Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 1018791" data-attributes="member: 32260">I can guess you have in mind the &quot;Defender exclusions&quot; issue. But in this case, the Defender exclusions were not the cause of the infection, but happened after the infection. We can expect that the infected computer with added exclusions can be &quot;more compromised&quot; compared to the infection without exclusions. But this is not necessarily true, because there are tenths of similarly (or more) dangerous techniques (the computer was infected with high privileges). We can also expect that by using exclusions, the attacker did not use another dangerous technique that could be used in the case of another AV. There is no evidence, that &quot;exclusions&quot; are more efficient or used more frequently than other possible techniques. Finally, the user did not post that exclusions caused another infection. So, there is no evidence, that this example is more than another &quot;Ebola case&quot;.As we know, Loki ransomware can infect computers protected by any popular AV on default settings.Edit.Of course, popular AVs on default settings cannot protect against many fresh malware samples (Loki ransomware is only an example).</blockquote>

[QUOTE="Andy Ful, post: 1018791, member: 32260"] I can guess you have in mind the "Defender exclusions" issue. But in this case, the Defender exclusions were not the cause of the infection, but happened after the infection. We can expect that the infected computer with added exclusions can be "more compromised" compared to the infection without exclusions. But this is not necessarily true, because there are tenths of similarly (or more) dangerous techniques (the computer was infected with high privileges). We can also expect that by using exclusions, the attacker did not use another dangerous technique that could be used in the case of another AV. There is no evidence, that "exclusions" are more efficient or used more frequently than other possible techniques. Finally, the user did not post that exclusions caused another infection. So, there is no evidence, that this example is more than another "Ebola case". As we know, Loki ransomware can infect computers protected by any popular AV on default settings. Edit. Of course, popular AVs on default settings cannot protect against many fresh malware samples (Loki ransomware is only an example). [/QUOTE]

Verification