Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 755459" data-attributes="member: 32260">Yes, you use some capabilities of &#039;Run By SmartScreen&#039; to test forced SmartScreen - that is OK because you intended to use it that way. But, the recommended way for the average user, would be &#039;Run By SmartScreen&#039; all tested malware samples. That is why I wrote the note about &#039;Run By SmartScreen&#039;. I am not sure what happened. Some time ago I tested many malware samples against WD, and some files were locked for several minutes by WD - that depended on the number of samples. In the high settings each file can be locked for max 60s, but when it is recognized as malicious then the time can be substantially longer because WD is very slow to quarantine the files. If the file happened to be locked, and &#039;Run By SmartScreen&#039; was used before it has been quarantined, then it could be not checked by SmartScreen.So, when testing SmartScreen, it is better to turn off WD realtime protection.Edit (for Hard_Configurator users)Run By SmartScreen = forced SS (all supported files) +&nbsp; block dangerous files + allow other filesIt is recommended for running/opening all new files in the default-allow security setup.Run As SmartScreen = forced SS (only EXE, MSI) + Run as administrator (EXE, MSI) + block other filesIt is recommended only for the application installers (EXE, MSI) in SRP based setup (default-deny).</blockquote>

[QUOTE="Andy Ful, post: 755459, member: 32260"] Yes, you use some capabilities of 'Run By SmartScreen' to test forced SmartScreen - that is OK because you intended to use it that way. But, the recommended way for the average user, would be 'Run By SmartScreen' [COLOR=rgb(0, 0, 0)]all tested malware samples. That is why I wrote the note about 'Run By SmartScreen'. [/COLOR] I am not sure what happened. Some time ago I tested many malware samples against WD, and some files were locked for several minutes by WD - that depended on the number of samples. In the high settings each file can be locked for max 60s, but when it is recognized as malicious then the time can be substantially longer because WD is very slow to quarantine the files. If the file happened to be locked, and [COLOR=rgb(0, 0, 0)]'Run By SmartScreen'[/COLOR] was used before it has been quarantined, then it could be not checked by SmartScreen. [B][COLOR=rgb(184, 49, 47)]So, when testing SmartScreen, it is better to turn off WD realtime protection.[/COLOR][/B] Edit (for Hard_Configurator users) [B]Run By SmartScreen = forced SS (all supported files) + block dangerous files + allow other files[/B] It is recommended for running/opening all new files in the default-allow security setup. [B]Run As SmartScreen = forced SS (only EXE, MSI) + Run as administrator (EXE, MSI) + block other files[/B] It is recommended only for the application installers (EXE, MSI) in SRP based setup (default-deny). [/QUOTE]

Verification