Need some help with 2345SafeCenter

Dmitriy.Pisarets

Hello!
This link <a href="https://cloud.qainfo.ru/s/5Y2qDjeKZHAUMeN" target="_blank" rel="noopener">https://cloud.qainfo.ru/s/5Y2qDjeKZHAUMeN</a> leeds to some China software — 2345SafeCenter 
It will be great if you can help us with two points:
<ul>
<li>How will our product react on this software? are they compatible? </li>
<li>How other anti-viruses react on it? </li>
</ul>

harlan4096

Hum this link is a compressed small file of 85Kb with file 2345Base.sys inside <img src="/plugins/nodebb-plugin-composer-kl/vendor/tinymce/plugins/emoticons/img/smiley-undecided.gif" alt="undecided" />, so how can We test it?

Helios_07

Is that the tuneup software from 2345? 2345 PCsafe? If so seems to work fine but not easy to test since i have no idea what it sais and have to gues what it does =D
Well thats the only one i figured out how to download =D

huang1111

Hello, this software is an anti-virus software from China 2345.com company, but this software bundles other applications, URL navigation, and also pushes advertisements to users, so it may be used by some anti-virus software as a virus. Specific compatibility tests, I will reply to you next week.

Wesly.Zhang

@harlan4096 said in <a href="/post/7783" target="_blank" rel="noopener">Need some help with 2345SafeCenter</a>:
<blockquote>
Hum this link is a compressed small file of 85Kb with file 2345Base.sys inside <img src="/plugins/nodebb-plugin-composer-kl/vendor/tinymce/plugins/emoticons/img/smiley-undecided.gif" alt="undecided" />, so how can We test it?
</blockquote>
Hi, Harlan4096
I think this driver is related to this software could be download from here: <a href="http://dl.2345.cc/2345pcsafe/2345pcsafe_v5.4.1.11945.exe" target="_blank" rel="noopener">http://dl.2345.cc/2345pcsafe/2345pcsafe_v5.4.1.11945.exe</a>. This software integrates avira scanning engine and have application control funciton. 
Regards.

Wesly.Zhang

Hello,
2345 Safe Center is not a independently installed program. It is inherited in 2345 safe guard program installation file. 2345 compared to Qihoo 360,——This brand is not well known in China , it can be said that it is very small. And this brand has been used for malicious promotion and bundled installation, which can be said to be notorious. I don't like this brand indeed.
The file you provided only has been detected by Microsoft as "PUA:Win32/2345Cn". I installed 2345 safe guard with KIS 2020. Now there is no problem has been found, Only a few popup window related to it push to display in the right corner. If I found somethings go wrong, I will reply here.
Regards.

xzz123

I agree with <a href="/user/wesly-zhang" target="_blank" rel="noopener" data-username="Wesly.Zhang" data-uid="34">Wesly.Zhang</a>

harlan4096

The link to download it is very slow here, not more than 12kbytes/seg... but stable downloading at 6 Kb/seg <img src="/plugins/nodebb-plugin-composer-kl/vendor/tinymce/plugins/emoticons/img/smiley-undecided.gif" alt="undecided" />

Meanwhile, is it a real-time tool? then should be incompatible with Kaspersky or tagged as it?

Wesly.Zhang

@harlan4096 said in <a href="/post/7794" target="_blank" rel="noopener">Need some help with 2345SafeCenter</a>:
<blockquote>
The link to download it is very slow here, not more than 12kbytes/seg... but stable downloading at 6 Kb/seg <img src="/plugins/nodebb-plugin-composer-kl/vendor/tinymce/plugins/emoticons/img/smiley-undecided.gif" alt="undecided" />

Meanwhile, is it a real-time tool? then should be incompatible with Kaspersky or tagged as it?
</blockquote>
Hello,

Let me share to you: <a href="https://cloud.qainfo.ru/s/NYwxIlz5ltc4xLT" target="_blank" rel="noopener">https://cloud.qainfo.ru/s/NYwxIlz5ltc4xLT</a>

This program doesn't have english or other languages GUI. I don't know this will lead to some problem or not when you install and operate it.

<blockquote>
 QA: Is it a real-time tool？
Yes. It is. It could do some other things such as fix and install OS patch, System and registry junk file cleanup, etc.
QA：should be incompatible with Kaspersky or tagged as it?
My idea is that it is better to be compatible, this is a situation that everyone will happy. If there is a problem to see if it can be resolved through communication, it is really impossible from technology side and there is no way. Let it go~
</blockquote>

harlan4096

Thanks! 我的中文不是很好 <img src="/plugins/nodebb-plugin-composer-kl/vendor/tinymce/plugins/emoticons/img/smiley-wink.gif" alt="wink" />

huang1111

@harlan4096 said in <a href="/post/7796" target="_blank" rel="noopener">Need some help with 2345SafeCenter</a>:
<blockquote>
Thanks! 我的中文不是很好 <img src="/plugins/nodebb-plugin-composer-kl/vendor/tinymce/plugins/emoticons/img/smiley-wink.gif" alt="wink" />
</blockquote>
If you cannot recognize the text in the GUI of this application, I do not recommend you to install this application. When installing this application, the installation package will automatically replace the browser's startup page with the URL navigation produced by the company 2345.com. After installation, the application will also push advertisements. When uninstalling the application, it will install a lot of other software by default, so this security software does not occupy a large market in China.

harlan4096

Ok, thanks... it seems more a PUP/PUA/Adware tool then... <img src="/plugins/nodebb-plugin-composer-kl/vendor/tinymce/plugins/emoticons/img/smiley-undecided.gif" alt="undecided" />

Wesly.Zhang

There are two news published by huorong which is famous IT & Anti-virus company in china :

<a href="http://www.huorong.cn/info/151212805083.html" target="_blank" rel="noopener">http://www.huorong.cn/info/151212805083.html</a>
<a href="https://www.huorong.cn/info/1554067875200.html" target="_blank" rel="noopener">https://www.huorong.cn/info/1554067875200.html</a>

These two news & malicous software analysis articles are very instersting.

harlan4096

Thanks!

huang1111

Hello, according to the tests of these days, Kaspersky does not seem to have any incompatibility issues with the 2345 Security Center application. They have not shown any obvious conflicts on one computer. However, at the same time, it is also regrettable that Kaspersky did not identify and block the pop-up advertisement module of the application.

Wesly.Zhang

@huang1111 said in <a href="/post/7812" target="_blank" rel="noopener">Need some help with 2345SafeCenter</a>:
<blockquote>
Hello, according to the tests of these days, Kaspersky does not seem to have any incompatibility issues with the 2345 Security Center application. They have not shown any obvious conflicts on one computer. However, at the same time, it is also regrettable that Kaspersky did not identify and block the pop-up advertisement module of the application.
</blockquote>
Hello, huang1111

The same to me here. Do you try to run a malware in a controlled enviroment such as vmware to see whether KL product and 2345 application also report "found a malware" and process it without any problem at the same time or not. On my side, it seem that 2345 process malware speed is higher than KL product. It is not a problem, I think. But I take care their PDM model behavior: If I allow some malicous actions in 2345 proactive defense model ( 应用入口防护/Application Defense, 系统底层防护/System protection ), KL product could be blocked or detect it and countinue to handle it, which is the best important things, I think. Do you also test this way?

Regards.

huang1111

@wesly-zhang said in <a href="/post/7813" target="_blank" rel="noopener">Need some help with 2345SafeCenter</a>:
<blockquote>
@huang1111 said in <a href="/post/7812" target="_blank" rel="noopener">Need some help with 2345SafeCenter</a>:
<blockquote>
Hello, according to the tests of these days, Kaspersky does not seem to have any incompatibility issues with the 2345 Security Center application. They have not shown any obvious conflicts on one computer. However, at the same time, it is also regrettable that Kaspersky did not identify and block the pop-up advertisement module of the application.
</blockquote>
Hello, huang1111

The same to me here. Do you try to run a malware in a controlled enviroment such as vmware to see whether KL product and 2345 application also report "found a malware" and process it without any problem at the same time or not. On my side, it seem that 2345 process malware speed is higher than KL product. It is not a problem, I think. But I take care their PDM model behavior: If I allow some malicous actions in 2345 proactive defense model ( 应用入口防护/Application Defense, 系统底层防护/System protection ), KL product could be blocked or detect it and countinue to handle it, which is the best important things, I think. Do you also test this way?

Regards.
</blockquote>
Hello, this is no longer in the scope of our compatibility testing. There are two anti-virus software installed on one computer. Such a system environment is not normal, so we do not need to pay special attention to this very special problem. In addition, I cannot find virus samples to test this situation, because in most cases Kaspersky can scan more viruses than 2345 Security Center, which makes this type of testing very difficult.

Dmitriy.Pisarets

thank you for your help!

Dmitriy.Pisarets

Can also say, do other antivirus consider 2345 as malware or adware ?

Wesly.Zhang

@dmitriy-pisarets said in <a href="/post/7837" target="_blank" rel="noopener">Need some help with 2345SafeCenter</a>:
<blockquote>
Can also say, do other antivirus consider 2345 as malware or adware ?
</blockquote>
I think Adware is more relevant. For this program, it has not reached the level of malicious programs. <img src="/plugins/nodebb-plugin-composer-kl/vendor/tinymce/plugins/emoticons/img/smiley-undecided.gif" alt="undecided" />
You can ask your chinese colleagues about the evaluation of 2345 company.

Kaspersky EAP

Need some help with 2345SafeCenter