Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 1123849" data-attributes="member: 32260">I do not think Webroot can do better than in this test (without WHHLight):[URL unfurl=&quot;true&quot;]https://malwaretips.com/threads/webroot-secureanywhere-2024-with-whhlight-wihout-whhlight.132634/[/URL]Against evasive threats, Webroot needs additional protection (like WHHLight, CyberLock, etc.). The result could probably be OK, even when WHHLight was used without WDAC (only SimpleWindowsHardening restrictions for non-EXE threats).If Shadowra wants to make another test, it would be interesting to test EXE files separately. Unfortunately, the rollback feature can be triggered after some minutes. So, after the test, it would be necessary to wait an hour or more (depending on the number of executed samples) and restart the system before checking for possible infections.<img src="data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7" class="smilie smilie--sprite smilie--sprite111" alt=":(" title="Frown&nbsp; &nbsp; :(" loading="lazy" data-shortname=":(" />The &quot;wait-and-see approach&quot; of Webroot is hard to test when the samples are executed one after the other. Many samples are actually executed in the system and are allowed to make many suspicious changes. So, the samples executed later are more evasive as compared to the test when each sample is executed on a clean machine, like in AVLab and SE Labs tests. This issue is not so important to other AVs, which have much better malware signatures (local and in the cloud) and pre-execution detection.</blockquote>

[QUOTE="Andy Ful, post: 1123849, member: 32260"] I do not think Webroot can do better than in this test (without WHHLight): [URL unfurl="true"]https://malwaretips.com/threads/webroot-secureanywhere-2024-with-whhlight-wihout-whhlight.132634/[/URL] Against evasive threats, Webroot needs additional protection (like WHHLight, CyberLock, etc.). The result could probably be OK, even when WHHLight was used without WDAC (only SimpleWindowsHardening restrictions for non-EXE threats). If Shadowra wants to make another test, it would be interesting to test EXE files separately. Unfortunately, the rollback feature can be triggered after some minutes. So, after the test, it would be necessary to wait an hour or more (depending on the number of executed samples) and restart the system before checking for possible infections.:( The "wait-and-see approach" of Webroot is hard to test when the samples are executed one after the other. Many samples are actually executed in the system and are allowed to make many suspicious changes. So, the samples executed later are more evasive as compared to the test when each sample is executed on a clean machine, like in AVLab and SE Labs tests. This issue is not so important to other AVs, which have much better malware signatures (local and in the cloud) and pre-execution detection. [/QUOTE]

Verification