Doesn't seem to detect certain known viruses. about loadlibrary HOT 2 CLOSED

Thanks for the report and testcase! If I dump the engine output, I see it does recognize it as TrojanDownloader:Win32/Tugsp, but the Flags are not what I was expecting.

Normally, Scan->Flags & 0x08000022 is non-zero when it's got a Name, but this time it only sets 0x40050000. I don't know what that means, maybe it means "Potentially Unwanted Application"?

I can at least handle that case for now while I figure it out. I'll commit a temporary patch for that.

If you run into any others that don't look right, please let me know. I'll figure out all the flags eventually 😄

from loadlibrary.

Thanks for looking into this.

I have not tried your patch yet, I will test it out tonight.

Perhaps I can help but I am not a good reverse engineer.
Did you use gdb to get the engine output dump and scan flags? Could you give me more details on how you were able to get this?

Would it help if I gave you this type of output for a set of viruses (I can also provide the viruses):

    Name: Worm:Win32/Vobfus.EK
    ID: 2147656017
    Severity: Severe
    Category: Worm
    Path: file:_C:\virus\VirusShare_00206\.VirusShare_f000bf4d50cdfe9a93f6f23098b159c0.r4aXzr
    Detection Origin: Local machine
    Detection Type: Concrete
    Detection Source: Real-Time Protection
    User: test1\test
    Process Name: C:\cygwin64\bin\rsync.exe
    Signature Version: AV: 1.239.1384.0, AS: 1.239.1384.0, NIS: 116.88.0.0
    Engine Version: AM: 1.1.13601.0, NIS: 2.1.12706.0"

from loadlibrary.