2

I've seen many viruses/malicious VB scripts get executed when accidentally double clicked or through fake shortcuts redirecting to some viruses causing the Victim's PC a serious damage. But nowadays latest windows distributions like Windows 8.1, 10 have this feature, enter image description here

This feature in windows is extremely good because it shows what is actually executed even the name of the exe so one could easily find out what they are actually executing. I have also created the shortcut before executing the application and the feature works fine still. But unfortunately running a full scan in my PC with Kaspersky Total Security 2016 which is not a trial version I found that my PC has been infected by a virus and I removed. Since I'm paranoid of security I run scan weekly once I analyzed all the files i have downloaded from the internet on that week and found that the virus came along with the zip package. The virus wasn't bundled it is itself found as an separate executable and I have executed by clicking a file. but why does this message(shown by windows failed) to warn me? I have scanned the zip file with my antivirus before opening it and it said me no threats found but fortunately found on heuristic analysis when completely scanned my PC. I'm quiet sure it's not a false positive because I done a Virus Total analysis.

P.S I'm not blaming Windows but I just want to know how does a malware overcomes this facility. (Off topic but important for security) Free upgrade for Windows 10 ends on 29th of July.

Improve this question
4
  • Just a minor correction. Knowing the name of the exe doesn't mean that you can easily find out what you are actually executing (simply rename your evil exe to explorer.exe or winword.exe and that's it). What is a bit more useful is the publisher name, since as far as I know it is validated through code signing.
    – A. Darwin
    May 7, 2016 at 15:17
  • I can agree with A. Darwin here. The name of the file should not and does not mean it is safe. You can view the file and verify the publisher/creator/etc but even then its possible to be a malicious file.
    – Jeff Meigs
    May 7, 2016 at 16:53
  • @JeffMeigs No, I didn't mean that. I mean if I am willing to execute a software named "CCleaner" but my windows warns "explorer.exe" will be executed. though explorer.exe is a name of Windows it is not what I want to execute actually. So I could easily figure out something goes wrong.. Thank you
    – VISWESWARAN NAGASIVAM
    May 7, 2016 at 17:10
  • Off-topic: the blur effect in your image isn't very complete, if your goal was to prevent us from reading the name of the .exe file. If it's blurry enough you can't read it, you may want to get an eye exam and get evaluated for corrective lenses.
    – Ben
    Jul 18, 2016 at 15:05

2 Answers 2

Reset to default
1

This is likely due to a lag between malware developers and your antivirus database. Kaspersky had to see and identify this as malware before it could be added to their database (then flagged by your scan). So the first time you scanned this zip file, it came back clean. But by the second time you scanned it Kaspersky had found it and updated your local antivirus about it, allowing it to be caught.

Improve this answer
1

SmartScreen most likely relies on heuristics and code-signing. Heuristics can be bypassed and code-signing can be bypassed as well by either stealing a certificate/private key from a legitimate company (already happened with D-Link), or getting a certificate using forged documents.

Finally, do not underestimate user stupidity. Most people will happily click through this if the file pretends to be important like "list of people to be fired" or the winning ticket for that million dollar lottery from Nigeria.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .