App Review ESET Behavior Test

[erreale]

I am very disappointed with Eset. I expected much more.

 

[razorfancy]

Hi, you should read the comments of Marcos from ESET in this thread:
Video Review - NOD32 10.0 HIPS Test (Catastrophic failure)

 

[Amelith Nargothrond]

Hi, you should read the comments of Marcos from ESET in this thread:
Video Review - NOD32 10.0 HIPS Test (Catastrophic failure)

That's irrelevant. The developer will say what he needs to say in order to defend its product. But if a module is dependent on another, this should be reflected in the product in certain cases. If the product allows you to disable (a) module(s), the other module(s) should react accordingly if dependent on the disabled modules, e.g. display a warning or let the user know somehow in the UI that the others are not working as expected anymore. How else would the user know about the consequences of his actions? He can't guess what's under the hood. It's common sense really, the tester did not tamper with critical NOD32 files, deleted NOD32 registry entries etc. All he did is to disable some modules from the UI, to test the others (exclusively).
It's a security product, not notepad++ with plugins, no matter how many KB articles, help files or forum posts you may have.

Some things need to be made "poor user judgement proof". This could be one case (?). You simply can't rely on users to do the things you think they should do, especially when you are a security product developer.

I think the test is valid because NOD32 failed to warn the user about crippled module(s) functionality (if this is the case), or failed to disable the crippled modules, and if something needs to be done, it needs to be done by ESET (again, if the disabled modules affect other modules). This is called product design or software architecture.

 

[XhenEd]

That's irrelevant. The developer will say what he needs to say in order to defend its product. But if a module is dependent on another, this should be reflected in the product in certain cases. If the product allows you to disable (a) module(s), the other module(s) should react accordingly if dependent on the disabled modules, e.g. display a warning or let the user know somehow in the UI that the others are not working as expected anymore. How else would the user know about the consequences of his actions? He can't guess what's under the hood. It's common sense really, the tester did not tamper with critical NOD32 files, deleted NOD32 registry entries etc. All he did is to disable some modules from the UI, to test the others (exclusively).
It's a security product, not notepad++ with plugins, no matter how many KB articles, help files or forum posts you may have.

Some things need to be made "poor user judgement proof". This could be one case (?). You simply can't rely on users to do the things you think they should do, especially when you are a security product developer.

I think the test is valid because NOD32 failed to warn the user about crippled module(s) functionality (if this is the case), or failed to disable the crippled modules, and if something needs to be done, it needs to be done by ESET (again, if the disabled modules affect other modules). This is called product design or software architecture.

According to here: Video Review - NOD32 10.0 HIPS Test (Catastrophic failure), Marcos already recognized that. But apparently they haven't implemented it (yet).

 

[Deleted Member 3a5v73x]

Result would have been different, if HIPS was set to "Learning Mode" for couple of days and then set to "Interactive Mode" after HIPS "trained" your system. Yes, in deffault settings Eset is rubbish, but I am testing Eset for some weeks now with tweaked settings and trained HIPS, Firewall set to "Interactive Mode", and I must say I am not able to infect the system with all precautions taken, HIPS is really good and informative. It's hard to test Eset, so I am not blaming you , because most settings are linked to each other, and it's almost not possible to test just particulary one protection module. Thanks for the test in advance @erreale

Marcos
First of all, real-time protection is fundamental for HIPS to receive information about operations that are performed at the file system level. Otherwise HIPS will not react to file-based operations that are performed either by legitimate applications or threats. Other HIPS-based modules, such as Advanced memory scanner (heuristic detection of malware running in memory), Exploit Blocker and Ransomware protection will not work either or will be substantially limited in terms of functionality and effectiveness.

 

[Amelith Nargothrond]

According to here: Video Review - NOD32 10.0 HIPS Test (Catastrophic failure), Marcos already recognized that. But apparently they haven't implemented it (yet).

Must have overlooked that part, sorry

 

[mekelek]

Result would have been different, if HIPS was set to "Learning Mode" for couple of days and then set to "Interactive Mode" after HIPS "trained" your system. Yes, in deffault settings Eset is rubbish, but I am testing Eset for some weeks now with tweaked settings and trained HIPS, Firewall set to "Interactive Mode", and I must say I am not able to infect the system with all precautions taken, HIPS is really good and informative. It's hard to test Eset, so I am not blaming you , because most settings are linked to each other, and it's almost not possible to test just particulary one protection module. Thanks for the test in advance @erreale

when someone is looking for a security suite, they don't want something that requires weeks of training like a puppy....

 

[Der.Reisende]

when someone is looking for a security suite, they don't want something that requires weeks of training like a puppy....

Nailed it!

I am very disappointed with Eset. I expected much more.

Thank you for that great review
Would you mind testing AVG against all those samples? I predict it failing against some MBR stuff (at least Petya), but I'd love to see it's effectiveness against "normal" RW

 

[Amelith Nargothrond]

when someone is looking for a security suite, they don't want something that requires weeks of training like a puppy....

Nor a direct hotline with the support team (if they don't move in with you).

 

[Deleted Member 3a5v73x]

when someone is looking for a security suite, they don't want something that requires weeks of training like a puppy....

Then i suggest to not look for 3th party security suite if you are not willing to spend some time on learning it, there's always a Windows Defender you know But I agree, Eset takes some user time to set up, and in deffault settings it doesn't provide best possible protection. I wouldn't install Eset for my mom for example, I would look for a more "friendly" AV, wich is not so user-dependant like Eset in "Interactive Mode". It's just a matter of user choice and needs, same as asking the question: "What is the best free/paid AV?"

 

[Arequire]

Then i suggest to not look for 3th party security suite if you are are not willing to spend some time on learning it, there's always a Windows Defender you know But I agree, Eset takes some user time to set up, and in deffault settings it doesn't provide best possible protection.

Keep in mind that we're in the minority on this forum. The majority of ESET's customers (and most other AV vendors) are general users who have little to no interest in how their AV works. They just want an install and forget solution that protects them against the various threats out there without the need to change settings, manage alerts, train HIPS, etc. That's why every AV products' default settings should provide sufficient protection without forced user interaction.

 

[Deleted Member 3a5v73x]

That's why every AV products' default settings should provide sufficient protection without forced user interaction.

should, but Eset does NOT. Based on my experience with Eset, so that's just my opinion and noone should take it as granted of course.

 

[ctrlz]

I understand the importance of security modules balance, specially in a security suite, but IMO in this case it's clear that ESET HIPS module with default settings is very poor/basic.

Anyway I appreciate the test, thanks @erreale.
I think that it clearly shows what would happen with 0-days malwares (or outdated signatures) and default settings.

 

[mekelek]

Then i suggest to not look for 3th party security suite if you are not willing to spend some time on learning it, there's always a Windows Defender you know But I agree, Eset takes some user time to set up, and in deffault settings it doesn't provide best possible protection. I wouldn't install Eset for my mom for example, I would look for a more "friendly" AV, wich is not so user-dependant like Eset in "Interactive Mode". It's just a matter of user choice and needs, same as asking the question: "What is the best free/paid AV?"

there is a difference between YOU learning to configure/use a security suite and the SECURITY SUITE needs to learn how to protect you for more than a few days...