Where can I download a virus?

[agreenbhm]

While I agree somewhat, reading can only go so far. I don't know any IT admin who has purchased the licenses to an av product without actually trying it first. There is nothing wrong with throwing a couple viruses/malware at them in a sandbox and seeing how they react and behave. If you even take it from an end user perspective, seeing how they react to these programs and viruses could be valuable information. I'd almost call someone an incompetent/lazy admin if they didn't do this.

Thank you. Finally someone who understands. I've read all the comparatives I need to. I'm between two different products. Just want to see them in action. If you can't understand that, then so be it.

BTW, the Malware Domain List was exactly what I was looking for. I saw it in a YouTube video a while back, just didn't catch the URL. Thanks for posting it.

[Phenom II]

Thank you. Finally someone who understands. I've read all the comparatives I need to. I'm between two different products. Just want to see them in action. If you can't understand that, then so be it.

BTW, the Malware Domain List was exactly what I was looking for. I saw it in a YouTube video a while back, just didn't catch the URL. Thanks for posting it.

Was the site I PM'd you still infected ?

[RoomKid]

Just download Limewire, look for a song which is 32KB's. Download that, and your PC is infected :p

[david]

Just surf the web with IE6.

[agreenbhm]

@Phenom the site seemed to be down. I chose to use ie8 for my testing since that is what we use at work. Surprisingly the only infections I got were by dling a file and then running it; no "visit a bad page and you're auto-screwed".

[Phenom II]

Yea.. it was a long time ago I went there so wasnt sure

[agreenbhm]

Someone posted a link to a rapid.org post which had a link to a virus test archive. Post probably got removed from Neowin by a mod for linking to a virus. For those interested, search for "Test Your Antivirus" on rapid.org.

[carmatic]

are you the network admin as well? couldnt you look at what sites your users have visited and retrace their steps towards being infected...

[agreenbhm]

are you the network admin as well? couldnt you look at what sites your users have visited and retrace their steps towards being infected...

I am, but unfortunately we don't have the monitoring in place yet to do that. We have purchased a hardware appliance that includes that functionality, but it isn't in place yet.

[carmatic]

?

I am, but unfortunately we don't have the monitoring in place yet to do that.??We have purchased a hardware appliance that includes that functionality, but it isn't in place yet.

might i suggest a different methology? get your most virus-prone users, and ask them to 'test' that computer you have set up as your virus testbed... if they are experts at getting computers infected, it figures to let them do what they are best at...?

[Phenom II]

Someone posted a link to a rapid.org post which had a link to a virus test archive. Post probably got removed from Neowin by a mod for linking to a virus. For those interested, search for "Test Your Antivirus" on rapid.org.

Yea I downloaded the package

Avast found 1572 / 1642

Not good

[agreenbhm]

?

might i suggest a different methology? get your most virus-prone users, and ask them to 'test' that computer you have set up as your virus testbed... if they are experts at getting computers infected, it figures to let them do what they are best at...?

We don't have time for that. We're in our busy season and no one has extra time to attempt to get a machine infected. Plus, I wouldn't want them using a PC without AV protection. I am looking to see how effectively the software cleans the PC after the infection has occurred.

Yea I downloaded the package

Avast found 1572 / 1642

Not good

NOD32 was in the 1500 range as well :(

[Phenom II]

I uploaded the remaining to VirusTotal, which eSafe found a virus with all of them

Bu eSafe apparently no longer support home PCs, maybe good for business'

[+Warwagon MVC]

In all honestly just let a friend, relative or stranger use your computer for more than 10 mins and you'll have your virus.

[MikeChipshop Member]

My mates vast collection of porn and his untreatable need to beat off at every second has rendered his comp dead on several occasions. I suggest you give hime a call he owes me a favour after the amount of times i've had to play PC doctor for him.

[Phenom II]

We don't have time for that. We're in our busy season and no one has extra time to attempt to get a machine infected. Plus, I wouldn't want them using a PC without AV protection. I am looking to see how effectively the software cleans the PC after the infection has occurred.

NOD32 was in the 1500 range as well :(

Much better :)

[strelok1911]

Yea I downloaded the package

Avast found 1572 / 1642

Not good

Hey, can you PM me a link to the "package"? I'd also like to test MSE and KIS 2010

[Phenom II]

I dont have the link, it was up here for a few minutes when I downloaded it, but was promptly removed, so I assume PMing the link would also be a no go even if I did have it

[Sn00pY]

Out of interest which are your two chosen products? I assume they are Enterprise products? ie; cloud/smart scanning ablilty, deployment, upgrades, user access modules etc?

Also which piece of hardware did you mention a few posts up ^^

also - is there a budget for this? if so should you look at this particular hardware appliance you have bought ?

more info... I want to help :)

[agreenbhm]

Out of interest which are your two chosen products? I assume they are Enterprise products? ie; cloud/smart scanning ablilty, deployment, upgrades, user access modules etc?

Also which piece of hardware did you mention a few posts up ^^

also - is there a budget for this? if so should you look at this particular hardware appliance you have bought ?

more info... I want to help :)

I was torn between Sunbelt Vipre Enterprise and NOD32 Business Edition. NOD32 is the one I've chosen.

[Sn00pY]

poor choice imho.

you should have got Trend OfficeScan IMHO.

[n301]

I'm in the process of testing antivirus software for my office. I'm deciding between two different applications, and I'd like to have some side-by-side comparisons of how well they work. I'm not interested in charts or anything like that that has already been done. I want to see for myself, a live test, of how effective each AV product is.

My users are fairly good at contracting viruses ( :p ), but I can't seem to find any! I'm using IE8 and surfing the internet without any AV software. I'm going to tons of warez & crackz sites, clicking on all the links I can find. My biggest problem is staying away from the porn, since anyone that walks around the corner will see that on my screen. I disabled images for IE to avoid this, but that probably also hindered my ability to get infected.

I already tried the Eicar test virus, but this is not a substantial test as far as I'm concerned. I want to get (a lot) of real viruses. Does anyone know of a sample I can get? If you have a known bad link, post it up!

I really like what your doing here, if i could trouble you to report your findings, i would really appreciate it.

Edit: i just read all your replies. NOD ftw!!

[tiagosilva29]

Just search videos on youtube for keywords like "keygen". You'll find a virus in no time.

Here's one for example:

(DO NOT DOWNLOAD THE FILE AND RUN IT!)

Antivirus;Version;Last Update;Result

a-squared;4.5.0.50;2010.03.15;Trojan-PWS.Win32.VB!IK

AhnLab-V3;5.0.0.2;2010.03.15;-

AntiVir;8.2.1.180;2010.03.15;TR/VB.Downloader.Gen

Antiy-AVL;2.0.3.7;2010.03.15;Trojan/Win32.AccountHunter.gen

Authentium;5.2.0.5;2010.03.15;-

Avast;4.8.1351.0;2010.03.15;Win32:Trojan-gen

Avast5;5.0.332.0;2010.03.15;Win32:Trojan-gen

AVG;9.0.0.787;2010.03.15;Generic16.BIQF

BitDefender;7.2;2010.03.16;Gen:Trojan.Heur.VB.nm1@cmCkAtgi

CAT-QuickHeal;10.00;2010.03.15;-

ClamAV;0.96.0.0-git;2010.03.15;-

Comodo;4277;2010.03.15;-

DrWeb;5.0.1.12222;2010.03.16;BACKDOOR.Trojan

eSafe;7.0.17.0;2010.03.15;Win32.TRVB.Downloade

eTrust-Vet;35.2.7364;2010.03.15;-

F-Prot;4.5.1.85;2010.03.15;-

F-Secure;9.0.15370.0;2010.03.15;Gen:Trojan.Heur.VB.nm1@cmCkAtgi

Fortinet;4.0.14.0;2010.03.15;-

GData;19;2010.03.16;Gen:Trojan.Heur.VB.nm1@cmCkAtgi

Ikarus;T3.1.1.80.0;2010.03.15;Trojan-PWS.Win32.VB

Jiangmin;13.0.900;2010.03.15;Trojan/Agent.dlwg

K7AntiVirus;7.10.998;2010.03.15;Trojan.Win32.Malware.4

Kaspersky;7.0.0.125;2010.03.16;Trojan-PSW.Win32.AccountHunter.c

McAfee;5921;2010.03.15;Generic.dx!nld

McAfee+Artemis;5921;2010.03.15;Generic.dx!nld

McAfee-GW-Edition;6.8.5;2010.03.15;Trojan.VB.Downloader.Gen

Microsoft;1.5605;2010.03.15;-

NOD32;4947;2010.03.15;probably a variant of Win32/Genetik

Norman;6.04.08;2010.03.15;-

nProtect;2009.1.8.0;2010.03.15;-

Panda;10.0.2.2;2010.03.15;Trj/CI.A

PCTools;7.0.3.5;2010.03.15;Trojan-PSW.Saluni

Prevx;3.0;2010.03.16;-

Rising;22.39.00.04;2010.03.15;-

Sophos;4.51.0;2010.03.15;Mal/Generic-L

Sunbelt;5904;2010.03.16;Trojan.Win32.Generic!BT

Symantec;20091.2.0.41;2010.03.16;Infostealer.Saluni

TheHacker;6.5.2.0.233;2010.03.15;Trojan/PSW.AccountHunter.c

TrendMicro;9.120.0.1004;2010.03.15;-

VBA32;3.12.12.2;2010.03.14;-

ViRobot;2010.3.15.2228;2010.03.15;-

VirusBuster;5.0.27.0;2010.03.15;-

Result: 25/42 (59.53%)

Additional information

File size: 221381 bytes

MD5...: a5999da9394616a753b97d1458cbce5f

SHA1..: 70f86f7354a4d295256056fd491920eaa4da52d7

SHA256: 2748638972f777e1dea79c993f2d2cde5abda7b64c3c583bed5775c0445eaed0

ssdeep: 6144:HGZLlL56XKpWl+PHwFb2B6XKpWVJl1ZbW:sLfg+oFOa7y

[agreenbhm]

poor choice imho.

you should have got Trend OfficeScan IMHO.

Care to post an explanation?

NOD32 was one of the highest rated AV solutions from what I've read. I've been an avid Norton fan/user for years and use it at home, but started using NOD32 at work (just on my machine) when I saw how FAIL CA Enterprise was. NOD32 has been great on my work machine and I feel confident that it will provide great protection for the rest of my office as well. The two other AV solutions I saw ranked up there with NOD32 was Kaspersky and Bit Defender. Since I've had experience with NOD32, i'm going to go with it.

I went through the Malware Domain List, downloading everything I could, and NOD32 wouldn't let anything through. Can't say the same for Vipre. Vipre did pretty well, but when it came down to removing the infection (when I downloaded a variant of Vundo, let it wreak havoc, then turned AV back on), NOD32 did a better job of putting my machine back to normal.

NOD32 comes with a bootable rescue disk that will allow me to do an offline scan and removal of any infections on my machine, and if I need even more firepower, I have the BitDefender 2010 Rescue CD (free download) at my disposal as well.