Reply to thread

Message

<blockquote data-quote="MacDefender" data-source="post: 976436" data-attributes="member: 83059">Very well written and I agree with your feedback. DeepGuard is probably the most interesting part of F-Secure and it&#039;s one of the most effective BB&#039;s out there. I agree that all of its engines have a bit of a weak spot against script based malware, and DeepGuard in particular is very weak if you exploit something they overzealously whitelisted. (For example the last time I tested, various things like 7Zip, MATLAB, official and portable Python, and Node.JS / Chromium V8 are all completely whitelisted. You can easily build ransomware or even run stock malware with those, and DeepGuard won&#039;t say a thing unless your malware is stupid enough to download a secondary payload that gets flagged). On the other end of the spectrum, DeepGuard can have a lot of false alarms with certain software. In another thread, we analyzed that for something like Rufus which tries to disable USB drive autorun dialogs via GPO, if you change the hash of the app at all, DeepGuard thinks that it&#039;s a GPO trojan.They don&#039;t seem to focus on either proper cleanup or rollback. A lot of partial hits result in DeepGuard repeatedly flagging an AutoRun on every boot. KSW and other BB&#039;s combine almost as strong performance with a pretty elaborate rollback mechanism.Overall though it&#039;s still one of my favorite lightweight AVs. It&#039;s small, unintrusive, and tastefully uses a lot of native Windows features like notifications without bothering you all the time. It&#039;s probably my favorite drop in replacement for Windows Defender for those who just want an AV that gets out of their way.</blockquote>

[QUOTE="MacDefender, post: 976436, member: 83059"] Very well written and I agree with your feedback. DeepGuard is probably the most interesting part of F-Secure and it's one of the most effective BB's out there. I agree that all of its engines have a bit of a weak spot against script based malware, and DeepGuard in particular is very weak if you exploit something they overzealously whitelisted. (For example the last time I tested, various things like 7Zip, MATLAB, official and portable Python, and Node.JS / Chromium V8 are all completely whitelisted. You can easily build ransomware or even run stock malware with those, and DeepGuard won't say a thing unless your malware is stupid enough to download a secondary payload that gets flagged). On the other end of the spectrum, DeepGuard can have a lot of false alarms with certain software. In another thread, we analyzed that for something like Rufus which tries to disable USB drive autorun dialogs via GPO, if you change the hash of the app at all, DeepGuard thinks that it's a GPO trojan. They don't seem to focus on either proper cleanup or rollback. A lot of partial hits result in DeepGuard repeatedly flagging an AutoRun on every boot. KSW and other BB's combine almost as strong performance with a pretty elaborate rollback mechanism. Overall though it's still one of my favorite lightweight AVs. It's small, unintrusive, and tastefully uses a lot of native Windows features like notifications without bothering you all the time. It's probably my favorite drop in replacement for Windows Defender for those who just want an AV that gets out of their way. [/QUOTE]

Verification