Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 562606" data-attributes="member: 32260">Today I had an example how Windows Defender Heuristics work. I tested a new version of &#039;Run By Smartscreen&#039;&nbsp; that threw in a short time several files to check. The great deal of them was not recognized as safe by SmartScreen filter. Among them were some not signed, legitimate&nbsp; system files copied from C:\Windows\System32 to C:\z\ folder (mshta.exe, hh.exe, mmc.exe, control.exe, wscript.exe). Suddenly I saw the Defender alert, that it found a malware (trojan). After that in quarantine landed RunBySmartscreen(x64).exe . In this way I created my first trojan, and successfully infected my own computer.<img src="data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7" class="smilie smilie--sprite smilie--sprite109" alt=":)" title="Smile&nbsp; &nbsp; :)" loading="lazy" data-shortname=":)" />So now, I have to test &#039;Run By Smartscreen&#039;&nbsp; with disabled Windows Defender to not make it nervous.</blockquote>

[QUOTE="Andy Ful, post: 562606, member: 32260"] Today I had an example how Windows Defender Heuristics work. I tested a new version of 'Run By Smartscreen' that threw in a short time several files to check. The great deal of them was not recognized as safe by SmartScreen filter. Among them were some not signed, legitimate system files copied from C:\Windows\System32 to C:\z\ folder (mshta.exe, hh.exe, mmc.exe, control.exe, wscript.exe). Suddenly I saw the Defender alert, that it found a malware (trojan). After that in quarantine landed RunBySmartscreen(x64).exe . In this way I created my first trojan, and successfully infected my own computer.:) So now, I have to test 'Run By Smartscreen' with disabled Windows Defender to not make it nervous. [/QUOTE]

Verification