[Remote Administration]

Wait :D
It sucks because 1 scan costs 3 cents (and that is the most expensive option)?
Thanks for your opinion, but in my opinion the price is just fine considering I am not only reselling from Scan4You for profit. 🤝

I've been a happy user of RazorScanner for 3 months.
And Its always been more up-to-date than any others.

But I do know that Nodistribute doesn't send samples.
They even have there own crypter.
And they don't use Scan4You API because Scan4you is 35 AV's
Nodistribute is 33-34

[BoomShot]

But I do know that Nodistribute doesn't send samples.
They even have there own crypter.
And they don't use Scan4You API because Scan4you is 35 AV's
Nodistribute is 33-34

You don't "know" that, so why state that you do?

[Remote Administration]

You don't "know" that, so why state that you do?

Yes.. I did this for VirusTotal, Nodistribute, MetaScan,
All the files where encrypted using privately donated VB6 crypters.

Virustotal: took 1 week & 2 days.
Nodistribute: Was fud for 3 months, 1 week, 5 days, then I used the server.. Now detected 2/60
MetaScan: Was 2+ months (I don't have the exact date).

[BoomShot]

Yes.. I did this for VirusTotal, Nodistribute, MetaScan,
All the files where encrypted using privately donated VB6 crypters.

Virustotal: took 1 week & 2 days.
Nodistribute: Was fud for 3 months, 1 week, 5 days, then I used the server.. Now detected 2/60
MetaScan: Was 2+ months (I don't have the exact date).

You'll need a lot more proof than just that.

[Remote Administration]

You'll need a lot more proof than just that.

Ill re-create the tests.

Though its going to take a hella long time to get more crypters.
It took months to get those.

[incoming]

I cannot judge whether NoDistribute distributes or not, but all I've seen is that JackDeRips is starting beef
right when he joined this thread. Instead of arguing and discussing these issues of trust, he starts attacking
a third party, that was not involved yet, which would be Razor. Can someone tell me why please?

[Remote Administration]

I cannot judge whether NoDistribute distributes or not, but all I've seen is that JackDeRips is starting beef.
right when he joined this thread. Instead of arguing and discussing these issues of trust, he starts attacking
a third party, that was not involved yet, which would be Razor. Can someone tell me why please?

I like you, better grammar than most, and actually reads the posts.

[BoomShot]

Ill re-create the tests.

Though its going to take a hella long time to get more crypters.
It took months to get those.

I wasn't doubting your results, but instead the lack of evidence to support your results.

Anyone could lie and say something like:

"Based on my tests, VirusTotal doesn't even distribute. The file I uploaded remained FUD for 2 months."

Obviously not true, but who knows since I never provided the evidence to support my claim.

[Approach]

1. 46 (I think, correct me if i am wrong) detected it. That's 2/3 not 1/2.
2. For some AVs I disabled warning messages (PUA warnings) and such appear on the Eicar file as it's no real virus - reasons for that where that every file compiled with MingW i.e. gets a PUA warning on 3. AVs - now tell all the people that use MingW that they will never recieve a FUD result because of a warning message that doesn't even stop the program from executing.
4. There is a possibility that an AV still fails to detect such samples - scan it on virus total and you will see that not all AVs pick it up - they should, but well we all should know that AVs never really do their job correctly.

Also timeouts can happen, old AVs as VBA are slow as fuck sometimes - I will not let any AV scan longer then 90 secs - and yes timeout happen, I guess not in this case. Anyway you can ALWAYS and on EACH online AV Scanner (doesn't matter if distributing or not)
have inaccurate results, period.

I never said your scanner or Scan4You distributes, I just say that IF there would be such issues Scan4You would be responsible and not your scanner. Neither did I attack you and your products. Your reaction changes my entire mind on you. I have seen as concurrency so far, not anymore now. I can't take people with such immature reactions serious.

Edit:
Just scanned, 47 are actually detecting it:

Spoiler (Click to View)Result: (47/60)
A-Squared(Emisoft AntiMalware) EICAR-Test-File (not a virus) (B)
Agnitum Clean - Nothing Found
AhnLab V3 Internet Security Malware detected
ArcaVir ERROR: No FilesFolders Found.
Avast EICAR Test-NOT virus!!!
Avg vir.EICAR_Test
Avira Eicar-Test-Signature virus!
Ad-Aware EICAR (v)
Baidu AV Clean - Nothing Found
BitDefender Malware detected
BKav vir.EICAR_Test/A
BullGuard Internet Security EICAR-Test-File (not a virus)
ByteHero Potential Virus
ClamAv Eicar-Test-Signature
Comodo ApplicUnwnt@#2975xfk8s2pq1
Total Defense IS the EICAR test string
Dr. Web EICAR Test File (NOT a Virus!)
eScan Clean - Nothing Found
eTrust-Vet vir.EICAR_Test/A
eScan Internet Security Suite 14 EICAR-Test-File (DB)
ESET NOD32 @Teststring.Eicar
Fortinet Clean - Nothing Found
Fprot Malware detected
FSB Antivirus doslegacy/EICAR_Test_file_not_a_virus!
F-Secure EICAR_Test_File
Gdata Malware detected
Ikarus EICAR-ANTIVIRUS-TESTFILE
Immunet Antivirus EICAR:EICAR_Test_file_not_a_virus-tpd
IObit Malware Fighter Clean - Nothing Found
K7Ultimate EICAR_Test_File
Kaspersky Internet Security 2013 EICAR-Test-File
KingSoft Clean - Nothing Found
mcafee EICAR test file
Microsoft Security Essentials Virus:DOS/EICAR_Test_File
nProtect EICAR-Test-File
NANO Antivirus Malware detected
Netgate Clean - Nothing Found
Norton Internet Security EICAR Test String
Norman doslegacy/EICAR_Test_file_not_a_virus!
Outpost Security Suite Pro EICAR_test_file (Virus)
Ozone AV Clean - Nothing Found
Panda Antivirus EICAR-AV-TEST-FILE
Panda Cloud Malware detected
PC Tools Malware detected
Quick Heal EICAR.TestFile
SUPERAntiSpyware Clean - Nothing Found
Solo Clean - Nothing Found
TotalDefense doslegacy/EICAR_Test_file_not_a_virus!
Trendmicro Internet Security Malware detected
TrustPort Antivirus 2014 Clean - Nothing Found
Twister Antivirus 8 EICAR.Test.File.zewa
Unthreat AntiVirus BE Malware detected
Vba 32 EICAR-Test-File
Vexira Malware detected
Vipre Internet Security 2013 EICAR (v)
VirIT Clean - Nothing Found
Webroot Clean - Nothing Found
Zillya Malware detected
Zoner doslegacy/EICAR_Test_file_not_a_virus!
360 @Teststring.Eicar

Filename: eicar.com
File MD5 Hash: 44d88612fea8a8f36de82e1278abb02f
File SHA1: e75f19015f7416ecced3cd32c4f7165db4dd8ade
File Size: 68 Bytes
Time Scanned: 20-05-14, 10:07:34
Scan provided by RazorScanner
Link to Scan: http://razorscanner.com/result.php?id=408925
That it's ~80%. Weird with 30+ fake AVs, isn't it?

Why exactly would you disable PUA warnings?
A scanner should provide all the data possible and allow the user to make his/her own interpretation. I don't see any advantages of having the PUA warnings disabled.

You are in other words manipulating the scan results of thousands of files just to give a clean result on files compiled with MinGW? If other AVs will detect the file then what exactly is the point of giving it a clean result?

Let's take eScan as an example.
Command-line parameters: http://wiki.escanav.com/wiki/index.php/C...Parameters

VirusTotal: https://www.virustotal.com/en/file/275a0...400672013/
- eScan: EICAR-Test-File

RazorScanner: http://razorscanner.com/result.php?id=408925
- eScan: Clean - Nothing Found

I checked through the software and the command-line parameters and was not able to find any options that allow you to disable PUA warnings. Please let me know if I missed it.

If your scanner takes over 90 seconds and ultimately times out when scanning a file that is 68 bytes large, then I'm out of words. It shouldn't take over 90 seconds for a file to be scanned regardless of the AV.

[Razοr]

Why exactly would you disable PUA warnings?
A scanner should provide all the data possible and allow the user to make his/her own interpretation. I don't see any advantages of having the PUA warnings disabled.

You are in other words manipulating the scan results of thousands of files just to give a clean result on files compiled with MinGW? If other AVs will detect the file then what exactly is the point of giving it a clean result?

Let's take eScan as an example.
Command-line parameters: http://wiki.escanav.com/wiki/index.php/C...Parameters

VirusTotal: https://www.virustotal.com/en/file/275a0...400672013/
- eScan: EICAR-Test-File

RazorScanner: http://razorscanner.com/result.php?id=408925
- eScan: Clean - Nothing Found

I checked through the software and the command-line parameters and was not able to find any options that allow you to disable PUA warnings. Please let me know if I missed it.

If your scanner takes over 90 seconds and ultimately times out when scanning a file that is 68 bytes large, then I'm out of words. It shouldn't take over 90 seconds for a file to be scanned regardless of the AV.

It is only disabled for AVs that where not willing to fix such false positives. It does only affect a very few files and will not make that much of a difference. I will also give the user an option to enable them soon. MingW was only 1 example, I would not disable it for one false positive only, but if there are multiple that are reported for a long time already and they simply don't care and as it does not affect the execution at all I thought it would be better to just disable PUA detections instead of completely removing the AV from the scanner (that is the way Garrik deals with such things btw). Also to the CL-Params of eScan, it still runs as usual (no settings are changed, PUAs get filtered after scanning, I did that to give an option to enable them again, as mentioned above). I constantly work on improving my Scanner. I also don't know where I said that it times out on the test file - I guess you did read somewhere between the lines. I just said it is possible to show you that such scanners aren't 100% accurate for multiple reasons. I guess that wasn't clear enough for you.

Also please e-mail VT about their fake AVs! 49 / 52 detected it only? WTF. Must have 30+ fake AVs.

I don't see any point to continue arguing anymore after this post, I got work to do and I think i 1. made my point and 2. nearly anybody can see that you where wrong about your fake-AV statement. I don't get why you randomly started attacking me & products just because people spread rumors about yours. I never was about to fight, but well you made your decision. 🤝

[Approach]

It is only disabled for AVs that where not willing to fix such false positives. It does only affect a very few files and will not make that much of a difference. I will also give the user an option to enable them soon.

Still does not explain why you would alter the results.
As a user, expect to see the exact same result that the AV would display to a normal user and I absolutely don't care about the MinGW issue. You can bring in MinGW and compilers all you want but in the end of the day you are not displaying the same result as another AV.

Also please e-mail VT about their fake AVs! 49 / 52 detected it only? WTF. Must have 30+ fake AVs.

Will do.
I'll send it to you later so you can proofread it for me.

I don't see any point to continue arguing anymore after this post, I got work to do and I think i 1. made my point and 2. nearly anybody can see that you where wrong about your fake-AV statement. I don't get why you randomly started attacking me & products just because people spread rumors about yours. I never was about to fight, but well you made your decision. 🤝

Yeah... last time I checked you were the one sending messages telling me to "f*** off" and saying that you were going to forward the case to your lawyer. Not to mention the -3 that you and your friend left.

Off-topic: please for the sake of the readers (me) put down a couple of seconds on the paragraph division as it is otherwise a pain to read.

[Mace]

JackDeRips, Razor already gave you a detailed explanation, no reason for him to continue to argue with you, you might have another opinion, but that's not his problem. I agree with razor.

Looks like your somehow supporting nodistribute, witch actually is sending samples to av companies, I see you don't like competition.



EDIT: not trying to fight you here, or anybody else, but I think you and razor should take this over the PM, since it seems you both had some problems with each other?

[Yoshikage Kira]

Well now, since no-one is posting actual proof i'll check it myself.
This is my private downloader which noone else has, i'll scan it in a month to see if it's still fud.
[img]http://nodistribute.com/imageresult/?result=8qjwFuefNtD3sklpM[/img]
edit:
1 week later:
http://nodistribute.com/result/8qjwFuefNtD3sklpM
https://www.metascan-online.com/en/scanr...66181a95e9
still fud.
edit: 2 weeks later: still fud(rescanned).

[mafia_man]

2 days?

You think they will be able to reverse engineer that amount of executables in that time.
Check it after week and later after month.

[BlacksmithSec]

"an uncrypted darkcomet server"
dude eset would (and does) catch that anyway! as would most respectable avs. there are heuristics as well as signatures. dc is in the public domain so if you havent crypted then of course avs are going to know what it is, even if you havent distributed your newly created unique stub. its still behaves exactly the same as all other dc samples, has the same number of sections, resources, imports, unpacking sequence and program flow