Reply to thread

Message

<blockquote data-quote="MacDefender" data-source="post: 861373" data-attributes="member: 83059">Yes! This is spot on and better than how I said it. When I say &quot;signatures&quot; in the context of ESET I really mean static scanning analysis. Unlike how most signature engines tend to work, the ESET one seems to be extremely good at identifying variants of existing malware without being prone to false positives.A lot of other AV engines have some sort of machine learning component and so does ESET with the ML/ detections. . Symantec&#039;s &quot;AdvML&quot; detections seem to trigger on new malware once in a while too. But ESET&#039;s standout feature is how often its &quot;Variant of XXXXXX&quot; detections are spot on and match the names that other AV engines eventually assign to the malware.When I first heard about this I suspected they would have a lot of false positives but that&#039;s not true at all. In fact a lot of other engines that don&#039;t do a good job in the real world of statically identifying new malware variants actually have more false positives to harmless things. I&#039;ve seen a few cases where unpacking or repacking a VMWare piracy tool would generate &quot;VM detection&quot; heuristic detections simply because the crack contains snippets of the VMWare binary. I&#039;ve yet to see ESET tricked by situations like this.And yes you are definitely right it&#039;s not fair to turn off ESET&#039;S protection layers. A lot of folks (myself) are tempted because we don&#039;t like SSL inspection or we have seen performance degradation due to this kind of network stack protocol filter, but while other AVs tend to carry a dynamic behavior blocker as a last line of defense, the same doesn&#039;t hold for ESET and it might be a really bad idea and a more significant loss of protection with ESET.</blockquote>

[QUOTE="MacDefender, post: 861373, member: 83059"] Yes! This is spot on and better than how I said it. When I say "signatures" in the context of ESET I really mean static scanning analysis. Unlike how most signature engines tend to work, the ESET one seems to be extremely good at identifying variants of existing malware without being prone to false positives. A lot of other AV engines have some sort of machine learning component and so does ESET with the ML/ detections. . Symantec's "AdvML" detections seem to trigger on new malware once in a while too. But ESET's standout feature is how often its "Variant of XXXXXX" detections are spot on and match the names that other AV engines eventually assign to the malware. When I first heard about this I suspected they would have a lot of false positives but that's not true at all. In fact a lot of other engines that don't do a good job in the real world of statically identifying new malware variants actually have more false positives to harmless things. I've seen a few cases where unpacking or repacking a VMWare piracy tool would generate "VM detection" heuristic detections simply because the crack contains snippets of the VMWare binary. I've yet to see ESET tricked by situations like this. And yes you are definitely right it's not fair to turn off ESET'S protection layers. A lot of folks (myself) are tempted because we don't like SSL inspection or we have seen performance degradation due to this kind of network stack protocol filter, but while other AVs tend to carry a dynamic behavior blocker as a last line of defense, the same doesn't hold for ESET and it might be a really bad idea and a more significant loss of protection with ESET. [/QUOTE]

Verification