Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 702116" data-attributes="member: 32260">Two features to kill false positives:1. Automatic learning/whitelisting on install.2. Adopting reputation cloud for suspicious files.I have a good experience with SmartScreen Application Reputation (Windows 8+) for application installers. It has less false positives than Virus Total. So on Windows 8+, it is sufficient to check if the EXE file, has the appropriate &#039;Mark Of The Web&#039; and if so, then all rules for that file could be skipped. Such solution is totally safe on Windows 10, where one can block the option of bypassing SmartScreen prompt.The above could be also effective when forcing SmartScreen for any suspicious EXE files. But then, there would be more false positives, because normally, the EXE files embedded in installers are not checked by SmartScreen, so they hardly will get a good reputation. This can be improved by skipping OSArmor rules for files that have the parent installer checked by Smartscreen.</blockquote>

[QUOTE="Andy Ful, post: 702116, member: 32260"] Two features to kill false positives: 1. Automatic learning/whitelisting on install. 2. Adopting reputation cloud for suspicious files. I have a good experience with SmartScreen Application Reputation (Windows 8+) for application[B] installers[/B]. It has less false positives than Virus Total. So on Windows 8+, it is sufficient to check if the EXE file, has the appropriate 'Mark Of The Web' and if so, then all rules for that file could be skipped. Such solution is totally safe on Windows 10, where one can block the option of bypassing SmartScreen prompt. The above could be also effective when forcing SmartScreen for any suspicious EXE files. But then, there would be more false positives, because normally, the EXE files embedded in installers are not checked by SmartScreen, so they hardly will get a good reputation. This can be improved by skipping OSArmor rules for files that have the parent installer checked by Smartscreen. [/QUOTE]

Verification