo. Kaspersky caught them all though.

Rainmaker · 9 Dec 2009 at 17:50

Mikoyan said:
your using nod32 also Rainmaker? same!

No I used to run Avira Premium (still have a licence for it), then Avast Pro combined with SuperAntiSpyware Pro (paid-for/real time), but since my zero-day testing I've stuck with Kaspersky. Every other AV vendor allowed between 20% and 80% of the malware through their net unchallenged, but Kaspersky caught 100% of it (50 out of 50 samples in the end!).

DreXeL · 10 Dec 2009 at 08:57

Rainmaker said:
No I used to run Avira Premium (still have a licence for it), then Avast Pro combined with SuperAntiSpyware Pro (paid-for/real time), but since my zero-day testing I've stuck with Kaspersky. Every other AV vendor allowed between 20% and 80% of the malware through their net unchallenged, but Kaspersky caught 100% of it (50 out of 50 samples in the end!).

Did you test MS Security Essentials?

Mikoyan · 10 Dec 2009 at 09:14

Rainmaker said:
No I used to run Avira Premium (still have a licence for it), then Avast Pro combined with SuperAntiSpyware Pro (paid-for/real time), but since my zero-day testing I've stuck with Kaspersky. Every other AV vendor allowed between 20% and 80% of the malware through their net unchallenged, but Kaspersky caught 100% of it (50 out of 50 samples in the end!).

Did this include fake av's?

cokecan · 10 Dec 2009 at 09:17

DreXeL said:
Did you test MS Security Essentials?

Wondering this myself

Rainmaker · 10 Dec 2009 at 10:28

DreXeL said:
Did you test MS Security Essentials?

cokecan72 said:
Wondering this myself

Yes I did, details are in the main AV thread - and they weren't good. The samples included trojans, worms, fake AVs, rogues, exploits and so on.

Rainmaker said:
MSE blocked only four out of 13, giving around 30% success rate and 70% failure rate. It too let through the fake AV and a trojan as well as completely ignoring the malicious iFrame redirects and PDF exploit. That, unfortunately, fits in with my previous real-world experience of MSE letting even known threats infect a machine, and MS replying with "Meh." when questioned about it.

And yes, the samples blocked 100% by Kaspersky included several fake AVs and 'scareware' suites. Don't forget that no test is conclusive, results can change daily, and that layered protection is still your best bet no matter what or who you choose. My results have shown me fairly consistently though that Kaspersky and Avira are damn reliable, NOD32 and Avast coming close seconds. MSE and so on were barely worth installing.

div0 · 10 Dec 2009 at 10:43

Rainmaker said:
Yes I did, details are in the main AV thread - and they weren't good. The samples included trojans, worms, fake AVs, rogues, exploits and so on.

Excellent work, and good to see that Avira thanked you for helping them to update their detections.

A very interesting read

bledd · 10 Dec 2009 at 12:28

Rainmaker, sent you a trust email

Need to know where to download those fake AV Trojens?

Man of Honour