Best Behaviour Blocker?

[low L!fe]

1- Norton
2-BitDefender
3-Kaspersky
4-AVIRA
5-ESET

 

[IceLion36]

Comodo's HIPS is not a behaviour blocker?

 

[509322]

Comodo's HIPS is not a behaviour blocker?

No. HIPS is not a behavior blocker. The Viruscope module is the closest thing to a behavior blocker. It uses malicious action detection algorithms. It is similar to Kaspersky's System Watcher.

 

[Deleted Member 3a5v73x]

The Antiransomware module is a bit odd. Most typical users will look at the alerts and logging and scratch their head. G DATA is a techie security soft.

Some of the Locky variants with (.lukitus) extension also leave me scratching my head, because AntiRansomware module detects most variants, stating that ".. following proccess were therefore interrupted by G DATA.." however it wasn't (or it was too late after clicking "Block", because encryption proccess weren't "frozen" when dialog box came up, and still kept going in background). Anyway, log files were collected and sent so I hope they come up with some improvements in next updates.

 

[Peter2150]

And here in lies the problem in even asking this kind of questions. Multiple opens of different folks which leaves the equestion still unanswered. The answer is you have to evaluate and make your own decision.

 

[Deleted member 178]

I always saw Emsisoft' BB as one of the best in term of efficiency/simplicity, i know it since ages (when it was called mamutu) and i was never disappointed by it.

 

[Plebman123]

I can name a few G Data, Emsisoft, Kaspersky and AVG, but id recommend Emsisoft since it offers the most specific settings and is an internal part of their program

 

[plat1098]

And here in lies the problem in even asking this kind of questions. Multiple opens of different folks which leaves the equestion still unanswered. The answer is you have to evaluate and make your own decision.

This is the fundamental truth--one might be influenced by loyalty, subscription cost or customer service, variables that have nothing to do with a specific feature. It's not possible to be strictly objective when it comes to behavior blockers because of user interaction in real time, plus infinite machine/software combinations, etc.

Which leaves these AVs heavily dependent on marketing and word of mouth, both crucial for survival. And polls like this.

 

[Rengar]

I always saw Emsisoft' BB as one of the best in term of efficiency/simplicity, i know it since ages (when it was called mamutu) and i was never disappointed by it.

Very true.

 

[frogboy]

I do quite enjoy the user interaction with Emsisoft it stops the boredom.

 

[RoboMan]

Some of the Locky variants with (.lukitus) extension also leave me scratching my head, because AntiRansomware module detects most variants, stating that ".. following proccess were therefore interrupted by G DATA.." however it wasn't (or it was too late after clicking "Block", because encryption proccess weren't "frozen" when dialog box came up, and still kept going in background). Anyway, log files were collected and sent so I hope they come up with some improvements in next updates.
View attachment 165499
View attachment 165500

In the same log, GDATA stated that processes were stopped and malware was deleted. Suspicious activity that triggered the detection was the rename of picture filles. Aka the behaviour blocker triggered the anti ransomware module when it was too late. It probably stopped the encryption at some time, too late. Another proof of this is that GData mentions the block of wscript.exe but the payload was already downloaded since it blocked it from the AppData folder.

 

[nsm0220]

In the same log, GDATA stated that processes were stopped and malware was deleted. Suspicious activity that triggered the detection was the rename of picture filles. Aka the behaviour blocker triggered the anti ransomware module when it was too late. It probably stopped the encryption at some time, too late. Another proof of this is that GData mentions the block of wscript.exe but the payload was already downloaded since it blocked it from the AppData folder.

I saw that happening with malware i been testing from the hub.

 

[amico81]

so Gdata should more improve their bb? no recommendation?

 

[nsm0220]

so Gdata should more improve their bb? no recommendation?

Of course they should, but im seeing the improvements already.

 

[legendcampos]

Kaspersky > Norton > Emsisoft > Bitdefender...

 

[amico81]

Of course they should, but im seeing the improvements already.

OK thx. I have installed a trial version. Runs fine until now