VirusTotal getting annoying cause of FPs

Checking executables

I thought I'd post a way of checking any new unsigned executables that attempt to run anywhere on your system but just for information purposes and not to suggest that it's a good idea to install this software. I've been using it for some time. There's a one year free license.

https://secureaplus.secureage.com/Main/secureaplus_download.php

Personally I use the offline No AV version. Once installed the initial scan of executables that are already present on your system takes around an hour or more. Those executables will be whitelisted.

What happens when an unsigned executable attempts to run - you get the option to block it:



The file gets scanned on VirusTotal and the result is shown.



Configuration options:

Prompt when a file is not in the whitelist


Trust the file based on digital signature if it's in the trusted list


Disable AV and rely on your installed AV or optionally enable/ disable it when needed for a secondary scan


Add any application capable of downloading/ creating executables to the restricted application list.

Typically:

Any/all web browsers installed on your computer
Entire MS Office suite (Access, Excel, Outlook, PowerPoint, Word)
Sun (now Oracle) Java
Any media player (Windows Media Player, VLC, iTunes, RealPlayer, QuickTime, Winamp)
Any software that waits and listens for a network connection
Any Adobe product that you see frequently listed within Adobe's Security bulletins and advisories.

No need to add flash player - the plugin is protected by adding the browser's executable.



When installing trusted software there's an option to "Trust All"


There's also the option to change trust level for any executable on your system


I feel that it does add an additional layer of security but it doesn't seem to get mentioned often here on SevenForums. I guess that it suits users who wish to be kept informed of what's going on on their system and who don't mind responding to pop ups. I like pop ups!

Tookeri said:

I'll have a look at Metascan, but is it as frequently used as VT? I don't know, but one of best things with sigcheck and VT is that it almost never have to submit any files because someone else has already done it, including recently updates files. Checking thousands of files only takes a few minutes.

Click to expand...

MetaScan has been arounf for a bit, I don't see why it wouldn't get as much usage as VT. It works on exacly the same principle as VT.

Thanks for the input guys!

And thanks for all the screenshots Callender, much appreciated!

Opswat Metascan

Golden said:

Tookeri said:

I'll have a look at Metascan, but is it as frequently used as VT? I don't know, but one of best things with sigcheck and VT is that it almost never have to submit any files because someone else has already done it, including recently updates files. Checking thousands of files only takes a few minutes.

Click to expand...

MetaScan has been arounf for a bit, I don't see why it wouldn't get as much usage as VT. It works on exacly the same principle as VT.

Click to expand...

Sometimes I've used the MetaScan File Uploader

It does seem very similar to VirusTotal.

I also installed Gears from the same company:

Opswat Gears

I removed it as it crashed my machine. I couldn't be bothered to figure out why.

I do find their browser add on very useful though:

http://www.sevenforums.com/browsers-mail/349908-metascan-firefox-add-released.html

Also available for Chrome.

Scans connections, downloads and ip addresses.

I just like to add additional security if it works without slowing things down too much!

Yep....its a brilliant little add-on for a browser