Reply to thread

Message

<blockquote data-quote="Der.Reisende" data-source="post: 539904" data-attributes="member: 32430">The reason for EIS real-Time doing nothing on those script files is the limited preset of file extensions to be monitored in real-time. If you add further extensions (like .wsf) manually, it should flag / remove them automatically. You can also simply untick the box next to &quot;monitor only certain extensions&quot;, which might lead more RAM usage, or to some FP, in the worst case.[SPOILER=&quot;Emsisoft Stock Settings&quot;][ATTACH]114273[/ATTACH] [ATTACH]114274[/ATTACH] [ATTACH]114275[/ATTACH] [/SPOILER]Not wanting to act like a smarta**, but regarding those scripts doing nothing on the first glance, I&#039;d suggest mrizos should use at least SysInternals ProcessExplorer to spot malicious processes (turn on VT detections there manually), as malware more and more tries to sleep for some minutes before rolling out it&#039;s actions (and make EIS HIPS intercept it in most cases). However, me speaking of ShadowDefender protected environment, the VM-awareness mentioned by [USER=39208]@_CyberGhosT_[/USER] is still to be considered.Back to topic, this is a great share, thank you for that [USER=18831]@Terry Ganzi[/USER]!</blockquote>

[QUOTE="Der.Reisende, post: 539904, member: 32430"] The reason for EIS real-Time doing nothing on those script files is the limited preset of file extensions to be monitored in real-time. If you add further extensions (like .wsf) manually, it should flag / remove them automatically. You can also simply untick the box next to "monitor only certain extensions", which might lead more RAM usage, or to some FP, in the worst case. [SPOILER="Emsisoft Stock Settings"][ATTACH]114273[/ATTACH] [ATTACH]114274[/ATTACH] [ATTACH]114275[/ATTACH] [/SPOILER] Not wanting to act like a smarta**, but regarding those scripts doing nothing on the first glance, I'd suggest [I]mrizos[/I] should use at least SysInternals ProcessExplorer to spot malicious processes (turn on VT detections there manually), as malware more and more tries to sleep for some minutes before rolling out it's actions (and make EIS HIPS intercept it in most cases). However, me speaking of ShadowDefender protected environment, the VM-awareness mentioned by [USER=39208]@_CyberGhosT_[/USER] is still to be considered. Back to topic, this is a great share, thank you for that [USER=18831]@Terry Ganzi[/USER]! [/QUOTE]

Verification