The first one was from Avira talking about a great new feature: as I understand it, in the new version of their product if an application is permitted by the Application rules of the firewall, the port rules are not checked. So my thought was: long live the injected DLLs.

The second one was from ThreatExpert. The post is somewhat murky and self contradicting. As I understand it, it says that Conficker uses two separate methods of injecting DLL’s, neither of which is particularly new (in fact the first one is very old). This seems to be stupid, since why would it inject multiple copies of the DLL in the same process? I’m not saying that malware doesn’t have bugs (in fact most of them have a lot of bugs), but my hunch is that the analyst missed a conditional jump somewhere (ie. the second method is called only if the first one fails for example).

PS. I would have left a comment on their blog asking for clarification, but they didn’t enable comments. A blog with partial feed and/or no commenting facility is not a blog!

Image taken from DeclanTM’s photostream with permission.

• Download the install kit from their website (warning! there is some upselling going on)
• Install the software
• Done!

Unfortunately there aren’t any options to make the program more silent or transparent to the end-use. It is rather chatty and will always prompt the user about things like detected files or updates. Also, it will show an advert after each update. Now there are ways to disable this, however be aware that you might be breaking the license by using them.

To sum up: Avira is a nice little AV with very good detection rates, however it lacks some configuration options which would make it suitable running it silently (to avoid bothering / confusing users). I would recommend going with one of the other alternatives and a layered security approach.