Please tell me, how many are these other layers of protection?
That's similar than what I wrote before, I forgot about only Network-Protection.
I do agree with you. I've had several instances of ESET and Avast where a web page was blocked by the web filter but if I disabled the web filter, the downloaded file was executed, infecting the system. Tests are done to give the users a fair idea about the specific product but it never reflects the real world scenario.
I've said the same, simply introducing a large number of malware is not a realistic scenario, as it is rarely going to happen. Not completely impossible though.
That real world scenario won't happen as long as behavior blocking/monitoring modules by AV would be able to intercept/block the attack...
I always look at the detection rate first. In fact I look forward to it. I know I’m not the average joe, just a nerd. ESET generally gets a clean sheet. When it is infected it’s usually blocking like 16/17, and a scripted malware snuck in.
One sample remains to dynamic testing, that looks more like real world scenario, except web-protection/filtering still impossible to test.
Old ESET users are gonna rejoice!
<ITEM NAME="EKRN_CFG">
...
<NODE NAME="RequireElevation" TYPE="number" VALUE="0" />Yeah I do agree. Dynamic protection is just as equally important as static protection. But the same rule applies here as well. You cannot expect the BB to block 100% of all malwares (unless it's Lord Kaspersky)
Testing McAfee against this archive for example would be totally inaccurate, as Web Advisor uses aggressive heuristics and deletes everything that looks untrusted. McAfee doesn't want to employ the same tactic in the common scanning engine to avoid false positives, but their protection capability is still great. Web Advisor also uses 2 additional databases, not utilized by the scan engine. These are McAfee Gateway Intelligence, which detects untrusted files circulating via emails and Early Bird Database (EBD) where they send all files exhibiting signs of maliciousness, but not yet fully analysed. When I say McAfee is missing a lot of threats, I am talking about the AV module alone, as I have bypassed the Advisor's warnings myself. Their behavioural blocker alone is a hit and miss. Also I have noticed (and McAfee confirmed) if you re-download a program that it has already flagged and removed, it excludes it, which is not great.
Happened to me when I was testing SHP. The infected file was detected my Sophos ML. When I ran the same detected file from a USB drive, system was infected.
Perfect protection doesn’t exist and everyone is more or less on the same level nowadays... It all comes down to the little extras and the final touch of the product, rather than the protection level. Also, most of the people don’t need stelar protection.
