Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 996588" data-attributes="member: 32260"><a href="https://malwaretips.com/goto/post?id=996558" target="_blank">Anthony Qian</a>,Although I cannot see any evidence that BAFS did not work in the Magniber campaign, I also cannot say how efficient was BAFS against this malware. From some reports, we know that Kaspersky and Comodo were more efficient. Kaspersky was able to recover the files and Comodo was able to contain the malware. It means that in theory both Kaspersky and Comodo could be 100% efficient. The Defender&#039;s efficiency was smaller for sure, even with fully working BAFS. <img src="data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7" class="smilie smilie--sprite smilie--sprite130" alt="(y)" title="Thumbs up&nbsp; &nbsp; (y)" loading="lazy" data-shortname="(y)" />Edit.[USER=78686]@SeriousHoax[/USER] sent me a sample (not Magniber) that was already recognized as malicious in the Defender&#039;s cloud, but&nbsp; BAFS did not work for it. I submitted it to Microsoft (waiting for an answer). So it is true that in some rare cases BAFS can skip something.</blockquote>

[QUOTE="Andy Ful, post: 996588, member: 32260"] [URL='https://malwaretips.com/goto/post?id=996558']Anthony Qian[/URL], Although I cannot see any evidence that BAFS did not work in the Magniber campaign, I also cannot say how efficient was BAFS against this malware. From some reports, we know that Kaspersky and Comodo were more efficient. Kaspersky was able to recover the files and Comodo was able to contain the malware. It means that in theory both Kaspersky and Comodo could be 100% efficient. The Defender's efficiency was smaller for sure, even with fully working BAFS. (y) Edit. [USER=78686]@SeriousHoax[/USER] sent me a sample (not Magniber) that was already recognized as malicious in the Defender's cloud, but BAFS did not work for it. I submitted it to Microsoft (waiting for an answer). So it is true that in some rare cases BAFS can skip something. [/QUOTE]

Verification