Reply to thread

Message

<blockquote data-quote="MacDefender" data-source="post: 844111" data-attributes="member: 83059">I will try that next. I wrote another relocate-and-add-to-startup variant and Emsi and F-Secure both block it. So far those two are tied in my testing. Norton actually isn&#039;t doing a great job at behavior blocking. SONAR sometimes flags these binaries when delivered via a web browser (simply as low reputation under Aggressive) and deleting user documents triggers it, but the other sketchy behavior like downloading+executing a secondary payload or moving itself to a randomly generated temp file name and then registering as startup item is less likely to trigger Norton.EDIT: Honestly I&#039;m okay with ESET&#039;s response. They have their reasons of not making a general behavior blocker. Just customers need to understand that despite their advertising about &quot;deep behavior&quot; blocking and HIPS being automatic, in reality those components don&#039;t really react to zero days quite the same way that other BB&#039;s do.</blockquote>

[QUOTE="MacDefender, post: 844111, member: 83059"] I will try that next. I wrote another relocate-and-add-to-startup variant and Emsi and F-Secure both block it. So far those two are tied in my testing. Norton actually isn't doing a great job at behavior blocking. SONAR sometimes flags these binaries when delivered via a web browser (simply as low reputation under Aggressive) and deleting user documents triggers it, but the other sketchy behavior like downloading+executing a secondary payload or moving itself to a randomly generated temp file name and then registering as startup item is less likely to trigger Norton. EDIT: Honestly I'm okay with ESET's response. They have their reasons of not making a general behavior blocker. Just customers need to understand that despite their advertising about "deep behavior" blocking and HIPS being automatic, in reality those components don't really react to zero days quite the same way that other BB's do. [/QUOTE]

Verification