Author Topic: 2nd layer protection for USB drives: MCShield  (Read 132726 times)

0 Members and 1 Guest are viewing this topic.

dr_Bora

  • Guest
Re: 2nd layer protection for USB drives: MCShield
« Reply #120 on: November 27, 2012, 12:13:49 AM »
ky331, I'm not taking your (and not just yours) comments the wrong way. Almost 3 years ago, MCS consisted of one exe file, it was without the GUI, there were no settings and you couldn't even close the program (the scanner worked completely silently in the background).
Thanks to suggestions/bug reports/feature requests... like yours, it evolved to it's current form. I'm always grateful for any feedback (as long as it's not intentionally malicious and without any ground in reality and personal experience with the program).

Will rename do the job? Sure, it would do, but using this as default and only action would force the users to manually clean the drive after the scan.
So, it comes to balancing between ease of use in different situations (and proper detections are, of course, much more common than mistakes). It would be possible to have an option like "never delete, just rename". Basically, quite easy to implement in the scanner, the hardest part is finding the place in the GUI for another option and updating translations and documentation.

The quarantine issue: I've been running the fixed dll since yesterday. As soon as I've tested enough to feel confident about proper functionality, update will be released (ETA: 1-3 days).

Quote
Well, I think we're talking about drivers and a service... aren't we?

That's one approach, but we're not going there, because going there means possible driver conflicts with other security software (and I've promised a long time ago that MCS shall never cause a BSOD or OS crash - it's there to help the AV, not to make a mess).

As I mentioned, I have an idea how I could implement a certain degree of user interaction. So, some stuff needs to be done fast and I can't ask, but... I can perform the action, and then ask: if the user says no, then I can reverse the action. Other things can be directly decided by users. Could be a "bit" tricky to implement this (wasn't really planned), but I'll try.

Offline Lisandro

  • Avast team
  • Certainly Bot
  • *
  • Posts: 67194
Re: 2nd layer protection for USB drives: MCShield
« Reply #121 on: November 27, 2012, 02:07:59 PM »
A rollback function will be quite useful.
If it is simple and userfriendly, it can solve the issue.
The best things in life are free.

Offline schmidthouse

  • VIRUS FREE A Long Time
  • Avast Evangelist
  • Starting Graphoman
  • ***
  • Posts: 7168
  • When you think you know, Think Again
Re: 2nd layer protection for USB drives: MCShield
« Reply #122 on: November 27, 2012, 05:41:36 PM »
I have been running MCS on my XP since awhile now.
I now also run Windows8 64Bit and am considering the install on this OS.
After reviewing the information in previous posts and the move to rectify I will wait until then. :)

Offline Lisandro

  • Avast team
  • Certainly Bot
  • *
  • Posts: 67194
Re: 2nd layer protection for USB drives: MCShield
« Reply #123 on: November 27, 2012, 06:33:24 PM »
I now also run Windows8 64Bit and am considering the install on this OS.
I'm using at W8 x64.
The best things in life are free.

Offline schmidthouse

  • VIRUS FREE A Long Time
  • Avast Evangelist
  • Starting Graphoman
  • ***
  • Posts: 7168
  • When you think you know, Think Again
Re: 2nd layer protection for USB drives: MCShield
« Reply #124 on: November 27, 2012, 06:43:10 PM »
I now also run Windows8 64Bit and am considering the install on this OS.
I'm using at W8 x64.

Hi Tech:Ah yes. I was just wondering about the 'quarantine/warning' update referred too.
Maybe I misunderstood the posts. 8)

Offline Lisandro

  • Avast team
  • Certainly Bot
  • *
  • Posts: 67194
Re: 2nd layer protection for USB drives: MCShield
« Reply #125 on: November 27, 2012, 06:59:10 PM »
I now also run Windows8 64Bit and am considering the install on this OS.
I'm using at W8 x64.

Hi Tech:Ah yes. I was just wondering about the 'quarantine/warning' update referred too.
Maybe I misunderstood the posts. 8)
No, no misunderstandings. I'm just corroborating with your posts.
The best things in life are free.

Offline schmidthouse

  • VIRUS FREE A Long Time
  • Avast Evangelist
  • Starting Graphoman
  • ***
  • Posts: 7168
  • When you think you know, Think Again
Re: 2nd layer protection for USB drives: MCShield
« Reply #126 on: November 27, 2012, 07:05:51 PM »
I now also run Windows8 64Bit and am considering the install on this OS.
I'm using at W8 x64.

Hi Tech:Ah yes. I was just wondering about the 'quarantine/warning' update referred too.
Maybe I misunderstood the posts. 8)
No, no misunderstandings. I'm just corroborating with your posts.

No worries ;)
I'm understanding they are working on a 'fix/update' so as to address "no harm first" premise. :)
 

Offline bob3160

  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 48582
  • 64 Years of Happiness
    • bob3160 Protecting Yourself, Your Computer and, Your Identity
Re: 2nd layer protection for USB drives: MCShield
« Reply #127 on: November 27, 2012, 07:43:44 PM »
I now also run Windows8 64Bit and am considering the install on this OS.
I'm using at W8 x64.

Hi Tech:Ah yes. I was just wondering about the 'quarantine/warning' update referred too.
Maybe I misunderstood the posts. 8)
No, no misunderstandings. I'm just corroborating with your posts.

No worries ;)
I'm understanding they are working on a 'fix/update' so as to address "no harm first" premise. :)
That's what I'm waiting for. :)
Free Security Seminar: https://bit.ly/bobg2023  -  Important: http://www.organdonor.gov/ -- My Web Site: http://bob3160.strikingly.com/ - Win 11 Pro v24H2 64bit, 32 Gig Ram, 1TB SSD, Avast Free 24.4.6112, How to Successfully Install Avast http://goo.gl/VLXdeRepair & Clean Install https://goo.gl/t7aJGq -- My Online Activity https://bit.ly/BobGInternet

Offline schmidthouse

  • VIRUS FREE A Long Time
  • Avast Evangelist
  • Starting Graphoman
  • ***
  • Posts: 7168
  • When you think you know, Think Again
Re: 2nd layer protection for USB drives: MCShield
« Reply #128 on: November 30, 2012, 12:48:55 AM »
Just received an Auto Update of MCS to version 2.3.3.17
Is this the update talked about in Post #120  (Update in 1-3days)? ???
Thanks,  8)

Offline magna86

  • Anti Malware Fighter
  • Avast Evangelist
  • Massive Poster
  • ***
  • Posts: 4235
    • Ambulanta MyCity Forum - ASAP Member
Re: 2nd layer protection for USB drives: MCShield
« Reply #129 on: November 30, 2012, 12:19:52 PM »
Just received an Auto Update of MCS to version 2.3.3.17
Is this the update talked about in Post #120  (Update in 1-3days)? ???
Thanks,  8)
:D

http://forum.avast.com/index.php?topic=9671.msg869094#msg869094

Offline ky331

  • Sr. Member
  • ****
  • Posts: 303
Re: 2nd layer protection for USB drives: MCShield
« Reply #130 on: November 30, 2012, 03:54:45 PM »
I see you have released a new version, 2.3.3.17, which is supposed to take care of the "hidden" files in quarantine.   Thank you.

I just came across an interesting article:   Can we take for granted your program will protect us from the likes of what is being discussed here:   http://nakedsecurity.sophos.com/2012/11/30/w32vbna-x-spreads-quickly-through-networks-and-removable-media/
Lenovo T530 laptop, Intel Core i5-3320M @ 2.60 GHz, 8GB RAM, Windows 7 Pro SP1 (64-bit), avast! 17 Free, MBAM3 Pro, Windows Firewall, MVPS HOSTS file, OpenDNS Family Shield, Zemana AntiLogger Free, SpywareBlaster, IE11 & Firefox [both using WOT (IE set to WARN, FF set to BLOCK)], WinPatrol PLUS, uBlock Origin, MBAE, MCShield, CryptoPrevent, SAS (on-demand scanner). 
[I believe computer-users who sandbox (Sandboxie) are acting prudently.]

Offline schmidthouse

  • VIRUS FREE A Long Time
  • Avast Evangelist
  • Starting Graphoman
  • ***
  • Posts: 7168
  • When you think you know, Think Again
Re: 2nd layer protection for USB drives: MCShield
« Reply #131 on: November 30, 2012, 07:43:44 PM »
Thanks. ;) :)

dr_Bora

  • Guest
Re: 2nd layer protection for USB drives: MCShield
« Reply #132 on: November 30, 2012, 09:17:06 PM »
ky331, thanks for reporting the problem.

Malware described on that link? A "blended behavior" worm; exploits autorun, replicates, mimics user's folders, uses tricks to lure the user into running it...
Normally, this is bad because of many ways an infection can occur, but if we're talking MCS, it's good: the worm would trigger several detection routines (in my belief; more than enough).

Offline ky331

  • Sr. Member
  • ****
  • Posts: 303
Re: 2nd layer protection for USB drives: MCShield
« Reply #133 on: December 16, 2012, 02:09:43 PM »
v 2.4.3.18: 16th December 2012.

- implemented a new generic detection routine (for more precise detection/remediation of Trojan:VBS/Autorun.B (MS));
- added Persian language (thanks to translator Seyed Ehsan Hadi).
Lenovo T530 laptop, Intel Core i5-3320M @ 2.60 GHz, 8GB RAM, Windows 7 Pro SP1 (64-bit), avast! 17 Free, MBAM3 Pro, Windows Firewall, MVPS HOSTS file, OpenDNS Family Shield, Zemana AntiLogger Free, SpywareBlaster, IE11 & Firefox [both using WOT (IE set to WARN, FF set to BLOCK)], WinPatrol PLUS, uBlock Origin, MBAE, MCShield, CryptoPrevent, SAS (on-demand scanner). 
[I believe computer-users who sandbox (Sandboxie) are acting prudently.]

Offline Lisandro

  • Avast team
  • Certainly Bot
  • *
  • Posts: 67194
Re: 2nd layer protection for USB drives: MCShield
« Reply #134 on: December 16, 2012, 07:06:40 PM »
Is it a bug when I've set "not warn about updates" and each boot a panel is shown that there is no updates? :'(
The best things in life are free.