Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 1117212" data-attributes="member: 32260">The problem with this (and any similar) video demonstration is that it provides insufficient information about possible infections.What we know from the test:<ol>
<li data-xf-list-type="ol">One of the samples succeeded in adding a few folders to the Microsoft Defender exclusion list. This means that Defender could detect files in those folders only on execution.</li>
<li data-xf-list-type="ol">Two or three malware samples succeeded in adding autorun entries, but from the Defender alerts after the test we could see that some malicious actions were detected/blocked.&nbsp; Unfortunately, we do not know if any truly malicious actions were allowed.</li>
<li data-xf-list-type="ol">SmartScreen was ignored (as in most tests) to focus only on AV protection.</li>
</ol>The point 1 makes the whole test invalid. For example, if the first malware adds folders to the exclusion list, other samples are tested with invalidated AV. The surprising conclusion from this test could be that invalidated Microsoft Defender can provide protection close to Bitdefender Total Protection.<img src="data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7" class="smilie smilie--sprite smilie--sprite132" alt=":unsure:" title="Unsure&nbsp; &nbsp; :unsure:" loading="lazy" data-shortname=":unsure:" />What do we know from professional tests?<ol>
<li data-xf-list-type="ol">Microsoft Defender free on default settings is not a top AV, but the difference is not big.</li>
<li data-xf-list-type="ol">The difference follows mainly from advanced settings (like Network Protection and ASR rules) that are disabled in Microsoft Defender&#039;s default settings.</li>
</ol></blockquote>

[QUOTE="Andy Ful, post: 1117212, member: 32260"] The problem with this (and any similar) video demonstration is that it provides insufficient information about possible infections. What we know from the test: [LIST=1] [*]One of the samples succeeded in adding a few folders to the Microsoft Defender exclusion list. This means that Defender could detect files in those folders only on execution. [*]Two or three malware samples succeeded in adding autorun entries, but from the Defender alerts after the test we could see that some malicious actions were detected/blocked. Unfortunately, we do not know if any truly malicious actions were allowed. [*]SmartScreen was ignored (as in most tests) to focus only on AV protection. [/LIST] [B][COLOR=rgb(184, 49, 47)]The point 1 makes the whole test invalid. For example, if the first malware adds folders to the exclusion list, other samples are tested with invalidated AV. [/COLOR][/B] The surprising conclusion from this test could be that invalidated Microsoft Defender can provide protection close to Bitdefender Total Protection.:unsure: [B]What do we know from professional tests?[/B] [LIST=1] [*]Microsoft Defender free on default settings is not a top AV, but the difference is not big. [*]The difference follows mainly from advanced settings (like Network Protection and ASR rules) that are disabled in Microsoft Defender's default settings. [/LIST] [/QUOTE]

Verification