Új hozzászólás Aktív témák

• #8715 blattida nagyúr

  Új Válasz 2014-02-06 13:23:31 #8715

  Új hozzászólás

  Összes hozzászólása itt Válaszok az összes hozzászólására itt Válaszok erre a hozzászólásra

  Privát üzenet küldése

  

  blattida

  nagyúr

  Aki tesztelni szeretné a Viruscope jelenlegi képességeit, annak álljon itt egy leírás a tesztelés menetéről:

  Context
  Current viruscope recognisers are:
  - Move (not copy) self to autorun path
  - Move (not copy) self to other folder and copy link (shortcut) to self to autorun path
  - Move (not copy) self to other folder and set registry value in autorun key to self

  Recognition operates only for unknown .exe files, not trusted or batch files

  Solution
  So you can get a Viruscope alert, and thus test recognition and reversal by finding a program in which you can manually or programmatically carry out file moves, and arranging for it to be rated as unknown. If it is also capable of editing a registry, or running a program that can like regedit.exe, that's ideal!

  One example might be a Windows explorer file manager substitute, though I would not recommend you use a full replacement Windows shell. But how do you arrange for it to be unknown? You could:
  find a relatively obscure one that happens to be unknown
  find a beta version of a better known one which is unknown
  remove the programs vendor and/or trusted file entry from CIS and disable all cloud interactions or disconnect your network connection
  if the file's license agreement allows this, over-write some irrelevant bytes in it's executable file with a random string of equal length

  Please be careful when carrying out these experiments as user files created by detected unknown programs, or the programs they run, may be automatically deleted by reversals. So for example, based on my analysis of how VS is currently working, if you use your explorer or shell substitute to start an office program, create some files you want to keep, forget and then trigger a detection and don't respond to the alert, the files will be deleted by the reverser. This is a bigger potential issue with a full Windows shell replacement, which is why I do not recommend using a substitute windows shell for this type of testing.Taking a full data backup before triggering detections is a wise precaution.

Új hozzászólás Aktív témák