Multiple Antivirus

[L3arn3r]

Hey,

I want to install multiple antivirus in One PC as We already have an example like virustotal.com etc... they are running all anti's in one machine so Would like to know how it can be done?

You may post links or any sort of information you have with your own knowledge!

Edited September 10, 2013 by L3arn3r

[Mr-Protocol]

It is pointless to do so in my opinion. Reasons below.

• They will most likely conflict with each other
• Active scanning will cause disk thrashing
• Resource hogs
• Antivirus is almost pointless

[digip]

Lots of ways to bypass AV these days, but if you need solutions I use these three when using questionable downloads, along with a sandbox, like Sandboxie or a virtual machine with no network card or internet access.

http://anubis.iseclab.org/

http://virusscan.jotti.org/en

https://www.virustotal.com/en/

Edited September 11, 2013 by digip

[L3arn3r]

<p>

It is pointless to do so in my opinion. Reasons below.

• They will most likely conflict with each other
• Active scanning will cause disk thrashing
• Resource hogs
• Antivirus is almost pointless

If Antivirus are pointless then what would you suggest to use?

Lots of ways to bypass AV these days, but if you need solutions I use these three when using questionable downloads, along with a sandbox, like Sandboxie or a virtual machine with no network card or internet access.

http://anubis.iseclab.org/

http://virusscan.jotti.org/en

https://www.virustotal.com/en/

If i will give you exe via PM then can you verify that attacker all information like IP, port?

Edited September 13, 2013 by L3arn3r

[digip]

http://anubis.iseclab.org/ will install, show changes, and give you a PCAP file of the traffic of the executable if it downloads anything that you can throw in WireShark, which is one of the reasons I like it, so give it a try. If its a zip, may not work. Usually works with installers. If its packed, use something like Uniextract and PEiD to inspect(in a SANDBOX or VM).

Also, forgot about CWSandbox, an online one that is similar to anubis.

As for AV being dead, windows machines can use things like EMET to help protect against programs that try to bypass ASLR and such, but you should create a limited user account that users use, and never use the Admin account on a Windows box. Especially on a corporate domain, users should be setup to have file shares, and reverting desktops, and always save files to their shares, which is on the server side, while each time they reboot, you put them back in to a frozen state using something like Deep Freeze or such whith all the programs they need installed, each reboot will revert any changes or virus infections, while their file share will still be accessible to them after reboot. Its on the file share servers that you really want to protect and keep things locked down from privilege escalation and such.

Nothing is perfect, and today, its not always a virus that gets you in trouble. 9 times out of 10, its users clicking shit or opening things they have no reason to be opening, or, mobile devices and external home devices/drives plugged into the network that you really can't ever stop 100% without educating the whole workforce and hoping they actually listen.

[L3arn3r]

At anubis! it doesn't provide PCAP file as you said. anubis option were "HTML PDF XML TXT" these four only shows after scan can't get pcap file?

Edited September 13, 2013 by L3arn3r

[digip]

At anubis! it doesn't provide PCAP file as you said. anubis option were "HTML PDF XML TXT" these four only shows after scan can't get pcap file?

When done uploading and it runs on their target machines, IF the program makes access to the internet, it should also provide a pcap of the traffic along with the report of what was changed. Its jut a link in the HTML report like the other info. If no pcap, then either the program crashed, didn't run, or was no web traffic created by the program uploaded. Read the output and check the page report for the program you upload. Post a link here to the results on anubis if you want. Edited September 13, 2013 by digip