Reply to thread

Message

<blockquote data-quote="Wave" data-source="post: 582573">Well that would be the logical thought but I&#039;m afraid to say more common than not, the user will just allow... Because they think they know better, then they complain about getting infected.In fact, sometimes the user becomes really social engineered and may even disable their AV... You know those downloads that tell them that since it&#039;s a &quot;hack tool&quot; the AV will detect and how it&#039;s an &quot;FP&quot;, etc... E.g. Bob wants to download a keygen but the AV blocks it since it&#039;s really a backdoor, so Bob allows it and runs it anyway -&gt; infection.What you said is what happens for people like us, obviously we won&#039;t just allow, but for inexperienced people who don&#039;t know what they are doing, they probably won&#039;t listen at all most of the time and will then just complain about how the product didn&#039;t protect them. This is probably why a lot of AV products auto-block these days by default instead of ask the user which action it should carry out.</blockquote>

[QUOTE="Wave, post: 582573"] Well that would be the logical thought but I'm afraid to say more common than not, the user will just allow... Because they think they know better, then they complain about getting infected. In fact, sometimes the user becomes really social engineered and may even disable their AV... You know those downloads that tell them that since it's a "hack tool" the AV will detect and how it's an "FP", etc... E.g. Bob wants to download a keygen but the AV blocks it since it's really a backdoor, so Bob allows it and runs it anyway -> infection. What you said is what happens for people like us, obviously we won't just allow, but for inexperienced people who don't know what they are doing, they probably won't listen at all most of the time and will then just complain about how the product didn't protect them. This is probably why a lot of AV products auto-block these days by default instead of ask the user which action it should carry out. [/QUOTE]

Verification