Battle Kaspersky Free Antivirus or Avast Free Antivirus for Default-Deny Protection?

[Wraith]

So guys this setup will be for one of my friends who is just an average Joe. He had his laptop infected with all sorts of malware and god knows what I had to do to restore the laptop. I flashed the BIOS, Secure Erased the HDD using Parted Magic, reset the Router to its defaults and then installed Windows 10 Home 64-bit ver 1809. I need to minimise the attack vectors. So far I've installed SysHardener(applied the tweaks)and OSArmor 1.4.2(just in case some malware manages to revert the changes made by SH). I had installed hard_configurator but it was too much of a hassle for my friend since he is unable to execute his softwares which he is downloading from the web. Maybe I'll try Comodo Firewall but that too I think will be too much for my friend since he is not so geeky. So it comes down to Avast free or Kaspersky Free. I like the System Watcher in KAF but it only jumps into action after any malicious activity is performed. I'm considering Avast just because of the Hardened Mode(Aggressive) since it will prevent any unknown file from executing. So what's your opinion guys? In this scenario which one should I choose? Avast or Kaspersky?

 

[DSD27]

kaspersky is superior in all aspects

Not really.

App Review - Kaspersky Security Cloud Free vs Ransominator (default settings)

Kaspersky users: don't worry, you're already using a strong AV, this is just the 0day bypassing XYZ AV show, avoid running unknown files and stay safe! Edit: typo

malwaretips.com

App Review - Avast Free (Hardened Mode) vs Ransominator

I'm genuinely surprised to see Avast Free blocking my LOLbin inspired ransomware while Kaspersky Free allowed it to execute and encrypt my files. Is this the end of Ransominator?

malwaretips.com

 

[Chri.Mi]

For me a good way to test antivirus (for normal user, newby) is not how much features have, if the bb is more or low effective, or other things like this. This can be important for advanced users. For common ppl would be much more important test how much time need by av vendors for intercept new zero days with signatures? How much is the delay? If them intercept these zero days. I would like to see an av test like this for see who react better and worst.

 

[silversurfer]

Does Avast have any other Shield or setting to block those? Is KasperskySC Free better at blocking them?

Avast File-Shield (signatures/cloud) blocks known payloads related to scriptors
Avast Behavior-Shield blocks rarely scriptors itself

KSC Free blocks scriptors by heuristic and rarely by System-Watcher
KSC Free signatures/cloud blocks known payloads related to scriptors

I believe that KSC Free offers stronger protection overall against scriptors/scripting malware!

 

[Chri.Mi]

Not really.

App Review - Kaspersky Security Cloud Free vs Ransominator (default settings)

Kaspersky users: don't worry, you're already using a strong AV, this is just the 0day bypassing XYZ AV show, avoid running unknown files and stay safe! Edit: typo

malwaretips.com

App Review - Avast Free (Hardened Mode) vs Ransominator

I'm genuinely surprised to see Avast Free blocking my LOLbin inspired ransomware while Kaspersky Free allowed it to execute and encrypt my files. Is this the end of Ransominator?

malwaretips.com

This dont means nothing xD... avast recognize the .exe as untrusted. In other side kaspersky got signatures fast

 

[stefanos]

Not really.

App Review - Kaspersky Security Cloud Free vs Ransominator (default settings)

Kaspersky users: don't worry, you're already using a strong AV, this is just the 0day bypassing XYZ AV show, avoid running unknown files and stay safe! Edit: typo

malwaretips.com

App Review - Avast Free (Hardened Mode) vs Ransominator

I'm genuinely surprised to see Avast Free blocking my LOLbin inspired ransomware while Kaspersky Free allowed it to execute and encrypt my files. Is this the end of Ransominator?

malwaretips.com

And i like Avast but is not invincible my friend. All protection programs are infected, and have strengths and weaknesses.

 

[stefanos]

 

[DSD27]

This dont means nothing xD... avast recognize the .exe as untrusted. In other side kaspersky got signatures fast

It didn't recognize it, that's why it blocked it. Kaspersky didn't. Though it later got the signatures, but so did Avast.

And i like Avast but is not invincible my friend. All protection programs are infected, and have strengths and weaknesses.

No one said it is, it was just better in this case example.

 

[Chri.Mi]

IF u wanna "invicible" setup go with:
avast free->HM aggressive, will allow only trusted exe
Comodo free -> will block all untrusted by comodo lookup (specially with edited TVL)
or
SAP -> whitelist only trusted installer and block all rest
Comodo free
Will break OS much times, but will learn step by step how to avoid it.

 

[bayasdev]

Avast has improved its script protection by implementing AMSI but it's a W10 exclusive feature, I don't think it's fair to use a W7 VM for AV testing in 2020.

 

[DSD27]

IF u wanna "invicible" setup go with:
avast free->HM aggressive, will allow only trusted exe
Comodo free -> will block all untrusted by comodo lookup (specially with edited TVL)
or
SAP -> whitelist only trusted installer and block all rest
Comodo free
Will break OS much times, but will learn step by step how to avoid it.

No thanks.

 

[Chri.Mi]

IF u wanna "invicible" setup go with:
avast free->HM aggressive, will allow only trusted exe
Comodo free -> will block all untrusted by comodo lookup (specially with edited TVL)
or
SAP -> whitelist only trusted installer and block all rest
Comodo free
Will break OS much times, but will learn step by step how to avoid it.

I was able with comodo to block my Tim Hub, no voice info led in red light xD

 

[DDE_Server]

Both programs are good in terms of protection.simply no AV whatever strong it is 100% full proof.see which is has less false positive and have good performance and stable .also don't think about sofisticated software for home user
Also if you use free AV you want able to get all the benefits of paid one unless your days is the price
I would advise to simply use KSC free with some tweaks such as @harlan4096 tweaks may add some type of default deny solution such as vodooshield or hard configurator and he is fine to go
To protect against ransomware I would recommend to start with good web protection beside KSC he must harden there browser with good extension to protect more about malicious sites /downloads he could use McAfee webadvisor which scan also files when they are being downloaded note most ransomware attacks comes from malicious mails and cracking torrents and websites
If you want complete silent free solution with less user interaction I would recommend bifdefender free as it will accomplish the task
Don't consider AV solution is strong or weak based in simple test .may be your chosen solution fail in another type of malware varients

 

[Chri.Mi]

Both programs are good in terms of protection.simply no AV whatever strong it is 100% full proof.see which is has less false positive and have good performance and stable .also don't think about sofisticated software for home user
Also if you use free AV you want able to get all the benefits of paid one unless your days is the price
I would advise to simply use KSC free with some tweaks such as @harlan4096 tweaks may add some type of default deny solution such as vodooshield or hard configurator and he is fine to go
To protect against ransomware I would recommend to start with good web protection beside KSC he must harden there browser with good extension to protect more about malicious sites /downloads he could use McAfee webadvisor which scan also files when they are being downloaded
If you want complete silent free solution with less user interaction I would recommend bifdefender free as it will accomplish the task
Don't consider AV solution is strong or weak based in simple test .may be your chosen solution fail in another type of malware varients

All Antivirus fails, for this good av test should test who react first at fails!

 

[DDE_Server]

All Antivirus fails, for this good av test should test who react first at fails!

My opinion is general .all AV solution will try to adapt and evolve and find solution .also I understood from the posts the file is blocked as it considered as untrusted due to tuning configuration
For example I am using vodoo shield .when it is in on mode it increase false positive ..(it block executing of hello world python program during compiling is that mean it is strong yes it might by coincidence mailcious non exe script but doesnot mean it is strong it is tuned to increase it is sensitivity which may increase protection but also increase false positive and may decrease productivity

 

[Chri.Mi]

@geminis3 Have u idea what antivirus now detect the ransomware you posted?

 

[stefanos]

@geminis3 Have u idea what antivirus now detect the ransomware you posted?

CF i think is the best protection against ransomwares

 

[DDE_Server]

@Chri.Mi Even hard mode failed against some ransomer variant. No solution is completely perfect

Avast has improved its script protection by implementing AMSI but it's a W10 exclusive feature, I don't think it's fair to use a W7 VM for AV testing in 2020.

 

[bayasdev]

@geminis3 Have u idea what antivirus now detect the ransomware you posted?

Original variant VirusTotal
Last variant VirusTotal

 

[DDE_Server]

CF i think is the best protection against ransomwares

if you configured it is HIPS and sandbox well also comdoo is considered one of the best firewall software. it is not strong as pure AV detection and rollback mitigation but excellent as default deny if it is well configured

 

[Chri.Mi]

Original variant VirusTotal
Last variant VirusTotal

Nice. How u can see the original one is detected by half virustotal (other half no...), the new variant is detected by avast (nice job!)