Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 979895" data-attributes="member: 32260"><a href="https://malwaretips.com/posts/979871/reactions" target="_blank">wat0114</a>,Your last post has given me an idea about better and worse signatures in relation to &quot;EXE error&quot;.Let&#039;s look again at the test results:AV-Comparatives + AV-Test, Consumer Malware Protection tests 2021Missed samples - tested few-weeks-old prevalent samples: only EXE files:Avira ..................... 39TrendMicro ......... 224The results for relatively old and prevalent EXE files depend mostly on signatures. So, it is natural to conclude that TrendMicro has got worse signatures.But this is not necessarily true because, in the test, not all signatures are used.The test uses signatures for the EXE files, but ignores the possible signatures for documents, scripts, etc. In reality, the signatures for documents and scripts can be better and more efficient protection than signatures for EXE files. In many cases, the EXE payloads are delivered only by documents and scripts. Furthermore, one signature for a document or script can protect against several EXE payloads. The scripts and documents often include only the URL to the payload, and the payloads there are often changed after a few hours.So, in this example, TrendMicro has got a much worse result not because of worse signatures. The issue is the testing methodology which is anomalous for TrendMicro. The test can see the signatures for bullets (that killed people) but ignores the signatures for guns and shooters.</blockquote>

[QUOTE="Andy Ful, post: 979895, member: 32260"] [URL='https://malwaretips.com/posts/979871/reactions']wat0114[/URL], Your last post has given me an idea about better and worse signatures in relation to "EXE error". Let's look again at the test results: AV-Comparatives + AV-Test, Consumer Malware Protection tests 2021 Missed samples - tested few-weeks-old prevalent samples: only [B]EXE files[/B]: Avira ..................... [COLOR=rgb(41, 105, 176)][B]39[/B][/COLOR] TrendMicro ......... [B][COLOR=rgb(41, 105, 176)]224[/COLOR][/B] The results for relatively old and prevalent EXE files depend mostly on signatures. So, it is natural to conclude that TrendMicro has got worse signatures. [B][COLOR=rgb(184, 49, 47)]But this is not necessarily true because, in the test, not all signatures are used.[/COLOR][/B] The test uses signatures for the EXE files, but ignores the possible signatures for documents, scripts, etc. In reality, the signatures for documents and scripts can be better and more efficient protection than signatures for EXE files. In many cases, the EXE payloads are delivered only by documents and scripts. Furthermore, one signature for a document or script can protect against several EXE payloads. The scripts and documents often include only the URL to the payload, and the payloads there are often changed after a few hours. So, in this example, TrendMicro has got a much worse result not because of worse signatures. The issue is the testing methodology which is anomalous for TrendMicro. The test can see the signatures for bullets (that killed people) but ignores the signatures for guns and shooters. [/QUOTE]

Verification