Reply to thread

Message

<blockquote data-quote="MacDefender" data-source="post: 920632" data-attributes="member: 83059">Thanks this matches my understanding and observations too. Their static heuristics and signature writing are as excellent as ever but so far my tests of behavior blocking shows no general behavior blocking. I expanded my tests to add persistence/evasion too (tries to move itself to the Windows directory under the name NvCpl.exe and register as a startup item in the registry), nothing. Usually this behavior triggers Kaspersky and Emsisoft and F-Secure.I strongly believe that ESET’s protection is top class especially against variants of in the wild malware. And I also believe that detecting via static scanning and web filtering is always more comforting than relying on the BB to make up for spotty signatures. But yeah based off their description of what changed I was hoping to see a behavior blocker, but that isn’t what I’m finding. My most optimistic theory is that their behavior blocker is just looking for very specific actions of malware families that they have trouble writing signatures for.</blockquote>

[QUOTE="MacDefender, post: 920632, member: 83059"] Thanks this matches my understanding and observations too. Their static heuristics and signature writing are as excellent as ever but so far my tests of behavior blocking shows no general behavior blocking. I expanded my tests to add persistence/evasion too (tries to move itself to the Windows directory under the name NvCpl.exe and register as a startup item in the registry), nothing. Usually this behavior triggers Kaspersky and Emsisoft and F-Secure. I strongly believe that ESET’s protection is top class especially against variants of in the wild malware. And I also believe that detecting via static scanning and web filtering is always more comforting than relying on the BB to make up for spotty signatures. But yeah based off their description of what changed I was hoping to see a behavior blocker, but that isn’t what I’m finding. My most optimistic theory is that their behavior blocker is just looking for very specific actions of malware families that they have trouble writing signatures for. [/QUOTE]

Verification