- Dec 23, 2014
- 8,591
But for people like me, Antiviruses is only needed to fight against zero-day exploits.
You can conclude nothing in general from the test with one sample. If you did, then your conclusion would be irrational even if true. When thinking rationally, such a video can only be an example of something confirmed in another way.
Currently, most AVs use behavior-based detections. So, the AV vendors consider such detections important. The main purpose of using behavior-based detections are morphed samples. It means that the malware used in the video will not become prevalent by using 1000 morphed copies. Most of them will be detected, even if a few initial samples could bypass AVs. This is also a clear difference compared to old-fashioned AVs.
If you need protection against 0-day exploits, then you should install an AV with a good anti-exploit module and minimize the attack surface (Standard User Account, fresh updates, system/software hardening, applications running in AppContainer, etc.). The standard behavior modules are not so efficient and often focus on the post-exploitation phase. If you do not like 3rd party AVs, you can apply Windows built-in anti-exploit and application control features.
Last edited: