- Jul 22, 2014
- 67
- Content source
- https://youtu.be/mHtEcqP6q3A
LiveGuard (not to be confused with LiveGrid) is across all of the products now.And the whole ESET Premium unknown file cloud scan is something to be desired. I fell like the engineers were forced to release a half baked solution because they were driven by the accounting department. I.e. "many competitors have ability to receive an unknown file and have it ran in their server side sandbox. We can't be left behind.".
Oh cool about it being offered across the whole portfolio.LiveGuard (not to be confused with LiveGrid) is across all of the products now.
Eset couldn’t have released anything better, even if they wanted to. The Cloud detonation systems require a whole arsenal of software and hardware working together to ensure malware can’t wiggle its way around. Eset hasn’t got neither the revenue nor the know-how to build a comprehensive emulation.
From Leo’s video it is yet again proven that Eset’s behavioural-based detection and protection is almost non-existent.
Really? When have they made this change?LiveGuard (not to be confused with LiveGrid) is across all of the products now.
Here, we haven’t got EIS and EAV.Really? When have they made this change?
I've not been able to find any documentation that it's now available on EIS or EAV.
Yeah I just noticed, the feature is listed under Essential, but it has a “Premium” label next to itEssential plan (which includes license for Internet security) doesn't include LiveGuard:
View attachment 283902
Wait the RT protection was disabled? I thought he ran it with it enabled hence he was testing the execution of those samples and not just doing an on demand scan.I think that's a pretty good result, don't you? 2,000 samples defeated, the script stopped, the encryptor ...
Well, with real-time protection disabled, I'm afraid no one but the Eset developers can tell us how well the antivirus worked. In any case, HIPS is not Eset's specialty (generally the best solutions in this area are zero trust solutions, but Eset is focused on the home market with a little love for geeks, but not entirely for geeks ), for protection against simple encryptors you need Premium version and higher with cloud analysis, more complex threats that can hide from cloud virtualization will be caught by the engine with higher chances, if you even have a chance to meet such threats in the wild.
Although encryptors don't interest me much at all and don't scare me as long as they don't break through the antivirus self-defenses to send some data to the network. With a firewall in manual mode after training, such a threat is minimal.
When he tested HIPS to see if it was penetrated by an encryptor, he turned off real-time protection.Wait the RT protection was disabled? I thought he ran it with it enabled hence he was testing the execution of those samples and not just doing an on demand scan.
ahh yes..sorry thanks, missed that part.When he tested HIPS to see if it was penetrated by an encryptor, he turned off real-time protection.
(11:16)
View attachment 283909
So why Eset is allowing turning off individual components if this is the case? It is Eset’s responsibility to implement a proper poke-yoke to ensure that customers and users don’t enter erroneous states where components work half-way as expected.And just disabling real-time protection is a system error.
Marcos mentioned in an ESET forum thread (if I remember correctly) that HIPS needs information from other components running under real-time protection. Turning it off loses information about what is going on. If I understand this correctly, then according to Marcos HIPS is not a self-contained component that can run completely independently.
Same excuse as Webroot uses stating that it was not configured properlySo why Eset is allowing turning off individual components if this is the case? It is Eset’s responsibility to implement a proper poke-yoke to ensure that customers and users don’t enter erroneous states where components work half-way as expected.
I don’t really accept this excuse. Eset allows switching off one, whilst leaving the other, so Leo is making use of this allowance. He is not tampering with components in any other way, other than what manufacturer allows.
Norton for example has similar architecture, when you switch off real time protection, it turns off SONAR and download insight too. He will have hard time doing that with Norton.