Methodology for Active Malware Treatment Test (October 2012)

The expert group at the Anti-Malware Test Lab selected 24 malicious programs for the active infection treatment test of antivirus products. Selection was based on the following criteria:

1. Malicious programs were selected with a view to providing maximum coverage of technologies used to mask their presence on the system and prevent their detection and/or removal.
2. The malicious program should be widespread.
3. All the antivirus products tested should detect the malicious program’s components.
4. The malicious program should be able to recover if some of its components are removed.
5. The malicious program should not deliberately interfere with the antivirus products’ operation (deleting the antivirus files and keys, antivirus processes shutdown, antivirus database update blocking etc.).
6. The malicious program should not block system operability.

While selecting malwares for the test, priority was given to the most complicated types meeting the most of the above-mentioned criteria.

It should be noted that detection of malicious program components by all of the antivirus products tested was a critically important parameter in selecting malicious programs for the test.

All malicious programs used in the test were collected by Anti-Malware Test Lab experts in the wild.

The following malware samples for Windows XP x86 were selected:

1. TDL (TDSS, Alureon, Tidserv)
2. Koutodoor
3. Win32/Glaze
4. Sinowal (Mebroot)
5. Rootkit.Protector (Cutwail, Pandex)
6. Worm.Rorpian
7. Rootkit.Podnuha (Boaxxe)
8. Virus.Protector (Kobcka, Neprodoor)
9. Rustock (Bubnix)
10. Email-Worm.Scano (Areses)
11. Rloader (WinNT/Simda)
12. SubSys (Trojan.Okuks)
13. Rootkit.Pakes (synsenddrv, BlackEnergy)
14. TDL2 (TDSS, Alureon, Tidserv)
15. TDL3 (TDSS, Alureon, Tidserv)
16. Xorpix (Eterok)
17. Pihar (TDL4,TDSS, Alureon, Tidserv)
18. SST (PRAGMA, TDSS, Alureon)
19. Zeroaccess (Sirefef, MAX++)
20. Cidox (Rovnix, Mayachok, Boigy)

And some malwares for Windows 7 x64:

1. Pihar (TDL4,TDSS, Alureon, Tidserv)
2. SST (PRAGMA, TDSS, Alureon)
3. Zeroaccess (Sirefef, MAX++)
4. Cidox (Rovnix, Mayachok, Boigy)

Thus, 24 different malware samples were selected for the testing on two types of operating systems.

Every malware selected was tested for its productivity and installation in the test system. You can find detailed description of the malwares in the detailed test report in Excel-format. 

Testing procedure

The test was performed on real computers (unlike the earlier tests) under the guidance of Microsoft Windows XP Professional with the integrated Service Pack 3.

lkd> !devstack \Device\Harddisk0\DR0
!DevObj   !DrvObj            !DevExt   ObjectName
89bcfe08  \Driver\PartMgr    89bcfec0
> 89bceab8  \Driver\Disk       89bceb70  DR0
89b74f18  \Driver\ACPI       89c0f0e0  00000061
89bd0940  \Driver\atapi      89bd09f8  IdeDeviceP0T0L0-3

The following antivirus software participated in the test:

1. Avast! Internet Security 7.0.1456
2. AVG Internet Security 2012 (2012.0.2197)
3. Avira Internet Security 2012 (12.0.0.1127)
4. BitDefender Internet Security 2013 16.16.0.1348
5. Comodo Internet Security 5.10.228257.2253
6. Dr.Web Security Space Pro 7.0.1.07100
7. Eset Smart Security 5.2.9.1
8. F-Secure Internet Security 2012 (1.62)
9. Kaspersky Internet Security 2012 (12.0.0.374(i))
10. McAfee Internet Security 11.0.678
11. Microsoft Security Essentials 4.0.1526.0
12. Norton Internet Security 2012 (19.8.0.14)
13. Outpost Security Suite Pro 7.5.3 (3942.608.1810)
14. Panda Internet Security 2012 (17.01.00)
15. Trend Micro Titanium Internet Security 2012 (5.0.1280)

When installing them on an infected computer, default settings recommended by the vendor were used and all the actions recommended by the software were performed (the system reboot, update, etc.):

• Whenever possible, installation process was performed with taking all the recommended actions into consideration including the product update and malware checking.
• If the installation manager did not suggest rebooting the malware search checking starts without the system reboot after installation. If the checking fails (a malware was not detected or was detected but not deleted) the system rebooted and the malware search checking started again.
• If updates were not performed during installation it was performed manually before active infection treatment.
• When treating active infections predefined g options were the first to be initiated (quick scan, startup scan, etc). If the first attempt failed the catalogue scanning from the context menu where the malware files are stored started. If this attempt failed too the whole system scanning started.
• If an antivirus interface has an option for a separate rootkits checking it was the first to be performed in all the samples containing rootkit-component.
• If only one of several components was detected during the checking the search for other components continued after reboot.

If several variants of action were suggested they were selected in sequence in accordance with the failure occurred: heal, remove, rename, quarantine. 

The testing process comprised the following steps:

1. Install the operation system on a hard drive and creating a complete hard drive image using Acronis True Image (image_main).
2. Infect the computer with a clean operation system (malware activation).
3. Verify that the virus is functioning correctly and that it has been successfully installed on the system.
4. Restart the infected system.
5. Verify again that the virus is functioning correctly and create a new image of the system (image_virus).
6.  Repeat steps 1 through 5 for all the malicious programs used in the test.
7.  Load one of the image_virus snapshots and attempt to install one antivirus product participating in the test and disinfect the system.
8. If disinfection of the system was successful, create a list of the remaining traces of the infection.
9. Restoring the clean operation system image_main on the disk using Acronis True Image (booting from a CD).
10. Repeat steps 7 and 9 for all sixteen image_virus snapshots and all seventeen antivirus products.