topbanner_forum
  *

avatar image

Welcome, Guest. Please login or register.
Did you miss your activation email?

Login with username, password and session length
  • Saturday August 13, 2022, 9:36 am
  • Proudly celebrating 15+ years online.
  • Donate now to become a lifetime supporting member of the site and get a non-expiring license key for all of our programs.
  • donate

Show Posts

This section allows you to view all posts made by this member. Note that you can only see posts made in areas you currently have access to.


Topics - BillR [ switch to compact view ]

Pages: [1]
1
First, a quick thanks to BGM, Mouser, and many other authors who have created useful, or at least interesting, tools for us.

Systemus is a handy dandy system admin tool that BGM created for N.A.N.Y. 2020.  Systemus had problems with false positives from antivirus products.  Just out of curiosity, I ran Systemus through three meta-scanners, Jotti, VirusTotal, and MetaDefender, two days ago just to see what had changed.  The results did improve (fewer presumably FPs), but are far from perfect.

At the end of 2020, I submitted Systemus to a half-dozen-ish vendors, plus a few more later on.  Over the intervening couple of weeks, VirusTotal varied from 23 FPs initially, to 15 minimum, to 17.  BGM reported 23/69 for VT in his response.  I'm not sure why we had different totals, but I can imagine several possibilities (e.g., maybe BGM ran his PE Studio analysis a couple of weeks before his reply in the thread; or maybe he used .exe and I noted .zip, primarily); etc.).  FPs also decreased on Jotti (no details) and MetaDefender (8 to 5) during those few weeks.  Some other person also may have submitted FP requests during that few weeks or the intervening months.  (See end of https://www.donation....msg442731#msg442731 for my comment and BGM's response.)

As several developers noted in that Systemus thread (and many other threads), this can be frustrating: each antivirus false positive is going to discourage users from experimenting with the software, but getting each AV vendor to evaluate each iteration (or even periodic stable releases) is like playing whack-a-mole at the bottom of the deep end of the pool using your nondominant foot with one eye closed and with some moles stuck in the up position. (I'm look at you, Webroot, who didn't actually evaluate/act on Systemus even after I submitted it twice; and you, McAfee in several guises, who has lots of fiddly restrictions; and a few others who make submitting arduous -- only webform with odd fields, only via forum, only via installed AV(!), only by author (not a user), etc. -- or even impossible as far as I can tell).  A couple of reputation-based products aren't (or weren't a couple of years ago) willing to whitelist little known software even after their lab had reversed a FP in the main AV.  Some authors recommend other authors just ignore FPs as too much trouble.

For comparison, these are April 2022 results for Systemus using the same files from my download folder.  The dates here identify the last update to the engine/signatures.

Jotti
.zip (1/14):
Fortinet Apr 8, 2022 W32/PossibleThreat

VirusTotal
.zip (6/59 -- 59 excludes incompatible or nonreporting AVs):
AhnLab-V3    Malware/Win32.Generic.C3986407
Fortinet         W32/PossibleThreat
MaxSecure     Trojan.Malware.300983.susgen
McAfee          Artemis!A5AC6681733F
McAfee-GW-Edition  Artemis!Trojan
Panda           Trj/CI.A
.exe (run today -- 8/68 -- excludes 4 incompatible and 1 nonreporting engine)
Same FPs as above except:
(different) McAfee-GW-Edition  BehavesLike.Win32.Dropper.dh
(added) Palo Alto Networks  Generic.ml
(added) Webroot  W32.Malware.Gen

MetaDefender
.zip (0/35 but infected components flagged -- 35 includes 2 incompatible file type and 1 no result)
.exe (2/35 -- includes 1 no result)
Malware/Win32.Generic   AhnLab   Apr 9, 2022
Malware   Webroot SMD   Apr 8, 202
.dll (1/35 -- includes 1 no result)
Malware   Webroot SMD   Apr 8, 2022

I have no idea how much of the difference from two years ago may be due to FPs being fixed (either proactively or because someone submitted a request), or due to improved engines, or due to pruning because the miniscule installed base is no longer considered relevant (perhaps partially due to user whitelisting).

Note that due to different settings or other differences, "AhnLab" and "McAfee" reported "No Threat Detected" on MetaDefender while alerting on VT.  This is not the first time I've noted a few differences between results for the same engine between these (and other) meta-scanning platforms. VT has a statement somewhere that mentions various reasons VT results may vary from the same vendor's installed product and/or web scanner.  Some of these reasons (plus others) also apply between meta-AV platforms.

My personal impression is that, for the same vendor, VT tends to have more hits (almost always FPs for me) than MetaDefender and Jotti, but I have seen the reverse.

A couple of tools I used to automatically submit likely FPs to selected multiple sites via email were discontinued many years ago.  I saw a few attempts to create something similar, but those weren't maintained (but I haven't looked recently).  TechSupportAlert had a great list but it is not as useful anymore -- especially for FPs.  MetaDefender's knowledge base has an updated list for its vendors (usually email, sometimes web or other) but doesn't explain the restrictions (i.e., address but not content or formatting restrictions).  If jotti or VT has a similar list, I've missed it.  VT really needs a list as some of their vendors/engines are obscure to this English speaker who only dabbles in security occasionally.

2
Anyone else with conflict between HitmanPro.Alert and Screenshot Captor Scrolling Window?
Suggestion for resolution?  Perhaps exclude a different/additional process in HMPA?

I posted the following excerpt yesterday.  (Issue 2 regards LastPass and HMPA encryption conflict.)

http://www.wildersse...age-313#post-2545573

Has anyone else encountered conflicts between:
Screenshot Captor and HitmanPro.Alert?

Issue 1: Screenshot Captor (just snipping via scrolling window feature) by DonationCoder and HitmanPro.Alert conflict. I have to stop Screenshot Captor in order to cancel the .Alert warning (canceling many more times might work eventually). Excluding the main process via Exploit Mitigation was not sufficient. (Win7, multiple browsers, .Alert all features except encryption)

To reproduce, install SC trial and show Quick Capture Bar; with browser open to a page that scrolls, click on scrolling window button; loop the error message a few times; cancel snipping request via the tray icon.


3
Random Idea - Maybe a simple way to submit every(?) page of a site to VirusTotal for evaluation?  Several tools will list all links and build a tree and VT has a simple API so I guess this would be primarily a script (with a 16 second delay between submits) and some parsing of the results to build a simple report.
I've also noticed that www.some-site-xyz.com and some-site-xyz.com will return different results in VT even when one redirects to the other.

---------
Websense (Directly and via VirusTotal) - DonationCoder is Malicious   :o

http://csi.websense....4-bb68-a2b8006ae41e#

https://www.virustot...analysis/1390140476/

https://www.donation...AndRunRobotSetup.exe

Requested reclassification as productivity software because:

FARR - Program launcher for MS Windows.
Other software is also available on donationcoder.com, much of it productivity related such as ScreenshotCaptor (enhanced print/capture screen) and JottiQ (MS Windows Explorer context menu extension to submit files to Jotti.org -- security productivity).

-----
File detected:   FindAndRunRobotSetup.exe
File threat classification:   Malicious
....
The Websense ThreatSeeker Intelligence Cloud is now reclassifying this URL due to the malicious file it drops. If you suspect someone from your organization went to this URL, inspect their machines for possible malware infection. The assessment overview below does not include the results of this file analysis.
-----
Scroll to the bottom to see FARR.exe analysis

4
Screenshot Captor / How to Capture Screenshot Capture Itself?
« on: November 15, 2013, 02:04 PM »
How does one use Screenshot Capture to capture screenshots of itself (e.g., those in documentation)?  Or does one just use a different tool?

Apologies if this has been answered before and my clumsy self-referential search in the SC forum failed to find it.

5
Screenshot Captor / Bug - Wrong Description
« on: November 15, 2013, 01:53 PM »
This is the description for the IE9 window and tab ("Start new topic ..."; other tab is "Screenshot Captor - Software - Donation Coder") that I am writing in now resulting from Grab Active Window:

iexplore
11/15/2013 , 2:26:53 PM
https://citrixeast.a...auth/loggedout.aspx?           <=====  ?????
CTX_MessageType=INFORMATION&CTX_MessageKey=SessionExpired
Start new topic - DonationCoder.com - Windows Internet Explorer

But the only citrix tab open refers to a different window (different session?) which is minimized to the taskbar.

I don't have this problem if I open a new session (from "Start new topic ...") with two tabs (ixquick.com and duckduckgo.com):
iexplore
11/15/2013 , 2:40:43 PM
https://ixquick.com/
Ixquick Search Engine - Windows Internet Explorer

or new window (from ("Start ...") with two tabs:
iexplore
11/15/2013 , 2:41:27 PM
https://ixquick.com/
Ixquick Search Engine - Windows Internet Explorer

or new window from the citix window:
iexplore
11/15/2013 , 2:43:33 PM
https://www.google.com/
Google - Windows Internet Explorer

But the citrix window/tab itself (only tab!):
iexplore
11/15/2013 , 2:46:59 PM
https://ixquick.com/                                                      <===== ?????
Citrix XenApp - Logged Off - Windows Internet Explorer

6
For this laptop I set default DPI scaling to large in Vista.  I think this causes the text on the buttons to overflow.   Re-sizing the pop-up with some application implementations/settings sometimes allows more text to display but not here.

One possible quick solution might be to enable hover display.   

I only use SC a few times a year so I don't have the icons/button-positions memorized.

Pages: [1]