AV is supposed to be proactive right?

Feb 19, 2001
20,155
23
81
So here's a little rant. You can call me dumb, but one of my grad classes has a very anal lab report component, so I was slaving away doing my statistics analysis.

It involved a lot of statistics, which is fine because I use a piece of statistics software already. I suddenly remembered that when I was an intern years that I used another piece of software.

I'll admit that I ventured into illegal software and I tried downloading that 2nd piece of software. Now, in my own defense, I was like 90% done generating all the graphs I needed. I wanted to see how the other piece of software would do it. Plus, this is the day the lab is due. I'm just playing around to see if the other software can do a better job.

Well guess what? Virus. It was one of those multi RAR files that extracted and setup.exe infested my computer.

My question is...

1) In extracting RAR files, shouldn't AV kinda scan through what the hell is being extracted? I'm using MSE right now, but if I remember properly, when I had a NOD or Kaspersky License, these things caught all this stuff in my RAR files. Heck, if the RAR file had anything fishy, I couldn't even download!

Why isn't MSE alerting me?

2) When I EXECUTE something, shouldn't MSE first analyze it, and then let me execute it? Shrug.

Maybe this is karma saying that I should stick to the piece of software that I own, and that my little adventure in trying another piece of software out was the wrong thing. Heh, if so, I'll take that.

As a result I was late to my lab TA class that I taught, and I spent the whole day recreating these graphs on a 8 year old laptop that served me through college because I only have PC stats software, and my Mac won't do. I basically rewrote my whole damn lab report today because I was gone the past 2 days in lab, and my work was all on remote desktop on my desktop at home. So once it died, I was screwed. Either I had to come home and spend hours troubleshooting, or whatever.

This is the SECOND MSE has failed me and my MBR has gotten infected. I'm thinking of going back to buying a NOD32 license again. It might be worth it. I stopped only because I found out MSE got a top notch rating back in AV Comparatives for speed and detection rating.


Cliffs:

I use MSE

1) In extracting RAR files, shouldn't AV kinda scan through what the hell is being extracted? I'm using MSE right now, but if I remember properly, when I had a NOD or Kaspersky License, these things caught all this stuff in my RAR files. Heck, if the RAR file had anything fishy, I couldn't even download!

Why isn't MSE alerting me?

2) When I EXECUTE something, shouldn't MSE first analyze it, and then let me execute it? Shrug.
 

KeithP

Diamond Member
Jun 15, 2000
5,664
201
106
MSE is basic, free AV software. The paid programs you mentioned have different features and would probably be considered more "complete" protection. Which is why they cost money. Free means a more limited feature set.

If you think you might be downloading software like that in the future, you might want to set yourself up with a Windows virtual machine to test the software first. Even if you do switch to something like NOD32 or Kaspersky, I guarantee you will get infected at some point, even when using paid AV software, if you are downloading illegal software. It is the nature of the beast.

-KeithP
 

Modelworks

Lifer
Feb 22, 2007
16,240
7
76
You have to understand how AV software works. AV software will never ever detect all threats. AV software works by looking for known virus code in your files. If that virus has never been reported then the AV software cannot distinguish it from normal software.

There is a wonderful little application that I use on all software I am uncertain about called uniextract. Uniextract unpacks programs from their setup.exe . So when you get a file you are not sure about use the program and it will extract it. If you see things like another exe inside the files or things like script.bin then you know it is probably suspect. Of course you still need to understand what those files do but it helps to spot a lot of the malware. Another thing to check is the file properties. I have found most malware authors don't bother to fill out the things like company or creator slots.

http://legroom.net/software/uniextract
 

Scouzer

Lifer
Jun 3, 2001
10,358
5
0
MSE is not a particularly great product, even against its free competitors. I'm not surprised it failed you.
 

mechBgon

Super Moderator<br>Elite Member
Oct 31, 1999
30,699
1
0
Submit a few thousand malware samples to VirusTotal.com, and you'll be permanently cured of expecting any brand of AV software to save your bacon in lieu of common sense. If you must dabble with questionable stuff, do it inside a virtual machine that you can nuke afterwards.