Reply to thread

Message

<blockquote data-quote="RoboMan" data-source="post: 940649" data-attributes="member: 53544">Kaspersky Application Control and Avast Hardened mode aim for the same concept, but work different.While Kaspersky relies on their Trusted Vendor List to determine wether a file will be executed or blocked, Avast (or AVG) relies on a Cloud White List.How it works?Scenario #1File 1.exe is executed on the local system.KASPERSKY -- checks for a digital signature, if found and the user configured AC as &quot;allow if digital signature exists&quot;, file will be allowed to execute; if not found file will be blocked; if found but user configured AC as &quot;do not trust only because digital signature exists&quot;, Kaspersky will compare the signature with all Trusted Vendors Signatures, where if a coincidence exists file will be allowed, else it will be blocked.AVAST -- MODERATE - blocks the file if it&#039;s detected as suspicious by an initial scan or a DeepScreen scan, else it will be allowed to execute, relies on the module to decide your fate.AVAST -- AGRESSIVE - consults the Cloud White List and looks for the file&#039;s hash, if the file itself isn&#039;t on the whitelist, execution is blocked (else it&#039;s allowed); this mode pretty much blocks everything, which may lead to lots of false positives but will also be incredibly secure (compromising usability)</blockquote>

[QUOTE="RoboMan, post: 940649, member: 53544"] Kaspersky Application Control and Avast Hardened mode aim for the same concept, but work different. While Kaspersky relies on their Trusted Vendor List to determine wether a file will be executed or blocked, Avast (or AVG) relies on a Cloud White List. [B]How it works?[/B] [I][U]Scenario #1[/U][/I] File 1.exe is executed on the local system. [B]KASPERSKY [/B]-- checks for a digital signature, if found and the user configured AC as "allow if digital signature exists", file will be allowed to execute; if not found file will be blocked; if found but user configured AC as "do not trust only because digital signature exists", Kaspersky will compare the signature with all Trusted Vendors Signatures, where if a coincidence exists file will be allowed, else it will be blocked. [B]AVAST -- MODERATE[/B] - blocks the file if it's detected as suspicious by an initial scan or a DeepScreen scan, else it will be allowed to execute, relies on the module to decide your fate. [B]AVAST -- AGRESSIVE[/B] - consults the Cloud White List and looks for the file's hash, if the file itself isn't on the whitelist, execution is blocked (else it's allowed); this mode pretty much blocks everything, which may lead to lots of false positives but will also be incredibly secure (compromising usability) [/QUOTE]

Verification