Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 1025939" data-attributes="member: 32260">OK. <img src="data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7" class="smilie smilie--sprite smilie--sprite109" alt=":)" title="Smile&nbsp; &nbsp; :)" loading="lazy" data-shortname=":)" />I am not sure how this choice can impact the results for AVs. It is not only the case with web browser extensions. For example, the BAFS (very important Defender 0-day protection) does not work properly with Firefox. In this case, it is rather the Firefox issue, because Defender is a part of the Windows system.But, there is a more important issue related to Defender.For some reason (probably due to API used for the automation), BAFS does not work properly in most AVLab tests. When BAFS works, then the macros and files like EXE, JS, VBS&nbsp; (downloaded directly from the Internet) are locked just after the download and checked against the cloud backend. So the files are detected mostly at the Pre-Launch level. That is how Defender works on most computers. On the contrary, in the AVLab tests, we can see the opposite results. I am not sure if Defender should be tested in such a scenario. It would be good to contact Microsoft to solve this issue.</blockquote>

[QUOTE="Andy Ful, post: 1025939, member: 32260"] OK. :) I am not sure how this choice can impact the results for AVs. It is not only the case with web browser extensions. For example, the BAFS (very important Defender 0-day protection) does not work properly with Firefox. In this case, it is rather the Firefox issue, because Defender is a part of the Windows system. But, there is a more important issue related to Defender. For some reason (probably due to API used for the automation), BAFS does not work properly in most AVLab tests. When BAFS works, then the macros and files like EXE, JS, VBS (downloaded directly from the Internet) are locked just after the download and checked against the cloud backend. So the files are detected mostly at the Pre-Launch level. That is how Defender works on most computers. On the contrary, in the AVLab tests, we can see the opposite results. I am not sure if Defender should be tested in such a scenario. It would be good to contact Microsoft to solve this issue. [/QUOTE]

Verification