Reply to thread

Message

<blockquote data-quote="Trident" data-source="post: 1097393" data-attributes="member: 99014">Webroot does use folder priority. That&#039;s how the product has been designed, I am not designing it. Other products of this sort are McAfee, Eset that uses emulation on downloaded files, Avast with their cyber capture that needs the MOTW. These products have additional systems that kick in only when the file is downloaded. The design decision of the vendor should be respected. Malware doesn&#039;t just come from the sky, It needs to be downloaded or saved from email (same thing). You cannot always place all products under one umbrella and test them the same way.It is not even folder priority, it monitors the chain of events. Files created by browser are examined with a more aggressive rule set. AVs like Norton also take into account the website file came from.To this point, I agree with Lynx. But I don&#039;t agree that users will start playing hide-and-seek or whack-a-mole, creating HIPS rules, tweaking heuristics. This is something that very small minority will do. Vast majority of users use Defender with no tweaks whatsoever.But whatever, let&#039;s tweak them. They will still fail.This in the Webroot world is impossible, as it automatically whitelists and excludes absolutely all trusted binaries, which LOLBins are... it does not monitor them at all or scan them. This is why everyone would cast a doubt over the Webroot effectivness, which I did and then I was attacked.</blockquote>

[QUOTE="Trident, post: 1097393, member: 99014"] Webroot does use folder priority. That's how the product has been designed, I am not designing it. Other products of this sort are McAfee, Eset that uses emulation on downloaded files, Avast with their cyber capture that needs the MOTW. These products have additional systems that kick in only when the file is downloaded. The design decision of the vendor should be respected. Malware doesn't just come from the sky, It needs to be downloaded or saved from email (same thing). You cannot always place all products under one umbrella and test them the same way. It is not even folder priority, it monitors the chain of events. Files created by browser are examined with a more aggressive rule set. AVs like Norton also take into account the website file came from. To this point, I agree with Lynx. But I don't agree that users will start playing hide-and-seek or whack-a-mole, creating HIPS rules, tweaking heuristics. This is something that very small minority will do. Vast majority of users use Defender with no tweaks whatsoever. But whatever, let's tweak them. They will still fail. This in the Webroot world is impossible, as it automatically whitelists and excludes absolutely all trusted binaries, which LOLBins are... it does not monitor them at all or scan them. This is why everyone would cast a doubt over the Webroot effectivness, which I did and then I was attacked. [/QUOTE]

Verification