Reply to thread

Message

<blockquote data-quote="SeriousHoax" data-source="post: 911208" data-attributes="member: 78686">I'm just showing that Protected Folders can be configured via ESET HIPS. Btw, protected folders is not a guaranteed method either. In our malware hub here, protected folders of F-Secure, Trend Micro have been breached by malwares in one or two tests. There was also a POC which breached Microsoft Defender's protected folder when ran as administrator. So, many AV don't want to implement this because nowadays often malwares leverage trusted windows process for encryption which often bypasses protected folders which use reputatinal data to determine what is trusted and not unlike Microsoft Defender's protected folders which blocks everything. Block everything unless manually whitelisted is safer of the two approach.The journaling function is also something not every AV can afford to implement. It increases CPU, ram, disk usage activity which may hamper performance. Kaspersky had some performance impact because of that but now they have mastered this it seems so performance impact is almost non-existent now. Bitdefender also have this journaling system now so kudos to them. According to Marcos of ESET forum, ESET also tried this but the performance impact is too much for their liking. Like I said before, false positive and performance impact are top two priorities of ESET.</blockquote>

[QUOTE="SeriousHoax, post: 911208, member: 78686"] I'm just showing that Protected Folders can be configured via ESET HIPS. Btw, protected folders is not a guaranteed method either. In our malware hub here, protected folders of F-Secure, Trend Micro have been breached by malwares in one or two tests. There was also a POC which breached Microsoft Defender's protected folder when ran as administrator. So, many AV don't want to implement this because nowadays often malwares leverage trusted windows process for encryption which often bypasses protected folders which use reputatinal data to determine what is trusted and not unlike Microsoft Defender's protected folders which blocks everything. Block everything unless manually whitelisted is safer of the two approach. The journaling function is also something not every AV can afford to implement. It increases CPU, ram, disk usage activity which may hamper performance. Kaspersky had some performance impact because of that but now they have mastered this it seems so performance impact is almost non-existent now. Bitdefender also have this journaling system now so kudos to them. According to Marcos of ESET forum, ESET also tried this but the performance impact is too much for their liking. Like I said before, false positive and performance impact are top two priorities of ESET. [/QUOTE]

Verification