AV Research

Hey Hey,

*This belongs in both AV and Adware/Spyware Discussions... I picked this forum.... but a lot of the processes are Network Aware Adware... remember the below machine was used for no surfing... everything that appeared did so on it's own*

As many of you may know from my posts, convos on AIM, IRC and MSN, or from PMs.... The network at the college where I work is plagued with viruses... We were curious to see exactly what we were dealing with... so I created fresh machine... After spending a few hours trying to locate a Windows XP CD (everything we had was SP1 Slipstream).. I installed it and immediately turned off Automatic Updates... I also ran Pest Patrol, just to ensure there was nothing listed off the default install..

Over the course of the next 7 days, the test box was connected to 4 different VLANs... two representing Residence Traffic and two representing traffic from our IT Division (The majority of IT students are in a laptop program and have network access in every class).

I was really surprised to find that halfway through, after spending time on the Residence VLANs... that there were only two virus connections... Considering we see patched computers with double and triple this number of infections, I was very confused... I rebooted the machine and low and behold.. approx 10 additional processes appeared on boot. The machine spent the rest of it's week on the IT VLANs and picked up a few more viruses...

I created a ghost image of this infected machine, and started doing my testing.. So far I have ran:
Sophos Anti Virus
eTrust Antivirus (Our coporate solution)
ClamWin
AVG Professional
Norton AV 2004
Trend Micro Housecall
CA Pest Patrol Online

I have created an Excel sheet comparing the products and then breaking down what each found... In addition I've detailed which processes were running, and then hunted down the binaries of all non-MS applications that were listed.

I have plans to include:
McAfee
PC-Cillin
AdAware
SpyBot
Panda AV
HiJack This! Log files
and anything else anyone suggests.

I am attaching the Excel sheet and also the 'questionable' binaries... Any passwords you run into will be 'antionline'... The zip contains two files... another zip with the questionable binaries and the Excel sheet..

Anyways, hopefully this will be useful or at least interesting to some of you.

Peace,
HT

Quote:

---

The machine spent the rest of it's week on the IT VLANs and picked up a few more viruses...

---

Do some of the IT people need a bit of a spanking??????

Quote:

---

Originally posted here by Tiger Shark
Do some of the IT people need a bit of a spanking??????

---

Hey Hey,


The students in the IT Division definately do... IT doesn't refer to our IT department... but the Student-Based IT Division...with the various computer related courses...

So many IT Students run without AV, without a firewall, without patches... The problem is our CTY (Computer System Technology program [3 year]) and it's two year partner attract people who know nothing about computers but think programming would be too hard... and our CPA (Computer Programmer Analyst program [3 year]) and it's two year counter part attract gamers, gamers and more gamers because it's almost entirely Win32 programming... lots of DirectX stuff... They all buy the latest games, have weekend LAN parties, turn the homework lab into LAN parties and think that the latest and greatest is the best.... They figure they know everything and couldn't possibly get a virus.

I don't consider myself overly knowledgeable when it comes to computers... but I'd be hard pressed to find more than 5 Students in the division that know as much as I know and I doubt I'd find any that know more... Half of them are there because they think they'll be the next Bill Gates and be worth a Billion dollars within a year of graduating.. As a result, our network get's raped...

We've had students that have removed files from quarentine bceause they 'thought they were valid files'...

We've definately got our work cut out for us around there.

Peace,
HT

I tried to D/L this link:
Symantec Norton NetSec 2004 informed me there was a virus ...........
and deleted file..........

Am I missing something ? :)

not at all foxey he said that it contained the virus binaries. you need to turn off real time protection to download and play with them

Hey Hey,

If you want the scan results without the virus... here's an attachment with just the Excel Sheet...

Peace,
HT

Quote:

---

and anything else anyone suggests.

---

Kaspersky is usually in these sort of tests
also:

F-Prot
F-Secure
Bit Defender

I am interested in the AV products' ability to detect trojans and other non-viral malware.

On that note:

SwatIt
The Cleaner (Moosoft)

Interesting :)

Would be interesting to see TDS (trojan scan) and nod32 (antivirus) included in the tests aswell nod32 have a quite good record and have 'won' Virus Bulletin 100% Award a few times. I dont know much about TDS except that they claim to be easy to use and good at what they do.

I have been to lazy to download the Excel sheet so I dont know yet what information you have provided but detection rate, if they are able to clean the infection and scan times (in heuristic mode) would be really interesting :).

~micael