Battle Behavioral Blockers: SONAR vs DeepGuard vs System Watcher

[notabot]

What the title says, I'm interested only in the Behavioural Blocking component, not the other components of suites which include the said BB components.

Are there any tests on behavioral blockers?

Which BBs work well against scriptors/fileless?

 

[HarborFront]

@BVLon

How about the testing results so far with BBs can you post them here?

Thanks

 

[BVLon]

@BVLon Thank you very much for your detailed explanations and your efforts in testing different BBs. Maybe you can shed some light on G Data and Bullguard.

I recently tested BullGuard. Their BB is on par with Panda. It's OK, but not like wow and will certainly fail at some point. They also don't have the massive user-base like some othr companies...
I do not see any point why people should go for BullGuard (Bitdefender SDK) and not Bitdefender. I mean, I live in London and they are London-based if that can be a valid reason... UI and performance are awful tho. I would never use or recommend BullGuard.

I need to give GData a long run... I tested it briefly and it did OK... the UI however is ancient.... this is a huge put-off for me.... I will test it soon.
However GData is another Bitdefender-based solution and I don't see a reason why anyone should go for them and not for the highly-praised original. Unless you're a total Gaga over poorly-maintained German software...

 

[BVLon]

@HarborFront I will post them soon.

I am not aware who uses Emsisoft... It doesn't seem like a solution designed for a newbie... I would be very confused with all of the alerts.

 

[BVLon]

So, in the upcoming week I will test Norton, which is clearly my main solution + 5 others. List the solution that you would like to see tested. Most mentioned ones will be put to a check.

BullGuard and GData are already on the list, as they are all kinda questionable. Emsisoft was tested last night and it blocked 12/12. Since it clearly blocks everything with questionable reputation it was pointless to continue the test. Nothing will get through it, it's more likely to produce a false positive than false negative. That leaves 3 slots for you to choose what you wanna see.

 

[ForgottenSeer 823865]

I am not aware who uses Emsisoft... It doesn't seem like a solution designed for a newbie... I would be very confused with all of the alerts.

when i was their community manager , i didn't see much complaints about the BB alerts , most were "Why did you remove the firewall !!!" lol

 

[Divine_Barakah]

I do not see any point why people should go for BullGuard (Bitdefender SDK) and not Bitdefender

Bullguard has little issues and is less buggy that Bitdefender. I know that Bitdefender is decent but you're lucky it it runs on your system without issues. I would not use Bitdefender even given the fact it is offered by my ISP.

 

[BVLon]

Bullguard has little issues and is less buggy that Bitdefender. I know that Bitdefender is decent but you're lucky it it runs on your system without issues. I would not use Bitdefender even given the fact it is offered by my ISP.

It's got less issues, due to the fact that in the last 5 years, they've implemented 50 lines of code in total

 

[oldschool]

I would not use Bitdefender even given the fact it is offered by my ISP.

I'd use it for the cool logo alone!

 

[BVLon]

I'd use it for the cool logo alone!

The Dacian dragon wolf? A.k.a Dacian Draco?
I went to their re-branding back in 2011 or 2012, don't remember the exact year

 

[SeriousHoax]

I can't stand Bitdefender mainly for one reason, that is: After detecting and removing a malware you won't be able to see hidden files of your PC till you restart the system. The show hidden file toggle doesn't work and Bitdefender has no intention to fix this. This is almost a 10 years old issue.

 

[BVLon]

I can't stand Bitdefender mainly for one reason, that is: After detecting and removing a malware you won't be able to see hidden files of your PC till you restart the system. The show hidden file toggle doesn't work and Bitdefender has no intention to fix this. This is almost a 10 years old issue.

Yeah, I remember this issue in BD 2010. I won’t use them also because they don’t provide proper information about what what exactly it has deleted. Norton tells me all files, folders, registry keys and settings that it had to delete/change. Bitdefender tells me nothing and as analyst it gets difficult for me to measure its performance accurately. I have to go in all folders and through the whole registry...

 

[SeriousHoax]

Yeah, I remember this issue in BD 2010. I won’t use them also because it doesn’t give proper information about what what exactly it has deleted. Norton tells me all files, folders, registry keys and settings that it had to delete/change. Bitdefender tells me nothing and as analyst it gets difficult for me to measure its performance accurately. I have to go in all folders and through the whole registry...

I like this about Norton too. It shows almost everything it has deleted. I don't remember any other AV that does this.
Btw, just remembered a regular user of our forum and malware tester told me last year that Norton still can't deal with those classic USB autorun malwares and his/his friend's PC also got infected because of this. Do you have any idea about this?

 

[BVLon]

I like this about Norton too. It shows almost everything it has deleted. I don't remember any other AV that does this.
Btw, just remembered a regular user of our forum and malware tester told me last year that Norton still can't deal with those classic USB autorun malwares and his/his friend's PC also got infected because of this. Do you have any idea about this?

I have downloaded quite a lot of autorun malware for the 13 years that I have used Norton and it has always coped with that. What exactly is the issue?
AVG used to display everything it has deleted, but after Avast acquired them, that was terminated.

 

[SeriousHoax]

I have downloaded quite a lot of autorun malware for the 13 years that I have used Norton and it has always coped with that. What exactly is the issue?
AVG used to display everything it has deleted, but after Avast acquired them, that was terminated.

Oh I don't remember much about AVG anymore. I liked it and their signature names were kind of different from others if I remember correctly. Anyway about Norton, I forgot about the exact issue. I'll ask him if I get a chance.

 

[BVLon]

Oh I don't remember much about AVG anymore. I liked it and their signature names were kind of different from others if I remember correctly. Anyway about Norton, I forgot about the exact issue. I'll ask him if I get a chance.

is autorun malware still a thing lol

 

[SeriousHoax]

is autorun malware still a thing lol

Around here you would still often see this in noob's USB drives

 

[ForgottenSeer 823865]

is autorun malware still a thing lol

put a USB on the street visible to all, i guarantee you , someone will plug it on his computer.
This is how we infect computers LOL

 

[Evjl's Rain]

is autorun malware still a thing lol

for unknown reasons, norton can't detect USB malwares despite having signatures.
when we perform a manual context scan or copy the malwares to anywhere else in the computer, norton will detect them
that's a bug which has been present since 2013 version when I first noticed it because it made my desktop infected by an ancient virus. Autorun was disabled
some users confirm this bug on the latest versions. Not sure if it's still present now

regardless how good other components are, I never consider norton a good AV. There are many hidden bugs that can affect real-time protection although they sound good and perform well in paper and in tests. Symantec AV is much more reliable

 

[BVLon]

for unknown reasons, norton can't detect USB malwares despite having signatures.
when we perform a manual context scan or copy the malwares to anywhere else in the computer, norton will detect them
that's a bug which has been present since 2013 version when I first noticed it because it made my desktop infected by an ancient virus. Autorun was disabled
some users confirm this bug on the latest versions. Not sure if it's still present now

regardless how good other components are, I never consider norton a good AV. There are many hidden bugs that can affect real-time protection although they sound good and perform well in paper and in tests. Symantec AV is much more reliable

That’s an interesting claim. I haven’t seen autorun malware for quite some time, leave alone get my usb devices infected. I gotta test that.

 

[BVLon]

SONAR will be put to a test tomorrow.

Q&A - Norton BASH: How it works, questions, weekly testing

Dear all, This thread is all about Norton BASH (Behavioural and Security Heuristics). It is not to compare Norton with others and it is not to comment on other Norton features. I will also be testing BASH against 0-day malware every week at least once and posting the results here. Expect the...

malwaretips.com

This is the link to the methodology, in case anyone is interested.