Testing AV

We use Symantec Endpoint protection at work. We are always getting those stupid fake alert programs running on machines, and symantec never stops them or removes them.

So, we are testing a new AV (Kaspersky) which so far, is doing a great job.

I would like to test against these fake alert malware programs though, and since the trial is time limited, was wondering if anyone knew a site I could go to to test this.

Obviously this is an odd request, but as the fake alert doesn't 'spread' I figured it'd be ok to send a test machine to a problem site, and click on the malware to see what happens.

Thanks in advance!

Drop me a PM with a mail addy that will allow password protected rar files.

I work for Panda so its easy for me to gather some samples for you. At your own risk though XD.

I'll send you a PM shortly. :D

Also i can vouch for Cider, he's the Inside man with access to the good stuff. ;)

If you have malicious files, you can upload them to virustotal.com ... It will run them against [currently] 41 different AV products, and display the results. These results may not reflect actual detection rates... I have heard that they run them against the CLI version of these programs, but you can still get a pretty good idea. You can also check out hash values.

Quote:

---

We are always getting those stupid fake alert programs running on machines, and symantec never stops them or removes them.

---

I guess that unless they are well known, not much will stop scareware, as it doesn't seem to actually do anything malicious?

I would respectfully suggest that you take a look at your user account policies; as they shouldn't really be able to install anything executable?

Have you considered sandboxing your internet connections with something like sandboxie or fortres grand?