There's a lot of Runtime and Scantime sites with a Engine with Multiple Antivirus making it easy to test if the server is FUD Runtime/Scantine, but some distribute the samples to AntiVirus companies and those who say they do not distribute are never 100% sure.
So thinking about it if I create some Virtual Machines (5 ou 10) and install a different AV in each to test RT/ST, what precautions should I have for AVs don't istribute the samples?
Whenever I'll test the server, should I update the AV, disable the internet and only then copy the server to the VM?
(Dec 24, 2018 10:34 AM)aerohacker Wrote: Whenever I'll test the server, should I update the AV, disable the internet and only then copy the server to the VM?
Correct.
DO NOT DEAL WITH THIS MEMBER
Use Snapshots instead of multiple VM's, also wait a couple of minutes after disabling internet before scanning. After you copy as well ensure that sharing is disabled.
DO NOT DEAL WITH THIS MEMBER
I use snapshots http://prntscr.com/lz764w
Update AV then disable internet connection and just test your file.
I just use snapshots too: ![[Image: CoIwOxf.png]](https://i.imgur.com/CoIwOxf.png)
(Dec 24, 2018 07:26 PM)NYANxCAT Wrote: I use snapshots http://prntscr.com/lz764w
Update AV then disable internet connection and just test your file.
(Dec 24, 2018 07:29 PM)Exodus Wrote: I just use snapshots too:
Must be a more efficient way?
sorry for the dig
(Mar 1, 2019 03:01 PM)Goldmouth Wrote: Must be a more efficient way?
sorry for the dig
Not that I know off.
The most efficent way is to install the av's command line tools onto the same install and to scan the file via command line, but that can be a bitch to setup. Also make sure you go into the antiviruses settings and disable the distribution of files- all avs have the option in the settings, and even if you disable your internet it may copy the file and wait until there is internet to upload it.
(Mar 4, 2019 03:11 PM)V3xD Wrote: The most efficent way is to install the av's command line tools onto the same install and to scan the file via command line, but that can be a bitch to setup. Also make sure you go into the antiviruses settings and disable the distribution of files- all avs have the option in the settings, and even if you disable your internet it may copy the file and wait until there is internet to upload it.
That’s why you make a snapshot of a clean VM without networking and revert back to that snapshot when you’re done testing... Atleast that’s what I did on my service
|
![[Image: MWjc9rm.png]](https://i.imgur.com/MWjc9rm.png)