MCShield (MCS)

[DavidR]

@ =Snake=
3:  the MD5 is a unique identifier for the file.  Even if the name was changed but nothing else, the MD5 would be the same. 

It may be possible to do a search on virustotal for that MD5 to see if it has been scanned before and what the results were.  I know it is possible to do a search on VT for a files SHA-256 unique identifier, I have done that before, but don't know about MD5 unique identifier.

Thanks for your declarations. I never used VT before.

You're welcome, it can be a helpful tool for confirmation, etc.

It shouldn't matter which machine is used if you are just searching out information on the MD5, if it has been scanned before (or not).  However if you are uploading a file, it would need to be on that system or transfer it to a USB stick which could be connected to any machine and uploaded.

[=Snake=]

You're welcome, it can be a helpful tool for confirmation, etc.

It shouldn't matter which machine is used if you are just searching out information on the MD5, if it has been scanned before (or not).  However if you are uploading a file, it would need to be on that system or transfer it to a USB stick which could be connected to any machine and uploaded.

Well, yesterday evening, I tried that link Pondus wrote with my main machine (W7). After ~2 hours without any result, I killed it.
How long will it last normally?

[Pondus]

You're welcome, it can be a helpful tool for confirmation, etc.

It shouldn't matter which machine is used if you are just searching out information on the MD5, if it has been scanned before (or not).  However if you are uploading a file, it would need to be on that system or transfer it to a USB stick which could be connected to any machine and uploaded.

Well, yesterday evening, I tried that link Pondus wrote with my main machine (W7). After ~2 hours without any result, I killed it.
How long will it last normally?

The link i posted goes to the MD5 (you posted)  search result at VT and as you should see it say No matches

Meaning that file has never been uploaded and scanned at VT so you will not get any result
If you had the file (not deleted by MCShield) you could have uploaded and scanned it for a result




EKSAMPLE: Here is scan result taken from a random file from my work computer

https://www.virustotal.com/#/file/eda1b1390404f14443e46a1c399f037f159ef6256ddd0ba17718729d12dc8d60/detection

at top you see SHA-256 / analysis date ... and below the scan result Clean
If you click the detail tab you also find MD5 and SHA-1 
When it was first seen at VT and last scan / who made it if signed .....


EKSAMPLE: with malicious file
Here is a writeup written by TrendMicro about a malicious file(s), at the bottom they list the samples SHA-256 hash.

https://blog.trendmicro.com/trendlabs-security-intelligence/bashlite-iot-malware-updated-with-mining-and-backdoor-commands-targets-wemo-devices/

I dont have this file so cant upload and scan it, but i copy the fist sample hash listed, goes to www.virustotal.com  click the search tab, paste in the hash and search and voila i can see the detction result ... meaning this file has been uploaded and scanned at VT, clicking the details tab show that is was first uploaded  First Submission   2019-03-23 18:39:19

https://www.virustotal.com/#/file/81cbb253ef6ad4803e3918883eed3ec6306ef12e7933c5723bd720d55d13a46a/detection

[=Snake=]

You're welcome, it can be a helpful tool for confirmation, etc.

It shouldn't matter which machine is used if you are just searching out information on the MD5, if it has been scanned before (or not).  However if you are uploading a file, it would need to be on that system or transfer it to a USB stick which could be connected to any machine and uploaded.

Well, yesterday evening, I tried that link Pondus wrote with my main machine (W7). After ~2 hours without any result, I killed it.
How long will it last normally?

1. The link i posted goes to the MD5 (you posted)  search result at VT and as you should see it say No matches
2. Meaning that file has never been uploaded and scanned at VT so you will not get any result
If you had the file (not deleted by MCShield) you could have uploaded and scanned it for a result

As I try to get all that stuff into my old head, I parted your answer into smaller ones. Let me correct
1: After about 2 hours running VT without any result (it said nothing at all, so I killed it!!!), should I have
    waited longer?
2: My meaning was, that the stick was empty and I still don't know, what MCS has done! 

[Pondus]

1: After about 2 hours running VT without any result (it said nothing at all, so I killed it!!!), should I have waited longer?

NO, file has not been uploaded to VT so my link will not show a result

2: My meaning was, that the stick was empty and I still don't know, what MCS has done!

Correct, since we dont have the file we will never know what and why


If you want to find out how to use virustotal?
go to youtube and search "how to use virustotal"  and you should find several videos

[=Snake=]

1: After about 2 hours running VT without any result (it said nothing at all, so I killed it!!!), should I have waited longer?

NO, file has not been uploaded to VT so my link will not show a result

2: My meaning was, that the stick was empty and I still don't know, what MCS has done!

Correct, since we dont have the file we will never know what and why

If you want to find out how to use virustotal?
go to youtube and search "how to use virustotal"  and you should find several videos

Hey, now I know a bit more about VT and will get more later. Thanks a lot, Pondus.

[magna86]

Hello,

MCShield may still be competent software and thanks to his auto-routines and behavior MCShield should catch most of the new and old USB related malware.

But yes, unfortunately, MCShield isn't been updated for years. MCS's authors have simple move alone with there private lives. MCShield is now "as-is".

If any FP does occur (and it is likely possible nowadays), users should be able to de-Quarantine and whitelist any files they want from the settings.

[schmidthouse]

Thanks for the info and the proggie.

[bob3160]

I've removed it from my systems and my recommended programs list.

[Pako7]

I've removed it from my systems and my recommended programs list.

Heyy nob3160 why did you remove it?? care to share?

[DavidR]

I've removed it from my systems and my recommended programs list.

Hey bob3160 why did you remove it?? care to share?

I would guess this would be clear, based on what has been said in the topic.

1.  No longer updated
2.  Possible FPs potentially based on the lack of updates.

Based on that the actual user would need to be competent to determine if what is detected is correct or an FP.  My guess, when you are recommending programs you have to have confidence that it isn't going to have a possible adverse effect. 

Whilst Bob is capable to make those decisions for himself, but he can't say that for others who might use it based on his recommendation.

[bob3160]

I've removed it from my systems and my recommended programs list.

David hit the nail on the head.
I follow up my Avast sponsored Presentations with tips, recommendations and quite a few free programs.
When a program becomes outdated and is no longer supported, it isn't something I can recommend to people
that in most instances know a whole lot less than I.
They do depend on my recommendations to be something they can depend on.

[magna86]

Although I do agree with the written above, I just want to point out that if the user has infected USB memory and AV or AM software can't help,
users can freely install MCShield to detect and remove USB related malware.

As I was sad before, MCShield has never been software to relay on his database per se. In early alpha testing, the idea was for MCShield be protable tool with no definition or settings, modern interface, etc. Just a run tool with his heur/engine power and log report. Then the real-time protection was added and this is MCShield we know today.

When I sad FP, in most cases it should be autorun.inf related to no real FP or damaging the legit files or programs. Mark is on should.



But MCShield isn't updated for years and probably will not be in the future so ...yea. Unfortunately.

[=Snake=]

I'm running MCS everytime while using USB on all my os.

[bob3160]

I'm running MCS everytime while using USB on all my os.

Your computer, your choice.