Cybersecurity: How Do You Know If Your Antivirus is Working (without actual Malware)?

Antivirus is a lot like having insurance... you have it, but hope you never have to use it. 

What if I tell you that you can test your antivirus on your PC, without downloading any malware, by simply typing something on your keyboard? If it reacts, the antivirus is working. If it didn't... your antivirus' real-time scan is not working. 

This only works on Windows, by the way. 

Open a powershell window. (If you don't know what is Powershell, please read this from Microsoft. It's already in your system.  https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/powershell )

What you will type or copy is just a string, a bunch of characters. It is NOT a script or malware. It is offered by Microsoft as a way to test their own AMSI (Microsoft Antimalware Scan Interface)

Enter this at the prompt:  ‘AMSI Test Sample: 7e72c3ce-861b-4339-8740-0ac1484c1386’ 

Note, please replace the fancy quotes with single quotes to get this to work properly. Yes, the single quotes are important. 

Microsoft Security should trigger as you press enter. Depending on whether you have any clipboard management software, it may react as soon as you try to copy the string onto the clipboard. 

Now you know whether your antivirus is active or not. 

There are, of course, other ways to test this. For this method (all credits goes to Black Hills Info Sec) and other ways, go read BHIS's blogpost: https://www.blackhillsinfosec.com/is-this-thing-on/

PSA: Uninstall "The Great Suspender" immediately (should be already done)

The Great Suspender was a good extension as it "suspends" the tabs you don't use so Chrome doesn't eat up so much memory. But recently, a different maintainer took over the app, and some changes appear to be not so innocent. When several places classified the item as malware or potential malware, you should uninstall it immediately. And indeed, my own version was automatically uninstalled by the Chrome store. 

And this is actually a common pattern: a free utility changes hands, and suddenly some sort of trackers or potentially malware got added to the app. Another way is to release a utility that sounds VERY similar to an existing popular one. Chrome, having over 60% of all browser market share, is the most popular target of hacks. And being a trusted app, if it can be compromised from within, it can be VERY dangerous, as it also saves your passwords, and tracks basically EVERYTHING you do. 

What can a rogue extension do? Rogue extensions have been found to:

• bank hack -- steal login info if you log into a certain bank
• Phishing specific app logins via browser, such as Whatsapp
• impersonate popular extensions such as AdBlock Plus
• mine Bitcoin -- Coinhive was dubbed the first cryptojacking extension, using your PC to mine Bitcoins for someone else
• and much more

So beware of browser extensions you download. Only download from Chrome store if you can (which will remove the bad ones for you, even if by remote). 

For now, I have downloaded a replacement of Great Suspender which supposedly is without the controversial appendages. But as a separate download, it's not an approved extension, so I will likely have to replace that with one from the Chrome store soon.