2nd layer protection for USB drives: MCShield

[magna86]

Hi all,

Fresh MCShield has been released.

Changelog:

version 3.0.5.28: 12th April 2014.

• fixed an issue related to folder selection when adding files to the whitelist;
• improved handling stability for write protected drives;
• improved display of tray notifications on high DPI configurations;
• updated Brasilian Portuguese language.

Official homepage:
http://www.mcshield.net/

Cheers,

[bob3160]

Thanks, already updated.

[schmidthouse]

+1

[Lisandro]

Thanks. Already updated.
Last month, I've installed McShield in 3 computers

[SafeSurf]

@ magna86,

When will MCShield be available for Mac PC's?  Thank you.

[magna86]

Hi SafeSurf, Hi all, 

@ magna86,

When will MCShield be available for Mac PC's?  Thank you.

Probably never unfortunately.

Other rules apply for MAC eco system which means that the program should be re-written from the start and re-test from the beginning.
The authors do not have so much free time plus it is for wonder too . . if it is worth it?

[SafeSurf]

Thank you Magna86.  You have a great program as I use it on my other Windows machine.  I guess I'll have to find something else for the Mac.    Thank you again for your hard work.

[testingNoobie]

 I am still a bit confuse, hope you don't mind answering some question of my. I am asking these question after I have read all 15 page of post.

1)From what I understand MCShield operate on a real time scan whereas avast is on demand when it is regarding a removable drive. So if you choose to scan the removable drive after inserting it will it be the same as MCShield?

2) considering that autorun for windows have been change to autoplay for the user to decide what action to take does this mean that unless the user run the autorun program most threat would not be activated upon inserting?

3) if the removable drive have thousand of file wouldn't that means that it will take at least a few hours to complete scan?

[Pondus]

1)From what I understand MCShield operate on a real time scan whereas avast is on demand when it is regarding a removable drive. So if you choose to scan the removable drive after inserting it will it be the same as MCShield?

No .... and MCShield only look for the type of malware that use removable drive to spread when plugged in
so if you have 50Gig of files on it these will not be checked by MCShield .....for that you use your AV

2) considering that autorun for windows have been change to autoplay for the user to decide what action to take does this mean that unless the user run the autorun program most threat would not be activated upon inserting?

autorun is only one way these malware spread

[TwinHeadedEagle]

3) if the removable drive have thousand of file wouldn't that means that it will take at least a few hours to complete scan?

If traces of malware were found, it will take few minutes, but not hours.

[magna86]

Hi testingNoobie,
Please do not hesitate to ask whatever interests you. 



1) To be more precise, MCS is in idle and waiting for you to attach some USB removable drive and also triggers itself to all possible & known vectors attack that malware can exploit. avast! also monitors the USB device if it is set up in the settings.

The difference between AntiVirus and AntiMalware (MCS) programs is that AV scans are mainly signature based detection. MCS does not need to know is the file malware or not. MCS 'reads them', it reads the file and their executive behavior ...
To read more abaut signature & heuristic detection, you may read what I wrote here some time ago:
http://www.bleepingcomputer.com/forums/t/523938/mcshield-malware-remover-not-mcafee-is-it-safe/?p=3299985


2) USB worms based on autorun.inf file (autorun on XP's and autoplay on newer OS's) are not so common. This is one of the oldest known vectors attack and all AV programs does monitor autorun.inf file and corresponding file (again, only if AV know that file as malware). The ugly truth is different, today malware uses other vectors in order to bypass AV's detection and load itself in host system.



3)

MCShield is an active (preventive) anti-malware program designed to prevent infections transmitted through removable drives.

Although I have not seen the actually USB mem-device with a real thousand files, but yes, scanning time may take a while in this case. But in most cases, MCS will verify the files in short. In this example, speed time may depends on disk (HDD) speed and actually speed of USB drive (removable drive) itself.

[testingNoobie]

1) To be more precise, MCS is in idle and waiting for you to attach some USB removable drive and also triggers itself to all possible & known vectors attack that malware can exploit. avast! also monitors the USB device if it is set up in the settings.

The difference between AntiVirus and AntiMalware (MCS) programs is that AV scans are mainly signature based detection. MCS does not need to know is the file malware or not. MCS 'reads them', it reads the file and their executive behavior ...
To read more abaut signature & heuristic detection, you may read what I wrote here some time ago:
http://www.bleepingcomputer.com/forums/t/523938/mcshield-malware-remover-not-mcafee-is-it-safe/?p=3299985

I read your post in bleepingcomputer so from what I understand is that MCShield detect and decide for itself whether its dangerous or not, something like an AI? Whereas normal AV detect base on updates, so if it did not receive any update it doesn't know whether the file is a threat or not?

2) USB worms based on autorun.inf file (autorun on XP's and autoplay on newer OS's) are not so common. This is one of the oldest known vectors attack and all AV programs does monitor autorun.inf file and corresponding file (again, only if AV know that file as malware). The ugly truth is different, today malware uses other vectors in order to bypass AV's detection and load itself in host system.

Do you mind listing some of them so that I will know to be wearily of them or becareful not to click them. Autoplay and autorun is actually the same? I thought autoplay is actually safe.

one thing I would like to know is that is malware with autorun the only one that will trigger on plug in or all malware will trigger on plug in

[Para-Noid]

This might help you http://www.softpedia.com/get/Antivirus/MCShield.shtml
and http://www.mcshield.net/

Don't be afraid to use Google to do some research.

[Pondus]

@testingNoobie    as Para-Noid said ..... dont be afraid to google        http://lmgtfy.com/?q=dont+be+afraid+to+google+

this i found in one minute
http://resources.infosecinstitute.com/usb-malware/
http://www.darkreading.com/risk-management/how-usb-sticks-cause-data-breach-malware-woes/d/d-id/1099437?
http://antivirus.about.com/od/virusdescriptions/ht/autorunworms.htm
http://www.microsoft.com/security/portal/threat/encyclopedia/search.aspx?query=INF/Autorun
https://blog.avast.com/2010/11/03/malware-running-on-autorun/
http://www.infosecurity-magazine.com/view/27703/infautorun-malware-is-most-prevalent-malware-in-july-/

basically, the net is full of info for the one who is curious 

[BlackHawk1]

Not knocking the program at all, but it just seems like a waste if proper AV is already in place.