Reply to thread

Message

<blockquote data-quote="MacDefender" data-source="post: 840457" data-attributes="member: 83059">I think F-Secure DeepGuard is also worth an honorable mention. I like that the company has a white paper that documents how their BB works and it makes a lot of sense. I don’t like that DeepGuard uses the delivery mechanism (download vs external drive vs magically showing up on disk) to influence how aggressively it monitors — I would like to be able to command it to be suspicious of a binary even if it’s just sitting on a local drive.But yeah overall Emsisoft is my favorite. My main criticism of their BB is that the detection signatures are not specific. DeepGuard gives signature-like names like W32/Behavior.Cryptolocker!DeepGuard that make it super clear which engine flagged it and what it acted like. Emsisoft sometimes just says that it blocked suspicious behavior or “the anti malware network recognized this as DANGEROUS” and that’s great for an average joe, but as a technical user I would like a better explanation.(BTW, Norton/Symantec is also fairly communicative and feature rich but after seeing many ways where SONAR/BB either reacts late or not at all, I don’t feel confident. New and emerging threats matter the most to me — for signature based detection I have no problem with uploading it to VirusTotal or trusting one of dozens of signature engines that scores 99.xxx% these days)</blockquote>

[QUOTE="MacDefender, post: 840457, member: 83059"] I think F-Secure DeepGuard is also worth an honorable mention. I like that the company has a white paper that documents how their BB works and it makes a lot of sense. I don’t like that DeepGuard uses the delivery mechanism (download vs external drive vs magically showing up on disk) to influence how aggressively it monitors — I would like to be able to command it to be suspicious of a binary even if it’s just sitting on a local drive. But yeah overall Emsisoft is my favorite. My main criticism of their BB is that the detection signatures are not specific. DeepGuard gives signature-like names like W32/Behavior.Cryptolocker!DeepGuard that make it super clear which engine flagged it and what it acted like. Emsisoft sometimes just says that it blocked suspicious behavior or “the anti malware network recognized this as DANGEROUS” and that’s great for an average joe, but as a technical user I would like a better explanation. (BTW, Norton/Symantec is also fairly communicative and feature rich but after seeing many ways where SONAR/BB either reacts late or not at all, I don’t feel confident. New and emerging threats matter the most to me — for signature based detection I have no problem with uploading it to VirusTotal or trusting one of dozens of signature engines that scores 99.xxx% these days) [/QUOTE]

Verification