Malware test CIS 8 on youtube and 6 trojans recognized by "HITMAN PRO"

[Karniaris]

Hi everybody,
I have just seen a malware test with CIS 8 on youtube.

- YouTube

At the end of the test, HITMAN PRO finds 6 pieces of malware.
How is this possible.
I look forward your answers.
Thank you very much

[davidepi]

I guess it’s because the tester has the archive with infected files already on his virtual machine when he tested CIS. The new version of CIS with default settings sandboxes only unknown files downloaded from internet, while it considers as safe all the files which are already on the system.

[siketa]

He should change “Internet” setting to “Any”.

[Karniaris]

Siketa,
thank you for answering.
Where could he change the settings??? Is it not changed by default in the latest version???

[siketa]

@Karniaris post:4

Siketa,
thank you for answering.
Where could he change the settings??? Is it not changed by default in the latest version???

Thanks to djigibao.

[attachment deleted by admin]

[Karniaris]

Thank you very, very much!!! These graphics helped!!!

But would it not be better, to change the configuration by default???

Karniaris

[L.A.R_Grizzly]

@davidepi post:2

…while it considers as safe all the files which are already on the system.

Boy, that’s just a bad setting! I changed mine. Thanks!

[attachment deleted by admin]

[qmarius]

@davidepi post:2

The new version of CIS with default settings sandboxes only unknown files downloaded from internet, while it considers as safe all the files which are already on the system.

considers is a bit too much.
I’d say it’s an inability to auto-sandbox files without streams (in other words, files with no origin information). Sanya IV Litvyak has explained this known issue here quite fine.
How is this an issue? Well, I’m not sure whether it’s intended or not (hopefully not). What I know is that this is considered as issue since it was not rated ‘invalid’ by devs.

[Karniaris]

Now I have learnt to switch to the configuration “proactive security” instead of “internet security”.
I hope I understood everything correctly.
Thanks a lot. (CLY)

[Citizen_K]

According to the head developer

@egemen post:62

Right so the new default configuration keeps track of files downloaded from the Internet or coming from the removable or network based media. We have collected telemetry information for about 2 years and found out that automatically sandboxing unknown executables from these sources will prevent infections.

In your case, you are testing with some VMs and have specific scenarios. You need to fine tune either CIS or your environment. CIS is flexible though. By all means you can simply switch to old way of doing things. All you need to do is to go to Rules #3 in auto-sandbox policy and remove all source criteria.

I attached the screenshot.

May be the issue is related to the advanced users who download malware archives from the web, copy archives with malware to a virtual machine and possible other actions that get rid off the ADS?

[radek178]

@Karniaris post:1

Hi everybody,
I have just seen a malware test with CIS 8 on youtube.
- YouTube
At the end of the test, HITMAN PRO finds 6 pieces of malware.
How is this possible.
I look forward your answers.
Thank you very much

I had similar problem on my PC. CIS have a big problem with malware files that are digitaly signed - CIS allow run it because lots of digital sign has CIS default as trusted…

[wasgij6]

@radek178 post:11

I had similar problem on my PC. CIS have a big problem with malware files that are digitaly signed - CIS allow run it because lots of digital sign has CIS default as trusted…

CIS does NOT allow any app with a digital signature to run without an alert. The digital signature has to be present in the trusted vendors list. If its not then CIS will show an alert.

[radek178]

CIS allow app with digital signature without alert. On the internet there are lots of infected files that are digital signed. When I run it CIS lets run them without alert. This infected files has digital signature that Comodo has in trustfull. It means CIS lets run infected file without any alert. It means malware creators can just buy/get digital signature that Comodo has in trustfull and CIS lets any infected file to run (I mean file that does not get as AV engine). I solved those problems for few times in the forum.
The only thing that helps is to delete all trusted vendors. But then PC does not work OK, because it asks about any file that is run.