App Review F-Secure SAFE 18.2

[Anthony Qian]

Thanks to the three-year giveaway, I have been testing F-Secure SAFE 18.2 over the last few days.

Compared with my previous experience with F-Secure, I see significant improvements in terms of DeepGuard and F-Secure Security Cloud.

DeepGuard, an effective behavior blocker, successfully blocked the so-called Coffee Ransomware, which Comodo, Kaspersky's SW, HitmanPro Alert, ESET, Bitdefender's ATD, and Symantec's SONAR failed to block when the threat was not yet added to their Virus Database, indicating that DeepGuard is better than other well-known BBs in some cases. However, DeepGuard is not perfect. It was unable to block the Remcos malware and some PowerShell script malwares in my testing. In addition, I hope DeepGuard will be able to roll back any changes made by malware in the future.

F-Secure Security Cloud, F-Secure's equivalent of Kaspersky's KSN and ESET's LiveGrid, has done a very good job at detecting new malwares that Avira engine failed to detect. Its detection rate has improved. However, unlike KSN and LiveGrid, we cannot check the files' reputations in F-Secure Security Cloud.

The biggest shortcoming of F-Secure is its VERY SLOW response to users' sample submissions. In my experience, F-Secure's analyst replied my submission after five days, saying the files I submitted were malicious and had been blocked by F-Secure Security Cloud for immediate protection (???). But, as the C&C server is down, this sample actually does no harm when it was blocked by F-Secure Security Cloud .

 

[Mjolnir]

Just curious...when Comodo failed the Coffee Ransomware test was it running at default settings or with Cruelsister's set up?

 

[ForgottenSeer 67480]

Last times he's using so much RAM on my PC, but I don't have any problems with him. DeepGuard does fantastic job by blocking new threats early.

 

[Anthony Qian]

Just curious...when Comodo failed the Coffee Ransomware test was it running at default settings or with Cruelsister's set up?

Default settings.

 

[kyros]

Do FS and Comodo work well together, or is it better to keep Windows firewall? And what about security? Windows or Comodo Firewall? Or maybe wisevector?

 

[BigWrench]

Do FS and Comodo work well together, or is it better to keep Windows firewall? And what about security? Windows or Comodo Firewall? Or maybe wisevector?

They work absolutely perfect together. (install F Secure first, and remember to disable, or uninstall the AV part of Comodo)

 

[kyros]

They work absolutely perfect together. (install F Secure first, and remember to disable, or uninstall the AV part of Comodo)

I thought you mean Comodo free

 

[BigWrench]

I thought you mean Comodo free

Free is bundled. Firewall has no separate downloader, that I have found. (If somebody has a FIREWALL ONLY download, PLEASE SHARE)

 

[Anthony Qian]

Do FS and Comodo work well together, or is it better to keep Windows firewall? And what about security? Windows or Comodo Firewall? Or maybe wisevector?

I have tried to install F-Secure and Comodo firewall with HIPS disabled. I did not notice any problems. However I recommend using Symantec Endpoint Protection (only firewall component) along with F-Secure. SEP has fantastic IPS function.

 

[Shadowra]

Do FS and Comodo work well together, or is it better to keep Windows firewall? And what about security? Windows or Comodo Firewall? Or maybe wisevector?

They work well together, but I find that the Windows firewall is more than enough.
I remind you that F-Secure modifies the Windows firewall by adding rules to it.

And if security is important, you have the tool of @Andy Ful which allows to reinforce even more

 

[BigWrench]

They work well together, but I find that the Windows firewall is more than enough.
I remind you that F-Secure modifies the Windows firewall by adding rules to it.

And if security is important, you have the tool of @Andy Ful which allows to reinforce even more

Forgot about that. You’re absolutely correct!

 

[superleeds27]

Can you expand on why you give it three stars for surf protection or the con for Limited web protection at all?

 

[Anthony Qian]

Can you expand on why you give it three stars for surf protection or the con for Limited web protection at all?

F-Secure blocks phishing and harmful websites with its browser plug-in. However, in my testing, F-Secure was unable to block as many harmful websites as McAfee WebAdvisor. Because some phishing sites are difficult to detect, failing to block them isn't a big deal. What disappoints me about F-Secure's surf protection is that even after I submitted the URLs for analysis, it was unable to block those sites until they were down. In contrast, McAfee WebAdvisor responds to my URL submission within one hour, and Norton SafeWeb responds immediately if its automatic system is able to classify.

 

[superleeds27]

F-Secure blocks phishing and harmful websites with its browser plug-in. However, in my testing, F-Secure was unable to block as many harmful websites as McAfee WebAdvisor. Because some phishing sites are difficult to detect, failing to block them isn't a big deal. What disappoints me about F-Secure's surf protection is that even after I submitted the URLs for analysis, it was unable to block those sites until they were down. In contrast, McAfee WebAdvisor responds to my URL submission within one hour, and Norton SafeWeb responds immediately if its automatic system is able to classify.

Might be worth mentioning it on their forum/community.

They seem quite active on there!

 

[Virtuoso]

F-Secure blocks phishing and harmful websites with its browser plug-in. However, in my testing, F-Secure was unable to block as many harmful websites as McAfee WebAdvisor. Because some phishing sites are difficult to detect, failing to block them isn't a big deal. What disappoints me about F-Secure's surf protection is that even after I submitted the URLs for analysis, it was unable to block those sites until they were down. In contrast, McAfee WebAdvisor responds to my URL submission within one hour, and Norton SafeWeb responds immediately if its automatic system is able to classify.

Can this be mitigated by using Bitdefender traffic light or Emsisoft Browser Security extension instead of F-secure extension?

 

[Anthony Qian]

Can this be mitigated by using Bitdefender traffic light or Emsisoft Browser Security extension instead of F-secure extension?

I think TrendMicro extension is a good choice. Or, you can use McAfee or Norton extensions - they are free.

 

[show-Zi]

Might be worth mentioning it on their forum/community.

They seem quite active on there!

I think F-Secure's official community is amazing. Staff or knowledgeable users will respond to your feedback.

 

[Anthony Qian]

I think F-Secure's official community is amazing. Staff or knowledgeable users will respond to your feedback.

If so, F-Secure should remove the Submit A Sample site, and ask submitter to send their samples through official community, just like Malwarebytes.

 

[MacDefender]

Very well written and I agree with your feedback. DeepGuard is probably the most interesting part of F-Secure and it's one of the most effective BB's out there. I agree that all of its engines have a bit of a weak spot against script based malware, and DeepGuard in particular is very weak if you exploit something they overzealously whitelisted. (For example the last time I tested, various things like 7Zip, MATLAB, official and portable Python, and Node.JS / Chromium V8 are all completely whitelisted. You can easily build ransomware or even run stock malware with those, and DeepGuard won't say a thing unless your malware is stupid enough to download a secondary payload that gets flagged). On the other end of the spectrum, DeepGuard can have a lot of false alarms with certain software. In another thread, we analyzed that for something like Rufus which tries to disable USB drive autorun dialogs via GPO, if you change the hash of the app at all, DeepGuard thinks that it's a GPO trojan.

They don't seem to focus on either proper cleanup or rollback. A lot of partial hits result in DeepGuard repeatedly flagging an AutoRun on every boot. KSW and other BB's combine almost as strong performance with a pretty elaborate rollback mechanism.

Overall though it's still one of my favorite lightweight AVs. It's small, unintrusive, and tastefully uses a lot of native Windows features like notifications without bothering you all the time. It's probably my favorite drop in replacement for Windows Defender for those who just want an AV that gets out of their way.

 

[show-Zi]

If so, F-Secure should remove the Submit A Sample site, and ask submitter to send their samples through official community, just like Malwarebytes.

I evaluated them in the sense that they are proactive in responding to users.

As for the fact that it takes longer time than other vendors to determine and reflect suspicious files, I suspect that the support desk and the technical department are not well coordinated.

False positive with PrivaZer

Hello, here is the PrivaZer Team. You have a false positive with our new release of PrivaZer. See below. Please fix it. OK ?

community.f-secure.com