(Apr 24, 2019 06:22 AM)CyberStrike Wrote:  I remember about 2 years ago there was a story about how AV makers got caught uploading samples even with submission disabled. I for the life of me cannot find this story anymore, but I specifically recall it.

(Apr 27, 2019 03:13 AM)˗ˏˋ NYAN CAT ˎˊ˗ Wrote:  Thanks you for your codes but I already know it. I was asking if wd will re-enable itself after restart pc or not. I wi love if you test it on your win10 vmware.

(Apr 27, 2019 04:18 AM)crypt4u Wrote:  whith reading your registry i know it will enable itself again
as you forget disable the service itself from group policy
add this line and it will not enable itself on restart

Code

reg  add "HKLM\SYSTEM\CurrentControlSet\Services\Sense" /v "Start" /t "REG_DWORD" /d "4" /f
reg  add "HKLM\SYSTEM\CurrentControlSet\Services\WdNisSvc" /v "Start" /t "REG_DWORD" /d "4" /f
reg  add "HKLM\SYSTEM\CurrentControlSet\Services\WinDefend" /v "Start" /t "REG_DWORD" /d "4" /f

(Apr 27, 2019 03:34 AM)Viotto01 Wrote:  Yes, I proved that myself with ESET, specifically.
ESET steals your files, even with all the privacy settings properly set.

(Apr 27, 2019 05:40 AM)CyberStrike Wrote:  Did you write an article or publish the research? I honestly specifically remember reading that a few of them were caught doing it. But anything about it is gone just gone from twitter/blogs everywhere gone. Link me the thread or article please. Thank you.

(Apr 27, 2019 06:11 AM)Viotto01 Wrote:  No, I did not publish it.
I discovered it by accident.
I had ESET installed on one of my development machines (with sample submission disabled and so on).
I deployed there a new version of # and a few other files, for some penetration testing activity which should have remained internal to my lab.
Those files were all undetected by ESET.
After a couple of days, all those files where signed by ESET with very specific signatures (Win32/Backdoor.# etc.)
There is only one possible explanation about this: they stole all my files.
They steal users files, to provide an unfair advantage to their business, completely betraying users privacy.
I wrote them about this: got no reply.
I guess they were too busy trying to hide their dirt under the carpet.
:-)

(Apr 27, 2019 06:26 AM)CyberStrike Wrote:  hmm do you run wireshark/tshark or snort (or an IDS/NIDS) If so the pcaps would prove it perhaps my next weekend I will try to do some testing.

(Apr 27, 2019 06:42 AM)Nosfir Wrote:  Windows defender did re-enable itself (as a matter of fact it didn’t even turn off..(

(Apr 27, 2019 06:50 AM)˗ˏˋ NYAN CAT ˎˊ˗ Wrote:  Did you run it as administrator?

(Apr 27, 2019 07:23 AM)Nosfir Wrote:  No... as you said originally it wouldn’t be needed.

(Apr 27, 2019 06:26 AM)CyberStrike Wrote:  hmm do you run wireshark/tshark or snort (or an IDS/NIDS) If so the pcaps would prove it perhaps my next weekend I will try to do some testing.

(Apr 27, 2019 09:14 PM)QU⚡CKSILVER Wrote:  I guess the connection to antivirus servers is indeed encryptd, but you don't need to analyze packets to determine if your computer is sending data to them.
Just monitor the amount of bytes sent by all the processes related to ESET while having sample submission off. If you see a considerable amount of data being sent, then they are clearly submitting stuff without you even knowing it.

It can be done with Procmon or process hacker, or even TCP View.