Serious Discussion FinalAV - British Startup Offering Containment for Unsigned Processes

Trident

Trident

From Hawk Eye
Thread author
Verified
Top Poster
Developer
Well-known
Feb 7, 2023
4,138
26,615
5,089
hea-p.com
Whilst browsing the web, I came across this AV, which claims to be offering a rather "novel" approach.

A Novel Approach To Cybersecurity - Anti Virus | FinalAV Security

Anti virus software that protects you from yesterday’s malware is not good enough anymore. FinalAV turns the table with our patented security engine.
finalavsecurity.com finalavsecurity.com

The approach is to check whether executables have a digital signature and sandbox the ones without.



The website does have some issues:
  • It's got a slight hint of unprofessionalism, allows user to click on every image to zoom.
  • The website claims that attackers will not sign their creations, unless they want to get arrested by authorities. This is anecdotal at best, as there is loads of signed malware.
  • The above suggests that protection will be rendered useless simply by using a digital signature.
  • Video rather unprofessional too, sort of acceptable for a startup.
  • Resources, such as articles and support very limited.
Other than that, the application is not very expensive, I've not tried it myself. Trial is available on the website.
 
  • Like
  • Applause
Reactions: Behold Eck, [correlate], Miravi and 4 others
It seems like you've done quite a thorough analysis of FinalAV. While their approach of sandboxing unsigned executables is indeed novel, it's not a foolproof method as you've pointed out. Signed malware is a reality. The unprofessionalism and limited resources could be due to their startup status. However, if the price is reasonable and they offer a trial, it might be worth a shot but with caution. Remember to always have a backup of your important data.
 
  • Love
  • Like
  • Hundred Points
Reactions: Behold Eck, roger_m and Trident
Most dangerous malware are signed this wouldn't work and criminals sell certificates pretty cheap there are all kinds of reputation based security wich would deal better with malware pretty sure most major av vendors have an option to either block or isolate (best if it's cloud based isolation) based on reputation and they have enough customers to reduce false positives quote a lot so wouldn't really be much worse in terms of false positives
 
Last edited:
  • Like
Reactions: [correlate], roger_m, simmerskool and 1 other person
I took a look at their minifilter and what little it does is underwhelming to say the least.
I wouldn't even call this an AV, nor do I see the purpose of this product when (as others have said) other products implement similar features already, while implementing vastly more robust antimalware capabilities.
 
  • Like
  • +Reputation
Reactions: Behold Eck, [correlate], roger_m and 1 other person
WTF ?

Capture d’écran 2025-01-28 171551.png Capture d’écran 2025-01-28 171529.png

Capture_decran_2024-11-28_132438.png
 
  • HaHa
  • Like
Reactions: [correlate], simmerskool, Miravi and 5 others
[correlate] said:
I've tried it and it doesn't work very well
It's been running the file categorization scan for hours.
And when I deleted it, it gave me a computer crash.
I'm no longer able to install new programs.
Click to expand...
Well it's contained right? If you can't use the PC you can't infect the PC, problem solved. Modern problems require modern solutions.
 
  • HaHa
  • Like
Reactions: [correlate], simmerskool, Miravi and 3 others

You may also like...