Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 996574" data-attributes="member: 32260">I do not say that is impossible, but I cannot see any evidence for that (from your posts).The MSI file is blocked for up to 1 minute and the automatic cloud-based analysis + postinfection detections can take even several minutes. So with fully working BAFS, there can be sometimes a several-minute window when the malware can infect the users.Yes, that can happen with fully working BAFS. The ransomware attack usually uses many different initial samples, so even if one sample would infect only one user, there still can be several infected users with fully working BAFS. Anyway, the BAFS is still efficient if it can prevent one sample from infecting many users.In some scenarios, BAFS + postinfection detection will not be efficient for example, when a hacker prepares one sample for one target - there is no gain from BAFS because, after the infection, one infected target is equal to 100% infected victims.By the way how many infected users were confirmed?</blockquote>

[QUOTE="Andy Ful, post: 996574, member: 32260"] I do not say that is impossible, but I cannot see any evidence for that (from your posts). The MSI file is blocked for up to 1 minute and the automatic cloud-based analysis + postinfection detections can take even several minutes. So with fully working BAFS, there can be sometimes a several-minute window when the malware can infect the users. Yes, that can happen with fully working BAFS. The ransomware attack usually uses many different initial samples, so even if one sample would infect only one user, there still can be several infected users with fully working BAFS. Anyway, the BAFS is still efficient if it can prevent one sample from infecting many users. In some scenarios, BAFS + postinfection detection will not be efficient for example, when a hacker prepares one sample for one target - there is no gain from BAFS because, after the infection, one infected target is equal to 100% infected victims. By the way how many infected users were confirmed? [/QUOTE]

Verification