Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 975173" data-attributes="member: 32260">I had in mind SmartScreen for Explorer. You can see the SmartScreen prompt when the EXE/MSI files (and some others) are downloaded directly from the Internet by any popular web browser, and then executed from the file Explorer or Desktop. For example:[ATTACH]264298[/ATTACH]If you can see this alert, then simply do not run the file, but inspect it via Virus Total or wait one day - give the chance to someone else to be infected, so the AV could detect the malware. Your actions should depend on how strong is the AV protection against EXE files. If you use Defender with ConfigureDefender MAX settings or Avast Hardened Mode, then you can ignore this alert for EXE files. Some AVs can be highly tweaked (like KIS) and then SWH is not needed at all.Of course, SWH can be useful with any AV, but only to support the AV protection against the attacks that use fileless methods as an initial attack vector (weaponized documents, scripts, etc.). So, even if the full attack uses EXE payload(s), SWH can break the infection chain before the EXE malware could be downloaded/dropped/executed.But, if one wants to install pirated/cracked software (EXE installer) which is malware, then SWH will not help much.As [USER=71262]@oldschool[/USER] mentioned in his post, the SmartScreen for Explorer can be enhanced by using RunBySmartscreen tool.</blockquote>

[QUOTE="Andy Ful, post: 975173, member: 32260"] I had in mind SmartScreen for Explorer. You can see the SmartScreen prompt when the EXE/MSI files (and some others) are downloaded directly from the Internet by any popular web browser, and then executed from the file Explorer or Desktop. For example: [ATTACH]264298[/ATTACH] If you can see this alert, then simply do not run the file, but inspect it via Virus Total or wait one day - give the chance to someone else to be infected, so the AV could detect the malware. Your actions should depend on how strong is the AV protection against EXE files. If you use Defender with ConfigureDefender MAX settings or Avast Hardened Mode, then you can ignore this alert for EXE files. Some AVs can be highly tweaked (like KIS) and then SWH is not needed at all. Of course, SWH can be useful with any AV, but only to support the AV protection against the attacks that use fileless methods as an initial attack vector (weaponized documents, scripts, etc.). So, even if the full attack uses EXE payload(s), SWH can break the infection chain before the EXE malware could be downloaded/dropped/executed. But, if one wants to install pirated/cracked software (EXE installer) which is malware, then SWH will not help much. As [USER=71262]@oldschool[/USER] mentioned in his post, the SmartScreen for Explorer can be enhanced by using RunBySmartscreen tool. [/QUOTE]

Verification