You are here: Home » Announcements » GDATA AntiVirus 2009 Review

GDATA AntiVirus 2009 Review

by malwarekilla on October 10, 2008

FYI – I uploaded the GDATA antivirus 2009 review last night.  YouTube.com/mrizos

I really enjoyed working with GDATA.  I firmly beleive that multiple scan engines are the furture (along with whitelisting).  GDATA removed 95% of the malware on the test PC, however it couldn’t remove Qhost or any malware related registry entries.

My official rating for GDATA is:  Awesome! – hat’s off to the GDATA crew!!!!

Here is the HiJackThis Log (I’ve bolded leftover infections).

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:09:35 AM, on 10/10/2008
Platform: SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Java\jre1.6.0_04\bin\jusched.exe
C:\Program Files\VMware\VMware Tools\VMwareTray.exe
C:\Program Files\VMware\VMware Tools\VMwareUser.exe
C:\Program Files\\AntiVirus\AVKTray\AVKTray.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Common Files\G DATA\AVKProxy\AVKProxy.exe
C:\Program Files\G DATA\AntiVirus\AVK\AVKService.exe
C:\Program Files\G DATA\AntiVirus\AVK\AVKWCtl.exe
C:\Program Files\VMware\VMware Tools\VMwareService.exe
C:\Program Files\Java\jre1.6.0_04\bin\jucheck.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 – HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.com/
F2 – REG:system.ini: Shell=Explorer.exe C:\WINDOWS\shell.exe
O2 – BHO: G DATA WebFilter Class – {0124123D-61B4-456f-AF86-78C53A0790C5} – C:\Program Files\G DATA\AntiVirus\Webfilter\AvkWebIE.dll
O2 – BHO: (no name) – {01BA2111-5518-D0C8-A667-01E739079356} – C:\WINDOWS\system32\tnxqilzf.dll (file missing)
O2 – BHO: BhoApp Class – {32131238-5434-4234-4234-432432423432} – C:\Program Files\syscmd\mscmp32.dll (file missing)
O2 – BHO: SSVHelper Class – {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} – C:\Program Files\Java\jre1.6.0_04\bin\ssv.dll
O2 – BHO: (no name) – {7C109800-A5D5-438F-9640-18D17E168B88} – C:\Program Files\NetProject\sbmdl.dll (file missing)
O2 – BHO: e404 helper – {8F10DE2B-E923-4548-B524-4D9C5FA80777} – C:\Program Files\Helper\1208921198.dll (file missing)
O2 – BHO: 717305 helper – {963916CD-6311-485D-93DC-3BD1B9E2D2CB} – (no file)
O2 – BHO: Mirar – {9A9C9B69-F908-4AAB-8D0C-10EA8997F37E} – C:\WINDOWS\System32\WinNB58.dll (file missing)
O2 – BHO: iSecurity – {A8311E8F-E459-4D22-89B4-CB9DCF10A425} – C:\WINDOWS\System32\ISECUR~1.CPL (file missing)
O2 – BHO: ContextProgram – {E4D1D56C-3EC9-2F5D-FAA3-4112CCDD61DC} – C:\Program Files\ContextProgram\ContextProgram-2.dll (file missing)
O2 – BHO: cj helper – {F10587E9-0E47-4CBE-84AE-7DD20B8684BB} – C:\Program Files\IE Extensions\cj.v2.dll (file missing)
O3 – Toolbar: Mirar – {9A9C9B68-F908-4AAB-8D0C-10EA8997F37E} – C:\WINDOWS\System32\WinNB58.dll (file missing)
O3 – Toolbar: G DATA WebFilter – {0124123D-61B4-456f-AF86-78C53A0790C5} – C:\Program Files\G DATA\AntiVirus\Webfilter\AvkWebIE.dll
O4 – HKLM\..\Run: [SunJavaUpdateSched] “C:\Program Files\Java\jre1.6.0_04\bin\jusched.exe”
O4 – HKLM\..\Run: [VMware Tools] C:\Program Files\VMware\VMware Tools\VMwareTray.exe
O4 – HKLM\..\Run: [VMware User Process] C:\Program Files\VMware\VMware Tools\VMwareUser.exe
O4 – HKLM\..\Run: [iSecurity applet] rundll32.exe iSecurity.cpl,SecurityMonitor (GDATA KILLED THIS)
O4 – HKLM\..\Run: [wofgrqls] C:\WINDOWS\system32\wofgrqls.exe (GDATA KILLED THIS)
O4 – HKLM\..\Run: [apadibub] regsvr32 /u “C:\Documents and Settings\All Users\Application Data\apadibub.dll” (GDATA KILLED THIS)
O4 – HKLM\..\Run: [MSDisp32] rundll32.exe C:\WINDOWS\System32\drvboj.dll,startup (GDATA KILLED THIS)
O4 – HKLM\..\Run: [G DATA AntiVirus Trayapplication] C:\Program Files\G DATA\AntiVirus\AVKTray\AVKTray.exe
O4 – HKCU\..\Run: [MSMSGS] “C:\Program Files\Messenger\msmsgs.exe” /background
O4 – HKLM\..\Policies\Explorer\Run: [rTwrdHqj21] C:\WINDOWS\wpopejyl.exe (GDATA KILLED THIS)
O4 – HKLM\..\Policies\Explorer\Run: [J286hthVnp] C:\WINDOWS\wpopejyl.exe (GDATA KILLED THIS)
O4 – HKLM\..\Policies\Explorer\Run: [some] C:\Program Files\NetProject\scit.exe (GDATA KILLED THIS)
O4 – Startup: .protected
O4 – Startup: LimeWire On Startup.lnk = C:\Program Files\LimeWire\LimeWire.exe
O4 – Global Startup: .protected
O7 – HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O9 – Extra button: (no name) – {9034A523-D068-4BE8-A284-9DF278BE776E} – http://www.gateietool.com/redirect.php (file missing)
O9 – Extra ‘Tools’ menuitem: IE Anti-Spyware – {9034A523-D068-4BE8-A284-9DF278BE776E} – http://www.gateietool.com/redirect.php (file missing)
O9 – Extra button: Messenger – {FB5F1910-F110-11d2-BB9E-00C04F795683} – C:\Program Files\Messenger\msmsgs.exe
O9 – Extra ‘Tools’ menuitem: Windows Messenger – {FB5F1910-F110-11d2-BB9E-00C04F795683} – C:\Program Files\Messenger\msmsgs.exe
O15 – Trusted Zone: http://click.getmirar.com (HKLM)
O15 – Trusted Zone: http://click.mirarsearch.com (HKLM) (
O15 – Trusted Zone: http://redirect.mirarsearch.com (HKLM)
O15 – Trusted Zone: http://awbeta.net-nucleus.com (HKLM)
O16 – DPF: {2F0E7094-51A2-ECEB-8CF6-EF32B5ECD15E} – http://virusremover2008.com/VRM_Free.exe
O16 – DPF: {7D5DD829-6C90-42C5-B54C-2AFA82F988BA} (CLoader Object) – http://www.av-xp2008.com/tools/virusremover.dll
O16 – DPF: {C931FDF3-0319-0CAE-6DFD-8D061EABF08D} – http://virusremover2008.com/VRM_Free.exe
O20 – AppInit_DLLs: C:\WINDOWS\system32\wowfx.dll (QHOST INFECTION STILL RESIDES)
O20 – Winlogon Notify: wingvd32 – wingvd32.dll (file missing)
O21 – SSODL: zip – {177ab526-6b94-4cc2-b303-c1b6a4070316} – C:\WINDOWS\Installer\{177ab526-6b94-4cc2-b303-c1b6a4070316}\zip.dll (file missing)
O21 – SSODL: CheckMon – {b62df42a-0f78-46d6-81d0-3f0ae0d8dc6b} – C:\WINDOWS\Installer\{b62df42a-0f78-46d6-81d0-3f0ae0d8dc6b}\CheckMon.dll (file missing)
O21 – SSODL: iSecurity – {A8311E8F-E459-4D22-89B4-CB9DCF10A425} – C:\WINDOWS\System32\ISECUR~1.CPL (file missing)
O22 – SharedTaskScheduler: frowardness – {b0fdc513-46b9-46fc-8e70-d575ee546dae} – C:\WINDOWS\System32\zfaiqwr.dll (file missing)
O23 – Service: G DATA AntiVirus Proxy (AVKProxy) – G DATA Software AG – C:\Program Files\Common Files\G DATA\AVKProxy\AVKProxy.exe
O23 – Service: G DATA Scheduler (AVKService) – G DATA Software AG – C:\Program Files\G DATA\AntiVirus\AVK\AVKService.exe
O23 – Service: AntiVirus Monitor (AVKWCtl) – G DATA Software AG – C:\Program Files\G DATA\AntiVirus\AVK\AVKWCtl.exe
O23 – Service: VMware Descheduled Time Accounting Service (vmdesched) – VMware, Inc. – C:\Program Files\VMware\VMware Tools\vmdesched.exe
O23 – Service: VMware Tools Service (VMTools) – VMware, Inc. – C:\Program Files\VMware\VMware Tools\VMwareService.exe

–
End of file – 6360 bytes

Tags: registry entries, internet explorer, system ini, running processes, G DATA Software AG, test pc, c program, Microsoft Windows, hijackthis log

{ 17 comments… read them below or add one }

robin October 10, 2008 at 3:10 pm

Awesome, Gdata is great:)

malwarekilla October 10, 2008 at 3:22 pm

Yeah, I loved it! I’m going to check out their boot cd too.

James October 10, 2008 at 6:10 pm

Yer well to be honest, it should be great, because it uses 2 antivirus engines (avast and somethign else). It also has minutely updates

Adel October 11, 2008 at 5:01 am

Nice video…

Im waiting for a test on Agnitum’s Outpost Pro Security Suite now :)

dany October 11, 2008 at 10:00 am

I don’t understand something….why is xp antivirus still on your screen(desktop) after the normal mode scan?

VJ October 11, 2008 at 6:05 pm

Since Gdata 2009 uses Avast & BD, I am not surprised it missed Q-Host. As you said, only a few products like Avira,Kaspersky,Norton are able to remove it.

Maybe if they had stuck to Kaspersky, it would have removed that one.

Jukka October 13, 2008 at 10:00 am

Hi

Nice work you have done.
Try new a-squared antimalware withc including ikarus-antivirus. At least detectionrate is nice but how it will clean pc is another question. So if you could run some test with that one.

Adel October 14, 2008 at 3:10 pm

BTW how was the system resource usage of GDATA??

Dan October 15, 2008 at 6:53 pm

Hey.. I have just installed G DATA Internet Security, and so far i love it….

But… It uses ~150MB of ram.. That sucks..

What would you chose:

Kaspersky Internet Security og G DATAs IS..???

Thanks

AZLAN210396 October 16, 2008 at 6:12 am

Where to download G DATA?

Adel October 16, 2008 at 6:17 pm

@ Dan… Kaspersky Internet Security (Latest Build) uses about 30-35 MB on an average… thats very very light…

Matt October 21, 2008 at 1:13 pm

Hi Guys

You can download evaluation software at http://www.ultimateinternetsecurity.com or GDATA.de

regards

Matt

Adel November 21, 2008 at 5:15 pm

I have tried this. Actualy GDIS 2009.
Detection is very good. Ofcourse using two engines was a smart decision.

For the average user its seems to be a good package but i assume it does need some help from other softwares (IF user is suspicious of an undetected infection). May be advanced users would prefer to use (GDAV) other firewall and HIPS applications etc.

The only major negative that i could see is its memory usage and multiple background processes. But people with sufficient resources should be fine.

The guys at http://www.ultimateinternetsecurity.com are very helpful too :)

hatrec November 25, 2008 at 6:49 am

Yeah, I loved it!

Stephen Billard August 20, 2009 at 1:53 am

Well, Initially I really liked G-data. Nice configurable firewall, etc. But then I had a problem. The firewall is blocking my Retrospect backup to a client PC. Have to disable the firewall to get it to make a connection. No rules changes seem to stick to let things pass through.

Submitted a support request–maybe there is a way.

Then I found an annoyance. My sound card software seems to want to set itself in the “run” registry key each time that Windows boots. Perhaps that is not nice behavior, but it is what it is. Can’t find a way to tell G-Data to shut up and ignore it. Sent another support request.

So far I have not even got acknowledgement that my requests have been received. (Maybe they have not, the only contact is a web form, so no way to get a mail received receipt.)

In my opinion, G-Data support does not exist. Use this product at your own peril.

LonelyNightHowl October 30, 2009 at 4:22 am

try Iobit.com iobit360 to remove the left 5%!

bcmalloy December 8, 2009 at 1:20 pm

Great virus detection but found the following problems.

Create boot CD function does not work in windows 7 x64, try it.

GDATA Firewall causes world at war server fresh to work intermittently and does not actually get fully disabled when you choose the disable firewall function it must be uninstalled.

Works great with a third party firewall as purely anti virus software.

Leave a Comment

Previous post:

Next post:

My Business in St. Louis - st louis computer repair