Reply to thread

Message

<blockquote data-quote="Durew" data-source="post: 804064" data-attributes="member: 64794">I agree that is you would test MBAM (as a companion AV) alongside Windows Defender and WD catches everything that MBAM is not being tested. The conclusion that this makes that one is back to the orignal testing of MBAM all by itself is something I disagree with. (IMHO testing should be more than just throwing malware samples at an AV). The task of an companion AV is (IMHO) to catch what the main AV missed/would miss. Every resource the companion spends on detecting/stopping malware that the main AV could catch as well is wasted, thus leaving the malware that the main AV can deal with out of the scope of the companion AV. Thus all samples/vectors/exploits that the main AV detects are to be removed from the test (not a succes, not a failure). Thus a test where all samples (etc.) are detected by windows defender is effectively a test with zero samples (etc.). Which is an insufficient test that does not say anything about the quality of the companion (except perhapts about conflicts with the main AV). I do not make any statements about how hard it is to make a sufficient test for a companion AV.In a short analogy:If I try to test a scriptblocker but can&#039;t find any scripts to test it with I should look harder or conclude that I can&#039;t test it, not throw executables at it.Regards,Durew</blockquote>

[QUOTE="Durew, post: 804064, member: 64794"] I agree that is you would test MBAM (as a companion AV) alongside Windows Defender and WD catches everything that MBAM is not being tested. The conclusion that this makes that one is back to the orignal testing of MBAM all by itself is something I disagree with. (IMHO testing should be more than just throwing malware samples at an AV). The task of an companion AV is (IMHO) to catch what the main AV missed/would miss. Every resource the companion spends on detecting/stopping malware that the main AV could catch as well is wasted, thus leaving the malware that the main AV can deal with out of the scope of the companion AV. Thus all samples/vectors/exploits that the main AV detects are to be removed from the test (not a succes, not a failure). Thus a test where all samples (etc.) are detected by windows defender is effectively a test with zero samples (etc.). Which is an insufficient test that does not say anything about the quality of the companion (except perhapts about conflicts with the main AV). I do not make any statements about how hard it is to make a sufficient test for a companion AV. In a short analogy: If I try to test a scriptblocker but can't find any scripts to test it with I should look harder or conclude that I can't test it, not throw executables at it. Regards, Durew [/QUOTE]

Verification