Every year there are a lot of reports on which is the best antivirus, firewall or HIPS security software and most of them have different opinions. Some will say Kaspersky is the best, and some will prefer NOD32… When magazines or people say which antivirus, firewall or host intrusion prevention system software is the best, is it really accurate? I personally think that the only way to tell which is the best antivirus program IF all antivirus vendor give their source code to the world’s best security coder to analyze them, then maybe we can have the real winner. Virus coders can also tell which antivirus program is the best because they need to analyze how to code something that won’t trigger antivirus alert.
If we don’t know any virus coder, then how do we know which security software to use? Why not put your currently installed antivirus, firewall and HIPS program to the test?
System Shutdown Simulator is a unique leaktest designed to test the effectiveness of your firewall, antivirus and host-intrusion prevention system (HIPS) when malware simulates a fake Windows shutdown. System Shutdown Simulator is the first of a new generation of leaktests designed to test the effectiveness of HIPS software in protecting your computer from malware.
With the line between firewall and HIPS software becoming increasingly more blurred, System Shutdown Simulator is designed to redefine the leaktest formula by testing both your firewall and HIPS as well as antivirus software for leaks in their protection.
This leaktest highlights a new vulnerability that exists when a user shuts down their computer and a program cancels the
shutdown. For example, when installing new software, the installation program often asks the user to restart their
computer to complete the installation. When the user allows the computer to be restarted, the installation program could potentially compromise the user’s computer completely undetected by security software as these have already shutdown.
Simply follow the steps to test your security programs. First you press the “Intercept System Shutdown Call” button. Next, You can either hit the “Shutdown Computer button” from the program or manually shutdown your computer. You’ll notice that your computer WON’T shutdown because it has been intercepted when you clicked the Intercept System Shutdown Call button and also all your running programs including antivirus has been closed. Now if you want to test your antivirus, click the “Create Eicar Test file” and it will create a virus file on your computer. If your antivirus is able to detect the Eicar file, then your antivirus program proofs to be smart.
I tested System Shutdown Simulator with Kaspersky Anti-Virus v7.0.1.325 and was disappointed to know that it didn’t detect Eicar :( However, this doesn’t mean that the latest version of Kaspersky Anti-Virus is useless as this test is only one of the leaktest method. Good news is the upcoming version 8 will be able to detect this vulnerability.
[ Download System Shutdown Simulator ]
I have tested with comodo internet securty 4 (hips and firewall only),,
it pass with all testing,,
eicar file could not be created,,
Ne faite pas confiance dans les logeciels que vous connaissez pas …… il creer drs faille sur les pc …meme quil et crypter ….!!!!!
i’ve tested for both my antivirus (kaspersky 2009) and firewall.
it says
for antivirus:
eicar file created succesfully-fail
for firewall:
.: System Shutdown Simulator Test Page – Firewall Test Component
If this HTML page has been downloaded / displayed on your computer, your firewall has FAILED the Firewall Test Component.
does this means they are effective?or something is wrong with my system?
Is this not trivial in comparison to the malware doing a del *.* on your c drive?
If the malware is already installed wouldn’t it be easier just for it to monitor and terminate any antivirus installation before it commences.
As an aside question how easy would it be for an application to fake the results on the task manager? I ask as this is the main method I use to identify spyware on my machine.
hi i face a problem…………
i lost password of a important .rar file ……….i need this file immediately……………….
can any one help me in this regard to break the password
of that rar file…………
i tried some softwares but as they are not registered, so they do not solve my problem…………
so please help me as early as possible…………thanks in early………….
Never mind Raymond, please delete this comment and the one before it.
Raymond, Kaspersky detects EICAR on my system. Weird.
It’s the same link and just tested, that’s work fine.
can you send the link that is working
Link is working now. Just tested.
the link doesn’t work
Try this Link:
Link is not working!
I use PC Tools Internet Security 5.0 it works fine with the detected file.
You may also check if your AV/FW/HIPS hooks SSDT properly:
BSODhook
My antivirus detected and quarantined the file.
I have NOD32.
Anyway, nice find.