[aerohacker]

I'm think to build some Windows Virtual Machines and install AntiVirus in each guest to test FUD servers in Realtime/Scantime.

1) What is better?! VirtualBox or VMWare?!

2) Which and how many AntiVirus it's be good to start?! I think about 10 AVs.

3) After copy and execute the server, would be better update the AV and disconnect the VM from Internet to avoid the AV share the stub?!

[DramaKing]

I'm think to build some Windows Virtual Machines and install AntiVirus in each guest to test FUD servers in Realtime/Scantime.

1) What is better?! VirtualBox or VMWare?!

2) Which and how many AntiVirus it's be good to start?! I think about 10 AVs.

3) After copy and execute the server, would be better update the AV and disconnect the VM from Internet to avoid the AV share the stub?!

VMware Workstation is free now, so you should consider that.

That is a lot of VMs.

Turning off sample submission is better for the most accurate results without reporting.

[Bastille]

That's an interesting topic but I don't think that's as simple as that, it's usually not recommended to install more than 1 AV on a computer, or at least to have them all active at the same time because they work on the same spaces and there is a chance to get errors / conflicts.

Besides, nowadays many malware have anti-VM detection, which means that you need to custom your VM to obfuscate every artifact related to virtualization (machine name, services, drivers, and so on ...)

I know that some people of HF worked on alternative of Kleenscans and so on, maybe they could share some info

[aerohacker]

That's an interesting topic but I don't think that's as simple as that, it's usually not recommended to install more than 1 AV on a computer, or at least to have them all active at the same time because they work on the same spaces and there is a chance to get errors / conflicts.

Besides, nowadays many malware have anti-VM detection, which means that you need to custom your VM to obfuscate every artifact related to virtualization (machine name, services, drivers, and so on ...)

I know that some people of HF worked on alternative of Kleenscans and so on, maybe they could share some info

1 VM to each AV (It would be separated)

The servers are mine so my intention is only to scan in realtime and scantime without to need any sites and avoid the same share the stub, and i won't use any anti in the server.

[aerohacker]

no. 1 VM and multiple snapshots to different AVs i think is better to save u resources.

Yeah, I'm think about to test most popular and best AntiVirus, but I think some AVs shared the same engine.

[aerohacker]

yea, i think AVG, Avast have same engine.

When a server is FUD, It doesn't matter if the AntiVirus it's default or set to maximum, the server will bypass anyway?!

[DramaKing]

yea, i think AVG, Avast have same engine.

I checked to verify. Norton owns Avast, and Avast owns AVG.

---

When a server is FUD, It doesn't matter if the AntiVirus it's default or set to maximum, the server will bypass anyway?!

Just check for the 'set to maximum' setting. 😜

[aerohacker]

yea, i think AVG, Avast have same engine.

Avast bought AVG and both use the same engine and even the GUI is similar.

[darkterror]

I'm think to build some Windows Virtual Machines and install AntiVirus in each guest to test FUD servers in Realtime/Scantime.

1) What is better?! VirtualBox or VMWare?!

2) Which and how many AntiVirus it's be good to start?! I think about 10 AVs.

3) After copy and execute the server, would be better update the AV and disconnect the VM from Internet to avoid the AV share the stub?!

1. Doesn't really matter, for testing purposes of samples both are sufficient, for me it comes really to user experience. (Using Oracle VM)

2. Well focus mainly on AVs you need to penetrate and which are most common. Usually from what i saw people use ootb WD (might be wrong here) or "free ones" like AVG, Avira, Avast. I would suggest to check this annual report https://www.security.org/antivirus/antiv...rt-annual/ for more information

10 vm with 10 avs is quite useless, i would use one of the scanning services like https://scanner.to/ or check forum, there are other sites available as well, its not that expensive and it saves you a lot of time, but if you are developer, than i would go for it.

3. Well, this is very hard question to answer, because some AVs collect data from scanning/detections even when you turn off sample submission. (referring to AVG in this case) more info here: https://businesshelp.avg.com/Content/Pro...ttings.htm
3.1 You could turn off the internet to test the sample, but you would loose Cloud Based Detections which are quite strong these days so your results would be "inaccurate".

[Donrulezz]

Based on my experience, I have observed the following:

Instead of installing multiple antivirus programs, especially for runtime scan, I recommend installing Comodo Firewall and Antivirus. You can perform a scan in runtime mode.

If the scan bypasses Comodo, it is likely to bypass all other antivirus programs in runtime as well, as, to the best of my knowledge, Comodo is the strongest in runtime detection.

[DramaKing]

Based on my experience, I have observed the following:

Instead of installing multiple antivirus programs, especially for runtime scan, I recommend installing Comodo Firewall and Antivirus. You can perform a scan in runtime mode.

If the scan bypasses Comodo, it is likely to bypass all other antivirus programs in runtime as well, as, to the best of my knowledge, Comodo is the strongest in runtime detection.

Based on its static detection, I am very surprised.

[7]

QubesOS is great though for type 1 virtualisation just build the Qube and clone for multiple AV's
I personally love Qubes but you need the spec